Written by Dann Maurno, Editor-In-Chief, and Louis Sirico

Now Updated with Results from Super Tuesday, 2008

Alameda County has now done twice, something that has never been done before anywhere else in the United States: it successfully used Radio Frequency Identification (RFID) technology to secure the chain of custody for its election process. This was a bold move, given the past controversy in California around RFID technology, but a move that officials are glad they made.

"If you don't know who is handling election machinery and data, there is absolutely no way you can know whether your election has been either fair or accurate."

So writes BlackBoxVoting, an organization that declares itself "America's Elections Watchdog Group," a non-profit, donation-funded organization. Several like it exist, of varying credibility and reputation, but they underscore a distrust in the voting process.

The cranky 2000 presidential election (George W. Bush versus Al Gore) left Americans dismayed. Polling methods were inconsistent, usually decided at the county level, and in the age of optical scanning and electronic methods, paper-based punchcards and butterfly ballots seemed absurd.

Beyond polling, the major news outlets, CNN in particular, made much of the primitive logistics involved. The process typically involved volunteers dragging equipment and ballots to central counting facilities in the late evening, after polling closed. Rumors abounded of trashbags of ballots found by Florida roadsides (though the adamant witnesses never produced those trashbags).

Electronic polling seemed at first the answer, as it involved real-time polling and virtually no logistics. After 2000, 37 states purchased about 50,000 touch-screen polling machines, or direct recording electronic voting or DRE, at a cost of nearly $.25 billion. Results have been decidedly mixed, and Florida Senator Bill Nelson and Rhode Island Senator Sheldon Whitehouse have introduced a bill to ban touch-screen voting in federal elections starting in 2012. As a November 3, 2007 Time Magazine story described the challenge, "the only thing worse than a confusing paper trail, it turned out, was no paper trail at all."

Thus, voters must rely upon physical polling, and as a result, a physical chain of custody. The consensus among policymakers, registrars of voting, advocacy groups and non-government organizations like the Association for Computing Machinery and BlackBoxVoting is that paper balloting is necessary, and that the chain of custody must be secured. Some of the lapses in security which BlackBoxVoting describes include the ability to swap a memory card, anywhere between a polling place and tallying place, and a lack of security or organization at drop-off points.

Dave Macdonald, Director of Information Technology and Registrar of Voters in Alameda County, California, has proven the theory that the same electronic methods which enable supply chain efficiency can secure the chain of custody in polling (and, improve the logistics).

"Voting, as a process is no different from any supply chain. You've got to get a product to a particular location, and then get that product back," says David Eagleson, Senior Vice President of Sales and Marketing for RFID Global Solution (RFIDGS). "Unlike shipping companies, we don't have any margin for error. The importance of maintaining a Chain of Custody ensures that the security and sanctity of the process is maintained.” The company has been contracted by Alameda County, California, to create a logistics management solution to track and secure the county's voting equipment during the election. RFIDGS has named this first-of-its-kind system SecureVote™.

RFIDGS develops wireless asset and personnel management systems and solutions for real-time visibility at the enterprise level. "Enterprise" typically denotes industry or retailers, but RFIDGS also serves government agencies like the Department of Defense and NASA.

The Challenge

The voting process in Alameda County involves about 75 polling places for a local election, and more than 750 for a presidential election. Polling places were typically high schools, churches or community centers. Each polling place received:

A serialized canvas bag with tamper proof seal A memory pack (about the size of an old 8 track tape), which holds the voting results that have been scanned from the paper ballots	A PCMCIA card which holds the voting results from the touch screens used by disabled voters A voting roster, a paper index of who voted at that precinct that day

Each component is tagged with a barcode, using a set of protocols - a P number for each precinct, analogous to the top assembly number in a bill of materials; a B for the PCMCIA card, and so on. Thus, the three components were related, and joined to a "parent" bag that is also identified with a number related to that particular precinct.

Alameda county has been doing this manually, putting three key components in a canvas bag. All these bags go to approximately thirty collection points, which service the thousand polling places. Some go to the community center, others to a high school, whatever the polling places may be, and they have to account for every one. At the end of the night, that same exercise has to happen in reverse. (See Process image above.) Sheriff's deputies pick up and deliver the bags to Vote Count, a Facility in Oakland, CA. Vote Count is where votes are counted, and is the last step before equipment is returned to the central distribution warehouse. At Vote Count, dozens of volunteers would unzip each bag to determine if the three components were present. If something is missing a help desk is alerted to track down any missing components.

"Historically, all the bags came in at the same time and because the bar code process was slow, the bags stacked up," explained Macdonald. "If something was missing, we may not know until after midnight and then we have to find it."

Tracking down those missing components is the worst inefficiency. John Kuester, RFIDGS's Vice President of operations, spearheaded the implementation, and observed that "verification goes on sometimes until three or four in the morning." While tallying can proceed with a missing roster, a missing PCMCIA card delayed tallying: by the time the card was identified as missing, the precinct was locked up and the volunteers had gone home. A sheriff's deputy must find someone to open the building and find the PCMCIA card that was missing.

At night’s end, all equipment was returned to the central distribution warehouse.

It is important to note that the process was not without built-in security. Registry of Voters employees, sheriff’s deputies, or precinct captains, formed the chain of custody, while volunteers took part in activities which would not enable them to tamper with handoff or tallying. On top of these measures, Alameda County used two physical security measures. First, each bag was fitted, before it was distributed, with a tie wrap through its lock. In addition, PCMCIA cards are sealed in antistatic bags, which themselves had a distinctive seal. If either the wire wrap or seal was broken, a precinct captain or someone at Vote Count knew the equipment has been tampered with (no such incidents are on record).

SecureVote™

Macdonald approached RFID Global Solution in August, and Kuester met with both Macdonald and Alameda County’s Chief Technical Officer, Tim DuPuis.

In mapping the current voter server system, RFIDGS identified three key read points along the chain of custody (again, refer to Process image above), being:

• The central distribution warehouse, which RFIDGS likened to a store-level distribution center or storage facility;
• The intermediary collection points;
• The Vote Count Facility

It is at the central warehouse that each component is tagged with a ISO-18000-6C passive (non-battery powered) RFID tag. The PCMCIA card has a tag with antistatic backing (as shown on the PCMCIA card above), and each canvas bag receives a parent RFID tag which associates the assets to the bag.

RFIDGS uses the same numbering convention (e.g., the P numbers for precincts, the B numbers for the PCMCIA cards) that Alameda County had implemented prior. County employees use Motorola MC9090 hand-held RFID readers to verify the outbound shipment. Precinct captains pick up the bags at the warehouse.

This is the last check until after polling, when the bags and equipment are brought to intermediate collection points, typically police stations. A Registry of Voters employee uses another Motorola MC9090 hand-held RFID reader to scan each bag. Previously, the tamper proof seal had to be broken, the contents verified, and then re-sealed. Now, the RFID enabled hand-held scans the RFID tags and verifies that all contents are present without opening the bag and breaking the tamper-proof seal. (See ROV Precincts List image left.) Additionally, it communicates the hand-off in real time to the Vote Count Facility using RFIDGS’s Global Track application. Macdonald can monitor the process in real time from his laptop computer at Central Tally. He added, "we knew in real time what was happening with all the voting assets". This was a monumental first-time achievement.

Sheriff’s deputies bring the collected bags to the Central Tally Facility, where more deputies gather between four and six bags at a time, and pass them through a reader portal which includes a Motorola stationary reader and four antennas. Rather than rifle through each bag, the portal reads the RFID tags and verifies that all contents are present. Again, without opening the bag and breaking the tamper-proof seal. A volunteer simply monitors the results on a screen (see Security Check screen image below), giving a “go” signal or directing the deputy to a help desk if a component appears to be missing.

Here, RFIDGS has deployed its SmartTable™. This is a fully functional, fully enabled, “Plug & Play” RFID reading platform with a 6ft x 3ft of RFID-enabled workspace. SmartTable™ includes a reader, antennas, network interface, and light indicators. The SmartTable™ is also in use by The United States Department of Defense, which uses it for parts and ammunition management and Homeland Security checkpoints.

SecureVote™ Results

RFIDGS and Alameda County were able to conduct real-time, full-scale dry runs in anticipation of the November 6^th polling, which involved 75 precincts and three intermediary collection points, versus the 750+ that reported on the February, 2008 ?Super Tuesday? presidential primary.

In dry runs, tag reads at the inbound portal at Vote Count were 97% accurate, and any misreads were quickly resolved at the SmartTable™ station. In the dry run, the system identified missing components in 10 of 75 duffel bags. The items were traced to other bags, to the deliverer, or back to the polling places. All items were located within six minutes, a significant improvement over the four hours before using the SecureVote™ system.

The November 6^th polling was near perfect. Polling closed at 8pm, and the first bags arrived at the collection points at 8:40pm. In only two instances were components identified as missing, and in both cases, those errors were caught at the collection points, and the missing items quickly located and rejoined with their bags.

At Central Tallying, Registry of Voters employees and volunteers were able to read and verify the contents of every bag in an hour and twenty minutes, versus the four or five hours that is typical using bar codes. The difference, suggests Kuester, was in eliminating the manual process of opening each bag, matching bar code numbers manually, closing and resealing. A bag that registered no errors need not be opened at all, which greatly improves security. The bags were dispatched to the warehouse, and votes tallied, before 11pm.

Both the test run and November 6, 2007 polling in Alameda County proved to be unqualified successes. "I had high expectations and this exceeded them", Macdonald explained. "In 2008, California has three major elections, which hasn't happened since 1948, and the security requirements are tougher than they have ever been in history."

RFIDGS scaled the system up for the February 2008 presidential primary, which involved about 13,000 individual reads. The process was considerably faster than in prior years, though not quite as rapid or accurate as the November ?08 pilot. Alameda County and RFIDGS concluded that the speed, and read accuracy of about 80%, could be improved with a slightly scaled-up system and more volunteer training. In all cases of misreads, volunteers were able to fall back on the practice of manually opening and checking bags for contents.

Alameda County was very pleased with the results, and will scale up the system in anticipation of June local elections and the November 2008 presidential election. Macdonald summarized by saying "We have a low-tech front-end with paper and pencil voting, but a high-tech back-end with real-time tracking and security to account for everything. My goal is to ensure everyone's vote is counted."

RFIDGS is refining and productizing the system as SecureVote 2.0, for general release well in advance of the November 2008 presidential election.

US voters and policymakers are very concerned about the security of the vote, hence, their unwillingness to rely on touch-screen voting or internet-based polling. They are similarly concerned about vote tampering, security in the chain of custody, and certainty that all votes are counted. Each of these challenges can be met using the same technologies that, for example, the Department of Defense uses in asset tracking, and which consumers trust in retail applications. In the case of Alameda County, RFID technology enabled the Registrar of Voters to monitor the chain of custody in real time, to ensure that all votes were counted, and to streamline a five hour process into less than two hours.

Editor's note: After this story was published, RFIDGS provided a detailed data sheet, which you may download by clicking here.