Development of the system

Updated 30 Jul 2020

Introduction

EVACS is the computer system that provides for electronic voting and electronic counting for ACT Legislative Assembly elections. It provides for counting according to the Hare-Clark electoral system rules set out in the Electoral Act 1992.

Development

The successful implementation of the electronic voting and counting system was the culmination of an extensive and complex project begun by the Commission after the 1998 Legislative Assembly election. At the 1998 election, the close result in the Molonglo electorate (when 2 candidates were 3 votes apart at the point where one of them had to be excluded) and the resultant recount (which saw the relative order of these candidates change due to mistakes made in the original manual count) led to calls for computerised voting and counting processes to increase the speed and accuracy of the ACT's Hare-Clark counting system.

In 1998/1999 the Commission examined the available options for computerising the voting and counting processes, and in October 1999 the Commission published a Request for Proposal, seeking proposals for using technology to improve the speed and accuracy of ACT election counts. Fifteen proposals were received.

After evaluating the proposals, the Commission decided that no one proposal provided a complete solution for electronic voting and vote counting that would meet all the Commission's needs. However, the proposals did clarify possible options for proceeding to some form of electronic voting and vote counting for the October 2001 election.

After further investigation the Commission concluded that electronic voting should be provided in a controlled environment at pre-poll voting centres and polling places. The Commission was not convinced that it would be appropriate to use the internet for voting for the 2001 election.

In December 1999 the Commission submitted a business case seeking in principle support from the ACT Government to proceed with an electronic voting/vote counting system. After securing Government agreement for the Commission's proposed model, legislation to amend the Electoral Act was prepared and introduced in the Legislative Assembly on 18 October 2000 and was passed on 5 December 2000. The timeframe in which to deliver a complex system was therefore very tight.

Following passage of this legislation, the Commission published a Request for Tender for software for the electronic voting and vote counting system on 11 December 2000. Seven tenders were received. After a thorough tender evaluation process, the successful tenderer, Software Improvements Pty Ltd, was announced on 19 April 2001.

Development of the EVACS system commenced as soon as the contract had been signed in April 2001, with the product successfully used at the October 2001 election.

Overview of the system

EVACS has two parts: electronic voting and electronic counting. Electronic voting is used in polling places to directly record votes. Electronic counting handles the data entry and counting of votes.

Electronic voting

The system deployed in each polling place where electronic voting is available consists of a number of "booth" machines, which are used by individual voters to cast their vote. These are connected via a network to a single "ballot box" machine which acts as a server for the polling place, recording votes as they are cast and providing information to the booth machines when necessary.

The machines in the polling place are not connected to any external network for security, and at the end of polling the votes are physically transported from the ballot box machine to the counting (back-end) system by encrypted memory devices.

Electronic counting

The back-end system consists of a number of data entry workstations and the counting server. The data entry workstations are used by data entry operators to enter manually cast (paper) ballots. These are recorded on the counting machine, which also receives (via zip disks) the electronic ballots. Once the ballots are received/entered, EVACS then performs a Hare-Clark scrutiny to produce the results of the election, and also reports similar to those produced during the manual counting process. The counting server is also used to perform some of the administrative functions needed for the system, such as generating the barcodes used for authentication.

Consultation

In 2000, the Electoral Commissioner consulted with MLAs and party representatives on the design of the electronic voting system, particularly the voting interface.

After the software contract was let in 2001, the Commissioner established a Reference Group, consisting of representatives from parties, MLAs and special interest groups, including ACT Blind Citizens Australia and the Proportional Representation Society. The Reference Group was consulted on the development of EVACS and provided feedback on it.

The Reference Group met on 8 June, 6 September and 21 September 2001. At its first meeting, the Reference Group was shown a demonstration of a prototype voting interface. At the later meetings the Reference Group reviewed the voting interface and the electronic counting/data entry systems. Comments made by the Reference Group were taken into account as much as possible in the implementation of EVACS.

Testing

EVACS was extensively tested before the Commissioner was satisfied that it was suitable for use. The system is again thoroughly tested before each ACT election.

In consultation with the Commission, Software Improvements prepared a series of documents that were used in the design and testing of the software, including software requirements specifications, detailed design specifications, acceptance test plans, and test cases and procedures specifications. These documents were based on appropriate industry standards, particularly IEEE Standards 829-1998 and 830-1998. The system software was then developed and tested in accordance with the documented requirements.

Testing methods employed included:

  • conducting structured test cases in controlled situations (used to ensure individual modules perform as expected);
  • conducting Hare-Clark scrutinies in parallel, using EVACS and manual counting of known sets of ballot papers, comparing the results obtained by EVACS and the Commission's Excel spreadsheet Hare-Clark program (used to ensure that EVACS was correctly applying the Hare-Clark system, using a variety of test election outcomes to test specific cases);
  • "real user" testing, whereby large numbers of users cast electronic votes in a mock polling place and data-entry operators entered the results from paper ballots (used to test useability and to simulate realistic loads on the system);
  • load testing, where large quantities of ballot data was simulated and loaded into the counting system; and
  • "whole of life" testing, where the entire process was simulated, taking test electronic votes from a polling place, loading it into the counting server, adding data-entered results from paper ballots, and using the counting system to generate a Hare-Clark result.

This testing served to identify improvements in the software and hardware configuration and to demonstrate that EVACS was accurately counting votes and distributing preferences under the Hare-Clark system.

Auditing

The Commission contracted a software auditing firm, BMM International, to audit the software code of the system to ensure that the software did not contain code that would have the affect of altering the result of the election. For example, checks were undertaken to ensure that no code had been included that would change the votes recorded by electors or would insert or substitute fraudulent votes, or would in any other way alter the election outcome.

BMM International certified that the code for EVACS:

  • appeared to neither gain nor lose votes;
  • appeared to faithfully implement the Hare-Clark algorithm for vote counting provided to BMM by the Commission; and
  • was written in a consistent, structured and maintainable style.

BMM International also checked the final version of the code that was used in the election, which included the candidate information following the close of nominations, against the audited code, to ensure that any changes that had occurred in the interim would not affect the outcome of the election. This was confirmed by BMM International.

Source code

EVACS was written using Linux open source software to ensure appropriate transparency.

For more information on EVACS contact Software Improvements.

* We are grateful to members of the Australian National University's Computer Science Laboratory and NICTA's Logic and Computation Programme for finding and reporting this minor error. For more information see http://users.cecs.anu.edu.au/….