An Audit Report on the Voter Registration System at the Texas Secretary of State's Office

November 2007

Report Number 08-012

Overall Conclusion

The Texas Secretary of State's Office should improve its processes and controls to ensure that records in the Texas Election Administration Management (TEAM) system are accurate in accordance with the Help America Vote Act of 2002 (HAVA). Voter registration is an important element of the electoral process that presents many challenges. Ensuring that only eligible persons are registered to vote is an ongoing challenge that involves the Secretary of State's Office, 254 county voter registration offices, the Department of Public Safety, and the Bureau of Vital Statistics. Although the Secretary of State's Office has processes to identify many ineligible voters and remove them from the State's voter registration list, improvements can be made.

Auditors compared data in the TEAM system to data obtained from the Department of Criminal Justice and the Bureau of Vital Statistics using criteria developed by the Secretary of State's Office. As a result, auditors identified 49,049 (0.4 percent) of 12,374,114 registered voters for the May 12, 2007, special election who may have been ineligible to vote. These included the following:

- Voter records for 23,114 possible felons.

- Records for 23,576 voters who may be deceased.

- Duplicate records for 2,359 voters.

Auditors did not identify any instances in which potentially ineligible voters actually voted during the May 12, 2007, special election, although voting history data in the TEAM system was incomplete.

The Secretary of State's Office does not retain a complete history of death and felon records that were reported during previous periods. This limits its ability to identify ineligible voters who may not have been previously removed, convicted felons who try to register multiple times, or applicants who use a deceased person's information to register to vote. In addition, the Secretary of State's Office does not require counties to investigate and remove voter registration records that match felon or deceased records on a periodic basis. As a result, voter registration records identified by the Secretary of State's Office as potentially ineligible may remain active indefinitely.

The Secretary of State's Office has implemented certain access and security controls over the TEAM system; however, the Secretary of State's Office needs to implement additional controls to ensure that it adequately protects voter registration information and the TEAM system from unauthorized access. Auditors did not identify any breaches of security or disclosures of confidential voter registration data, but they did identify weaknesses that the Secretary of State's Office should address to ensure that the TEAM system is adequately protected. Specifically:

- The Secretary of State's Office does not have a process to ensure that user accounts are authorized by appropriate personnel, including administrative accounts that allow access to and control of confidential information within the TEAM system. The Secretary of State's Office also does not have the appropriate tools necessary to adequately monitor TEAM user activity.

- The Secretary of State's Office has not reviewed existing accounts for validity, nor does it have a process to do so in the future. As a result, it could not confirm whether county or contractor users were actual employees. This increases the risk of unauthorized access.

- Weaknesses within data backup and change management procedures increase the risk that the Secretary of State's Office would be unable to promptly and fully recover from a disaster. In addition, specific weaknesses within application and database security increase the risk that TEAM data is not adequately protected.

Tests performed by a contractor (IBM) on behalf of the Secretary of State's Office, as well as statements by county voter registration officials, indicate that although the TEAM system is available to users, its stability and response time can be improved. In addition, 106 (52 percent) of 204 county voter registration offices said that the TEAM system does not allow them to perform their jobs effectively.

For 6 (60 percent) of 10 benchmarks required by the Secretary of State's Office's contract for the development of the TEAM system, the TEAM system was slower than the system used previously by the Secretary of State's Office-the Texas Voter Registration System (TVRS). However, the Secretary of State's Office has made numerous changes to the TEAM system to enhance its performance. Foremost among these changes is an ongoing performance test that the Secretary of State's Office conducted during the week of August 6, 2007. According to the Secretary of State's Office, this test used an automated tool to simulate the voter registration activity that the TEAM system is likely to experience during the 2008 presidential election. (The TEAM system is expected to see the highest volume of activity during presidential elections.) According to the Secretary of State's Office, it plans to use the results of this test to make further improvements to the TEAM system's performance. Auditors did not verify the results of this performance test.

Auditors also identified less significant issues that were communicated separately to the Secretary of State's Office.

Contact the SAO about this report.

Download the Acrobat version of this report. (.pdf)

If you prefer an HTML version, follow this link to an Adobe site which converts PDF files to HTML.