Documents

Voting System Certification Documents

Voting System Certification Documents
Body

Summary of Changes between Public Comment Version and Adopted Version of the Voluntary Voting System Guidelines

 

Rationale for Global Changes to VVSG

The version of the VVSG adopted in December of 2005 includes several global edits to clarify the language.  Those changes are outlined below.

 

ITA— prior usage referred to independent testing organizations accredited by NASED to perform voting system qualification testing. All these references have been changed to “testing laboratory” (or some form of this term), to refer to the testing organizations accredited by the EAC to perform certification testing.

 

Polling site, polling area—have been changed to “polling place” for consistency.

 

Punchcard systems—all references to punchcard systems have been eliminated.

 

Qualification—has been changed to reflect the process of “certification” to reduce ambiguity between the previous NASED process and the new EAC process.

 

Race—has been considered in all its usages within the document and has only been used when referring to a political contest between people. Prior versions of the document used race interchangeably with contest, blurring the lines between contests held between people and those concerning issues. Many instances of “race” have been replaced with “contest.”

 

Standards—has been eliminated and replaced with “guidelines” when referring to the testing guidelines, and “requirements” when referring to the voting system requirements.

 

Structural Changes—due to reorganization of the material, some section, subsection and appendix numbering has been changed in Volume I. In addition, several headings have been shortened and clarified.

 

Voter choices, ballot choices—the word “choices” in these terms has been changed to “selections” whenever the terms refer to an unmarked ballot.

 

Voter verified—has been replaced with “voter verifiable,” clarifying that the information is able to be reviewed and verified by the voter if the voter so chooses after his vote has been selected and before it is cast.

 

Voting machine, voting station, voting equipment, voting system—these terms have been used interchangeably in past iterations of the Guidelines. For the 2005 VVSG, these terms have been closely reviewed and have each taken on a specific meaning.  “Voting machine” is now used to refer to the devices used by the voter to make a contest selection.  “Voting station” refers to the voting machine and the space at the precinct that

 

the voting machine and the voter occupy while the selections are being made. “Voting equipment” is any of the equipment used to place the vote, to verify that vote, and to tabulate that vote, and finally, “voting system” refers to the entire system that is used to perform election management functions, prepare ballots, and to display, capture, verify and record votes.

 

Write-once media—has been replaced in all instances with “unalterable storage media” indicating that the alterability of the media is more important to its acceptability in this role than the fact that it can only be written on once. (For instance, using a media type that allows write-overs but can be finalized so that it is unalterable at the point of sale would be acceptable).

 

Volume I: Voting System Performance Guidelines

The EAC published proposed Voluntary Voting System Guidelines for a 90-day public comment period in July of 2005. The comment period resulted in over 6000 comments. Each of these comments was reviewed and considered by the Election Assistance Commission (EAC) in consultation with the National Institute for Standards and Technology (NIST) in the development of the final version adopted by the Commission on December 13, 2005.

 

More than 5800 of the comments pertained to Volume I.  Several portions of the document have been modified to respond to the comments. In particular, Section 2 (previously Voting System Functional Capabilities) has been split into two separate sections (2, Functional Requirements and 3, Usability and Accessibility Requirements) and the Security section (now Section 7) has undergone a substantial re-write. Changes to the entire volume are outlined below section by section.  The adopted document section number and title heads each section.

 

Section 1: Introduction

The introductory section has been revised to reflect changes in the rest of the document and also to relate more closely to the EAC certification process.

 

Subsection 1.6.4 “Implementation Statement” has been changed from “An implementation statement may take the form of a checklist to be completed for each voting system for which a claim of conformance to the Guidelines is made” to “The implementation statement must include a checklist identifying all the requirements for which a claim of conformance is made.” The second and final paragraph in this subsection has been changed to communicate what is specifically required of the implementation statement.

 

Finally, Subsection 1.7 (“Effective Date”) has been clarified with new language.

 

Section 2: Functional Requirements

As indicated above, Section 2 of the public comment version of the Guidelines has been split into two sections for the adopted version. In this later version, the “human factors” requirements have been extracted from the functional requirements and placed in a section of their own. Section 2 is now titled “Functional Requirements.” Furthermore, all references to punch card systems have been eliminated.

 

Language in Subsection 2.3.3.2 (e)-(h) has changed from that of previous Subsection

2.4.3.2.2 (a)-(c) so that the terms “undervote” and “overvote” are clearly defined within the requirements.  The language was made consistent with the HAVA provisions in section 301 (a).

 

Subsection 2.4.1, previously 2.5.1 “Closing the Polling Place (Precinct Count),” has been simplified to “Closing the Polls.”  The introductory language in this Subsection has been changed to reflect that the closing of the polls includes the locking of voting systems against future voting.

 

Section 3: Usability and Accessibility Requirements

Human factors requirements were removed from Section 2 Voting System Functional Capabilities, placed in Section 3, and re-titled Usability and Accessibility Requirements. Subheadings have been added throughout the accessibility portion to more clearly indicate requirements for specific disability conditions. The usability and accessibility requirements have been considerably expanded from the 2002 Voting System Standards. They are expected to become more extensive and detailed as further research is done and new technological solutions become available for accommodating voter disabilities.

 

The order of presentation is reversed from the public comment version. Usability requirements are presented first because they apply to all voting systems. Alternative language and privacy requirements are included under Usability because they apply to all voting systems. Accessibility requirements follow as additional requirements that must be met by the accessible voting systems mandated by HAVA Section 301(a)(3)(B).

Requirements pertaining to DREs with voter verifiable paper audit trail components have been removed from this section and have been consolidated.

 

3.1.1Usability Testing (previously 2.2.7.3.1)

This requirement was revised to make usability testing mandatory for vendors: “The vendor shall conduct summative usability tests on the voting system using individuals representative of the general population. The vendor shall document the testing performed and report the test results using the Common Industry Format. This documentation shall be included in the Technical Data Package submitted to the EAC for national certification.

Discussion: Voting system developers are required to conduct realistic usability tests on the final product. For the present, vendors can define their own testing protocols. Future revisions to the Guidelines will include requirements for usability testing that will include performance benchmarks.”

 

 

3.1.2Functional Capabilities a. Thesethreewereexpandedtoandwordingrevisedtobeconsistentwith HAVA:

“a. The voting system shall provide feedback to the voter that identifies specific contests or ballot issues for which he or she has made no selection or fewer than the allowable number of selections (e.g., undervotes)

b.Thevotingsystemshallnotifythevoterif he or she has than theallowable of selections for any contest (e.g., overvotes)

c.Thevotingsystemshallnotifythevoterbeforetheballotiscastandcountedof the effect of than number of foracontest

d.The voting systemshall provide the correct the ballotfor either an undervote or overvote theballotiscastandcounted

e.The systemshall the voter,athisorherchoice,toanundervotedballotwithoutcorrection”

 

3.1.3 Alternative Languages (previously 2.2.7.2, 2.2.7.2.1, 2.2.7.2.2, 2.2.7.2.3, 2.2.7.2.4) The concept of “an alternative language voting station” has been removed. All voting equipment is subject to meeting the criteria for alternative language accessibility as defined in Section 203 of the Voting Rights Act (VRA) of 1975 as applicable in the jurisdictions where it will be used. The wording of the previous requirements has been consolidated and made consistent with HAVA and the VRA. The new wording also recognizes that some states provide alternative language accessibility beyond what is required in federal law.

 

“The voting equipment shall be capable of presenting the ballot, ballot selections, review screens and instructions in any language required by state or federal law.”

 

3.1.5 Perceptual Issues (previously 2.2.7.3.4)

Previous requirement 2.2.7.2.1.3 was moved to 3.1.5.e because it is a usability, not accessibility, requirement: “All voting machines using paper ballots should make provisions for voters with poor reading vision. Discussion: Possible solutions include: (a) providing paper ballots in at least two font sizes, 3.0-4.0mm and (b) providing a magnifying device.”

 

Previous requirement 2.2.7.2.1.6 was moved to 3.1.5.f because it is a usability, not accessibility, requirement: “The default color coding shall maximize correct perception by voters with color blindness. Discussion: There are many types of color blindness and no color coding can, by itself, guarantee correct perception for everyone. However, designers should take into account such factors as: red-green color blindness is the most common form; high luminosity contrast will help colorblind voters to recognize visual features; and color-coded graphics can also use shape to improve the ability to distinguish certain features.”

 

Previous requirement 2.2.7.2.1.7 was moved to 3.1.5.g because it is a usability, not accessibility requirement: “Color coding shall not be used as the sole means of conveying

 

information, indicating an action, prompting a response, or distinguishing a visual element. Discussion: While color can be used for emphasis, some other non-color mode must also be used to convey the information, such as shape or text style. For example, red can be enclosed in an octagon shape.”

 

3.1.7.1 Privacy at the Polls (previously 2.2.7.4.1)

Requirement was reworded to make it more specific: “When deployed according to the installation instructions provided by the vendor, the voting station shall prevent others from observing the contents of a voter’s ballot.”

 

3.2.1.b General (under 3.2 Accessibility, previously 2.2.7.1.1)

 

Requirement was revised to clarify interface between accessible voting station and personal assistive devices of the voters: “The support provided to voters with disabilities shall be intrinsic to the accessible voting station. It shall not be necessary for the accessible voting station to be connected to any personal assistive device of the voter in order for the voter to operate it correctly. Discussion: This requirement does not preclude the accessible voting station from providing interfaces to assistive technology. [See definition of “personal assistive devices in the Glossary.] Its purpose is to assure that disabled voters are not required to bring special devices with them in order to vote successfully. The requirement does not obviate the need for a voter’s ordinary non- interfacing devices, such as eyeglasses or canes. Jurisdictions should ensure that an accessible voting station provides clean and sanitary devices for voters with dexterity disabilities.

 

3.2.2.1.a Partial Vision (previously 2.2.7.1.2.1.1)

 

Requirement was revised to make usability testing mandatory for the vendor: “The vendor shall conduct summative usability tests on the voting system using partially sighted individuals. The vendor shall document the testing performed and report the test results using the Common Industry Format. This documentation shall be included in the Technical Data Package submitted to the EAC for national certification.”

 

3.2.2.2.a Blindness (previously 2.2.7.1.2.2.1)

 

Requirement was revised to make usability testing with blind individuals mandatory for the vendor. Wording is identical to 3.2.2.1.a above, except for the disability type.

 

Requirement 3.2.2.2.c.iv (previously 2.2.7.1.2.2.3.4) was revised to make the provision of a sanitized handset or headphone mandatory for each voter: “A sanitized headphone or handset shall be made available to each voter.”

 

Requirement 3.2.2.2.c.viii (previously 2.2.7.1.2.2.3.8) was revised to make it a performance standard rather than prescribing a specific solution: “The audio presentation of verbal information should be readily comprehensible by voters who have normal hearing and are proficient in the language. This includes such characteristics as proper

 

enunciation, normal intonation, appropriate rate of speech, and low background noise. Candidate names should be pronounced as the candidate intends.”

 

Requirement 3.2.2.2.c.ix (previously 2.2.7.1.2.2.3.9) was revised to make it more specific: “The audio system shall allow voters to control the rate of speech. The range of speeds supported should be at least 75% to 200% of the nominal rate.”

 

Requirement 3.2.3.a. under Dexterity (previously 2.2.7.1.3.1) was revised to make usability testing with individuals lacking fine motor control mandatory for vendors.

 

Requirement 3.2.3.d (previously 2.2.7.1.3.4) was revised to make the provision of a mechanism for non-manual input mandatory for voters with dexterity limitations: “The accessible voting station shall provide a mechanism to enable non-manual input that is functionally equivalent to tactile input. Discussion: This requirement ensures that the accessible voting station is operable by individuals who do not have the use of their hands. All the functionality of the accessible voting station (e.g., straight party voting, write-in candidates) that is available through the other forms of input, such as tactile, must also be available through a non-manual input mechanism if it is provided by the accessible voting station.”

 

Requirement 3.2.3.e (previously 2.2.7.1.3.5) was revised to make the capability to submit the ballot mandatory for voters with dexterity limitations: “If the normal procedure is for voters to submit their own ballots, then the accessible voting station shall provide features that enable voters who lack fine motor control or the use of their hands to perform this submission.”

 

Requirement 3.2.7 English Proficiency (previously 2.2.7.2) was revised to clarify provisions for voters lacking proficiency in reading English or whose primary language is unwritten: “For voters who lack proficiency in reading English, or whose primary language is unwritten, the voting equipment shall provide spoken instructions and ballots in the preferred language of the voter, consistent with state and federal law. The requirements of 3.2.2.2.c shall apply to this mode of interaction.”

 

Section 4: Hardware Requirements

Section 3, “Hardware” has been displaced by the split of Section 2 so that it is now labeled Section 4.  Furthermore, the title has changed so that it is now consistent with the others so it reads “Hardware Requirements.”

 

In Subsection 4.3 VAC in reference to electronic measurements is now spelled out to avoid any ambiguity or misunderstanding, so that it now reads “voltage alternating current.”

 

Section 5: Software Requirements

This Section is now titled “Software Requirements.”

 

Subsection 5.4.1 (“Pre-election Audit Records”) has been amplified with a new requirement (d), so that in addition to former requirements, the log shall include: “Any

 

other characteristics that may be peculiar to the jurisdiction, the election or the polling place location.”

 

Section 6: Telecommunications Requirements

Other than its displacement due to the Section 2 split, there were no significant changes made to this section titled “Telecommunications Requirements.”

 

Section 7: Security Requirements

Subsection headings throughout this section have been shortened and simplified.

 

7.3.1 Polling Place Security (previously 6.3.1)

Reworded to clarify that vendor is responsible for documenting security measures but poll workers will implement them.

 

  1. Software Distribution (previously 6.4.4 Software Distribution Methodology Requirements)

a.i. (previously 6.4.4.1) “Part number” added as second unique identifier example.

 

a.i. and b.i. (previously 6.4.4.1 and 6.4.4.4) “…certification number of the voting system” changed to “certification application number of the voting system”. The system certification number is not granted until after the system test report is reviewed and approved by EAC.

 

b.iii. (previously 6.4.4.6) “The testing authority shall retain this record until the voting system ceases to be nationally certified” was changed to “The testing lab shall retain this record until notified by the EAC that it can be archived.” EAC notification provides both authorization and a date certain for archiving this information.

 

  1. (previously 6.4.4.7) “After EAC certification has been granted” was added to the beginning of this requirement.

 

c.ii.(previously6.4.4.9)“…anyotherbytheElectionAssistance was changed to “any other a designatedNSRLasthenationalrepository all certified voting system software, butstates wish to designate other entities forthespecificsoftwareintheir jurisdictions. This change been throughout this section.

 

c.iii. “The testing shallretainthisthesystemceases to be nationally certified” waschangedto NSRLshallretainthissoftware until notified by the EAC that it canbearchived.”forNSRLparallelsthetestinglabinb.iii.

 

  1. (previously 6.4.4.11) “The vendor shall provide the NSRL or other EAC designated repository with a copy of all third party software” was changed to “The vendor shall provide the NSRL and any repository designated by a state with a copy of the software installation disk which the vendor will distribute to purchasers -- including the executable
 

binary images of all third party software.” This change was made to clarify what software is to be provided to NSRL.

d.ii. (previously 6.4.4.13) “The vendor shall document that the process used to verify the software distributed on write-once media is the certified software by using the reference information provided by the NSRL or other EAC designated repository” was changed to “The vendor shall document that the process used to verify the software distributed on unalterable storage media is the certified software by using the reference information provided by the NSRL or other designated repository before installing the software.” Adding the phrase “before installing the software” indicates when the vendor is to document verification of distributed software.

 

  1. Software Reference Information (previously 6.4.5 Generation and Distribution Requirements for Reference Information)

 

c. (previously 6.4.5.4) “The NSRL or other EAC designated repository shall retain the write-once media used to generate the reference information until the voting system ceases to be nationally certified” was changed to “The NSRL or other designated repository shall retain the unalterable storage media used to generate the reference information until notified by the EAC that it can be archived.” EAC notification provides authorization and a date certain for this action.

 

7.4.5.1 Hashes and Digital Signatures (heading added to indicate change in topic)

 

b.v. (previously 6.4.5.5.6) …“the name of the organization” was added before “name and contact information.” Change adds indication of organizational affiliation of person receiving public keys.

 

7.4.6 Software Setup Validation (previously 6.4.6 Setup Validation Methodology Requirements)

 

b. (previously 6.4.6.2) …”static and semi-static” removed before “voting system software”. At present only static software can be verified using NSRL reference information.

 

d.(previously 6.4.6.3.1) “The verification shall be able to be usingCOTS software and hardware available fromsourcesotherthanthevotingsystemvendor.”beable”changedto“shouldproducts are currently available andit is when they be.

 

e.(previously 6.4.6.3.4) “Voting system shall provide aread-only externalinterfacetoaccesstheonthe was changed to “Votingsystem shall a to ensure that systemsoftware can verifiedthroughatrustedsuchas a read-only or by otherwastoindicatethe capability required ratherthan to prescribe a single design solution.

 

7.5.1 Maintaining Data Integrity (combines previous 6.5.1 Access Control, 6.5.2 Data Integrity, and 6.5.3 Data Interception Prevention)

 

7.5.3 Monitoring and Responding to External Threats (previously 6.5.4.3)

 

e. Timeframe for implementing corrective procedures to threats changed from “no later than one month before an election” to “within the timeframe established by the state.” Comments from election officials indicated that the timeframe for corrective action needed to be related to the nature and potential impact of the threat and shouldn’t arbitrarily be specified in advance.

 

7.6Use of Public Communications (previously6.6SecurityforofOfficialDataOverPublic Communications

 

References to “DRE systems” changed to “voting systems” because use of communications networks is not limited to DRE voting systems.

 

7.7

Introductory discussion edited and restructured to improve clarity of presentation.

 

7.7.1Controlling6.7.2)

 

“This review shall be done either through an open and public review or by a subject area recognized expert” (previously 6.7.2.1.3.1) was deleted. The testing labs are accredited to have technical competency for documentation review and testing of all elements and technologies used in voting systems.

 

7.7.2Identifying Usage (previously 6.7.3)

 

c. (previously 6.7.3.3) “The indication should be visual” changed to “The indication shall be visual.” Visual indication that wireless capability is active is made mandatory to aid poll workers in properly controlling its use.

 

“The wireless (audible) path shall be protected or shielded” (previously 6.7.6.4) was deleted. This requirement was intended to pertain to acoustic hearing and speech which is not electronically mediated.

 

7.8Independent Verification

 

This subsection was added to provide an overview discussion and description of the basic characteristics of independent verification systems. This material establishes context for the next subsection which states requirements for voter verifiable paper audit trails, one type of independent verification. Also terminology was changed from independent dual verification systems to reflect NIST’s current nomenclature.

 

7.9Voter Verifiable Paper Audit Requirements (previously 6.8)

 

Introductory paragraph revised to indicate that these requirements are for DRE voting systems; that VVPAT capability is not required for national certification, but these requirements will be applied in certification testing if vendor’s application for certification testing so requests.

 

a.(previously 6.8.1.1) Discussionlanguage revised to references to use of paperrecord for recounts.

b.(previously 6.8.1.2) language revised to thephrase“ifrequiredbystatelaw”regardingwhetherpaperrecordwillbeusedforrecount.Thelastsentenceinthe Discussionwasrevisedto papershallalsobe suitable use in fullrecountsoftheelectionifrequiredbystatelaw.” These changes were in responseto fromelection officials thatstatelawprescribesrecountswillbeconducted.

 

7.9.2Approve or Void the Paper Record (previously 6.8.4 Approve or the PaperRecord)

 

This entire subsection has been substantially revised to clarify requirements for the processing of the VVPAT paper and electronic records in response to one of three possible scenarios:

-ThevoterverifiesthathisorherselectionsscreenandthoseprintedonthepaperaretheIftheyare,thevoteriswiththesethe voter proceeds tocasttheballot, thereby approving the paper record.

-If the records but the voter tochangeanyofhisorherselections,thepaperrecordbevoidedsoanew one can be printed to to thenew screen display. The summary screen data are not storedbyDREs,soprevioustorecordwould have required significant softwarechanges.Voidingthepaperrecordisa muchsolutiontotheaudit

-In the the do not voterwouldrequestassistancefromapollworkerasthis a Inthisthevoting would be withdrawn fromuse to investigation of the

 

7.9.3Electronic and Paper RecordStructure (previously 6.8.6)

 

Previous requirement 6.8.6.1 was deleted because it was a general statement that could not be tested.

 

Previous requirement 6.8.6.11 moved to 7.9.3.e.v. because it was out of sequence in the previous location.

 

The words “or barcodes” added to end of Discussion sentence under 7.9.3.g. (previously 6.8.6.8).

 

Previous requirement 6.8.6.9, “Any automatic accumulation of electronic or paper records shall be capable of detecting and discarding duplicate copies of the records,” was deleted as duplicate records cannot occur.

 

7.9.3.h. (previously 6.8.6.10) was revised to read: “If barcode is used, the voting equipment shall be able to print a barcode with each paper record that contains the human-readable contents of the paper record.” This change clarifies that the ability to print a barcode reflecting the contents of the paper record is mandatory if this technical solution is used.

 

7.9.4 Security and Reliability (previously 6.8.7)

 

This subsection was substantially revised to clarify and tighten up requirements.

 

Previous requirements 6.8.7.1 and 6.8.7.2 were deleted because general statements that cannot be tested.

 

Previous requirement 6.8.7.2.5 was deleted because it is subsumed in requirement 7.9.4.j.

 

Previous requirement 6.8.7.2.7 was revised and moved to 7.9.4.b and c: “Tamper-evident seals or physical security measures shall protect the connection between the printer and the voting machine.””If the connection between the voting machine and the printer has been broken, the voting machine shall detect this event and record it in the DRE audit log.”

 

Previous requirement 6.8.7.3 was deleted because a general statement that could not be tested.

 

New requirement 7.9.4.i added: “The voting machine shall not record votes if an error or malfunction occurs.” The “error or malfunction” refers to the VVPAT printer.

 

7.9.5PreservingVoter(previously6.8.5)

 

New requirement 7.9.5.b added: “When a VVPAT with a spool-to-spool continuous paper record is used, a means shall be provided to preserve the secrecy of the paper record of voter selections.

 

New requirement 7.9.5.c added: “When a VVPAT with a continuous spool-to-spool paper record is used, no record shall be maintained of which voters used which voting machine or the order in which they voted.

 

Previous requirement 6.8.5.1.1 deleted: “When the voter is responsible for depositing a paper record in the “ballot box” (reference is to the secure receptacle for storing the paper records, not the receptacle for ballots), the accessible voting station shall maintain the privacy and anonymity of voters unable to manually handle paper.”

 

Previous requirement 6.8.5.4 deleted: “The voter shall not be able to leave the voting area with the paper record if the information on the paper record can directly reveal the voter’s choices.” The rationale for both these changes (6.8.5.1.1 and 6.8.5.4) is that the voter should not be permitted to physically handle the paper record as this provides opportunity for fraud.

 

New requirement 7.9.5.g added: “Both paper rolls and paper record secure receptacles shall be controlled, protected, and preserved with the same security as a ballot box.” This is to ensure that audit records are properly maintained for use while preserving the privacy of the voters.

 

7.9.6

 

Previous requirements 6.8.3.2, 6.8.3.3, and 6.8.3.4 moved to 7.9.6.c and revised to read:

c.“The voting shall display, printandstorethepaper in any of thewrittenalternativechosenforthe

i.Toassistwithauditing,candidate names on the paper record shall bepresentedinthe languageas used on the DRE screen.

ii. on the paper record not bythevotertoperformverificationshallbeinDiscussionaddedtoclarify

 

Previous requirements 6.8.2.3 and 6.8.2.3.1 were combined and revised to read: “The paper and electronic records shall be preserved to allow the voter to read and compare the records without the voter having to shift his or her position.”

 

Sentence added to the Discussion following 7.9.6.e (previous 6.8.2.3.2): “The voter should be notified if it is not possible to scroll in reverse, so they will know to complete verification in one pass.”

 

Requirement 7.9.6.f (previous 6.8.2.3.3) was revised to read: “If the paper record cannot be displayed in its entirety on a single page, each page of the record shall be numbered and shall include the total count of pages for the record.” Discussion added: “Possible numbering schemes include ‘Page X of Y.’

 

7.9.7VVPAT Accessibility 6.8.3)

 

Requirement 7.9.7.b (previous 6.8.3.5) significantly revised: “If the normal voting procedure includes VVPAT, the accessible voting equipment should provide features that enable voters who are visually impaired and voters with an unwritten language to perform this verification. If state statute designates the paper record produced by the VVPAT to be the official ballot or the determinative record on recount, the accessible voting equipment shall provide features that enable visually impaired voters and voters with an unwritten language to review the paper record.” Discussion was added: “For example, the accessible voting equipment might provide an automated reader that converts the paper record contents into audio output.” This change was made to make it clear that if the paper record either is treated as the official ballot or could be the

 

controlling record used for recount, then visually disabled voters must be able to verify the paper record itself. The requirement was also extended to voters with an unwritten language.

 

Section 8: Quality Assurance Requirements and Section 9: Configuration Management Requirements

There were no significant changes made to these sections.

 

Appendix A: Glossary

A large number of terms were dropped from the glossary, either because the term does not appear in the document, there is a commonly understood meaning, or it is explained thoroughly in the text where it is used.  In addition, several terms have been added to the glossary.  They include: configuration status accounting, election, electronic voting system, hash function, internal audit log, NIST, personal assistive device, precinct count voting system, product standard, qualification testing, secure receptacle, security analysis, testing standard, and voter verifiable.  The definitions for a significant number of terms were expanded to better define their usage.

 

Appendix B

Appendix B is a list of references pertaining to the whole document to which has been added a list of Legislation References in Subsection B.3.

 

Appendix C: References

Appendix C, “Best Practices for Election Officials,” has been deleted. Election administration and procedural matters will be addressed by the EAC Management Guidelines Working Group and published in a separate document.

 

Appendix D (Now Appendix C): Independent Verification Systems

The term “Independent Dual Verification Systems” has been changed to “Independent Verification Systems.” There were several wording clarifications throughout this appendix.

 

Appendix E (Now Appendix D): Technical Guidance for Color, Contrast, and Text Size

Subsections D.1 (Introduction), D.2 (Requirements) and D.3 (Design Options) have been removed because this material is now contained in the main body of the Guidelines. The last line of the fourth paragraph of this appendix has changed so that the use of the 16- color palette or larger is now suggested instead of required when voter adjustment of color is provided. The term “accessibility” has been clarified as “low-vision accessibility.”

Volume II: National Certification Testing Guidelines

Of the thousands of comments made to the VVSG, only 148 pertained to Volume II; and 97 of those concerned Sections 1 or 5.  Many of these comments concerned simple formatting or grammar changes; relatively few substantive changes were called for in Volume II.

 

Structural changes to Volume II were also minimal.  Section numbers did not change or shift and no appendices were removed. A title page and a copy of the Overview were added to this Volume in order to provide an easy reference guide to Volume I for readers who will generally consult only Volume II.

 

Section 1: Introduction

The testing sequence described in Section 1.4 has been reordered to reflect a more logical sequence in which the testing must be completed. The order now prescribes that examination of the system, the technical documentation provided by the vendor and the vendor’s quality assurance program and configuration management plan occur prior to the development of a detailed system test plan. Furthermore, the witness of the system build will occur immediately after these examinations and the software code review.

Following the build, testing will be performed on the operation, function and performance of hardware first, then software, and finally on the entire integrated system. After all testing is complete, the National Certification Test Report will be prepared and delivered to the EAC. The witness of the system build described in Section 1.8.2.4 has been changed so that the build can now take place at either the vendor site or the test lab.

 

Section 2: Description of Technical Data Package

There were no substantial changes to Section 2.

 

Section 3: Functionality Testing

The language in Subsection 3.4 “Functionality Testing for Accessibility” has been changed from, “The test lab shall design and perform test procedures that verify conformance with each of these requirements” to;

 

To demonstrate conformance to these requirements, vendors shall conduct summative usability tests of accessible voting equipment with blind and visually impaired individuals and individuals lacking fine motor control. A description of the testing performed, the population of test subjects participating, and the results shall be documented using the Common Industry Format (CIF) by the vendor and submitted as part of the Technical Data Package. The test labs shall review this information during the system certification documentation review.

 

Section 4: Hardware Testing

“Voltage Alternating Current” is now spelled out in Section 4.3 (b) to avoid reader confusion.

 

 

The tests that previously had their own titles under “Other Environmental Tests” are now labeled with individual letters for direct reference without those titles.

 

Section 5: Software Testing

 

Control constructs in Section 5.4.1 have been amplified to include permission for conventional constructs that are inherent to the development language with the caveat that such constructs must be documented in the code, adjacent to their use.

 

The assessment of coding conventions described in Section 5.4.2 has been clarified by removing guideline (t) which stated “(the test lab shall review the code to ensure that it) specifies explicit comparisons in all if() and while() conditions;” and by removing the accompanying examples.

 

Section 6: System Integration Testing and Section 7: Quality Assurance Testing

There were no substantive changes made to these sections.

 

Appendix A: National Certification Test Plan, Appendix B: National Certification Test Report and Appendix C: National Certification Test Design Criteria

There were no substantive changes made to the appendices.

 

Changes in the Glossary

The following terms have been removed from the glossary:

 

alternative language voting station, approval, attestation, ballot set, baseline, calibration, compliance point, configuration identification, configuration item, conformity, conformity assessment, conformity assessment body, consensus, design entity, design entity attributes, designating authority, designation, DRE display, DRE-VVPAT, election coding, electronic ballot printer, electronic vote capture system, electronically-assisted ballot marker, ergonomics, e-voting, fled voter, font, HAVA, human computer interaction, human factors, implementation conformance statement, on-site absentee voting, operations procedures, pass/fail criteria, point size, profile, public information package, public key certificate, punchcard voting system, quality assurance plan, quality control, quality manual, race, read ballot, record, records, repeatability, rolloff, second chance voting, secret key, section 508, specification (technical), standard, standard (product), standard (testing), standard on data to be provided, test case specification, test design specification, testing, testing authority, traceability, type font, uncertainty, user documentation, verification and validation, vote capture system, voter registration system, VVPAT, voting environment, voting equipment operational environment, voting equipment operations procedure, voting equipment user documentation, VVPAT ballot box, VVPAT display, VVPAT printer, witness device, and workspace.

 

 

Terms that have been added to the glossary are:

 

configuration status accounting, election, electronic voting system, hash function, internal audit log, NIST, personal assistive device, precinct count voting system, product standard, qualification testing, secure receptacle, security analysis, testing standard, voter verifiable.

 

These terms appear in the glossary, but have been slightly altered from their previous form:

 

alternate format (from alternative formats), central count voting system (from central count), directly verifiable (from directly verified), guidelines (from Guideline), indirectly verifiable (from indirectly verified), overvote (from overvotes), and voter verifiable audit record (from voter verified audit record).

 

Several definitions of pre-existing terms have been clarified or enhanced to better define their usage by EAC.  They are:

 

absentee ballot, Access Board, accessibility, accessible voting station, accreditation, adequate security, audio ballot, audio-tactile interface, audit, audit trail, availability, ballot counter, ballot counting logic, ballot format, ballot image, ballot instructions, ballot measure, ballot position, ballot production, ballot scanner, ballot style, canvass, certification, challenged ballot, checksum, claim of conformance, closed primary, common off the shelf (COTS), component, confidentiality, conformance, conformance testing, contest, cross-filing, cryptography, cumulative voting, decertification, decryption, disability, early voting, election district, election officials, electronic cast vote record, electronic voter interface, encryption, error correcting code, Federal Information Processing Standards (FIPS), firmware, hash, independent testing authority, integrity, multi-seat contest, national certification testing, NVLAP, non-partisan office, nonvolatile memory, open primary, operational environment, optical scan, optiscan system, paper-based voting system, polling place, precinct, privacy, provisional ballot, public network DRE voting system, qualification number, qualification test report, recall issue with options, recertification, referendum, requirement, residual vote, semi-static voting system software, split precinct, state certification, straight party voting, support software, tabulation, touch screen voting machine, undervote, usability, valid vote, validation, vote for N of M, voted ballot, voting equipment, voting machine, voting station, voting system software and write-in voting.

Document assets