Briefing for the EAC Public Meeting Boston, Massachusetts April 26, 2005 Dr. Hratch Semerjian, Acting Director National Institute of Standards and Technology

NIST “Help America Vote Act” Responsibilities Chair Technical Guidelines Development Committee (TGDC) Provide technical support to TGDC in the development of voluntary voting system guidelines including –Security –Methods to detect and prevent fraud –Human factors, including technologies for individuals with disabilities

TGDC/NIST Method of Operation Plenary Sessions –Formal meetings held periodically to develop resolutions, review work products, discuss, and vote –First plenary (July 2004) established 3 subcommittees Security and Transparency, Human Factors and Privacy, Core Requirements and Testing –Public invited to attend and provided access via webcast, transcripts published Subcommittees –Comprised of TGCG members and supported by NIST staff –Gather and analyze information in support of development of voting system guidelines –Conduct bi-weekly teleconferences with occasional face-to-face meetings –Public provided access via Internet, transcripts provided NIST staff –Provide technical expertise and research –Develop work products as directed by TGDC resolutions, with guidance from subcommittee –Work products are submitted to the entire TGDC for approval

Timeline of TGDC/NIST Activities July 2004: First plenary session of TGDC September 2004: TGDC public hearings gathered information on human factors, privacy, computer security, transparency, core requirements and testing of voting systems October 2004: NIST posted voting software “hashes” for use by state and local election officials at National Software Reference Library Web Site: January 2005: Second plenary session of TGDC, 31 resolutions adopted defining NIST technical support tasks February-March 2005: NIST established priority of resolutions, drafted work products for most critical tasks in TGDC resolutions to provide guidance to States in complying with HAVA for the 2006 Election Cycle March, 2005: Third plenary session of TGDC, TGDC provided feedback and endorsement of NIST draft work products April 2005: Fourth plenary session of TGDC, NIST work products approved as the TGDC initial recommendations for voting system guidelines, to be forwarded to the EAC To be determined: Additional plenary sessions, as needed, to review on going work products and approve the second version of voting system guidelines

Developing an Implementation Strategy First goal is to develop the best long-term guideline possible –Building on the strengths of the VSS-2002 –Changing areas that needed improvement –Reorganizing the requirements Second goal is to provide guidance to states in time for the 2006 election cycle –Implies need to minimize changes to VSS-2002 –While also filling in VSS-2002 gaps Thus, two guidelines will be developed –An augmented VSS-2002 – Voluntary Voting System Guidelines (VVSG) Version 1 –A new redesigned voting system guideline – VVSG Version 2

VVSG Version 1 Improves the VSS-2002 by filling in gaps (accessibility, usability, security, and others) Addresses issues facing the States e.g., helping to ensure that installed voting system software is the software that has been tested

New Areas Addressed/Enhanced in VVSG Version 1 Conformance Clause Human Factors Security –Overview –VVPAT –Wireless –Software Distribution and Setup Validation Glossary Error Rates

Conformance Clause VSS-2002 did not contain a conformance clause Conformance is defined as fulfillment by a product, process or service of specified requirements Conformance clause is a high-level description of who shall conform and what is required

Human Factors VSS-2002 –Section addressed accessibility and section addressed human engineering –Appendix C addressed usability –Errata issued in 2 NASED technical guides VVSG contains a new section addressing human factors –Replaces the old sections and –Replaces Appendix C –Incorporates the 2 NASED technical guides

Security Overview VVSG contains a new security section labeled section 6.0 containing: –Overview (informative) –VVPAT (normative) –Wireless (normative) –Software distribution and setup validation (normative) Overview explains the VVSG approach to security Future versions of the VVSG will require independent verification

Voter Verified Paper Audit Trails VVSG does not require or endorse VVPAT VVPAT is one method to achieve independent verification – other methods exist Requirements are provided so that states that choose to implement VVPAT can implement them effectively

Wireless TGDC concluded that wireless technology introduces severe risk and should be approached with extreme caution VVSG includes a section on wireless that augments the general telecommunications standards in Section 5

Software Distribution and Setup Validation VSS-2002 contained requirements to support validation of software and setup of voting systems New section augments the VSS-2002 and also includes use of the NSRL as well as other mechanisms NSRL = National Software Reference Library

Glossary New glossary contains terms from the VSS-2002 as well as new terms needed to understand voting and related areas Each term contains a definition and its source, as well as an association Glossary is also available on-line and allows searches by term, by source (e.g., VSS, HAVA), by association (e.g., testing, security, accessibility) Web site -

Error Rates VSS-2002 Volume II, Appendix C –set certain error rates for voting systems VVSG –modified Appendix C to revise the procedures to test that systems meet the indicated error rates –Applies to errors introduced by the system, defined as a ballot position error rate, and not by a voter’s action Research is needed to develop standards for error rates that account for human error

Organizational Changes in VVSG Version 1 Best Practices for Voting Officials Voting Process Structure of Requirements

Best Practices for Voting Officials VSS-2002 contained requirements for voting systems and testing entities Requirements in VVSG for wireless, VVPAT, human factors, etc. depend on voting officials developing and carrying out appropriate procedures VVSG contains best practices for voting officials These requirements are not testable and conformance can not be determined Best Practices for voting officials are contained in Volume I, Appendix C

Voting Process VSS-2002 defined three major stages of voting –Pre-voting –Voting –Post-voting VVSG Version 1, new sections indicate which stage the requirements pertain to VVSG Version 2 will contain a more detailed voting process model

Structure of Requirements New sections of the VVSG contain a more structured approach Each requirement is numbered according to a hierarchical scheme –Higher level requirements are supported by lower level requirements –Higher level requirements may not be directly testable but can be “indirectly” tested via their lower level requirements

“Grandfathering” Issue When drafting our recommendations, should we be sensitive to the current and planned practices of the various states? Examples: –VVPAT –Good accessibility introduces new requirements Three sub-committee Chairs all agree that the TGDC should develop the best technical guidelines possible The EAC can handle any difficulties that arise during a transition to the new guidelines by issuing appropriate "grandfathering" rules This is not a one-time issue. Technology changes and thus specs change over time –Municipalities may always be out of spec

Summary of TGDC/NIST Activities 31 resolutions adopted at January TGDC Plenary requesting NIST to conduct research and draft standards At March TGDC Meeting, NIST provided 22 separate draft work products that responded to resolutions – NIST instructed to continue development of technical support and related work product consistent with these preliminary reports At April TGDC Meeting, TGDC endorsed NIST work products as the initial recommendations for voluntary voting system guidelines Initial set of recommendations will be called the Voluntary Voting System Guidelines (VVSG) Version 1 –VSSG Version 1 = VSS-2002 augmented with new sections plus corrections VVSG Version 2 Plans –Need formal request from EAC to continue TGDC activities –TGDC subcommittees will continue to meet and gather information –Expect at least two TGDC plenaries to finalize VVSG Version 2