EAC: Public Comment Period for the Proposed Revisions to the 2005 VVSG

[Wilms]

06/01/2009

[phone]

120-Day Public Comment Period for VVSG 1.1 Begins Today

WASHINGTON- The U.S. Election Assistance Commission (EAC) will hold a 120-day public comment period for the Voluntary Voting System Guidelines (VVSG) version 1.1 beginning June 1, 2009. The purpose of the comment period is to provide an opportunity for the public to offer input on proposed revisions to the 2005 VVSG.

The VVSG are a set of federal specifications and requirements that are used to test voting systems for basic functionality, accessibility and security capabilities. EAC certifies voting systems according to this standard and requires testing to determine compliance with it. EAC certification is entirely voluntary – states are not required to use EAC-certified voting systems and voting system manufacturers are not required to obtain federal certification.

Why the revision is needed
The guidelines are being revised to improve the quality and efficiency of testing performed under the EAC testing and certification program by including new software development and testing protocols and practices. This includes the development of uniform test suites by the National Institute of Standards and Technology (NIST). This revision will also clarify several ambiguities in the standard, providing test labs and voting system manufacturers with a clearer sense of performance and test requirements for EAC certification.

The revision process
In partnership with NIST, EAC routinely examines the VVSG to make sure they reflect the best and most recent software development and testing standards and protocols. This involves informal observation and information gathering as well as formal requests for input from a broad group of stakeholders, including computer scientists, usability and accessibility experts, election officials, voter advocates, voting machine vendors and federally accredited test labs.

The proposed revisions are largely informed by the EAC Technical Guidelines Development Committee, which issued recommendations for the next iteration of the VVSG, and the thousands of public comments on the recommendations that the EAC solicited. The EAC also held seven roundtable discussions with groups of stakeholders to gather additional information on the recommendations.

By revising the guidelines now, the EAC expects to improve the test process over the short term while allowing additional time to develop more complex revisions to be included in the second complete iteration of the guidelines, the VVSG version 2.0.

Areas to be revised
The EAC and NIST selected the revisions based on their ability to yield immediate and marked improvements to the test process and be implemented with relative ease. Moreover, the revisions do not require any hardware changes or significant software changes, and can be adopted without extended research.

The revisions replace outdated practices with modern, proven methods that improve the development, analysis and testing of voting system logic. For example, by adding block structured exception handling to the list of acceptable control constructs, vendors will be able to use modern error handling techniques to better guard against undetected errors and improve system robustness.

The proposed revisions are limited to usability and accessibility, security, and core areas such as software workmanship. Following is a complete list of areas to be revised:

1) Hardware and software performance benchmarks and test method
2) Software workmanship
3) Test plan and test report
4) TDP and voting equipment user documentation
5) Non-EMC environmental hardware
6) Human factors requirements
7) System security documentation requirements
8) Election records
9) Voter verified paper audit trails (VVPAT)
10) Cryptography
11) External interface requirement
12) EAC requests for interpretation (RFI) decisions
13) General edits

A draft of the proposed revisions along with frequently asked questions about the process are posted on the EAC Web site.

Timeline for adopting the revisions
At the conclusion of the 120-day public comment period, the EAC and NIST will review the comments received on the proposed revisions, and will issue the revised guidelines, VVSG version 1.1, in late 2009.

Methods for submitting comments
Comments may be e-mailed to [e-mail] or mailed to Voluntary Voting System Guidelines Comments, U.S. Election Assistance Commission, 1225 New York Avenue, NW, Suite 1100, Washington, DC 20005. In addition, an online comment tool will be available this summer at www.eac.gov. They are posted on the EAC Web site.

http://www.eac.gov/News/press/120-day-public-comment-period-for-vvsg-1-1-begins-today/base_view

Proposed Draft Revisions to 2005 Voluntary Voting System Guidelines (VVSG v.1.1)

http://www.eac.gov/program-areas/voting-systems/docs/vvsg-version-1-1-volume-1-20090527.pdf/attachment_download/file

http://www.eac.gov/program-areas/voting-systems/docs/vvsg-version-1-1-volume-2-20090527.pdf/attachment_download/file


For a summary of changes and instructions for submitting comments, see the

* Public Notice of Proposed Updates and Revisions and Request for Public Comments

http://www.eac.gov/program-areas/voting-systems/docs/vvsg-v-1-1-fed-register-notice-final-signat.pdf/attachment_download/file


See also:

http://vote.nist.gov/VVSG-Version1-1.htm

[WillYourVoteBCounted]

1. any systems pending certification? if so, will they have to make changes?

Will this delay certification for the Piece-O-Crap Sequoia Insight machines, or the
ES&S DS200 optical scanner?

I hope so.

Let it take another 1-2 years.

[Wilms]

2. My guess is it may do the opposite.

Seems it's just streamlining the process to make certifying go faster, and it's buying more time before the next revision.

Does it matter? Even if the equipment works flawlessly under test, what's to say that it won't get hacked afterward?

We should have certified machines, evolving standards, L&A testing, and security through all of it. But you still have to do, at minimum, a hand counted risked based statistical audit to know the outcome is correct.

[WillYourVoteBCounted]

3. the problem is if it speeds up the process, more junk hits the streets soon

Sequoia's uncertified junk is already in San Francisco, Pierce County Washington and New York.
Once this crap is certified, it will have more "legitimacy" and be harder to repel.

Same with the ES&S DS200.

[Bill Bored]

4. Translation: No paper ballots; no software independence.

Or EAC to NIST: Drop Dead!

For those who are not familiar with all this crap:

In 2006 NIST experts told the EAC that voting systems should be software-independent, meaning in effect, that they had to have VVPBs or at least VVPATs. Of course, this means someone has to COUNT some or all of those pieces of paper to find out who REALLY won the elections. No one wants to be bothered with that vote-counting stuff, least of all election officials, so the EAC has been trying weasel out of the NIST recommendation ever since.

The 2007 version of the standards, which did in fact require software-independence and a number of other improvements, were never approved. So now the EAC wants to approve a watered down version based on the existing 2005 standards, which suck to a large extent.

I would suggest that public comments should urge the EAC to require voting systems to be software-independent, which for the foreseeable future means paper ballots or lever machines. Of course they aren't concerned with writing standards for lever machines, or for hand counts -- only for computers. But it's worth telling them that we are on to their scam and that we will not accept election results determined only by software, because it's inherently unreliable, non-transparent, undemocratic, or however you'd like to say that.

Of course, you should try to be respectful because these are public comments, will actually be published somewhere, and we don't want to come off like wackos. Just stick to the facts. Cite this NIST paper http://vote.nist.gov/DraftWhitePaperOnSIinVVSG2007-20061120.pdf
about software independence, and tell them to pass the original 2007 standards and stop trying to evade the issue.

[WillYourVoteBCounted]

5. it would be really really cool if someone would blog this and add

a suggested letter. I bet we could get a few people to follow through.