Applies To: EMS

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.3.2.a

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.3.1.1.1.b

Applies To: EMS

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.2.6.a and I.2.3.2.b

Applies To: EMS

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.2.6.a

Applies To: EMS

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.2.6.b, I.2.2.8.2, I.2.3.2.d

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Implicit in [VSS2002]

Test Reference: Part 3: 5.2 “Functional Testing”

Source: New requirement / clarification of [VSS2002] intent

Test Reference:Part 3: 5.2 “Functional Testing”

Source: Implicit in [VSS2002]

Applies To: EMS Λ Primary elections device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Added precision, based on [VSS2002] I.2.2.8.2 and glossary

Applies To: EMS Λ Write-ins device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.4.3.1.d

Applies To: EMS Λ Straight party voting device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Added precision, based on [VSS2002] I.2.2.8.2 and glossary

Applies To: EMS Λ Cross-party endorsement device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Clarification or extension of existing requirements

Applies To: EMS Λ Split precincts device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Added precision, based on [VSS2002] I.2.2.8.2 and glossary

Applies To: EMS Λ N-of-M voting device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Added precision, based on [VSS2002] I.2.2.8.2, I.2.3.2.a and glossary

Applies To: EMS Λ Cumulative voting device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Added precision, based on [VSS2002] I.2.2.8.2, I.2.3.2.a and glossary

Applies To: EMS Λ Ranked order voting device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Added precision, based on [VSS2002] I.2.2.8.2 and glossary

Applies To: EMS

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.2.2.1.a / [VVSG2005] I.2.1.2.a

Applies To: EMS

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Reworded from [VSS2002] I.2.2.2.1.b / [VVSG2005] I.2.1.2.b

Applies To: EMS

Test Reference: Part 3: 4.3 “Verification of Design Requirements”

DISCUSSION

"Persistent storage" includes nonvolatile memory, hard disks, optical disks, etc.

Source: [VSS2002] I.3.2.3.1.c and e ([VVSG2005] I.4.1.3.1.c and e), expanded to include persistent storage

Applies To: EMS

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Reworded from [VSS2002] I.2.3.2.e

Applies To: EMS

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.2.6.c

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.3.1.1.1.a

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Extrapolated from relevant requirements in [VSS2002]

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

In systems supporting primary elections, this would include the exclusion of party-specific contests that are not votable by the selected political party.

Source: [VSS2002] I.2.3.2.c

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.3.1.2.c

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Reworded from [VSS2002] I.3.2.3.1.d

Applies To: EMS Λ Primary elections device

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

In paper-based systems, open primaries have sometimes been handled by printing a single ballot style that merges the contests from all parties, instructing the voter to vote only in the contests applicable to a single party, and rejecting or discarding votes that violate this instruction. To satisfy the requirements for primary elections device, the EMS must be capable of associating different ballot configurations with different political parties.

Source: Reworded from [VSS2002] I.2.3.1.1.1.d

Applies To: EMS Λ Ballot rotation device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Added precision, based on [VSS2002] I.2.2.8.2 and glossary

Applies To: EMS Λ Split precincts device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Added precision, based on [VSS2002] I.2.2.8.2 and glossary

Applies To: EMS

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Reworded from [VSS2002] I.2.2.6.d

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

In paper-based systems, identifying marks would appear on the actual ballots. DREs would make internal use of unique identifiers for ballot styles but would not necessarily present these where the voter would see them.

When different precincts share a common ballot style in a paper-based system, typically it is assumed that the ballots from the two precincts will be kept physically separate, tabulated separately, and attributed to the correct precinct at the time of reporting—even in combined precincts where this imposes procedural overhead.

Source: [VSS2002] I.2.3.1.1.1.e

Applies To: EMS

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.3.1.2.e and g

Applies To: EMS

Test Reference: Part 3: 4.5.2 “Security”, 5.4 “Open-Ended Vulnerability Testing”

Source: [VSS2002] I.2.3.1.2.f

Applies To: Voting system

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.3.4.1, I.2.3.5.a2 and b2 (the second a and b, respectively), I.4.4.2.a

Applies To: Programmed device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.2.4.1.j, I.2.2.8.1.a

Applies To: EMS

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.2.6.f, I.4.4.2.c

Applies To: Programmed device

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

Examples of detectable errors include use of software or data intended for a different type of device and operational failures in transferring the software or data.

Source: [VSS2002] I.2.3.3.b, I.4.4.2.c

Applies To: Programmed device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.3.3.c, I.4.4.2.c

Applies To: Programmed device Λ Tabulator

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.4.3.3.s, generalized from DREs; I.4.4.2.d and f

Applies To: Paper-based device Λ Tabulator

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.3.4.2.a, I.4.4.2.f

Applies To: Paper-based device Λ Tabulator

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Interpretation of [VSS2002] I.2.3.4.2.b

Applies To: Vote-capture device Λ Paper-based device

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

In the case of manually-marked paper ballots this requirement is mostly moot. (Sharpen the pencils.)

Source: [VSS2002] I.2.4.1.2.1.a

Applies To: Voting device

Test Reference: Part 3: 4.3 “Verification of Design Requirements”, 5.2 “Functional Testing”

DISCUSSION

Status changes required to satisfy Requirement Part 1: 7.4-A and Requirement Part 1: 7.4-B.

Source: [VSS2002] I.2.3.4.1.b2 (the second b), significantly revised

Applies To: Programmed device Λ Tabulator

Test Reference: Part 3: 4.3 “Verification of Design Requirements”, 5.2 “Functional Testing”

DISCUSSION

Test data must never be reflected in official vote counts for specific contest choices.

Source: [VSS2002] I.2.4.3.3.t / [VVSG2005] I.2.3.3.3.v, generalized from DREs; I.4.4.2.e / [VVSG2005] I.5.4.2.e

Applies To: Programmed device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.4.1.1.a

Applies To: Programmed device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.4.1.1.b

Applies To: Paper-based device Λ Tabulator

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.4.1.2.2.a

Applies To: Paper-based device Λ Tabulator

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.4.1.2.2.b

Applies To: Vote-capture device Λ Programmed device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.4.1.3, generalized

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.4.1.3.a

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.4.1.3.b

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.4.1.3.c

Applies To: DRE, EBP

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

All DREs and EBPs, in addition to ballot activators, must support ballot activation, as defined in the following subrequirements.

Source: [VSS2002] I.2.4

Applies To: DRE, EBP

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

A DRE or EBP could be configured, pre-election, to function exclusively as an activation device. During elections, a DRE or EBP cannot be used as both an activation device and a vote-capture device.

Source: New requirement but existing practice

Applies To: Activation device, DRE, EBP

Test Reference: Part 3: 4.5 “Source Code Review”, 5.2 “Functional Testing”

DISCUSSION

A voting session on an EBP may culminate with the printing of the ballot. Activation devices, DREs, and EBPs must prevent re-use of the credentials, e.g., by erasing a memory token used to carry ballot activation information.

Source: [VSS2002] I.2.4.2.d, rewritten to respect the limits of what the system can do

Applies To: Activation device

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

The voting system must create a record at the time when credentials are issued to voters so that the collection of records can be compared to the number of ballots voted. This may be done if the activation device prints a record, or by using a paper pollbook.

Source: New requirement

Applies To: Activation device, DRE, EBP

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

For an electronic display, poll workers control the ballot configuration using an activation device and issuing credentials. See also Requirement Part 1: 7.2-A.2, Requirement Part 1: 7.2-A.3.

Source: [VSS2002] I.2.4.2.a

Applies To: DRE, EBP

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

In paper-based systems, open primaries have sometimes been handled by printing a single ballot style that merges the contests from all parties, instructing the voter to vote only in the contests applicable to a single party, and rejecting or discarding votes that violate this instruction. To use that approach on a DRE or EBP would violate this requirement.

Source: [VSS2002] I.2.4.2.g., [VSS2002] I.2.4.2.h

Applies To: DRE Λ Primary elections device, EBP Λ Primary elections device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.4.2.f

Applies To: Activation device, DRE, EBP

Test Reference: Part 3: 4.5 “Source Code Review”, 5.2 “Functional Testing”, 5.4 “Open-Ended Vulnerability Testing”

DISCUSSION

Secrecy of the ballot must be preserved during all operations associated with activation of the ballot, including during the creation of the ballot activation credential and information, during the process of activating the ballot, and in all keeping of associated records, reports, and logs. It must not be possible to identify a voter’s ballot or in some way violate secrecy of the ballot by aggregating records from different devices.

For example, an epollbook cannot retain and associate any information written to a ballot activation token with the voter’s identification information, and a vote-capture device cannot retain information from the token and associate it with the CVR – or else it would be possible to link the sets of records and identify the voter.

Note that Requirement Part 1: 7.5.1.2-A.3 modifies this requirement if the activation device is used with provisional voting on a DRE.

Source: New requirement

Applies To: DRE Λ Open primaries device, EBP Λ Open primaries device

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

In an open primary, the voter may be able to choose a party affiliation at the start of the voting session, therefore more than one ballot configuration may be available to the voter. The voter should be able to select the ballot configuration corresponding to the voter's chosen party affiliation in privacy.

Source: New requirement

Applies To: Activation device, DRE, EBP

Test Reference: Part 3: 5.2 “Functional Testing”, 5.4 “Open-Ended Vulnerability Testing”

DISCUSSION

The activation device must not create or retain any information that could be used for the purposes of identifying a voter’s ballot, or the time at which the voter arrived at the polls, or the specific vote-capture device used by the voter.

Source: New requirement

Applies To: Activation device, DRE, EBP

Test Reference: Part 3: 5.2 “Functional Testing”, 5.4 “Open-Ended Vulnerability Testing”

DISCUSSION

For provisional voting, the voter’s identity is associated with the voter’s ballot so as to permit a subsequent decision whether to count the ballot. As an example, the activation device may create an identifier and associate it with the provisional voter’s identity, and then include this identifier with other information necessary to activate the ballot. The vote-capture device may store this identifier with the ballot so as to trace the ballot back to the voter’s identity for the purposes of deciding whether the count the ballot. The identifier must not itself identify the voter. For example, it must not include the voter’s identity or other information associated with the voter such as an SSN or other identifying information.

Source: New requirement

Applies To: Voting device

Test Reference: Part 3: 5.2 “Functional Testing”, 5.4 “Open-Ended Vulnerability Testing”

DISCUSSION

The credentials and associated token are to be used only for ballot activation and not for other purposes. For example, the token or credentials cannot be used to convey additional information to the vote-capture device or other devices, or to convey information from the vote-capture device to other devices in the case of re-usable tokens.

Source: New requirement

Applies To: Activation device

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

The token should be limited to containing only the necessary information and nothing more – on memory card, possibly several bytes or less. This requirement addresses the threat of the token being used to pass other information to and from the vote-capture device, which should be considered especially if the activation device is connected to an external network (to connect to a registration database).

Source: New requirement

Applies To: DRE, EBP

Test Reference: Part 3: 4.5 “Source Code Review”, 5.2 “Functional Testing”

DISCUSSION

The token and credentials are considered as authorization to cast a ballot and therefore must be de-activated after that ballot has been cast (and not before). It may be useful for the token to carry state information, such as:

1. Inactive - ready to be used in an activation device;
2. Active - loaded with credentials and able to activate the ballot;
3. In use - has been used to activate the ballot but the ballot has not yet been cast;
4. Closed successfully - has been used to activate the ballot and the ballot has been cast successfully; and
5. Closed unsuccessfully - has been used to activate the ballot but the ballot was not successfully cast for some reason.

Source: New requirement

Applies To: Activation device

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

The token should be one-way in that it is used only once to activate the ballot and cannot be recycled and used again by an activation device to activate a subsequent ballot. This eliminates the threat of passing other information from the vote-capture device back to the activation device, which should be considered especially if the activation device is connected to an external network (to connect to a registration database).

Source: New requirement

Applies To: Activation device, DRE, EBP

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

The vote-capture device must verify the integrity of the credentials and their validity for the election, but also must verify whether they were created from a trusted activation device and for use on the vote-capture device. This means essentially that some trust relationship must exist between the vote-capture device and the ballot activator. One approach for implementing this cryptographically is for each ballot activator to calculate, for each credential issued, a keyed-hash message authentication code, or HMAC, on the credentials, and for the vote-capture device to verify the HMAC. If cryptography is used, key sizes are determined by cryptography requirements in Part 1: 5.1 “Cryptography”.

Source: New requirement

Applies To: Activation device ^ Electronic device

Test Reference: Part 3: 5.2 “Functional Testing”, 5.4 “Open-Ended Vulnerability Testing”

DISCUSSION

External is used here to mean ”a public or private network extending beyond the voting site.” An activation device may include the capability to access an external network for the purposes of accessing voter identification information in a remote voter registration database. Note that this is the only remote access permitted; network access cannot be used for other purposes such as for accessing web sites, email, etc. See also related requirements in Part 1: 5.5 “System Integrity Management” and 5.6 “Communication Security” pertaining to secure system and network configurations for the ballot activation device.

Source: New requirement

Applies To: Activation device ^ Electronic device

Test Reference: Part 3: 5.2 “Functional Testing”, 5.4 “Open-Ended Vulnerability Testing”

Source: New requirement

Applies To: Activation device ^ Electronic device

Test Reference: Part 3: 5.2 “Functional Testing”, 5.4 “Open-Ended Vulnerability Testing”

DISCUSSION

An election official must have the ability to enable or disable the remote access capability, i.e., its network interface and associated logic.

Source: New requirement

Applies To: Activation device ^ Electronic device

Test Reference: Part 3: 5.2 “Functional Testing”, 5.4 “Open-Ended Vulnerability Testing”

DISCUSSION

The notification must be continuous and obvious to the poll worker.

Source: New requirement

Applies To: Voting system

Test Reference: Part 3: 5.2 “Functional Testing”, 5.4 “Open-Ended Vulnerability Testing”

DISCUSSION

If the remote database is unavailable, the voting system must include some backup capability so that it may continue to activate ballots, e.g., a cached local copy of the voter registration database or a paper pollbook.

Source: New requirement

Applies To: Activation device ^ Electronic device

Test Reference: Part 3: 5.2 “Functional Testing”, 5.4 “Open-Ended Vulnerability Testing”

DISCUSSION

This requirement prohibits the activation device from connecting directly to the external network and possibly using a wireless connection. The device must connect to a router over a wire (e.g., Ethernet). The router must have firewall capability and be configured to block or filter unneeded services and protocols. See [NIST02] for suggested firewall configuration information.

Source: New requirement

Applies To: Activation device ^ Electronic device

Test Reference: Part 3: 4.5 “Source Code Review” and 5.2 “Functional Testing”, 5.4 “Open-Ended Vulnerability Testing”

DISCUSSION

The source code review must consider that the activation device may be accessed via an external network. Certain aspects of the software may be significantly more vulnerable to attack than if there were no external network connectivity. The test lab must review the source code of activation device software and inspect COTS configuration data to search for vulnerabilities that might be exploitable through the external network.

Source: New requirement

Applies To: Vote-capture device

Test Reference: Part 3: 4.3 “Verification of Design Requirements”, 5.2 “Functional Testing”

Source: Clarification of [VSS2002] I.2.3.1.3.1.b

Applies To: Vote-capture device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.4.3.1.c

Applies To: Vote-capture device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Extrapolated from [VSS2002] I.2.2.8.2 and I.2.4

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.4. Extended [VSS2002] I.2.4.2.e to all systems

Test Reference: Part 3: 5.2 “Functional Testing”

Source: New requirement / clarification of [VSS2002] intent

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Added precision

Applies To: Vote-capture device Λ Closed primaries device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Added precision, based on [VSS2002] I.2.2.8.2 and glossary

Applies To: Vote-capture device Λ Open primaries device

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

In paper-based systems, open primaries have sometimes been handled by printing a single ballot style that merges the contests from all parties, instructing the voter to vote only in the contests applicable to a single party, and rejecting or discarding votes that violate this instruction. To satisfy the requirements for open primaries device, the vote-capture device must be capable of handling the case where different ballot configurations are associated with different political parties.

Source: Added precision, based on [VSS2002] I.2.2.8.2 and glossary

Applies To: Vote-capture device Λ Write-ins device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.4.3.1.d

Applies To: Vote-capture device Λ Write-ins device

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

Reconciliation of aliases means allowing central election officials to declare two different spellings of a candidate's name to be equivalent (or not). Reconciliation of double votes means handling the case where, in an N-of-M contest, a voter has attempted to cast multiple votes for the same candidate using the write-in mechanism. See Part 1: 7.7.2.4 “Logic for reconciling write-in double votes” for details.

Source: Added precision based on clarification of write-in reconciliation process

Applies To: Vote-capture device Λ Ballot rotation device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Added precision, based on [VSS2002] I.2.2.8.2 and glossary

Applies To: Vote-capture device Λ Programmed device Λ Ballot rotation device

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

This is less restrictive than requiring sequential rotation. For a contest of M contest choices, the order may be shuffled randomly after each batch of M ballots and rotated sequentially within each batch.

Source: Clarification or extension of existing requirements

Applies To: Vote-capture device Λ Straight party voting device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Added precision, based on [VSS2002] I.2.2.8.2 and glossary

Applies To: Vote-capture device Λ Cross-party endorsement device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Clarification or extension of existing requirements

Applies To: Vote-capture device Λ Split precincts device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Added precision, based on [VSS2002] I.2.2.8.2 and glossary

Applies To: Vote-capture device Λ N-of-M voting device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Added precision, based on [VSS2002] I.2.2.8.2 and glossary

Applies To: Vote-capture device Λ Cumulative voting device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Added precision, based on [VSS2002] I.2.2.8.2 and glossary

Applies To: Vote-capture device Λ Ranked order voting device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Added precision, based on [VSS2002] I.2.2.8.2 and glossary

Applies To: Vote-capture device Λ Provisional-challenged ballots device

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

Unique identification of each provisional/challenged ballot is required. See Requirement Part 1: 7.7.2-A.5.

Source: Added precision, based on [VSS2002] I.2.2.8.2 and glossary

Applies To: DRE Λ Provisional-challenged ballots device

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

Categories (e.g., "regular provisional," "extended hours provisional," "regular extended hours") would be jurisdiction-dependent.

Source: [P1583] 5.6.5.2.s.2^[5]

Applies To: Vote-capture device Λ Review-required ballots device

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

In some systems and jurisdictions, all ballots containing write-in votes require flagging or separation for review. Support for the class indicates that the system can flag or separate ballots in this manner and include the results of the review in the reported totals (see Part 1: 2.5.3.1 “Supported voting variations (system-level)”). Other reasons for which ballots are flagged or separated are jurisdiction-dependent. It is assumed that ballot presentation is unchanged for Review-required ballots.

Source: Extrapolated from [VSS2002] I.2.5.2

Applies To: Vote-capture device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.2.2.1.c / [VVSG2005] I.2.1.2.c

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Added precision

Applies To: DRE

Test Reference: Part 3: 4.3 “Verification of Design Requirements”, 4.5 “Source Code Review”

DISCUSSION

"Persistent storage" includes nonvolatile memory, hard disks, optical disks, etc.

Source: [VSS2002] I.3.2.4.3.3.c, expanded to include persistent storage

Applies To: Voting system

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

This does not entail retaining a ballot image. DREs are required to retain ballot images (see Part 1: 4.3 “Electronic Records”) but other devices might not.

Source: [VSS2002] I.2.4. Extended [VSS2002] I.2.4.2.e to all systems

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

See also Requirement Part 1:7.5.7.

Source: [VSS2002] I.2.4.2.b, generalized to all systems

Applies To: Paper-based device Λ Vote-capture device

Test Reference: Part 3: 4.2 “Physical Configuration Audit”

Source: [VSS2002] I.2.4.1.2.1.c

Applies To: DRE

Test Reference: Part 3: 4.5.2 “Security”, 5.4 “Open-Ended Vulnerability Testing”

DISCUSSION

See also Part 1: Section 7.5.7, cast ballot.

Source: [VSS2002] I.2.4.3.3.n

Applies To: DRE

Test Reference: Part 3: 4.3 “Verification of Design Requirements”

DISCUSSION

Besides data stored in electronic memory, a paper record with barcodes or EBM-style markings or a paper record printed in a machine-readable font would qualify as machine-countable.

Source: [VSS2002] I.2.2.2.2, I.2.2.4.2 and I.3.2.4.3.2.c

Test Reference: Part 3: 4.3 “Verification of Design Requirements”

DISCUSSION

For improved auditability, it is preferable for the processes and paths used to record separate records to themselves to be as separate as possible, so that the opportunities for a single error to corrupt multiple records in the same way are minimized.

Source: [VSS2002] I.2.2.4.2 and I.3.2.4.3.2.c

Applies To: Tabulator

Test Reference: Part 3: 4.5 “Source Code Review”, 5.2 “Functional Testing”

DISCUSSION

Assuming that the counter size is large enough such that the value will never be reached is not adequate. Systems are required to detect and prevent an impending overflow condition.

Source: Clarification of [VSS2002] II.5.4.2.g

Applies To: DRE

Test Reference: Part 3: 4.3 “Verification of Design Requirements”, 4.5 “Source Code Review”, 5.2 “Functional Testing”, Requirement Part 3: 4.6-B

DISCUSSION

A DRE must not initiate a voting session if there is the possibility that the next ballot could not be properly cast and recorded. If there exists a way of voting the ballot that would exceed one of the limits, then the ballot must not be activated.

Source: Clarification of [VSS2002] II.5.4.2.g

Applies To: DRE

Test Reference: Part 3: 4.5.2 “Security”, 5.4 “Open-Ended Vulnerability Testing”

DISCUSSION

This does not apply to paper-based devices because the ballot is subject to handling beyond their control; however, a locked ballot box (per Requirement Part 1: 7.5.4-C.2 and Requirement Part 1: 6.1-F) serves the same purpose. See also Requirement Part 1: 7.7.1-A.

Source: [VSS2002] I.2.4.3.3.r

Applies To: Vote-capture device Λ Programmed device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Reworded from [VSS2002] I.2.5

Test Reference: Part 3: 4.5.2 “Security”, 5.4 “Open-Ended Vulnerability Testing”

DISCUSSION

An EBM cannot prevent a voter from marking a paper ballot with a writing utensil after polls have closed. This must be prevented through procedures.

Source: Reworded from [VSS2002] I.2.5.1.a

Applies To: DRE

Test Reference: Part 3: 4.5.2 “Security”, 5.4 “Open-Ended Vulnerability Testing”

Source: Reworded from [VSS2002] I.2.5.1.a

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Reworded from [VSS2002] I.2.5.1.b

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Reworded from [VSS2002] I.2.5.1.d

Test Reference: Part 3: 4.5.2 “Security”, 5.4 “Open-Ended Vulnerability Testing”

Source: Revised from [VSS2002] I.2.5.1.e; made consistent with [GPO90] 2.2.3.1

Applies To: Precinct tabulator Λ EMS

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Reworded from [VSS2002] I.2.5

Applies To: Voting system

Test Reference: Requirement Part 3: 5.2.3-F.1

DISCUSSION

For example, if the ballot styles loaded on a tabulator disagree with the ballot styles that were used by vote-capture devices, the system must raise an alarm and prevent the incorrect ballot styles from being used during tabulation. Otherwise, votes could be ascribed to the wrong contest choices.

Such a mismatch should have been detected and prevented in L&A testing (see Requirement Part 1: 7.3.1-C, Requirement Part 1: 7.3.1-D and Requirement Part 1: 7.3.1-E), but if it was not, it must be detected and prevented before tabulation commences.

Source: Amplification of existing requirements

Applies To: Paper-based device Λ Tabulator

Test Reference: Requirement Part 3: 5.2.3-F.1

Source: New requirement

Applies To: Tabulator

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.2.8.1 plus I.2.2.8.2

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Implicit in [VSS2002]

Test Reference: Part 3: 5.2 “Functional Testing”

Source: New requirement / clarification of [VSS2002] intent

Applies To: Tabulator Λ Absentee voting device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Added precision, based on [VSS2002] I.2.2.8.1, I.2.2.8.2 and glossary

Applies To: Tabulator Λ Provisional-challenged ballots device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Added precision, based on [VSS2002] I.2.2.8.1, I.2.2.8.2 and glossary

Applies To: Tabulator Λ Provisional-challenged ballots device

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

This is meant to rule out the mode of failure in which the IDs assigned to provisional ballots fail to be unique, rendering the system incapable of accepting one without also accepting the others with the same ID.

Source: Added precision, based on [VSS2002] I.2.2.8.1, I.2.2.8.2 and glossary

Applies To: Tabulator Λ Provisional-challenged ballots device

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

For "category," see Requirement Part 1: 7.5.3-A.17. The behavior when an individual acceptance/rejection conflicts with a categorical acceptance/rejection is system-dependent and should be documented by the manufacturer.

Source: [P1583] 5.6.5.2.s.3^[5]

Applies To: Tabulator Λ Primary elections device

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

In paper-based systems, open primaries have sometimes been handled by printing a single ballot style that merges the contests from all parties and instructing the voter to vote only in the contests applicable to a single party. This approach requires additional logic in the tabulator to support the rejection or discarding of votes that violate these special instructions, while the approach of assigning different ballot configurations to different parties does not. Support for the merged ballot approach is not required for a tabulator to satisfy the requirements for primary elections device. See Part 1: 7.7.2.1 “Merged ballot approach to open primaries”.

This requirement to separate by party applies only to the number of read ballots and counted ballots. It does not apply to contest choice vote totals.

Source: Added precision, based on [VSS2002] reporting requirements

Applies To: Tabulator Λ Write-ins device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Added precision, based on [VSS2002] I.2.2.8.1, I.2.2.8.2 and glossary

Applies To: Tabulator Λ Write-ins device

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

Reconciliation of aliases means allowing central election officials to declare two different spellings of a candidate's name to be equivalent (or not). Reconciliation of double votes means handling the case where, in an N-of-M contest, a voter has attempted to cast multiple votes for the same candidate using the write-in mechanism. See Part 1: 7.7.2.4 “Logic for reconciling write-in double votes” for details.

Source: Added precision based on clarification of write-in reconciliation process

Applies To: Tabulator Λ Ballot rotation device

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

This simply means that ballot rotation must not impact the correctness of the count. A mode of failure would be getting confused about the mapping from ballot positions to contest choices.

Source: Added precision, based on [VSS2002] I.2.2.8.1, I.2.2.8.2 and glossary

Applies To: Tabulator Λ Straight party voting device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Added precision, based on [VSS2002] I.2.2.8.1, I.2.2.8.2 and glossary

Applies To: Tabulator Λ Straight party voting device

Test Reference: Part 3: 4.6 “Logic Verification”, 5.2 “Functional Testing”

DISCUSSION

This requirement intentionally says nothing about what happens when there is both a straight party endorsed contest choice and an explicit vote in a given contest (a straight party override). See Part 1: 7.7.2.3 “Logic for counting straight party overrides”.

Source: Added precision, based on [VSS2002] I.2.2.8.1, I.2.2.8.2 and glossary

Applies To: Tabulator Λ Cross-party endorsement device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Added precision, based on [VSS2002] I.2.2.8.1, I.2.2.8.2 and glossary

Applies To: Tabulator Λ Split precincts device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Added precision, based on [VSS2002] I.2.2.8.1, I.2.2.8.2 and glossary

Applies To: Tabulator Λ N-of-M voting device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Added precision, based on [VSS2002] I.2.2.8.1, I.2.2.8.2 and glossary

Applies To: Tabulator Λ Cumulative voting device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: Added precision, based on [VSS2002] I.2.2.8.1, I.2.2.8.2 and glossary

Applies To: Tabulator Λ Ranked order voting device

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

This requirement is minimal. Since ranked order voting is not currently in wide use, it is not clear what, other than the final result, must be computed. See Part 1: 7.7.2.5 “Logic for ranked order voting”.

Source: [VSS2002] I.2.2.8.1 plus I.2.2.8.2

Applies To: Central tabulator Λ Paper-based device

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.3.2.5.1.2

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.3.2.5.1.2

Applies To: Central tabulator Λ Paper-based device Λ Review-required ballots device

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

The requirement to separate ballots containing write-in votes is not applicable in systems in which an EBM encodes write-in votes in machine-readable form and an optical scanner generates individual tallies for all written-in candidates automatically. Separation of ballots containing write-in votes is only necessary in systems that require the allocation of write-in votes to specific candidates to be performed manually. Such systems do not conform to the write-ins class. See Part 1: 2.5.3.1 “Supported voting variations (system-level)”.

Source: [VSS2002] I.3.2.5.1.2

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.3.2.5.1.2

Applies To: Precinct tabulator Λ Paper-based device Λ Review-required ballots device

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

The requirement to separate ballots containing write-in votes is not applicable in systems in which an EBM encodes write-in votes in machine-readable form and an optical scanner generates individual tallies for all written-in candidates automatically. Separation of ballots containing write-in votes is only necessary in systems that require the allocation of write-in votes to specific candidates to be performed manually. Such systems do not conform to the write-ins class. See Part 1: 2.5.3.1 “Supported voting variations (system-level)”.

Source: [VSS2002] I.3.2.5.1.3.b

Applies To: ECOS

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

If an EMPB appears to contain marginal marks or overvotes, either the EBM is broken or the scanner is broken. Either way, an election official should be notified immediately. (It is possible that the voter simply disregarded instructions and marked the ballot manually.)

Source: New requirement

Applies To: Paper-based device Λ Tabulator

Test Reference: Part 3: 4.3 “Verification of Design Requirements”, 5.2 “Functional Testing”

DISCUSSION

See also Requirement Part 1: 7.7.4-B and Part 1 Section 7.7.7.

Source: [VSS2002] I.3.2.5.1.4.a, expanded to include jamming and ballots that were read

Applies To: Paper-based device Λ Tabulator

Test Reference: Part 3: 4.3 “Verification of Design Requirements”, 5.2 “Functional Testing”

DISCUSSION

A similar issue arises with DREs that hang just as the voter presses the "cast ballot" button. See Requirement Part 1: 3.2.2.1-F. See also Requirement Part 1: 7.7.4-A and Part 1: 7.7.7 “Procedures required for correct system functioning”.

Source: [MS05] 14.2.5.3 (page 46)

Applies To: Optical scanner

Test Reference: Part 3: 5.3.3 “Reliability”

DISCUSSION

"Unmarked" in this requirement means containing no marks of any kind other than those designed to be present as part of the ballot style. This includes extraneous perforations, smudges, folds, and blemishes in the ballot stock. See Requirement Part 1: 7.7.5-E, Requirement Part 1: 7.7.5-F and Requirement Part 1: 7.7.5-G.

Source: [VSS2002] I.3.2.5.2, "Recognize vote punches or marks, or the absence thereof"

Applies To: ECOS

Test Reference: Part 3: 5.3.3 “Reliability”

DISCUSSION

Reading of marginal marks should be a non-issue if EBMs are used.

Source: Narrowed from [VSS2002] I.3.2.5.2.a and I.3.2.6.1.1

Applies To: MCOS

Test Reference: Part 3: 5.3.3 “Reliability”

Source: [VSS2002] I.3.2.5.2.a and I.3.2.6.1.1

Applies To: MCOS

Test Reference: Part 3: 5.3.3 “Reliability”

DISCUSSION

Different optical scanning technologies will register imperfect marks in different ways. Variables include the size, shape, orientation, and darkness of the mark; the location of the mark within the voting target; the wavelength of light used by the scanner; the size and shape of the scanner's aperture; the color of the ink; the sensed background-white and maximum-dark levels; and of course the calibration of the scanner. The mark specified in this requirement is intended to be less than 100 % perfect, but reliably detectable, i.e., not so marginal as to bring the uncontrolled variables to the forefront. In plain language: scanning technologies may vary, but as a minimum requirement, all of them should be capable of reliably reading this mark.

Source: Many issues and public comments. Specification of mark originated with recommendation in Issue #1322, changed to reduce ambiguity.

Applies To: Paper-based device Λ Tabulator

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

In previous iterations of these VVSG it was unclear whether "extraneous perforations, smudges, and folds" included perforations, smudges and folds appearing within voting targets. Those appearing within voting targets are now discussed in Requirement Part 1: 7.7.5-F and Requirement Part 1: 7.7.5-G. Those other requirements are "should" not "shall"—technology in wide use as of 2006 cannot reliably distinguish extraneous marks within voting targets from deliberate marks.

Marks that conflict with timing marks may cause a tabulator to reject a ballot. This is conforming behavior, as it does not result in the recording of bogus votes.

Source: Clarified from [VSS2002] I.3.2.5.2.b

Applies To: Optical scanner

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

With technology that is in wide use as of 2006, insignificant marks appearing inside voting targets can be detected as votes. This problem should be minimized.

Source: Clarified from [VSS2002] I.3.2.5.2.b

Applies To: MCOS

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

With technology that is in wide use as of 2006, it may be possible to reliably detect reasonable marks and reliably ignore hesitation marks if the scanner is calibrated to a specific marking utensil. Unfortunately, in practice, optical scanners are required to tolerate the variations caused by the use of unapproved marking utensils. Thus, lighter marks of a significant size are detected at the cost of possibly detecting especially dark hesitation marks. Emerging technologies for context-sensitive ballot scanning may solve this problem. It is also solvable through procedures that ensure that all voters use only the approved marking utensil.

Source: Clarified from [VSS2002] I.3.2.5.2.b

Applies To: MCOS

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

Bias errors are not permissible in any system ([GPO90] 7.3.3.3). An example of bias would be if marginal marks in the first ballot position were detected differently than marginal marks in the second ballot position.

Source: New requirement

Applies To: MCOS

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

It is difficult to have confidence in the equipment if consecutive readings of the same ballots on the same equipment yield dramatically different results. However, it is technically impossible to achieve repeatable reading of ballots containing marks that fall precisely on the sensing threshold. See Part 1: 7.7.5.1 “Marginal marks”.

Source: New requirement

Applies To: Precinct tabulator Λ EMS

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

For requirements on report content see Part 1: 7.8 “Reporting”.

Source: Reworded from [VSS2002] I.2.5.3.2

Applies To: Precinct tabulator Λ EMS Λ DRE

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

This requirement assumes that the precinct is operating using DREs exclusively and that one of those DREs fills the role of EMS.

Source: Reworded from [VSS2002] I.3.2.6.2.1

Applies To: Voting system

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

Even if the clock's accuracy leaves something to be desired, second precision is useful to have if two reports are generated in quick succession.

Source: New requirement

Applies To: Voting system

Test Reference: Part 3: 5.2 “Functional Testing”

Source: New requirement

Applies To: Programmed device

Test Reference: Part 3: 4.3 “Verification of Design Requirements”

DISCUSSION

The appending of an audit record reflecting the fact that a report has been generated is not considered an alteration.

Source: From [VSS2002] I.2.2.6.h, I.2.5.3.1.g, and I.2.5.3.2.d

Applies To: Voting system

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.2.6.i and I.2.5.3.1.f

Applies To: EMS

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

For the logging of auditable events during election programming see Part 1: 5.7 “System Event Logging”.

Source: [VSS2002] I.4.4.1 / [VVSG2005] I.5.4.1

Applies To: Programmed device

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

These reports typically are generated during pre-voting logic and accuracy testing; see Part 1: 7.3.1 “Logic and accuracy testing”.

Source: Reworded from [VSS2002] I.2.3.4.1.b

Applies To: In-person voting

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

In jurisdictions where there are no programmed devices in the precincts, confirmation of equipment readiness could occur through a manual check and signoff by election judges. These readiness reports could take the form of checklists, fill-in forms and signature sheets supplied to the precincts by a central authority.

Source: [VSS2002] I.2.3.5, separated generic precinct vs. precinct tabulator reqs, modified to deal with failures

Applies To: Precinct tabulator

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.3.5, separated generic precinct vs. precinct tabulator reqs, harmonized with Requirement Part 1: 7.8.2-F, modified to deal with failures, deleted "special voting options"

Applies To: Central tabulator

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.2.3.6, harmonized with Requirement Part 1: 7.8.2-E, modified to deal with failures, deleted "special voting options"

Applies To: Voting system

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.4.4.2.g / [VVSG2005] I.5.4.2.g

Applies To: Voting system

Test Reference: Part 3: 5.2 “Functional Testing”

Source: [VSS2002] I.3.2.7.2 / [VVSG2005] I.4.1.7.2

Applies To: Voting system

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

Binary document formats and text containing markup tags are not considered human-readable. The system may generate such documents, but it must also provide the functionality to render those documents in human-readable form (e.g., by including the necessary reader application).

Source: [VSS2002] I.2.2.2.1.c as expanded by [P1583] 5.2.1.1.c^[5]

Applies To: Voting system

Test Reference: Part 3: 4.6 “Logic Verification”, 5.2 “Functional Testing”

Applies To: Voting system

Test Reference: Part 3: 4.6 “Logic Verification”, 5.2 “Functional Testing”

Source: Reworded from [VSS2002] I.3.2.6.2.2, extended to all systems

Test Reference: Part 3: 4.6 “Logic Verification”, 5.2 “Functional Testing”

DISCUSSION

If this requirement is applicable, then the system has failed to satisfy Requirement Part 1: 7.8.3.1-D and is therefore non-conforming. Nevertheless, in practice it is essential that discrepancies be flagged by the system as much as possible so that they are not overlooked by election judges. The system cannot detect discrepancies if no single voting device is ever in possession of a sufficient set of data.

Source: New requirement in response to Issue #1366

Test Reference: Part 3: 4.6 “Logic Verification”, 5.2 “Functional Testing”

DISCUSSION

If this requirement is applicable, then the system has failed to satisfy Requirement Part 1 :7.8.3.1-D and is therefore non-conforming. Nevertheless, in practice it is essential that a specific cause be determinable.

Source: Reworded and generalized from [VSS2002] I.3.2.6.2.2

Applies To: Voting system

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

Jurisdictions in which more than one precinct may vote at the same location on either the same ballot style or a different ballot style may desire reports that consolidate the voting location.

Source: Derived from [ND06] 5.04.05.g, [UT04] Requirement 23 and [MS05] 14.3.2.3

Applies To: Precinct tabulator

Test Reference: Part 3:4.5.2 “Security”, 5.4 “Open-Ended Vulnerability Testing”

DISCUSSION

Providing ballot counts does not violate this requirement. The prohibition is against providing vote totals. Ballot counts are required for ballot accounting, but early extraction of vote totals is an enabler of election fraud.

Source: Revised from [VSS2002] I.2.5.3.2

Applies To: Voting system

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

In the case of 100 % DRE systems, it would suffice to provide a single total that is noted to represent both the number of cast ballots and the number of read ballots, since these are necessarily equal. Only when there is a tangible (i.e., paper) ballot is it possible to cast a ballot that is never read. There is no subrequirement for separate reporting of provisional cast ballots because the system is unlikely to know whether a ballot is provisional until it is successfully read.

Applies To: Voting system

Test Reference: Part 3: 4.6 “Logic Verification”, 5.2 “Functional Testing”

Test Reference: Part 3: 5.2 “Functional Testing”

Applies To: Primary elections

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

This requirement to report by party applies only to the number of read ballots. It does not apply to contest choice vote totals.

Applies To: Provisional-challenged ballots

Test Reference: Part 3: 5.2 “Functional Testing”

Applies To: Voting system

Test Reference: Part 3: 4.6 “Logic Verification”, 5.2 “Functional Testing”

DISCUSSION

See also Requirement Part 1: 7.8.3.2-D, which breaks down counted ballots by contest.

Applies To: Primary elections

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

This requirement to report by party applies only to the number of counted ballots. It does not apply to contest choice vote totals.

Applies To: Provisional-challenged ballots

Test Reference: Part 3: 5.2 “Functional Testing”

Applies To: Part 3: 5.2 “Functional Testing”

DISCUSSION

Some jurisdictions find this information to be useful. Blank ballots sometimes represent a protest vote.

Applies To: Voting system

Test Reference: Part 3: 4.6 “Logic Verification”, 5.2 “Functional Testing”

DISCUSSION

See definition of relevant contest in Appendix A.

This is by contest, while Requirement Part 1: 7.8.3.2-C is the overall count. The count by contest could be inferred from the other counts that are broken down by ballot configuration, but providing this figure explicitly will make it easier to account for every vote per Part 1: 8.3.3 “Cumulative voting”.

N-of-M in this requirement includes the most common type of contest, 1-of-M.

Applies To: Voting system

Test Reference: Part 3: 4.6 “Logic Verification”, 5.2 “Functional Testing”

DISCUSSION

See definition of relevant contest in Appendix A.

N-of-M in this requirement includes the most common type of contest, 1-of-M.

Applies To: Voting system

Test Reference: Part 3: 4.6 “Logic Verification”, 5.2 “Functional Testing”

DISCUSSION

See definition of relevant contest in Appendix A.

N-of-M in this requirement includes the most common type of contest, 1-of-M.

[VSS2002] required the reporting of overvotes even on 100 % DRE systems where overvoting is prevented (Requirement Part 1: 3.2.2.1-A); that requirement is retained here, though it may be redundant.

Overvotes are defined in Part 1: 8.3 “Logic Model (normative)”. Consistent with the definition of undervotes (see Requirement Part 1: 7.8.3.3-C), the count is of votes lost to overvoting, not of ballots containing overvotes. This means that a ballot that overvotes an N-of-M contest would contribute N to the count of overvotes for that contest.

Test Reference: Part 3: 5.2 “Functional Testing”

Source: From [VSS2002] I.2.2.6.h and I.2.5.3.1.e

Applies To: Voting system

Test Reference: Part 3: 4.6 “Logic Verification”, 5.2 “Functional Testing”

DISCUSSION

See definition of relevant contest in Appendix A.

N-of-M in this requirement includes the most common type of contest, 1-of-M.

Undervotes are defined in Part 1: 8.3 “Logic Model (normative)” as needed to enable accounting for every vote. Counting ballots containing undervotes instead of votes lost to undervoting is insufficient.

Applies To: Ranked order voting

Test Reference: Part 3: 5.2 “Functional Testing”

DISCUSSION

This requirement is minimal. Since ranked order voting is not currently in wide use, it is not clear what must be reported, how bogus orderings are reported, or how it would be done in multiple reporting contexts. See Part 1: 7.7.2.5 “Logic for ranked order voting”.

Applies To: In-person voting

Test Reference: Part 3: 4.6 “Logic Verification”, 5.2 “Functional Testing”

DISCUSSION

"Include" simply means that the final totals must reflect them. It does not entail separate totals for the different kinds of votes.

Applies To: Absentee voting

Test Reference: Part 3: 4.6 “Logic Verification”, 5.2 “Functional Testing”

DISCUSSION

"Include" simply means that the final totals must reflect them. It does not entail separate totals for the different kinds of votes.

Applies To: Write-ins

Test Reference: Part 3: 4.6 “Logic Verification”, 5.2 “Functional Testing”

DISCUSSION

"Include" simply means that the final totals must reflect them. It does not entail separate totals for the different kinds of votes.

Applies To: Provisional-challenged ballots

Test Reference: Part 3: 4.6 “Logic Verification”, 5.2 “Functional Testing”

DISCUSSION

"Include" simply means that the final totals must reflect them. It does not entail separate totals for the different kinds of votes. See also Requirement Part 1: 7.7.2-A.4, Requirement Part 1: 7.8.3.2-B.3 and Requirement Part 1: 7.8.3.2-C.2.

Applies To: Review-required ballots

Test Reference: Part 3: 4.6 “Logic Verification”, 5.2 “Functional Testing”

DISCUSSION

"Include" simply means that the final totals must reflect them. It does not entail separate totals for the different kinds of votes.