NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY
TGDC - MEETING
(START OF AUDIOTAPE 1)
	MALE:  Who else is on for teleconference?  Can you hear us?
	MALE:  Yes, James Elekes.  Alan, I'm -- you're coming through loud and clear.
	FEMALE:  And this is Helen Purcell.  I'm also here.
	MALE:  Very good.  Thanks.  
	We're going high-tech with a nice description here of our emergency exits.  It's very easy.  If something would happen, you just walk right out the door and you can see the exits on the left and the right when you -- when you head out.  There are also emergency directions posted on the left and on the right aisle.  And --.
	FEMALE:  (indiscernible)
	MALE:  Oh, I'm sorry.  Yes.  You can go out either side of the front here.  I was little -- right over here.
	FEMALE:  Okay.
	MALE:  Yes, you can, yeah.  [laughter]  That's right.  Think we're high-tech here and show it to you.  Here we go.  Exit.  Exit.  It's back over here and then back in there, so you're set there.  Now.
	Okay.  Turn off our cell phones and pagers.  We don't allow food in the auditorium, but we have a nice cafeteria right down the hallway and we'll break for lunch right around 12:30.  Please wear your name badges at all times.  I apologize for the fact that some people were not cleared through security.  We had a -- a glitch there, but we'll take care of that.  Your badge that you have today will get you in tomorrow through the gate.  You do not need to go through security, so good reason to keep it.  Anyone who needs to take advantage of signing, our signer is over here stage left and you may feel free to sit over on this left side as close as you need to to take advantage.  We have him lit, so we hope he's -- if you have any problems, just let us know.  But we do have a special light on him.
	With that, I would welcome you all to the home of the Washington Nationals and I think they're still in first place barely in their division.  We have a little warmer weather for you today than we've had for our last meetings.  Look forward to your participation.  Thank you for attending.  Also, hello to all people on the webcast.  Our last webcast was viewed by over 600 people.  I'd like to also welcome the members of the Election Assistance Commission (phonetic sp.) who are here today and the commissioners who will be -- Commissioner, Vice-Chair DiGregorio (phonetic sp.) will be addressing us shortly, and with that, I'll turn over the po -- podium and the microphone to the Chair of the Technical Guidelines Development Committee, Dr. Hratch Semerjian. 
	MR. CHAIRMAN:  Thank you, Alan.  Good morning.
	PARTICIPANTS:  Good morning.
	MR. CHAIRMAN:  Can you hear me?
	MALE:  You're coming through loud and clear, Doc.
	MR. CHAIRMAN:  Okay.
	FEMALE:  [laughing]
	MR. CHAIRMAN:  I'm Hratch Semerjian; I'm the Acting Director of the National Institute of Science and Technology and Chairman of the Technical Guidelines Development Committee.  I hereby call to order the 4th meeting of this committee today, Wednesday, April 20, 2005.  Let us now stand and pledge allegiance.
	PARTICIPANTS:  I pledge allegiance to the flag of the United States of America and to the Republic for which it stands, one nation, under God, indivisible, with liberty and justice for all.
	MR. CHAIRMAN:  As Alan pointed out, we have, I believe, two members of the Election Assistance Commission: Commissioner DiGregorio, the Vice-Chair, and Commissioner Martinez (phonetic sp.).  We're very pleased to have them with us today.  
	At this time, I recognize Mr. Craig Burkhardt as the TGDC parliamentarian and request that he determine if a form of the committee is present.  Mr. Burkhardt.
	MALE:  Thank you.  Roll call for attendance.  Mr. Williams.
	MALE:  Here.
	MALE:  Berger. (phonetic sp.) 
	MALE:  Here.
	MALE:  Caldez.  (phonetic sp.)  Caldez not present.  Craft.  (phonetic sp.)
	MR. CHAIRMAN:  Caldez.  He is no longer on the committee.
	FEMALE:  Here, for Davidson. (phonetic sp.)
	MALE:  Davidson.  Elekes.
	MALE:  Here.
	MALE:  Gannon. Harding.
	MALE:  Here.
	MALE:  Miller.
	FEMALE:  Here.
	MALE:  Purcell.  Quesenbery.
	FEMALE:  Here.
	MALE:  Rivest.
	MALE:  Here.
	MALE:  Schutzer.
	MALE:  Here.
	MALE:  Turnerbuoy.  (phonetic sp.)  And Semerjian.	MR. CHAIRMAN:  Here.
	MALE:  Calling once again for those who did not respond.  Caldez did not respond?  Is Gannon present?  Is Purcell present?
	FEMALE:  Here.
	MALE:  Okay.  Twelve persons being present, a quorum exists.  Members recalling that eight are required to pass a -- a motion.  Thank you.
	MR. CHAIRMAN:  Thank you, Mr. Burkhardt.  I can express my appreciation to the members of TGDC for arranging your busy schedules to participate in a most important TGDC meeting today.  The new voting team has benefitted from your willingness to volunteer significant time in assisting them to complete drafts of the voluntary voting system guidelines we will review today and tomorrow, and I'm sure that the American voters will benefit from your civic commitment.  
	TGDC members and I were distressed to hear of the recent illness of Mrs. -- Miss Sharon Turner Bouvier (phonetic sp.), one of our committee members.  However, I recently learned that she is recovering from successful surgery and we wish her a speedy recovery.  The committee will miss her presence at this meeting.  
	Due to new job responsibilities, Ms. Anne Caldest (phonetic sp.), the committee representative of the American National Standards Institute recently submitted her resignation from the TGDC.  She will be placed by Mr. David Carmel (phonetic sp.), Vice President of Public Policy and Government Affairs for ANC (phonetic sp.).  The formal approval process for Mr. Carmel is not yet complete; however we appreciate his attendance at the meeting today and look forward to his active participation in future TGDC activities.  Thank you, David, for being here.
	At this time, I will entertain a motion to adopt the April 20 and 21, 2005 meeting agenda for the Technical Guidelines Development Committee.  It is in under the first tab in your book.  Do I hear a motion?
	MALE:  (indiscernible)
	MR. CHAIRMAN:  Thank you.  Do I have a second?  Any?
	MALE:  Second.
	MR. CHAIRMAN:  Thank you.  Any comments?  All in favor, please say "aye."
	PARTICIPANTS:  Aye.
	MR. CHAIRMAN:  Anyone against?  Thank you.  The meeting agenda has been approved.  
	At this time I will entertain a motion to accept the minutes of the March 9, 2005 meeting of the Technical Guidelines Development Committee.  That is in your third tab in the book.  The minutes of the March 9 meeting.
	MALE:  (indiscernible)
	MALE:  Second.
	MR. CHAIRMAN:  Okay, we heard motion and a second.  Any comments, corrections?  Hearing none.  All those in favor?
	PARTICIPANTS:  Aye.
	MR. CHAIRMAN:  Anyone against?  Thank you.
	Since our March TGDC meeting, NIST scientists have written a complete final draft of the voluntary voting systems guidelines.  This is version 1.  The document VBSG, version 1 represents a best effort to incorporate this committee's guidance and constructive criticism of the preliminary technical reports presented at the March 2005 meeting.  TGDC members, today, will have an opportunity -- today and tomorrow -- to review this material and to provide detailed editing instructions to new staff.  I will ask Mr. Burkhardt to review the parliamentary logistics of this meeting shortly.  In addition, this voting team completed a preliminary draft of the voluntary voting systems guidelines version 2.  This document, VVSG version 2 proposes a framework for a complete voting standard that would succeed VVSG version 1.  We will receive presentations from this staff on both documents at this meeting.  However, the focus of our work today and Thursday will center on a final review of VVSG version 1.  When formally approved by the committee, VVSG version 1 will become the initial TGDC recommendations forwarded to the Election Assistance Commission as required by the Help America Vote Act.  
	The agenda for the committee's preliminary review of VVSG version 2 on Thursday will depend on the time needed to cover all the sections of VVSG version 1.  Tomorrow, we will also discuss next steps relevant to the future work of this committee in support of the Election Assistance Commission.  Copies of VVSG version 1 and VVSG version 2 as well as necessary meeting materials were electronically transmitted to you on April 13, 2005 in accord with the advanced notice required in TGDC Resolution Number 1-05.  In addition, these documents have been posted on the public website vote.nist.gov (phonetic sp.).
	As a brief review for the public in attendance and viewing the webcast, Public Law 107-252, the Help America Vote Act established the Technical Guidelines Development Committee.  (indiscernible) charters the members of this committee to assist the Election Assistance Commission with the development of voluntary voting system guidelines.  In the interim, the 2002 voting system standards adopted by the Federal Election Commission serve as the first set of voluntary voting system guidelines under HAVA (phonetic sp.).  
	Beginning in July of 2004, this committee met in plenary (phonetic sp.) session on three occasions and conducted 36 subcommittee teleconferences.  The proceedings of each of these meetings including archived webcasts and audio recordings are available on the voting website, vote.NIST.gov.
	At this 4th plenary session, I'm optimistic this committee will thoroughly review and adopt with possible editing instructions to NIST, the VVSG version 1, the culmination of sustained efforts by NIST scientists and this committee to meet a non-negotiable Congressional deadline.  I will note here that most standards development processes take at least 2 to 3 years.  
	This committee's initial set of recommendations for voluntary voting system guidelines are due to the Executive Director of the Election Assistance Commission 9 months after TGDC members were appointed and approved.  At this time, I note that the latest revised version of Roberts' Rules of Order (phonetic sp.) was adopted on July 9, 2004 to govern Technical Guidelines Development Committee and sub-committee proceedings.  I call on Mr. Burkhardt to review the logistics of this 4th meeting of the TGDC.  Mr. Burkhardt.
	MALE:  Thank you, Dr. Semerjian.  And welcome, everybody, again to NIST on behalf of Secretary of Commerce Gutierrez and President Bush.  I want to compliment everybody, the members of the TGDC, the NIST staff of scientists and other professionals as well as the hopeful guidance that's been received from the members and staff of the EAC which has gotten us here to date.  Surely a wonderful accomplishment given that most of this work has been done within the last 6 months.
	I'll very briefly go through the business aspects of what we're going to be doing today.  As the TGD members know, the goal today and tomorrow is to adopt as your own work product to be delivered to the EAC, the various initial set of recommendations.  And in order to do that, we'll be following a very similar process that we followed before; that being that each section will be discussed by a NIST -- NIST professional staff person, it will then be opened up again to questions and answers from you.  After that, then, of course, you will have your opportunity to make motions to make changes.  And one the changes that are generally thought to be acceptable, these would be done on the unanimous consent basis, meaning that it can be stated and if there are no objections, we don't need to take a formal vote.  Of course, if there's a contested situation, then we would actually move and take a recorded roll call vote, as you know.
	Now, the only difference between what we've done before and what we'll be done -- doing as well is that at the end of each section, we will then be taking another vote, and that vote will be the vote that you take embracing that section with all of the changes you might have made just before that as your work product that you wish to deliver to the Election Assistance Commission. 
	So we'll be following that same process, but we'll be taking that extra vote at the end, adopting that as your work product and authorizing NIST under the Director to make whatever technical changes that you've instructed to be made to that and deliver that to the EAC, which would be taking place in the not-too-distant future.  
	Now, of course, mention has been made of VVSG version 2.  These are the longer view issues which were not prioritized for immediate release in the initial set of recommendations and these are expected to come out sometime over the upcoming months.  So for those of you in the audience or on the Internet, know that we may or may not get to all provisions which are embraced in VVSG version 2, just depending on whether or not we accomplish our fundamental work on version 1.  To the extent we do get through sections of version 2, that procedure will be the same procedure we followed at the last meeting, meaning that we will be -- NIST staff is asking for you to provide directions as to how they may change that, and those will be done, generally speaking, on a unanimous consent basis or when appropriate, a contested vote basis, but you will not be adopting anything in version 2 as your work product to be delivered to the EAC later this month.  
	That would be my explanation of the parliamentarian's memo that you have in your packet.  Thank you.
	MR. CHAIRMAN:  Thank you, Mr. Burkhardt.  The scientists and I look forward to the committee's review of VVSG version 1.  The time required to accomplish the agenda items means that the committee cannot take public comments at this meeting; however, there will continue to be opportunities for the public to comment on relevant issues.  Comments and position statements should be sent to voting@nist.gov where they were be posted on the NIST voting website, vote.nist.gov.  The comments we have received to date have been posted and reviewed by NIST staff and TGDC committee members.  
	At this time, I call on the Vice Chairman of the U.S. Election Assistance Commission, Mr. Paul DiGregorio, to address the committee.  The Vice-Chairman, along with the other EAC commissioners, have provided the committee with helpful remarks at our previous meetings.  I appreciate the Commissioner's offer to address the TGDC at this meeting.  Please welcome Commissioner DiGregorio.
	MALE:  Thank you, Dr. Semerjian.  And thank you, members of the TGDC for giving me this opportunity to speak with you this morning.  I'm pleased to be here this morning with Commissioner Rey Martinez (phonetic sp.).  I think you've been aware that Commissioner Martinez and I have attended all of your meetings and followed your proceedings very closely.  It's a pleasure to be here to watch your deliberations on this very important day.  
	At the July 9, 2004 initial meeting of the TGDC, then-Chairman of the EAC, Buster Sorez (phonetic sp.) charged this group to complete its work in 9 months as required by the Help America Vote Act of 2002.  We are now reaching the conclusion of that period.  We're pleased to note that you have taken this charge seriously as you are convened today to consider the initial set of recommendations for the voluntary voting system guidelines that you will soon be forwarding to the EAC.  
	Let me reiterate the commission's expectations for this work product, again, as expressed by Commissioner Sorez at that July meeting.  We are looking for standards that are performance based, that can measure success as it relates to voting.  We're looking for standards against which new voting devices can be measured that embrace existing and emerging technologies.  That is not the EAC's responsibility to dictate to states what kind of voting systems they use.  But it is our responsibility to establish standards against which states can make informed decisions.  We know that this has been a difficult job and we deeply appreciate all the effort that the TGDC and the NIST staff have put forth in the past 9 months for this truly historic first effort by the federal government to provide assistance and guidance in this important area.  As aptly described by Dr. Scull (phonetic sp.) at the EAC's March 22, 2005 public meeting, there are two separate goals for this effort.  The first is to develop the best long-term guidelines possible, building on the strengths of the 2002 voting system standards.  We understand that this goal will take some additional period of time to achieve.  EAC has requested funding to continue this work throughout fiscal year 2006.  In fact, we had our hearing before the House Appropriations Committee just last week to make the case for more funding for NIST to continue this work.  The second near-term goal is to provide guidance to the states for the 2006 election cycle.  To accomplish this goal, we need to make some important revisions to the 2002 voting system standards that fill gaps concerning issues facing election officials as they prepare for the 2006 elections regarding security, accessibility, and audibility the voting systems.  We look forward to the discussions of the next 2 days as the TGDC deliberates on this work product and considers what your final recommendations to the EAC will be.  
	I have been asked to address the process that will occur after the delivery of the TGDC recommendations to the EAC that until work -- will occur no later than May the 9th.  As always, we will be following the ma -- the provisions of HAVA regarding the review and possible modification of these recommendations to become the proposed guidelines that will be published for public comment and ultimately adopted by the commission.  
	The first step will be for the EAC to review and assess your recommendations and consider what modifications, if any, we may wish to make before submitting our proposed guidelines to the EAC Board of Advisors and Standards Boards.  HAVA requires each board to review and comment on EAC's proposed guidelines.  
	At the same time, we will publish a notice in the federal register inviting the public to comment on the proposed guidelines.  We anticipate that a 90-day public comment period will be provided given the volume and the scope of the materials to be reviewed.  There will also be a public hearing conducted on the record during the comment period.  We will be reviewing public comments as received so that we can produce the final version of the guidelines as quickly as possible after the comment period has ended.  We will also review and incorporate as appropriate comments provided by the Board of Advisors and the Standards Board.  After all comments have been reviewed and acted upon, the next step is for the commission to vote on the adoption of the guidelines followed by publication of the final guidelines in the federal register.  
	Also at this time, as Section 221 of HAVA directs, the TGD -- the document that you produce from this meeting will be published in the federal register so it can be compared -- the initial recommendation can be compared with the final guidelines.  We envision this entire process to be concluded towards the end of August of this year.   
	 Tomorrow, I will be speaking in Vienna, Austria, about your work as I will be leading a U.S. delegation that is participating at a conference of officials from 55 nations that is discussing election technology issues.  Many of these officials are aware of your work and are following it very closely in this website.  And they are looking to use some of your recommendations in their country.  They've told them -- they've told that to me themselves.  So I'm here to tell you that your work -- the work that you do will have implications beyond U.S. borders.  
	On behalf of my fellow commissioners and your fellow citizens of the United States, I would like to once again express our sincere thanks to all of you for this tremendous service and time that you've put in to provide more confidence in our system of democracy to the voters of the United States of America.  So thank you for what you do, thank you for the time you've put in, and we look forward to receiving your work product.  Thank you.
	MR. CHAIRMAN:  Thank you, Vice-Chairman DiGregorio for your comments.  We very much appreciate them.  
	I will now introduce three procedural resolutions for adoption that I believe will assist the TGDC in accomplishing our work at this meeting.  The resolutions are in your workbook.  It's the last tab in the first set.  Says proposed new resolutions.  And they're numbered 37-05, 38-05, and 39-05.  
	If you allow me, I would like to read the first resolution.  Resolution Number 37-05.  Work product instructions to chair and staff of National Institute of Science and Technology.  It reads as follows:  The Technical Guidelines Development Committee intends to consider and adopt sections of the final draft of the initial recommendations to the Executive Director of the Election Assistance Commission during its April 20 and 21, 2005 meeting.  Each section of the final draft is to be presented by a NIST staff member followed by a question and answer session.  Immediately thereafter, specific proposals for changes to that section will be entertained by the TGDC.  The chair will attempt to reach unanimous consent for suggesting changes.  If unanimous consent is not reached, a TGDC member may make a motion and a recorded vote will be taken on the matter.  At the conclusion of the consideration of each section, a vote will be taken to adopt the entire section as revised by motions adopted through unanimous consent or recorded vote.  At the conclusion of the meeting, the TGDC chair will assign NIST staff members to revise the sections as required by votes of the TGDC.  	The TGDC chair will supervise this process to assure that revisions reflect the intent of the TGDC as expressed in its votes and resolutions.  In supervising the revision process, the TGDC chair shall not depart from technical decisions made by the TGDC.  Initial recommendations to the Executive Director of the EAC shall consist of the adopted sections as revised by NIST staff under the supervision of the TGDC chair.  The TGDC chair is to deliver this work product to the EAC.
	Because the work product will have been developed under a tight statutory schedule, the TGDC expects that minor and non-substantive drafting errors may have occurred.  Based on inputs from the TGDC members, NIST is requested to compile all of the corrections in a supplement which shall be delivered to the TGDC and EAC at an appropriate time.  
	Do I hear a second for this motion?
	MALE:  (indiscernible)
	MR. CHAIRMAN:  We have a second.
	Any questions -- I guess I shouldn't be -- do I hear a motion supporting?  And Dr. Schutzer (phonetic sp.) second it, so.  
	Do we have comments/questions on this motion?  This basically formalizes the procedure that Mr. Burkhardt explained so there is nothing new about -- we just want to make sure everybody on this 'stands that we will not, in fact, have a lot of time for reiteration and -- given the time constraints, so any comments?
	Okay.  Hearing none, we'll take a roll call.  Mr. Burkhardt?
	MALE:  Williams.  Williams votes yes.  Berger?
	MALE:  Yes.
	MALE:  Berger votes yes.  Caldez?  Caldez is absent.  Craft?
	MALE:  Yes.
	MALE:  Craft votes yes.  Davidson?
	FEMALE:  Yes.
	MALE:  Davidson votes yes.  Elekes?  Elekes?
	MALE:  Yes!
	MALE:  Elekes votes yes.  Harding?
	MALE:  Yes.
	MALE:  Harding votes yes.  Miller?
	FEMALE:  Yes.
	MALE:  Miller votes yes.  Purcell?
	FEMALE:  Yes.
	MALE:  Purcell votes yes.  Quesenbery?
	FEMALE:  Yes.
	MALE:  Quesenbery votes yes.  Rivest?
	MALE:  Yes.
	MALE:  Rivest votes yes.  Schutzer?
	MALE:  Yes.
	MALE:  Schutzer votes yes.  Semerjian?
	MR. CHAIRMAN:  Yes.
	MALE:  Semerjian votes yes.  That's 12 votes in favor.
	MR. CHAIRMAN:  Thank you.  The -- the resolution has been adopted.  
	The next resolution, Number 38-05.  Procedural resolution regarding grandfathering.  It reads as follows:  Pursuant to HAVA, the TGDC will recommend voluntary voting systems guidelines to the EAC.  The VVSG recommended may not include all practices currently followed or technologies currently utilized by election administrators.  Consequently, existing practices in some jurisdictions may not be in compliance with the VVSG.  The TGDC finds that whether such practices or technologies not contained within the VVSG should be grandfathered is a policy question not within the jurisdiction of the TGDC and not within the statutory duties of NIST.  
	MALE:  I'll second for second discussion.
	MR. CHAIRMAN:  Any questions or comments?  I think this was -- this resolution was put forth to address some of the concerns expressed by some of the TGDC members in between this meeting and the previous one.
	Yes, (indiscernible).
	MALE:  (indiscernible)
	MALE:  Microphone!
	MALE:  Thank you, sir.  Because fulfilling our 2006 elections and not discrediting some of our election environments, could we just have some greater clarity of what this means for the general public and what the expectation (indiscernible) so that we're all on board here in understanding the implication of what we are expressing than -- that, in fact, it is not in our pro view but rather the EAC?
	MR. CHAIRMAN:  Yes, I think that -- that's the general idea that this is not a policy-making body.  We provide the technical guidelines.  Any exceptions or grandfathering that needs to be done, that can only be decided by the EAC based on our own view.  This body is not in a position to grant such exceptions, so I think that is the main point.  Do you feel that we need to add something to this or is that clarification sufficient?
	MALE:  Well, it's sufficient for me, sir, but others may have other comments.
	MR. CHAIRMAN:  Mr. Craft.
	MALE:  Yes, I guess my problem is with the second sentence both in the way it's worded and perhaps in the actual fact, and that's a part that I would like to see clarified.  That the voting system guidelines recommended may not include all practices currently followed or technologies currently utilized.  I think it's been made abundantly clear by Congressional intent and the discussions we've had in prior meetings that what we want the guidelines to do is to include current best practice.  We do not want elements in this particular standard which do not currently exist and which are not currently deliverable to election administrators who are trying to buy equipment for the January 1, '06 election cycle.  So if there are elements here which can't be met, leaving them in under the argument that we're going to leave the policy decisions in grandfathering to the EAC is, I think, inappropriate.  I think this committee needs to make sure that, in fact, everything in the initial version 1 that we endorsed today reflects stuff that is real, that can be implemented, and that can be implemented in short order across the country.
	MR. CHAIRMAN:  Yes, Dr. Schutzer.
	MALE:  I don't think what this says violates that.  I mean, this is, I guess, recognizing the fact that there may be some districts that are currently practicing or currently have equipment which in the judgment of TGDC is not up to spec with the current best practices and the current technology that you can get today.  And so, therefore, they may find themselves out of compliance with the current specification.  We don't think we should be influenced by what they currently have or how they currently practice.  We think we should be influenced by what we think is the current best standards, the current technology today.  It's not our place to decide whether they get a waiver or not.  That's what we're saying.  And this says -- doesn't say current best practice.  This says may be practicing, may have technology that is not recommended and not compliant.  
	MALE:  I agree with what you say, sir, but I think the resolution needs to say that in place of the current language.  The current language leaves open (indiscernible) and standards that simply cannot be complied with and I think it needs to be more clear as to that.  
	MR. CHAIRMAN:  Excuse me.
	FEMALE:  I think I just wanted to agree with what Mr. Schutzer said which is I think there is a big difference between existing equipment or existing practices that could be followed today if you chose to do so and theoretical or speculative ideas about what we might be able to do in the future and I think the first is well within our purview, certainly for VVSG version 1.  And I think that we discussed this in the past, that we would be basing our current -- the current version 1 standards on existing and available options but not necessarily those that are in use at all -- in all jurisdictions.
	MALE:  (indiscernible)
	MALE:  How 'bout something, let me try some word snipping and see if you'd be okay with it.  Let's say we preceded this sentence with saying something like "although the."
	MALE:  Exactly where are we?
	MALE:  At the end of the first sentence, so right before the.
	MALE:  After VVSG?  No.
	MALE:  After EAC.
	MALE:  After EAC.
	MALE:  Yeah.
	MALE:  Okay.
	MALE:  So we might say "although the VVSC isn't -- was developed based upon current practices and current available technology, the recommendations may not include" then go on to the rest.  Is that okay?
	MALE:  Yes, that would be acceptable.
	MR. CHAIRMAN:  But then -- but then how?  Okay did you capture?
	MALE:  I didn't get after VVSG.
	MR. CHAIRMAN:  Could you read again Dr. Schutzer?
	FEMALE:  (indiscernible)
	MALE:  Although the VVSG was developed --
	FEMALE:  Developed.
	MALE:  -- to include -- to be based upon current best practices and best available technology, and then the rest stays the same.
	FEMALE:  Best practices.
	MALE:  To include.
	FEMALE:  And technology.
	MALE:  Based on.  Develop based on.
	FEMALE:  (indiscernible)
	MALE:  Current practices, I think it was.
	MALE:  Yes.
	FEMALE:  Okay.
	MALE:  Excuse me, Chair, James Elekes.
	MR. CHAIRMAN:  Yes, go ahead Mr. Elekes.
	MALE:  Thank you.  That sentence that you read back in its entirety, I have someone here who's doing electronic Braille copy for me and --
	MR. CHAIRMAN:  Yeah, as soon as we complete the typing -- [laughter] will just take a few minutes, we'll read back.
	MALE:  I appreciate that.  Thank you.
	FEMALE:  On current practices.
	MALE:  Gotcha.
	MALE:  Got it.
	MALE:  All right.  That's it.
	FEMALE:  (indiscernible)
	MALE:  And available technology?
	MALE:  (indiscernible)
	MALE:  Just a small editing change makes (indiscernible)
	MALE:  May can be interpreted as shall.  Which might be the opposite of what you (indiscernible).
	MALE:  Okay.
	MALE:  Were we going to have the word current technology?  Or currently available technology?
	FEMALE:  Just best practices (indiscernible).
	MALE:  Current best practices --
	MALE:  And available technology.
	MALE:  And available technology.
	MALE:  Yes.
	MR. CHAIRMAN:    Okay and then after that, there's a comma, I guess, after technology.  
	MR. CHAIRMAN:    Okay.  The motion reads now:  Pursuant to HAVA, the TGDC will recommend voluntary voting system guidelines to the EAC.  Although the VVSG was developed based on current best practices and available technology, the recommendations might not include all practices currently followed or technologies currently utilized by election administrators.  Consequently, existing practices in some jurisdiction might not be in compliance with the VVSG.  The TGDC finds that whether such practices or technologies not contained within the VVSG should be grandfathered is a policy question not within the jurisdiction of the TGDC and not within the statutory duties of NIST.  
	MALE:  Got it.
	MR. CHAIRMAN:  Are we comfortable with that?  J.R., did you have a comment?
	MALE:  That's fine with me now, sir.  I think it speaks more clearly to encouraging those states that have already raised the bar of performance and expectation while also recognizing that a number of states have a long way to go.
	MR. CHAIRMAN:  Thank you.
	MALE:  (indiscernible)
	FEMALE:  (indiscernible)
	MR. CHAIRMAN:  Do we have unanimous consent on this -- is everybody in favor, or do we have any objections?  If not, I'll declare unanimous consent and the resolution is adopted as modified.  Thank you.
	The next resolution, Number 39-05, voter-verified paper audit trail assignment.  It reads as follows:  The TGDC recognizes that voter-verified paper audit trails have been developed in some jurisdictions without formal requirements.  The TGDC is aware that some states currently require or intend to require use of VVPATs.  
	Actually, I have made a minor editorial here.  I have added at the beginning of the paragraph, second paragraph "at its January 18th meeting."  I just wanna make it clear because it was not in our last meeting; it was the previous meeting, so I just added "at -- at its January 18th meeting" the TGDC received a request from the EAC to develop VVPAT formal requirements for use by states in election jurisdictions that have chosen to require VVPATs so that those states can more effectively implement VVPATs.  Subsequently, the TGDC instructed NIST to develop and submit VVPAT formal requirements as a part of its voluntary voting systems guidelines technical assistance work product.  Neither the TGDC nor NIST express any opinion regarding the use of VVPATs as an independent verification process nor do they endorse the use of the VVPAT approach.  
	Do I hear a?
	MALE:  Second the purpose of discussion.
	MR. CHAIRMAN:  Okay.  Thank you.
	Yes, Dr. Williams.
	MALE:  I would like to suggest that the word "formal requirements" -- the two words "formal requirements" in two locations be changed to the single word "guidelines."  I -- I believe this is more in keeping with the semantics that we're currently using on those.
	MALE:  (indiscernible)
	MALE:  I agree with Dr. Williams.
	MR. CHAIRMAN:  Are we in general agreement on the change?  Do we have any comments?
	MALE:  I have a question.
	MR. CHAIRMAN:  Yes, Dr. (indiscernible).
	MALE:  The last phrase here, "nor do they endorse these, the VVPAT approach" the committee here is not in a position to be endorsing technologies per se.  This last phrase seems a little bit strange and I think just eliminating the "nor do they endorse the use of the VVPAT approach" could be eliminated without harm.  
	MR. CHAIRMAN:  Yes, Ms. Davidson.
	FEMALE:  You know, I -- I understand what you mean, but I -- I disagree because with this not having standards in there for the ones without the voter-verifiable paper, it looks like the standards are supporting this right now.  We're addressing the other in version 2 and I think that a statement like this needs to be made so that that's not an indication that's where this committee's coming from.  'Cause it, by perception right now, looks like it.
	MR. CHAIRMAN:  Mr. Craft?
	MALE:  And I think regardless of the other documents and our records of discussions on this after this work (indiscernible) on the street, there will be people trying to construe it to require VV -- VVPAT.  So I think clearly stating our intent is appropriate.
	FEMALE:  Well, perhaps --
	MR. CHAIRMAN:  Ms. (indiscernible).
	FEMALE:  Perhaps we'd like to word it more neutrally; that is that we neither endorse nor deprecate the approach.  Probably not the right word, I'm sure.  Parliamentarian has a better one, but if the intent is to say that we're providing guidelines for a technology that's in use in states and for which various states have, in fact, expressed interest in having guidelines, that's fine, but having only the negative suggests that we're not endorsing it rather than saying we're simply taking no position on it.
	MR. CHAIRMAN:  Would it be better to simply, maybe, after the verification process, put a semicolon "this does not constitute an endorsement."
	FEMALE:  Or maybe "the TGDC takes no position on VVPAT as a -- as an approach."  
	MR. CHAIRMAN:  Dr. Williams and then.
	MALE:  I don't want to get ahead of ourselves and talk about specific documents we're going to be talking about, but I'd like to suggest this -- this resolution be withdrawn at this time and brought up again after we have looked at what sort of guidelines we're recommending.  Because, as I read this, if it stay -- if it stands the way it's written right now, I think that the -- that the implication is very much that we are endorsing VVPAT and if we're not, we need to emphatically state that.  So I'd -- I'd like to suggest that we simply withdraw this right now and then bring it up after we have discussed that portion -- that portion of the document.  Then I'll know more what we're talking about.
	MALE:  Rather than endorse or not endorse, maybe another way around this is to say that unlike the other parts specification.  I'm a little long-winded, but we can succincter view of the gist of what I was going to say.  I like the other parts of the specification when you provided specification and you're either in compliance or not in compliance.  This particular area, if one chooses not to implement VVPAT, then they're not out of compliance with the specification.  If they choose to implement VVPAT, then they need to be in compliance with that section.  And that's, I think, essentially what we're saying.  We're not requiring it for compliance.  You can -- you can have a compliance system without VVPAT.  If you choose to implement VVPAT, then this particular section is applicable.  In -- in fact, if you were to put it that way, the specification -- and indeed, you might not need the resolution, but if you still felt comfortable having a resolution for some of the reasons that was discussed, you might use language along those lines rather than endorse or not endorse.
	MR. CHAIRMAN:  Yes.
	FEMALE:  Would it be appropriate to -- to table this for a while and allow our parliamentarian to draft this carefully rather than trying to wordsmith it in this group session? 
	MR. CHAIRMAN:  Okay, I think the -- we'll table this motion for now.  We'll make the changes to capture the spirit the comments made here and then we'll bring it up again after the discussion of the VVPAT part of the guidelines, the version 1.  Okay.  Thank you.
	At this time, then, I call on Mr. Mark Scull (phonetic sp.) of NIST Information Technology Laboratory to provide an --
	MALE:  Mr. Chairman.
	MR. CHAIRMAN:  Oh!  
	FEMALE:  (indiscernible)
	MR. CHAIRMAN:  Sorry.  Resolution Number 40-05.  Title is EAC (indiscernible) of initial recommendations.  The Technical Guidelines Development Committee recognizes that it will deliver its first set of recommendations to the Executive Director of the Election Assistance Commission (phonetic sp.).  And then shortly thereafter, such recommendations will be reviewed by the EAC and its Board of Advisors and Standards Board.  The TGDC is aware of individuals and organizations that wish to provide comments on the recommendations and is further informed such individuals and organizations may not understand how they can effectively provide such comments.  The TGDC, therefore, recommends that the EAC announce how and when comments on the initial recommendations may be provided to the EAC for its consideration.  
	Do I hear a motion?
	FEMALE:  I --
	MALE:  (indiscernible)
	FEMALE:  Yes, I think coming --
	MR. CHAIRMAN:  Well, yes, I think this is certainly consistent with what Vice-Chair DiGregorio (phonetic sp.) mentioned.  I think this was -- making sure -- this was formalizing that sort of --
	FEMALE:  Yeah.
	MR. CHAIRMAN:  -- everybody knows and it's part of the record.
	FEMALE:  Yes, I was going to say coming on the heels of the excellent presentation, thank you very much, Commissioner DiGregorio, it seems a little anticlimactic, but we have -- several members of this committee have been receiving comments from people who were not sure how to effectively submit comments and I just wanted to make that point.  I'm -- I'm sure that the EAC, as they have been very concerned as we have been with the transparency and openness of this process, will be widely publicizing opportunities for comments.
	MR. CHAIRMAN:  Yeah.  Perhaps after that presentation, this is a statement of the obvious, but sometimes -- since not everybody's here --
	FEMALE:  [laughing]
	MR. CHAIRMAN:  -- it may be useful to make this part of the record.  Any other questions, comments?  Did I hear a second?
	MALE:  Second.
	MR. CHAIRMAN:  Any other questions, comments?  Do we have a unanimous consent?  Any?  All in favor.
	MALE:  Aye.
	MR. CHAIRMAN:  Any opposed?  Okay.  We have a unanimous consent; the resolution is adopted.  Thank you very much.  
	Okay, now I can call on Mr. Mark Scull of NIST Information Technology Laboratory to provide an overview of voluntary voting system guidelines, VVSG version 1.  Mr. Scull?
	MALE:  Mr. Chair.
	MR. CHAIRMAN:  Yes, Mr. (indiscernible).
	MALE:  Can I do a quick point of order?
	MR. CHAIRMAN:  Sure.
	MALE:  I have a question in my mind how the necessary number of votes to pass a resolution was computed in view of the fact that we have a vacant position rather than simply a member not in attendance.
	MR. CHAIRMAN:  I will turn to our parliamentarian.  Mr. Burkhardt.
	MALE:  Yes.  Generally speaking, under federal advisory committee guidelines, the requirement would be a majority of those who are capa -- majority of the slots which are available.
	MALE:  Mr. Chairman, Mr. Burkhardt's gonna to step up to the mike 'cause you're not being heard from the teleconference.
	MALE:  Course, in terms of the majority that would be required, the first thing we would look to is the statute as to whether the statute provides any guidance as to what the majority is that's required.  The statute, of course, is silent on the issue, so then we would default to Roberts' Rules of Order.  Roberts' Rules of Order would require in a situation such as this that there be a simple majority of those who are appointed to the commission; however, I can take that under advisement and take a look at that.  Generally speaking, that would mean that eight votes would be required as a simple majority of the members of the commission.  The -- there is one vacancy on the commission due to a resignation and there is a second person who has not been replaced, so the membership of the commission right now would be 14 people.  And a simple majority of 14 would, of course, be half, 7, plus 1, which would make 8.  So I believe that 8 would be required, really, under any scenario in this case because we have an open vacancy which has not been replaced in the case of one person.  Thank you.
	MR. CHAIRMAN:  Thank you, Mr. Burkhardt.  Mark?
	MALE:  Thank you, Dr. Semerjian.  
	I'd like to just give the TGDC an overview of the Voluntary Voting System Guidelines version 1.  First a little background.  VVSG version 1 constitutes the initial set of recommendations mandated by HAVA.  HAVA asked that the initial set be delivered to the EAC 9 months after the formation of the TGDC.  VVSG version 1 is intended to assist the states in preparing for the 2006 election.  It augments the VSS 2002 to address the critical areas of security, accessibility, and usability, so it essentially fills in the gaps to the VSS 2002 and makes it usable for the 2006 election.  And it literally augments the -- the VSS 2002, so what you have in front of you is the VSS 2002 with many additional pages, probably 150 or 200 additional pages that were provided by the NIST (indiscernible) team.  
	VVSG version 2 will be a complete redesign of the 2002 standard.  It will be much more comprehensive, and we will rewrite existing requirements when necessary to make them more precise and testable.  
	Changes required by VVSG version 2 cannot be implemented and tested in time for the 2006 election, so we have this dual strategy.  Version 1, which will be available in time to -- to help states run the election 2006 is really an interim standard; version 2 will be the more permanent standard, the long-range redesign and future standard.
	There are many areas that are addressed and enhanced in VVSG version 1.  There's a conformance clause, the human factor section, there's a security section which has 4 subsections, there's a new glossary, a redone section on error rates, a new appendix called Best Practices for Voting Officials, the voting process is alluded to differently in the new sections, and the structure of the requirements for the new sections are different.  So I'm just going to go through these one-by-one quickly.  You will have detailed presentations on each of these the rest of today.
	VS 2002 did not contain a conformance clause.  Conformance is defined as fulfillment by a product, process, or service of specified requirements.  And the conformance clause is high-level discretion of who shall conform and what is required.  Conformance clause, we believe, is fundamental to a standard.  We've -- we've worked on many, many standards committees; they all have conformance clauses.  You need to know who the standard applies to and what is expected of them so that, in fact, when you develop tests and run these tests, you understand the criteria for when the implementation passes and fails.
	Human factors.  VSS 2002 Section 227 addressed accessibility and Section 349 addressed human engineering.  VSS 2002 also contained Appendix C on usability and two (indiscernible) technical guides.  The VVSG version 1 contains a new Section 227 addressing human factors consisting of accessibility, usability, and limited English proficiency, and this replaces old Section 227 and 349 as well as Appendix C.  
	Security.  VVSG contains a new section, Section 6.0 on security which consists of 4 subsections, including an overview.  The overview is an informative section which means it's not normative.  One -- it doesn't -- nothing in the section has to do with conformance.  There are, in fact, no requirements in that section.  The overview explains the VVSG approach to security which essentially is independent verification.  Future versions like VVSG version 2 will have requirements for this section.  We -- we thought about this long and hard, actually, about whether to put requirements into VVSG version 1 for many of the other types of verification besides VVPAT.  We were sensitive to, as the committee expressed, perhaps a misperception that by including VVPAT, we were tacitly endorsing it.  We -- we clearly are not; we take no position on it, and we want to put other methods of verification in to -- to reinforce that point.  We did not want to put requirements in for the other methods, however, for at least two reasons.  Number one, we have not done, we believe, all of the research necessary to be sure that these requirements are, in fact, correct and that's one thing we will not do; we will not put requirements in if we have not completed our research to make sure they're correct.  Secondly, putting requirements in for -- for many of the other technologies would be so onerous as to make them impossible to be implemented by 2006, and again, VVSG version 1 is intended for the 2006 election.  So those requirements as a consequence, the detailed requirements for those other sections on security will be put into VVSG version 2.  
	Voter-verified paper audit trails.  Again, I'm hopefully repeating what the TGDC has just expressed.  VVSG does not require or endorse VVPATs.  VVPATs are one method to achieve independent verification.  Other methods exist which are explained in the overview.  The requirements are provided so that states that choose to implement VVPAT can implement them effectively, and I think Dr. Schutzer expressed it exactly right.  There is no requirement to have VVPAT, but if you do have VVPAT, what the standard does is to say to conform, you need to do it according to the requirements we put in, so if you have VVPAT, follow these requirements.  There is, in fact, no requirement to include VVPAT.
	TGDC conclude that wireless technology introduces severe risk and should be approached with extreme caution.  VVSG includes a special section on wireless that augments the general telecommunications guidelines in Section 5.
	VSS 2002 contain requirements to support validation of software and set up of voting systems.  The new section augments the VSS 2002 and also includes use of our national software reference library as well as other mechanisms. 
	Glossary.  VSS 2002 had a glossary, a very fine glossary.  We've enhanced that glossary.  The new glossary contains terms from the VSS 2002 as well as many new terms needed to understand voting.  Each term in the new glossary contains a definition and its source as well as an association.  The glossary is also available online and -- and I think when we get to the glossary section, you'll see an online demo.  And allows searches by the term itself, by the source, for instance, VSS or HAVA or IEEE or searches by association so you can find things related to, for instance, security or testing.  The website is also listed.
	Volume 2, Appendix C in the 2002 VSS sets certain error rates for voting systems.  Appendix C has been modified in the VVSG to revise the procedures to test that systems meet the indicated error rates.  This applies to errors introduced by the system and not by a voter's action.  More research is needed to develop standards for error rates that account for -- for human actions.
	VSS 2002 contain requirements essentially for voting systems and testing entities.  There were requirements for other words there, but -- but essentially they were equivalent to these two terms.  The requirements in the VVSG for many areas including wireless, VVPAT, human factors, depend on voting officials developing and carrying out appropriate procedures as well as having the correct voting systems and the correct testing procedures.  So VVSG contains the best practices for voting officials.  These best practices are actually contained in line when we -- when we develop each of the requirements.  We actually have a section called Responsible Entity where we list voting systems testing entities as well as voting officials.  We pull out all the voting official references and put them in the Best Practices Appendix C.  These requirements are not testable; they do not have anything to do with conformance.  They are, in fact, guidance for voting officials, and they're contained again in Appendix C of Volume 1.  
	VSS 2002 define three major stages of voting: pre-voting, voting, and post-voting.  The new sections we've written designate which stage each requirement pertains to.  VVSG version 2 will contain a much more detailed voting process model and hopefully if we get to that tomorrow, you will hear about it in detail.  
	The new sections of the VVSG contain a much more structured approach.  Each requirement is numbered according to hierarchical scheme.  Higher-level requirements are supported by low-level requirements, so 227, which is Human Factors, 2271 would be Accessibility, the first requirement under Accessibility would be 22711 and so on.  High-level requirements may not be directly testable, but they can be indirectly tested via their lower-level requirements, so essentially we have a tree structure.  The leaves of the tree are directly testable and the higher-level requirements are testable by summing up the leaves that are -- that are under that particular branch.  
	My last slide has to do with the grandfathering issue which we discussed this morning.  I just wanna say a few more things about it.  This issue came in response to some questions from TGDC members and basically, we decided that it's not the purview again of the TGDC to make grandfathering decisions.  The EAC can handle these.  I just want to point out this is not a one-time issue; this will happen every time there's a revision to the standard.  I just wanna say one other thing to -- to balance this and give a little bit of our thinking for how we decided what requirements to put into VVSG version 1.  We need to take this instruction and counterbalance it by the fact that we did not put requirements in for two reasons.  Again, one, if our research was not concluded, we would not put requirements in.  And again, secondly, we want to make sure that everything we put in is doable by the 2006 election.  There may be things that need to be changed, but if things are so onerous that to change them would be so dramatic they couldn't possibly be done by 2006 election, we did not include them.  So that's a little bit of our strategy and philosophy.
	I think that's my last slide.  Any questions?  Yes, Mr. Craft.
	MALE:  Yeah, I just -- I -- I have a little problem with the sticker on the front page and basically for those of you that don't have a hard copy of the document, it states "This document is a work product of the Technical Guidelines Development Committee which received technical assistance from the National Institute of Standards and Technology.  I think for the sake of historical accuracy, the work product -- the work product of the Technical Guidelines Development Committee thus far has been the resolutions the committee has passed.  The document before us is very much a work product of NIST which over the next two days, perhaps, major pieces of it will be adopted by the TGDC and it will endorse those.  But I think, very clearly, we need to differentiate between the committee's work product which is strictly its resolutions and in this work product which is the deliverables that NIST has created in response to the resolutions.
	MALE:  Thank you.  Our esteemed parliamentarian ruling.
	MALE:  Yes.  Your comment is taken very, very well that -- that sticker was drafted for the work product which you will adopt today, so -- and has been applied, if you will, probably prematurely to this particular document.  So that would only be accurate with respect to those work products which you actually adopt today.
	MALE:  Okay.
	MALE:  So.  We'll -- we'll make sure that doesn't go out in any kind of a public release.  That was something we put on these paper releases because we did not want anybody to look to these materials as being authoritative unless and until you folks adopted them and the EAC themselves adopt them as well.  
	MALE:  Okay, well, I guess my concern is since the documents now exist.
	FEMALE:  Can't hear you.
	MALE:  Since the documents now exist, since they may be archived and flow into the (indiscernible), we need to make it very clear on the record that application of that sticker is an error.
	MALE:  I'll draft up a brief resolution that you can read into the record to that effect.  Thank you.
	MALE:  (indiscernible)
	MR. CHAIRMAN:  Thank you.  Any other questions, comments?
	MALE:  Dr. Semerjian, can I just add one -- one thing to the response?  I agree with you Mr. Craft.  I just want to add one thing, though.  These -- we have done these things not in a vacuum and in many cases, we've gotten input from TGDC members, subcommittee chairs to give us advice on how to write redraftings, but -- but I agree with your comment.  I just want everyone to know this was not done in a vacuum, was certainly done in cooperation with various TGDC members and committees.
	MALE:  Okay.
	MR. CHAIRMAN:  Any other comments?  
	We were scheduled to take a break now, but we're actually ahead of schedule so I -- I propose that we go on with the next presentation and then take a break.  So at this time, I call on Ms. Lynn Rosenthal (phonetic sp.) of NIST Information (indiscernible) Laboratory to present the report on the conformance clause for VVSG version 1.  Lynn?
	FEMALE:  Thank you.  Good morning.  Actually, it's better going before the break.
	Since the conformance clause comes at the beginning of the VVSG version 1, I get to go first and provide for you a overview of what this new section is.  It's Section 1.7.  It replaces the old 1.7 which now becomes 1.8, which is basically a table of contents of this section.  
	So, today, what I'd like to do is -- is give you an overview of the conformance clause, go through the various sections, point out any changes from the previous version that you saw at our last plenary.  Basically, there is no major drastic changes here.  Most of the work was a clarification or refinement of the text that was there before we filled in some of the holes.  We've maybe adjusted the organization of the document to the way it's presented in the conformance clause.  We added a new section, but it shouldn't be a major supr -- surprise because before we had a placeholder for this section, it was called "Conformance Model" so the name change and we renamed some of the sections and moved some things around.
	So, to start with, is the first subsection which is "Scope and Applicability."  This basically sets the stage for the rest of this clause and the whole VVSG version 1.  It talks about having requirements that are imposed or applied to voting systems and voting system vendors.  There are requirements that are imposed on test authorities.  This may be and is -- is specifically directed at the EAC accredited test authority, but it could be used by any other test authority.  And finally, as Mark pointed out, there is guidance for voting officials.  Again, these are meant as best practices; it's not subject to testing, and it really serves as an adjunct to the technical requirements as you'll hear more through the other presentations dealing with human factors and security.  We tried to be very clear about this, up front.
	The next section is actually a rework and reorganization.  We -- the previous version it was the sections entitled "Who and What May Conform" and "The Conformance Model."  And the conformance framework basically puts together what -- what your conformance model is -- is what some people think of it as various parts.  In particular, it addresses the applicable entities who is this targeted to, the relationship among those entities, and the conformance designation.  So the applicle -- applicable entities we had before, those that you would expect, new section is a description of how these entities interact and the relationship among them, and we added a picture just to illustrate the description of the text.  And then finally, a new section called "Conformance Designations."  This is basically to -- to reaffirm that voting systems, if all the mandatory requirements that apply to that voting system are met, then the voting system would conform.  That there's no concept of different levels of conformance or different degrees of conformance, conformance doesn't have various names depending on -- on what you do, for instance, there's no notion of hardware conformance versus software conformance versus human factor or security conformance, et cetera.  And that there's no concept of partial conformance, in other words, a voting system cannot conform 80% or be 80% conforming.  It's -- it's an all deal.  You do or you don't.  That's it.
	The next section is pretty much what was there before.  There are several keywords.  Shall is (indiscernible) -- is encouraged or should, may.  Normative text has to do with conformance, and we've added some words regarding informative parts of the VVSG version 1.  Informative parts would be things like examples, extended explanations within the requirements, the text prefixed by responsible entity process and discussion.  Informative parts have no bearing on conformance and we've tried to, where possible, identify the difference between the two informative or normative sections.  
	Categories -- categorizing requirements.  This, in the previous version, was called "Subsets for Voting Systems" is pretty much the same, did clean up the text a little bit to try to make it clearer.  The VV -- the 2002 VSS actually used the word "categorizing requirements", so to be consistent, we -- we went to that -- that title.  It's basically the idea of grouping requirements according to requirements that pertain to a certain type of equipment or a certain component or a certain capability and that if the voting system does not have that capability or is not that equipment type, then, of course, those requirements would not apply.
	Extensions and Implementation Statement were in the previous version and these sections have not changed.  That would be it.  Mr. Chairman.
	MR. CHAIRMAN:  Thank you, Ms. Rosenthal.  Any comments?  Before we start, actually, it was suggested that we want to make sure that we capture any changes that you may propose.  It may be easiest to write down your proposed change in your hard copy so that one of our staff will come and get that from you and then produce it on the screen and then will return it to you.  So that way, it will capture accurately and a little more efficiently any changes anybody may suggest, so, any -- Mr. Craft.
	MALE:  I had no suggested changes.
	PARTICIPANTS:  [laughter]
	MALE:  Well, that's a welcome change!
	MR. CHAIRMAN:  Any other comments?
	FEMALE:  It's nice to start off this way. [laughing]
	MR. CHAIRMAN:  Is there a motion -- a request for unanimous consent on this?
	MALE:  Also move.
	PARTICIPANTS:  [laughter]
	FEMALE:  I'll second.
	MR. CHAIRMAN:  Okay.  We are motion, a second.  
	MALE:  You actually have to read that for people.
	MR. CHAIRMAN:  Okay.  
	Okay, I'm told that I have to read this for legal reasons, so, there being no further motions to change VVSG version 1, Volume 1, Section 1.7, I will now entertain a motion for the TGDC to adopt this draft of Section 1.1 -- 1.7 as part of its first set of recommendations to the Executive Director of the EAC, subject to changes expressed in any motions we have adopted today that expressly apply to Section 1.7 which changes shall be made pursuant to TGDC Resolution Number 3705.  So do I hear a -- I guess I did hear a second?  And -- and at this point, I'll take a -- we'll take a roll call.  Mr. Green?  (phonetic sp.)
	MALE:  Williams?
	MALE:  (indiscernible)
	MALE:  Williams votes yes.  Berger?
	MALE:  Yes.
	MALE:  Berger votes yes.  Craft?
	MALE:  Yes.
	MALE:  Craft votes yes.  Davidson?
	FEMALE:  Yes.
	MALE:  Davidson votes yes.  Elekes?
	MALE:  Yes.
	MALE:  Elekes votes yes.  Harding?
	MALE:  Yes.
	MALE:  Harding votes yes.  Miller?
	FEMALE:  Yes.  
	MALE:  Miller votes yes.  Purcell?
	FEMALE:  Yes.
	MALE:  Purcell votes yes.  Quesenbery?
	FEMALE:  Yes.
	MALE:  Quesenbery votes yes.  Rivest?
	MALE:  Yes.
	MALE:  Rivest votes yes.  Schutzer?
	MALE:  Yes.
	MALE:  Schutzer votes yes.  Semerjian?
	MALE:  Yes.
	MALE:  Semerjian votes yes.  12 votes in favor.
	MR. CHAIRMAN:  Well, the resolution has been adopted.  I think we've taken a big step for this TGDC committee formally adopting this 1 -- Section 1.7.  
	I declare that we've earned a break here [laughter] so we will take a -- a 20-minute break and we will start at 10:40.  Please come back in time so that we get going quickly.  Thank you very much.
	MR. CHAIRMAN:  If everyone can take their seats, we'll get started.  We're still missing a couple of members.  Guess we're missing.
	FEMALE:  I didn't see him out there.  Alan?  Is this someone else's water?
	MALE:  It's clean water.
	FEMALE:  Excellent.
	MR. CHAIRMAN:  All right, we'll proceed.  At this time, I call on Dr. Sharon Leskowski (phonetic sp.) of NIST Information Technology Laboratory to present the report on human factors requirements in VVSG version 1.  Dr. Leskowski?
	FEMALE:  Thank you.  Before I start, is there going to be a little discussion of the editing process?  If there's -- if there's changes or?
	MR. CHAIRMAN:  We've been discussing how to do this most efficiently and the suggestion is that we -- if there are specific changes, suggest that first of all, you please write it down on your hard copy.  We will try to address them and come to an agreement, you know, but once we (indiscernible) there are several of these.  Before we vote on the entire section, what we will do is we will take those changes, create a modified version of the -- of those modifi -- of those pages, and then take a vote on the entire section so that when we vote on it, we know what we're voting for and you actually can see the changes made so that there's no debate later on so -- which means that we will -- we -- in some cases, we will discuss one particular section, have discussion and some changes, but we will not take the final vote on that until later, so we'll proceed to the next section, and then once the document is modified, we will come back and vote -- take a final vote on the modified section.  Is that -- is that a reasonable approach?  Because otherwise, either we'll be voting without seeing the final version, or it's going to take very long if we don't do some parallel processing, so.  Hearing no objection, I think we'll proceed with that unless the changes are very marginal, so.  All right.
	FEMALE:  Okay.  Thank you.  
	I'm going to be talking about the human factor section of the VVSG version 1, which is Section 2. -- 2.7 in your binders.  There we go.  
	Quick overview.  I'm going to do a quick discussion of our goals for this section, then I'll be talking about, sort of, just the general overview of the changes from the March 9th version, and then I have a couple slides that outline key decisions and issues that arose in producing this current draft.  
	So our -- our goals were first to focus primarily on the voting equipment, but there is some -- some discussion about polling place setup, but mainly voting equipment.  Because accessibility's called out so clearly in HAVA, we spent most of our time to try to get as comprehensive a set of accessibility requirements as possible and these were derived primarily from the VSS 2002 and then from other sources, Section 508, IEEE, P 1583, et cetera, as appropriate.  And in general, and this comment applies for all the sections actually, if we were trying to make a distinction between sort of what is sort of clearly being met today and make sure we capture that, but -- and if, as Mark Scull pointed out earlier, if something required some research and we weren't sure and -- or -- that we did not include it and then there's these things, kind of, in the middle.  Something wasn't readily achievable with current technology for 2006, we said we should at least point the way, so let's put it in as a should rather than a shall so it's a recommendation rather than a requirement because we felt then that would give everyone sort of a head's up as to what's coming in version 2.  Although I will point out that there are several of these -- that (indiscernible) the boundary between shall and should and their value judgments so we did the best we could try -- based on what we know about the existing systems in making that determination, so I imagine there, perhaps, may be some discussion on (indiscernible).
	MALE:  Mr. Chairman?
	MR. CHAIRMAN:  Yes, Mr. (indiscernible).
	MALE:  Can I ask a question?
	MR. CHAIRMAN:  Yes.
	MALE:  Great.  Just to understand you correctly, you were then defining readily achievable in a shall context?
	FEMALE:  That's correct.
	MALE:  Okay.  And a should, then, is more of, you know, the future because it was not universally agreeable as readily achievable.
	FEMALE:  That's correct.  And in some cases, we knew of some systems that currently did implement it, but -- but not all existing and that would require some re-engineering to achieve.  That was kind of how I made those decisions.  But, as I say, you know, we're not perfect in our value judgments, so we did the best we could.  
	MALE:  Thank you.
	FEMALE:  And another -- something new that you will see is evidence of summative usability testing.  All we ask in the requirement is that a test with users as appropriate is done and there is a standard for how to run those tests and how to report on them.  It's an (indiscernible) standard common industry format for usability tests.  We don't require anything but that test at this point, but this points the way to the future for when we do have some performance requirements.  A (indiscernible) for the usability requirements, there weren't that many.  There were a few design requirements in the VSS 2002, but there wasn't a usability appendix that was just informative, so we mainly took existing guidelines from those sources, mainly the design guidelines, and then we, again, put in these -- this requirement of doing some usability testing, but didn't specify anything about those tests.  The thought being at least people will start to become familiar with what we mean by usability testing, what it entails, and -- and take a look at the standard, et cetera.  
	We have a few privacy requirements that were focused on the voter interacting with the equipment.  So I'll talk briefly about those, but -- but there're not very many of them.  And we note that version 2 will have substantial changes and expansion.  
	Changes from the March draft.  We did heavy editing of the accessibility section and that included addressing comments from the access board and I will point out that two days ago, I did get some additional comments from the access board, so we might wanna discuss that as one of the issues of how much to incorporate from that.  In those versions, it's mostly wordsmithing, I believe.  
	The usability requirements were based on the outline we produced from March 9th, the minimal design standards at this point.  We added the small privacy section gleaned from existing requirements which just talk about configuration at the polling place to preserve privacy, not identifying features on the record of the vote, say, via how you -- if you use some specific accessibility component to vote, et cetera, and preserving privacy in absentee ballot handling, very high-level requirement.  Again, just pulled out from existing requirements.
	Okay.  I'm going to -- to list some specific changes and then go into decision points and issues.  
	We have a requirement for functional equivalents of all alternative formats.  We did some restructuring.  Included in restructuring was pulling out alternative language requirements in a separate subsection.  We specifically incorportated -- that's ABA, little typo there -- and ABA guidelines.  We reformulated the reach envelope for wheelchair accessibility.  We added an automatic universal reset after someone sets to vote so they've adjusted any particular settings on a DRE, for example, they would automatically reset for the next person.  We put in some recommendations.  These are shall clauses: to synchronize audio/video, some people call it "dual audio/video."  Should.  Yes.  Should.  Thank you.  The ability to control the rate of speech in an audio ballot; the use of recorded speech on an audio ballot as opposed to synthesized speech; skip navigation for referenda and contest an audio ballot; accessible verification for those who are blind if there's a verification component in the voting equipment; and sip and puff.  I have gotten some comments about the sip and puff to make that a little more general to deal with different motor skill disabilities from the access board, so we will be looking at those comments.  
	All right, so to the thornier issues.  We organized accessibility requirements by disability.  This is different from the way Section 508 is organized, but we found that -- that it worked for us.  There -- there are some requirements that support different disabilities and we so note, so there is some crossover, but because a voting system is used for a very specific task, we found that this organization worked in this case for this kind of standard.  We had a lot of discussion about which features should be required for an accessible voting station as opposed to which features would apply to all voting stations.  So, for example, having an audio interface, that's clearly applies to an accessible voting station.  Control of font size applies to all DREs, whether or not it's the designated accessible voting station.  To have redundancy of color coding in the user interface applies to all voting stations.  For low vision, you should have minimally two font sizes.  But what about VVPAT and a paper roll?  These -- these -- so some -- some of these we made should clauses for low vision because of this issue with -- with -- you want to address some low-vision two font sizes on all the systems because many people have, you know, because it helps a lot of people, seems like a general -- in general, a good thing to do.  Was unclear to us what to do about VVPAT, though, in -- in that case because of the -- with the paper rolls, et cetera.  We do say that all accessibility and usability requirements apply to VVPAT across the board. 
	And we've got a general question about the shalls versus the shoulds.  Do we have the right balance?  Do we move some to shalls?  Do we move some to shoulds?  I -- I was at a recent meeting at the EAC on -- for an accessibility discussion and -- and someone in the audience said, "You should have the omit no should philosophy."  And we like that because it puts in placeholders for future work and future standards that would be coming, so and -- and when I look through, we did more or less follow that philosophy.
	My second -- second slide of decisions we made, we require the initialization of this voter settable attributes.  That is, it's a shall clause that resets -- should it be a recommendation?  
[End of Audiotape 1]
	FEMALE:  -- justment to set up the accessible work voting station for a person coming to use it in accessible mode.  We did not put that in at this point.  Is it -- should that be a sub requirement under initialization of voter settable attributes?  
	We did not include anthropometric requirements.  The IEEE P-1583 did talk about them.  They referred to an old military standard for measurement that we know is outdated and only applied to soldiers, and we're aware of a much better seizer data that Wright-Patterson Air Force Base collected across many different populations.  But it's very difficult to know how to apply anthropometric data to specific piece of equipment and people often misuse that data.  So we decided that needed more research.  We did not include it.  
	We have no guidance specifically for cognitive disabilities although I will note at this point, I will note that many of the requirements that are in there now help to reduce cognitive load in different ways and that will also help with cognitive disabilities and we might want to think about calling those specifically out in the next version and also looking at some other approaches to make sure we've covered that well.  
	We do require vendors to perform target (indiscernible) usability tests, but there are no benchmarks associated with them.  And they can run those tests however they want, just show proof that they've been run.  
	We have minimal usability design standards at this point and these -- because these were interim requirements pending the development of performance requirements.  And we didn't want to do complex design standards 'cause they're difficult to prove or measure and we have this plan for performance requirements for version 2.  So that's why we took a minimalistic viewpoint.
	And those are kind of the highlights of the -- the issues.  I can -- I can back up if we need to look at that list of decisions.  And I suspect folks have some specific issues they want to talk about.
	MR. CHAIRMAN:  Thank you, Dr. Leskowski (phonetic sp.).  Any questions or comments?  J.R., did you have a?
	MALE:  Yes, sir.  I would definitely like to include a shall with the automatic setup, startup system there.
	FEMALE:  On the accessible systems.
	MALE:  Correct.  
	FEMALE:  Mr. Chairman.
	MALE:  Chairman, where is that chair?
	FEMALE:  Yeah.  I'd just like to say something as sort of echoing something that Sharon said.  I'm sure that people may have specific comments on other sections.  There are two things.  One is we have received a fair number of direct comments that were submitted to voting.nist.gov that have what I -- what I believe are small wording changes that people think will clarify the intent of the comment and I don't intend to bring those up here in the theory that they can be handled as general editing.  But there are a few of the cases where as presented, we've opted to take a recommendation approach rather than requirement approach, and I think those might be useful for us to address directly in an orderly manner and look at those requirements specifically, actually read them together so that we're very clear on what it is we're requiring now.  I would also note that in the language of the document that we have in front of us, many of those should recommendations also include a discussion that they will become shalls later as a way of putting a stake in the ground that while we're not requiring it for this -- this round, that by the later round, so I think these are well worth having some discussion and input from the full committee.
	MR. CHAIRMAN:  Would you like to walk us through these, you know, in the section?  We have line-item -- line numbers --
	FEMALE:  Yep.
	MR. CHAIRMAN:  -- to facilitate the discussion, so if you -- if everyone could go to their blue binders, the sections are -- are marked as Human Factors is starting at 2.27.  
	FEMALE:  I suppose what I could do is bring up my first big issue.  We could either go through those and then go back through -- I mean, it might be helpful to go in numerical order so we're not flipping back and forth a lot.  The first thing I'd like to discuss is on page 2-16.  And it's -- I'm not going to read the 227s 'cause they all start with 227.  It's section 2271219.  And the language of this section says "Any voting station using an electronic image display should also provide synchronized audio output to convey the same information that was on the screen.  The discussion is that synchronized presentation of information in both visual and oral modes is a recommendation in this version, but as anticipate that will become a requirement for future versions."  I'd to suggest that it be a requirement in this version.      
	MALE:  Mr. Chairman.
	MR. CHAIRMAN:  Yes, Mr. Craft.
	MALE:  At this time, there really is only one of the major three vendors and I limit my discussion to the major three: Sequoia, ES&S, and Diebold because they have such a large footprint on elections nationwide.  Diebold is currently the only system that has the audio/video simultaneous.  Both ES&S and Sequoia are working very hard to bring out a system that will give you this capability, but I think until it's something we see all the vendors can reach, it's dangerous to make it a should for the '06 elections.  We may find ourselves in a position where we can't comply with our own standards.
	FEMALE:  I guess I'd like to go back to the discussion we had earlier.  It is certainly technically capable, feasible, it can be done; we have actual proof that it can be done.  We have proof of intent to do it.  And we know that at least some vendors are -- that some jurisdictions are complying.  I think this in -- in the interest of making this a best -- best technical practices, well.
	MALE:  Well, while it can be done very factually, we are now 8 months, if my math is correct, from the deadline.  These things have yet to be produced.  After they're produced, they must go through the certification process.  After they go through the certification process, they must then go through the purchasing process of the governments that are going to acquire them.
	FEMALE:  But isn't this a grandfathering question?
	MALE:  I don't think it's a grandfathering question.  I think it's -- if you make it a should as a requirement that we very frankly don't know if we can meet in time for the election.
	FEMALE:  Mean shall.
	MALE:  Or shall.
	MALE:  Yeah.
	MALE:  We don't know if we can meet it in time for the election.
	MR. CHAIRMAN:  Secretary --
	FEMALE:  Oh, I'll let someone else speak.
	MR. CHAIRMAN:  Yeah, let me.  Go ahead.
	FEMALE:  You know, we all understand that it -- it needs to turn to shall, but I was on that committee and I took a very hard line that it should be should because we just cannot meet it for the 2006 or we're going to be saying you're only buying from one vendor.  And I think that possibly, that's what we're looking at.  And that could be a problem.  They couldn't even meet the demands if we ended up with one vendor in such an area like this.  So there's a lot of problems and I -- I understand the need to turn it into shall and think that's exactly what we need to do, but with it coming up, the should is -- that's the reason why we took this approach.
	MR. CHAIRMAN:  Yes, Dr. Williams.
	MALE:  We -- we've got to look at the objective we're trying to achieve here.  We're trying to help -- to assist people to make decisions for systems to use in November 2006.  This is not going to have any impact on the state of Georgia.  We've got a system in place.  This is going to impact those 615 jurisdictions out there that are still using paper punch cards and lever voting machines that need to make a decision.  And if we put a shall in here, we're -- we're restricting their choices because they've got to choose according to these guidelines, not the previous standards.  So I think we need to be very, very careful what we put in here because we're gonna -- gonna whittle everybody's choices down to the point where there are no choices.  All -- to go back a couple of pages, there are several of these that require things to be done under the control of the voter.  There's -- there's not a system out there right now that -- that allows the voter to manipulate contrast or what have you.  Well, Diebold has just -- has just come out with a -- where the voter can change contrast and oh, size.  Type size.  But nobody allows them to change (indiscernible) controls on the Realstat-type (phonetic sp.) controls on the voting machines where the voters can turn things up and down.  Those are set at the time that the voting station is set up.  And so, again, if we put those kinds of restrictions in here, we're basically eliminating practically, well, I think all of the systems on the market.  So we -- we need to look at who we're trying to help here.  We're not -- we're not trying to help people that already have systems installed; we're trying to help people that are -- that are faced with a decision.  They're -- they're looking at HAVA that says you've gotta get rid of that punch card, you gotta get rid of that lever machine and if we publish this -- whatever we publish is what they've got to adhere to and if it gives 'em no flexibility, then it's a moot document.
	MALE:  Mr. Chairman?  Mr. Elekes.
	MR. CHAIRMAN:  Yes, go ahead Mr. Elekes.
	MALE:  Okay.  The question I'm hearing is directed to the -- the governmental entity that has to purchase the equipment or the individual that appears to have to manufacture the equipment.  Having been blind for 27 years, the technology for adjustable font sizes, contrast, has been engineered since the mid-90s.  It has been available on the commercial market since that time.  So we're basically making excuses for people who have failed to keep current with the technology when they're manufacturing or designing equipment and to delay what is ultimately the accommodation for the end user, we're falling short on the accessibility section if we don't make sure it is a shall.
	MALE:  Okay.
	MR. CHAIRMAN:  Dr. Williams.
	MALE:  My -- my objection was not to the large font sizes.  All of the -- all of the current systems, again, you know, we get back to the big three, they can all do multiple-size fonts.  What I was referring to is controls on the voting machine where the voter themselves can alter the configuration of the voting machine.  We went through this with the -- in the IEEE procee -- committee.  And the initial 2002 standard, in fact, had provision in there for the voter to be able to control on a graduated scale, contrast and font size.  And that's just not implementable.  What -- what you could do is say okay, you've gotta have two font sizes, this little one and that big one.  Or you've got to have two -- two contrasts, one black and white and one whatever else.  But to allow continuously variable controls under the control of the voter, you eliminate every voting system on the market.
	MR. CHAIRMAN:  Okay, look, there are two questions.  Before we go there, I think we've expended discussion here from this particular case to other, so I'm not quite sure how to handle this.  I -- I would suggest that we go ahead and make some -- at least have some discussion on these cases where you may wanna change from should to shall and -- because otherwise right now, we're talking sort of in a vacuum, not having a particular point of reference.
	FEMALE:  I mean, in this case, are you suggesting that a shall be a should, so one -- one solution is to simply go numerically through it, not reading them all but just making sure that we're.
	FEMALE:  'Cause I don't think there's that many.
	MALE:  Mr. Chair, can I comment before we go into that?
	MR. CHAIRMAN:  Well, I'll take.
	FEMALE:  (indiscernible) as they come up and deal with them.
	MR. CHAIRMAN:  I'll take Secretary Davidson and then Mr. Berger and then Mr. Craft.
	FEMALE:  I was just wanting to make a statement that if we put something in place in our standards, they are volunteer standards.  And my goal is to have every state utilize these volunteer standards.  But if we put things in there that they can't meet, they're going to back off from it.  
	MALE:  Right.
	FEMALE:  And I think that is a mistake, so I think that we have to proceed and keep in mind what is capable of being done by 2006?  That is a time frame that we're meeting is fastly approaching every state.  So I guess that's my -- just a real philosophy that I have.
	FEMALE:  I hear it and I -- I agree that creating standards that people will simply reject is an exercise in futility.  The thing that I just heard that disturbs me is this came up in 2002, it was admitted in 2002, we're three years later, I mean, that -- that we -- one of the things that I like about the solution that the staff came up with, which is to put in a should clause here that points forward, essentially puts a stake in the ground that we move forward.  We may simply vote to leave things shoulds that are shoulds.  We may vote to change shoulds to shalls and so on, but for me, the important thing is that we begin to say it's time to begin to move forward, to really think about what it's going to take to create truly accessible voting.  And that we do that in a way that will not just delay it forever.
	MR. CHAIRMAN:  Well, let me suggest something, maybe it will sort of get away from this.  Obviously, we have some strong opinions on both sides.  I guess the concern is unless we make a decision, it will just keep on getting delayed and delayed.  One possibility is to, in the discussion section, instead of saying "but it is anticipated that this will become a requirement", can we change that section that says "but this will become a requirement in version 2"?
	FEMALE:  I don't think we can say more than it's anticipated or that we plan to because until we vote on it, it doesn't exist, so.
	MR. CHAIRMAN:  No, but I mean, if we vote on that change leaving the should but saying "this is a heads up in the next version which will apply to elections after 2006", it will become a requirement which means that we will expect this to be part of version 2.  Would that address the concerns?
	MALE:  I'm not confident it would, sir.
	MALE:  I -- I think I've been misunderstood.  Let me give some specific examples if I may.  Look at section 1212 on page 214.  It says, "You shall display all information at least two font sizes, under control of the voter."  Now, if you interpret that to mean that the voter can tell the poll worker which font size he wants, then that exists right now.  If you mean a switch on the voting system where the voter, in the process of voting, can change that, it only exists on one system.  So -- so what I'm suggesting is we take out that "under control of the voter" that -- that -- we have the capability to display the font sizes.  We require the dis -- capability to display the font sizes, but it may not be done by the voter themselves.  It may have to be done by the poll worker at the time they activate the voting station.  
	MALE:  Bert (phonetic sp.), I'm not sure all three basically can do it even with a poll worker.
	MALE:  Can I comment here?
	MR. CHAIRMAN:  Yes.
	MALE:  I -- I'm concerned about the nature of the discussion we're having here.  And I'm concerned that this committee may degenerate into a consumer reports kind of evaluation of what's currently on the market.  I mean, if all our considerations at this point are which are the systems on the market, what -- what can we do given the market, we have a problem here.  I think I'd like to see us if possible elevate the discussion to that of principle and see where it is we're going.  And we've got two documents we're trying to produce, VVSG 1 and VVSG 2.  VVSG 1 is admittedly directed at the more near-term, but even given that, I think trying to look at every line of this document and view what's on the market is probably a mistake and we need, instead, find a mechanism for grandfathering.  That is to say, if this committee in its judgment views that, you know, this principle should be a shall at this point and it causes problems, there should be a process by which a state or the EAC could say, you know, this is not something that's going to be enforced, you know, that strictly now.  We can proceed on that basis so that. This consumer reports attitude is saying this doesn't exist now, you know, you can't buy that.  You know, is a process we get locked in to what the decision's made by the vendors to date, you know, in their wisdom or lack of wisdom as the case may be on the particular features and I feel this committee can -- can raise the level of discussion above that a bit.
	MALE:  Mr. Chairman?  Mr. Elekes.
	MALE:  Mr. Chairman, point of order.  You said Mr. (indiscernible) was gonna go next.  
	MR. CHAIRMAN:  Yes.
	MALE:  And then I was going to go beyond that.
	MR. CHAIRMAN:  Yes.  Thank you, Mr. Craft.  I'll get back to you, Mr. Elekes.
	MALE:  Thank you.
	MR. CHAIRMAN:  Mr. Craft.
	MALE:  It's Mr. Berger going now.
	MR. CHAIRMAN:  Sorry.  Mr. Berger.
	MALE:  Mr. Chairman, let me ask a question first.  I actually have some comments and I would be ready to make a proposal on 712, some subsections there.  But I think Ms. Quesenbery had a suggestion on a different section.  Do we want to close that section and then move to this one?  I think right now, we're kind of moving between two sections.
	FEMALE:  I think we're jumping (indiscernible).
	MALE:  Well, I'm waiting to comment on that.  I would prefer not to close it.
	MR. CHAIRMAN:  Why don't we recognize Mr. Craft and then I'll make a ruling.
	MALE:  Okay, Mr. Chair.  As you're aware, we have all had very limited time to review this document.  This particular piece is about a half inch thick.  It is fairly complex.  It has a lot of issues in it.  What I would like to see is a traceability matrix that will show us basically that what I believe is the Congressional intent comes into this section.  And I think the Congressional intent was that the mandated requirements for accessibility in the 2002 FEC voting systems standards will flow into this document.  The optional accessibility standards in the 2002 as to audio ballot will come into this version of the standards and lines 9 to 16 on page 212 which is extracted from HAVA will be given effect in this document.  Everything else here, the shoulds, I have no disagreement with.  I have no disagreement with the EAC putting a stake in the ground at some point and making those absolutely mandated requirements, but I'm telling you right now, some of the shalls in this document will prevent a great number of jurisdictions in this country from being able to comply with these standards and for many of them, it will leave them no option for complying with these standards, which will lay a good groundwork for a legal action have these standards set aside.  So I -- I cannot support this section unless I have a high level of confidence that this will mandate nationwide the best of currently available accessibility in voting systems.  And there was a gentleman who commented that many of these accessible items had been in place for years.  That's true.  But they have yet to be integrated into voting systems and successfully used by voters.  That is where I believe we need to get.
	Also, on lines 41 and 42, we've got this statement that each ballot cast shall capture the intent of the voter who cast that ballot.  That is not a human factor standard.
	MR. CHAIRMAN:  Which page?
	MALE:  On page 210.  Lines 41, 42.  There is no human factors standard for reaching into the mind of the voter and taking data out.  Systems must be designed so that they facilitate the voter's ability to express their intent, but not to capture their intent.  You can't do that.  
	FEMALE:  I would point.
	MR. CHAIRMAN:  Excuse me.  I tried to play the referee here and not express opinions to the extent possible.  But I very much agree with the opinions -- the opinion -- the statement made by Dr. Rivest in the sense that these standards should not be controlled by what is actually available because that doesn't mean that the technology is not available; it simply means that that particular technology has not been utilized in a particular application area.  If the technology wasn't available anywhere, then I would agree with that, that we cannot count on the technology to be developed in the given time frame and make it available for a particular application area.  So I'm not necessarily pushing for definitive rule making saying these shall be used, but I think unless there is a stake put on the ground saying okay, we realize the time frame is such that it may not be available, you know, over the next 12 months, 8 months, whatever the appropriate time frame is, but unless we put a stake in the ground that says this will be -- this is the rule, perhaps, as of such-and-such date, so that this is a head's up, basically, to the vendors that you can't delay this.  
We realize the practical aspects of this, but you -- we cannot continually delay it, that this is a heads up, this is coming, and the technology better be there for the next round.  So somehow I think we need to get that message across and that was what I was trying to do.  But let me.
	MALE:  (indiscernible) a sponsor.
	MR. CHAIRMAN:  Yeah.  Well, I think Mr. Elekes has been waiting so let me capture his comment and then I will come back to you, Mr. Craft.
	MALE:  Okay.
	MALE:  Thanks, I appreciate it.  Basically, you stated what my considerations were.  The other issue is that I believe it was Dr. Williams brought up, and I just have to make a point of accessibility.  Presently, the voting systems may not require the individual to touch the voting machine to adjust the contrast or color or font size.  We are seeking, based on our reading and unless I'm misreading it, the interpretation of HAVA that regardless whether the voter has a disability or not, it is an independent voting process.  If you require someone else to physically adjust that, the voter does not have the ability as a non-disabled person does to independently vote.  They have to require the assistance of a poll worker who may not have had appropriate training or any other myriad of facts, so those components have to be built in and have to be available if you are truly going to have an individual with a disability who is an independent voter.
	MALE:  Dr. (indiscernible) one more statement. 	
	MALE:  I'll -- I'll read from -- from the guidelines that the overview that Mr. Scull gave.  Version 1 is intended to assist state election officials in preparing for the 2006 election, and then down below there, version 2 has changes that cannot reasonably be made and tested in time for 2006.  I have no objection to delineating all of these things that can be -- that will be done after 2006, but I think that the way we've got them intermixed right now makes this document almost impossible to -- to read by the people who are anxiously waiting for it.  Maybe what we need to do is separate these out and have here's -- here are the things that can assist you in 2006.  Pick those out and (indiscernible) like them and then put the heads up for what's coming up in another section.  
	MR. CHAIRMAN:  Mr. Craft and then Ms. Quesenbery and then Mr. Berger.
	MALE:  Well, Mr. Chairman, I agree with you.  I like stakes in the ground and there are probably some voting system vendor reps in the audience who are a little confused because we have, in fact, in Florida, driven a stake in the ground for July 1.  But in Florida, we began the process of getting newer technology out there back in 2001.  We have recently begun very aggressively pursuing accessibility, and all I'm saying is, don't drive that stake in the ground at a point 8 months away where you're going to fall on it.  Let's drive it in the ground.  Let's make the vendors comply with it.  But to attempt to force that by January 1, particularly for those counties who were still on punch card, on paper ballots, on lever machines, even the window for them to train their poll workers to use that stuff is rapidly closing.  The windows for voter education are rapidly closing.  I think what Congress intended, once again, was to take the current state of the art in voting system accessibility, which is the audio ballot, and mandate that jurisdictions across the country get up to that standard.  And the backside of the sword, if you go forward with the shoulds and if you mandate things that can't be met, if you wind up with this standard being thrown out in court because it contains things that can't be met, the backside of that sword is people who need this accessibility in these systems, who need the audio ballots across the country will not have them in '06.  And I think it is better to go forward, give them the stuff that's there now, let these jurisdictions go ahead and buy it, start training with it, start using it, and then to set a good stake in the ground, if you wish, for the next upgrade.  And I started out with Dr. Williams came back to.  This section needs to be condensed so that those shoulds are fairly obvious and the jurisdictions out there trying to make decisions can very quickly narrow down what they've got to do.
	FEMALE:  If I might suggest, it's easy enough to just make the shoulds in a gray instead of black in the document to make that clear, or some other, you know, technique.
	FEMALE:  Could I speak, please?
	MR. CHAIRMAN:  Ms. Quesenbery.
	FEMALE:  Can I speak please?
	MR. CHAIRMAN:  Yes.  Ms. Quesenbery.
	FEMALE:  I'd like to say two things.  First is that one of the reasons why I think that the should should be integrated in this document, although I do agree that they should be culled out visually separately so it's a little easier to find them; I keep going through and highlighting them with my orange highlighter.  So the fact that I'm doing that means that probably other people need something like that.  
	If you isolate them in a separate section, they will never be read.  They will never be looked at, and they will never be considered.  This document has a structure that may or may not be the perfect structure, but it's a structure that has some integrity.  And in general, I think we're talking about general principle and then here's how it should be met.  
	I'd also like to suggest that, I think we've sort of heard the general discussions.  I'd like -- I'd like to move from a general statements principles to looking at specific sections.  We may find that there's a small number of them.  We can resolve it either -- either by vote or by general consent, and that we will end up with something that's not quite as contentious as it may seem when we simply argue principle.  
	MR. CHAIRMAN:  Mr. Berger.
	MALE:  Well, I have a suggestion and I'd be willing to make it a motion if it finds general favor.  That would be that the equipment-related requirements we make effective on new submittals for certification 9 months the EAC adopts these doc -- these guidelines.  That would say that equipment out in the field, we're not dealing with.  Individual election officials may choose to impose additional requirements.  That's certainly their prerogative, but to me, that would be a reasonable time frame, 9 months after this, a vendor brings in a new system.  Here are the requirements.
	MR. CHAIRMAN:  I -- I'm not quite sure how that fits in with this should and shall business.  (indiscernible)
	MALE:  Well, I think that makes it easier to make shalls because certainly from this point to 9 months after the EAC would adopt these guidelines, in my -- my view for many things, makes it quite reasonable to make that a shall.  And that gives a time frame, I think, that election officials could -- could work with as well.
	MR. CHAIRMAN:  But it does not address the issue of which ones will stay as shall for this election.
	MALE:  Yeah.  But what it -- what it does do is as we had that discussion, there's a specific framework which we can look at is that a reasonable requirement.  Is it a reasonable expectation that multiple vendors can meet it in -- in that time frame.  
	MALE:  There are several shalls we wanna keep.  
	MR. CHAIRMAN:  Mr. Harding?  Did you have a?
	MALE:  Yes, thank you, Mr. Chairman.  
	Accessibility and disability issues, historically, have always been a back burner, and after-a-fact issue.  And so from one standpoint, I would agree with Whitney (phonetic sp.) that inclusion throughout the principle documents on accessibility matters is essential as any equality issue, recognizing it as an equality issue.  
	Then at the same time, having the issue of the '06 and '08 on a stake in the ground issue.  I believe Mr. Craft and Dr. Williams raised a significant issue here, that we're on a very tight kind of walkway here and it's not the issue the consumer report kind of thing, it is reality, it is politics.  These are everyday lives.  And we must be very careful that we do not inadvertently do away with all of this work by setting expectations for failure in '06.  Because if we screw it up, a whole (indiscernible) can come out from underneath us.  And so by having two separate -- separate documents as -- as Dr. Williams was indicating, this is what we believe is doable; this will be done in '06; and having that stake in the ground for the '08, I think, is a very prudent court -- course of action.  So I'd leave it there.
	MR. CHAIRMAN:  Thank you.  Dr. Schutzer.
	MALE:  I -- I think there's one thing we might be missing, so I was thinking about what we were talking about, you know, the idea that gee, it's bad to put something in if there's only one vendor 'cause then you're sort of like requiring everybody to buy that vendor.  So use that same example, the audio since I know something about that technology.  I'd like to point your attention that actually to implement that audio is simply a software module that you add on.  Doesn't really do anything for the hardware, works on all the existing operating systems and so forth.  I put that technology in myself.  You just buy another package from some of these software vendors.  It's not a very expensive package which means that it's equivalent, let's say, a software security patch to put the thing in.  Which -- so -- so in that particular case, the issue is if I went to buy another vendor and they didn't currently have it, I'm out of compliance spec.  It wouldn't be so terribly impossible to upgrade that particular device.  So perhaps some of the reasons it's not in all the different vendors' equipment is because it's not a current requirement, and so therefore, they don't find the necessity of doing it became as requirement, or might find there would be quickly a software patch to provide that.  And not one you have to write; one you could buy from a standing vendor.  
	MALE:  Mr. Chair.  All three of the vendors currently employ audio.  What is at issue here is audio/video simultaneous, the ability to speed up and slow down speech, the ability to adjust contrast on the screen independently by the voter.  The reason, frankly, that two of our vendors cannot reach audio/video simultaneous right now is because they were both very proactive and back in 2000, both Sequoia and ES&S charged ahead on audio ballots, and they looked at the state of their architecture on their systems and they realized the best way to implement audio ballot was to set up basically a separate processor; the DRE machine becomes two computers in one.  One handles audio; one handles video.  
	Diebold came out a little later with the audio ballot, realizing there was a need for simultaneous use of audio and video, and had a platform that would support it.  Basically, ES&S and Sequoia are paying a cost now of being behind in the market based on very prudent effort to bring accessible devices out in the market.  
	That said, for both of those companies, they've got to come up with a radically-changed architecture for their DRE in order to meet the audio/video requirement.  I believe they are both working on that very aggressively.  Florida has pushed them, and I believe we will see solutions available for testing in September/October.  That said, it doesn't pass and it can't be used until it does pass and when it brings it in, if we knew it was going to pass, we wouldn't have to test it.  To have those devices become available that late in the year with a need to certify them and counties sitting out there trying to figure out what to buy, you simply can't require that they buy that because you can't tell if it's going to be there or not.
	MR. CHAIRMAN:  Mr. Berger.
	MALE:  I think Dan brings us an important example and I would point out and I think we need to do our work with a mindset that after the simplest change, the vendor has to do aggression testing to make sure there are no unintended consequences of that change, then there's a process of re-certification and then if there's an election imminent, there's a deployment time.  I would say all of that's at least 12 months.  And we really need to do our work with the mindset that from the simplest change, it requires virtually no engineering effort.  You've got a 12-month process to have that effectively deployed.  
	MALE:  At least.
	MR. CHAIRMAN:  Yes, Dr. Schutzer.
	MALE:  I know, but we were discussing this and we -- we know this is not a one-time deal.  I mean, we will find that technology will continually advance every year.  And the bar will continually be raised every year, so we're always gonna be sitting there with new systems and fixes that will be coming in for the current elections that we've chosen, even if it's a simple software fix.  Logistics will just prevent us from effecting those security patches, those software upgrades, HAVA add-ins, whatever.  But it doesn't mean that if you know that today's technology is such, I mean, we don't write these specs and want to re-write them every 6 months or every year just to accommodate the fact that, you know, the logistics is such that it'll take a year to do regression testing.  So why not put it in and then we had a resolution there, I think, grandfather clause that says, well, each municipality has to use his own judgment.  Clearly, if the city with equipment that -- the city logistics, the regression testing, all that kind of thing they can't accommodate in the coming election, so they put it in in the next election, after they've done the testing, but do you want to degrade the technology for that, or the unfortunate choice of architecture makes it a little harder for one vendor than another vendor.
	MR. CHAIRMAN:  Secretary Davidson.
	FEMALE:  You know, I -- I understand and -- and it does take 12 months, you know, at least.  And technology does change daily.  But I think if we put something in here and it says shall and we do have the resolution that gives the others the option to (indiscernible) where they're at, but still putting in shall, sets them up for a court case that I think that I -- as an election official in Colorado, I would have a real problem with doing that to my cohorts.  
	MR. CHAIRMAN:  Ms. Quesenbery.
	FEMALE:  Chairman.
	FEMALE:  Well, I just -- I hear the argument and what I would like to do is consider it on an item-by-item basis.  As I suspect, listening to the kind of examples that we've used, that we may actually have very few places where we wanna say this should be a should, where we're putting that soft stake in the ground, we're saying we're going to consider it later so that -- so that people -- so that vendors and officials can begin thinking about where they're going in their development, but not making them hard shalls now.  I think that was the philosophy that the NIST staff tried to take and it may be that we have much less problem than it sounds from this discussion, if we just look at the specific sections we're talking about.  Perhaps I could ease this by saying well, you know, and we could either just take a voice vote or just -- just maybe go through and confirm that we like the shoulds or shoulds, that we have some shalls we'd like to move down to shoulds, there may be some shoulds that should move up to shalls, but maybe we could very quickly go through this section looking at the specifics rather than talking in generalities.  I agree.  I -- I would like this to be a document that is useful, that moves the art forward in a meaningful way and that doesn't cause more problems than it creates.
	MR. CHAIRMAN:  Yes.  Secretary Davidson.
	FEMALE:  My closing remark would be -- and I agree and I think everybody here at this table does agree that the shoulds is -- is initially.  The shalls, we definitely want in version 2.  I mean, you know, that we want to move forward.  We're not saying stand still.  We want to move forward.
	MR. CHAIRMAN:  Okay.  I -- I think that that's a good approach because that way, we'll sort of size up the magnitude of the issue and I think we can come up with an approach.  Perhaps we'll address this if it turns out to be a major concern.  So why don't we then?
	MALE:  (indiscernible) 
	MR. CHAIRMAN:  Do we -- do we have a comment from the phone?  Hello?
	MALE:  No, not comment from here.  Mr. Elekes.
	FEMALE:  No comment from here.
	MR. CHAIRMAN:  Okay.  Thank you.
	All right, then why don't we go ahead, Ms. Quesenbery, and walk us through these and at least identify the question -- the issues.  Could you?  You're?
	FEMALE:  Yeah.  If we start on, I think page 13 is the beginning of the first substantive stuff and just to call out the page number, let everybody look at it, read it a sec, and see if we have anything that we wanna offer changes to.  So, 13. [laughing]
	MR. CHAIRMAN:  Well, do you want to point out where the shalls and the shoulds are?
	FEMALE:  Oh.  Okay.  So the first one is that -- is a general statement that it shall incorporate features that are applicable to several types of disabilities.  The second, 1.1.1, looks for is a general principle to be followed for alternate formats that they shall be, you know, equivalent, that -- that things for that in one format are also presented in another.  1.1.2 says that accessibility -- that providing accessibility does not require personal assistive devices; that is, the voter is not required to bring equipment to the polling place.  1.1.3 says that if biometrics are used, that there shall be another -- that there shall, excuse me, be another means of using identification, for instance, if you can't sign your name, there's an -- I think most states already have this in place -- and the last one on this page is that polling places shall conform to ADA and ABA.  
	Moving on to page 14.  1. -- yeah -- 1.2 is a general statement.	
	MR. CHAIRMAN:  Can -- can I -- can I just get a quick pause here.  It seems to me like 1.4, do we have an issue there?  We shall conform?
	FEMALE:  [laughing]
	MALE:  (indiscernible) 1.4.
	MR. CHAIRMAN:  Beg your pardon?
	FEMALE:  [laughing] We don't -- we don't get to have an issue.  Mr. Harding said --.	
	MR. CHAIRMAN:  Well, that's my point, so I mean that there are some things that are given.
	FEMALE:  Yeah.  So, I mean, I think.
	MR. CHAIRMAN:  So maybe we can sort of mark them up and say okay, there's no issue here.
	FEMALE:  Yeah.  I think silence is consent (indiscernible).
	MR. CHAIRMAN:  Is it, though?
	FEMALE:  (indiscernible) 
	MR. CHAIRMAN:  Okay, so we have no problem with any of these shalls --
	FEMALE:  Right.
	MR. CHAIRMAN:  -- on page 13.
	FEMALE:  On page 13.
	MR. CHAIRMAN:  I was trying to clarify that.  Okay, good.
	FEMALE:  So, moving on to page 14 which begins to discuss accessibility for visual disabilities.  I suspect that the first one we wanna talk about is 1212 on the bottom of the page.
	MALE:  Yeah, and there, my suggestion is we simply delete the -- the last thing under "control of the voter."  But keep the requirement there.  But -- but.
	FEMALE:  So it remains a shall, but we (indiscernible).
	MALE:  Right.
	MALE:  But I'm not sure the (indiscernible).
	MR. CHAIRMAN:  (indiscernible) microphone, please.
	FEMALE:  So we're keep -- so you're suggesting that we keep it a shall but we -- and it -- but we include the ability for it to be set by someone other than the voter?
	MALE:  I think it should be a should because I'm not sure that all of the machines out there with an audio ballot can
	FEMALE:  It's actually in NASA -- this is actually in the current NASA technical brief.
	MALE:  Yeah.
	FEMALE:  So I think it actually is a current requirement.
	MALE:  Okay.  That's the current 2002?
	FEMALE:  Yeah.
	MR. CHAIRMAN:  Were they under control of the voter?
	MALE:  This is -- this is the one, Paul, that in the original 2002 standard, set for a variable control from this figure to that figure, and that quickly became obvious that that was not implementable and it was amended to mean that it has two sizes and I believe those are the ones right there.
	MALE:  Okay.
	FEMALE:  I think this is an exact copy from.
	MALE:  Okay.
	MALE:  What (indiscernible) number is that?
	MR. CHAIRMAN:  This is page 2 -- page 214, line 33.  So the only issue is do we leave under control of the voter or not?
	FEMALE:  How do we handle the procedure?  We have a suggestion on the floor.  I think --
	MR. CHAIRMAN:  Well.
	FEMALE:  -- we need to get general consent on it or a vote?  Is that right?
	MR. CHAIRMAN:  Yeah.  What is being proposed is to take out "under control of the voter."
	MALE:  Right.
	MR. CHAIRMAN:  Do we have?  Right.  Everything stays as shall and the rest of that, the only suggestion is to take out "under control of the voter."
	MALE:  Right.  I agree.
	MR. CHAIRMAN:  Do we have a unanimous consent on that?
	MALE:  No, we do not.
	MR. CHAIRMAN:  Mr. --.
	MALE:  There -- there are some voting systems where basically the poll worker has to set up select your ballot, select whether you're going to have an audio ballot, and whether you have a disability or not, the poll worker has to activate the system for you in the way that you want it activated, so.
	FEMALE:  We're talking about only this one and the specific -- the specific wording of this section.  I think where we have disagreement, we take a vote, right?
	MR. CHAIRMAN:  Mr. Elekes, would you elaborate?
	MALE:  Yes, as I've said before, Dr. Semerjian, the ide -- the concept is that the individual to the maximum extent possible with disability be able to independently vote.  And as we've said in previous discussion this morning, the technology has been out there since mid-90s.  I have technology in the kind of computers I'm using in front of me right now and it's off the shelf, so, I mean, it's a matter of what vendors need to do in order to make the voting system accessible and independently usable by the person with a disability.  
	MALE:  Well, I agree with that 100%, but it -- but it's a future requirement; it is not a present capability.  That -- that should be a should.  
	FEMALE:  Yeah.
	MALE:  The part we have right now is the shall.
	FEMALE:  I don't -- I don't think.
	MALE:  And that capability should be a should.
	FEMALE:  I can't draft it live, but perhaps we should split this into a shall and a should where the shall is a requirement for the two font sizes --
	MALE:  Yeah.
	FEMALE:  -- and then we would get another --
	MALE:  Should, yes.
	FEMALE:  -- another -- another item, whatever number it would be that it would be a should --
	MALE:  For "under the control of the voter."
	FEMALE:  -- "under the control of the voter" becomes a should.
	MR. CHAIRMAN:  Well, maybe then we could simply stop after 9.0 millimeter period.
	FEMALE:  Right.
	MR. CHAIRMAN:  Version VVSG, version 2 will require --
	FEMALE:  Right, I'm just gonna.
	MR. CHAIRMAN:  -- this control to be -- this feature to be "under the control of the voter" or something to that effect.
	MALE:  Uh-huh.  (affirmative)
	FEMALE:  I would -- I would think we would -- I think we would end up adding a section that said it -- that would be 1. -- 12121 [laughter] that said the ability to set the font size should be under the control of the voter or appropriate wording to that effect. 
	MR. CHAIRMAN:  Sounds like we have a general agreement to the approach, then.  
	FEMALE:  Yeah.
	MR. CHAIRMAN:  Will you please work with Alan --
	FEMALE:  Yeah.	
	MR. CHAIRMAN:  And make this --.
	FEMALE:  John, can I ask the NIST staff to do that 'cause I think that I saw them writing and I think they've got it.
	MR. CHAIRMAN:  Okay.  So.  Other than that, we're okay on page 14?
	FEMALE:  So we're hol -- so we're holding this until we move forward with rewording to look at.
	MR. CHAIRMAN:  Right.
	FEMALE:  Okay.  
	MR. CHAIRMAN:  Mr. Berger.
	MALE:  I'd like to suggest we omit the section just above and below that so that's 211 and 213.
	FEMALE:  Take 'em one at a time, please.
	MALE:  Okay.  211 requires summative usability testing.  But in 212, we have a very clear and objectively verifiable requirement, so I think 211 is just unnecessary and, you know, requires unnecessary resources where the science supports an objective requirement.
	FEMALE:  I'd like --.
	MR. CHAIRMAN:  Ms. (indiscernible).
	FEMALE:  I think the purpose you'll find that this -- this a requirement like this exists in three places here in this document, in this section of the document.  I actually would like to keep it as a shall.  I think it's very important that we begin to get people thinking about what usability testing looks like and how it's done and that it be done with appropriate users.
	Sharon, did you have some comments on this?
	FEMALE:  Yeah, I -- it -- it is an objective requirement.  Just produce a SIP (phonetic sp.) report.  Yes or no.
	FEMALE:  We don't say you have to do it with 500 people, we say --.
	MALE:  But we're spending very limited resources.
	FEMALE:  It's like a documentation requirement.
	MALE:  Is this really where we want the vendors -- what -- what's the value at of this test?
	FEMALE:  Do you want to speak to that, Whitney, or shall I?
	FEMALE:  I -- I hardly know where to begin since this is sort of meat of my life [laughing] and I know that nobody wants to hear the whole story.
	MALE:  And by the way, I'm not fighting this kind of testing --
	FEMALE:  Yeah.
	MALE:  -- in general, so, in other places, I agree, so it's very good contribution.
	FEMALE:  Hmmm.  I think there's a big value added in having the vendors start this kind of testing because that will drive their designs to better designs, even.
	MALE:  Yeah.  And in many places, I agree.  With -- this requirement for font size, what would be learned and what would --
	FEMALE:  This is.
	MALE:  -- change as a result of testing.
	FEMALE:  This isn't just font size, though.  I mean, you wouldn't -- you end up -- I think, well.
	FEMALE:  It's for partial vision.
	FEMALE:  It's for partial vision in general.
	MALE:  Okay.  Question stands.  What -- what would change as a result of this test being performed?
	FEMALE:  It's a future looking change.  We want -- we want to make sure that the -- the technology of usability testing is well understood in the community.
	MALE:  I guess what I'd like to see is NIST go forward with controlled independent research into that level of usability for future standards.  I mean, we're speaking two sides of our mouth: one, we don't want the vendor to drive the process and yet we hear to tell the vendors to go do some research --
	FEMALE:  No.
	MALE:  -- and that research doesn't bind them to producing or achieving anything.
	FEMALE:  We're not actually -- there's a difference between using the techniques of usability testing for user research and using usability testing to actually evaluate a specific implementation of a general standard.  And I don't think that we're asking vendors to do general research that would contribute to future standards here.  That's something that I hope and expect that NIST will be doing.  What we are asking is that vendors not just design their system and hope that it's good but that they actually test it with users themselves.
	FEMALE:  My -- my feeling is that I -- if I can avoid it, I would avoid purchasing any software that has not undergone some kind of usability testing.
	MR. CHAIRMAN:  Dr. Schutzer.
	MALE:  If I understand what you're saying on the issue here is that you just told me I have to build a system that's capable of presenting one or two fonts.  Then Vendor A could do one job of how they would design that system with all the other surrounding aspects of that system.  And Vendor B could do another one, and frankly, it could turn out that based upon the design, one is much more usable than the other.  One, even though it does go for the letter of the spirit in terms of being able to have different fonts, it's not going to be terribly usable.  And the other one might do a much better job of -- I think that's what you're trying to get after by that kind of a test.  
	FEMALE:  I think that the other thing we're getting after by calling this out in three places and not just asking for a general usability test is that people not just test with 5 fully-sighted people, but that they actually look at people with partial vision specifically.
	MALE:  Just to add one other thought to it is that right now, you have these requirements as if they're separate, independent serial requirements so that -- let's get back to the audio thing again, okay?  So I have a partially-sighted person and the administrator can tap it to the higher font and they could go vote.  But it could be that the other one actually has the two fonts along with audio stream.  And when you do that testing, of course, they can hear it and see it, they might do better.  Now you've (indiscernible) the combination of those two senses working together so it would have a -- score higher in a usability test.  It doesn't mean you can't buy the one that has the poor usability, but at least you'll be notified of that.  And likewise, I imagine contrast and a dozen other kinds of factors could evolve that would make one vendor's solution better than another's in usability and you outta be able to measure that and know that.
	MR. CHAIRMAN:  Secretary Davidson and then Dr. (indiscernible).
	FEMALE:  You know, one part, I see this being a test, really, that the state should do.  We just did one in our state and had over 300 probably disability individuals come in and test and evaluate each piece of equipment on every segment.  And I returned those over to the vendors also.  It also was a very useful tool to us to -- to utilize.  So maybe this is something that I -- I don't know if there's something that you can do.  The vendors, if they get a few people in, they may get input, but if they have -- if they're comparing them with other systems, it really helps, too, at the same time.
	FEMALE:  Well, I -- I think the purpose of this is to encourage vendors to incorporate a user-centered design process in their design.  Later on when we have performance-based standards and a testing ag -- authority does the tests, then you're looking at the benchmarks.  So I think this is in the same category as when vendors required to provide documentation that they did software testing.  That's -- that's how I view it -- view it.
	MR. CHAIRMAN:  Dr. Rivest.
	MALE:  I think Sharon may have answered my question.  But let me proceed with it anyway for -- for Whitney.  So, I'm a general fan of usability testing and I like the idea of having testing incorporated with the requirements, but I'd like to understand a little bit of your thinking about how this fits in and where it's going.  I mean, if a vendor merely does the usability testing after the design is done and just (indiscernible) the results, is this intended to be informative for the perspective purchasers?  Does this information get out to perspective purchasers?  The flip side of that is do you envision that the VVSG 2 will have actual levels of satisfaction of those tests that will be mandated?
	FEMALE:  Yeah.  We don't have any benchmarks in this version because the research hasn't been done to set those benchmarks, but the intention for version 2 is that we will be able to remove some of the design requirements and simply say that we -- and specify performance requirements which will be evaluated through a usability test.  
	And to answer the question of who gets to see it and I guess also to address Secretary Davidson's point, I think that everybody should be doing it.  [laughing]  I think we should be doing it before, during, and after.  I think it should be done at the state level where you're dealing with your people in your context in your laws.  I think it should be diagnostic during design.  I think it should be summative to evaluate the end point of the design.  And that the more we do it, the easier it will get.  It will seem a great deal less onerous if we're doing it on a regular basis.  I -- I have a personal hope that at least portions of the standard (indiscernible) will be made available as part of a public record, but that's way beyond, I think, the discussion of this question, and right now, all this says is that it has to be submitted to the test lab. 
	MALE:  I'll just add the comment I think Secretary Davidson's remarks were very well taken and point out that there's more parts to this process than just these guidelines.  I can't conceive of any vendor saying anything to 1211 other than, "Our product's great!"  Now, election official comparing various products, very likely would find there's differences that are -- that are germane to a decision.  I think it's a meaningless clause and we outta remove it.  
	MR. CHAIRMAN:  I -- I heard that it was very useful.  I'm not sure I can equate that to meaningless.  [laughter]
	MALE:  By "meaningless", is the vendor -- the vendor performing this test.
	MR. CHAIRMAN:  Well, I understand, so, I mean, I think that what we're saying, there is value to it.  The question is who should be responsible for doing the test, so.
	MALE:  I think if you want these tests done, they should be done by the ITA labs or the jurisdictions that are buying the machines.  I think it is -- it is a very valid approach to testing because you do learn things such as large font breaks a race (phonetic sp.) across two pages and isn't very usable.  Those are real things of system design about design, but I think to just put it out there as something the vendor is to do.  Vendors are driven and, you know, vendors like every organization, run on limited resources.  They are out there trying to use those limited resources to come as close as they can to the legal requirements for using systems and the wants and needs of their customers.  I think even if -- even if they were to come up with some profound discovery of usability within their systems, they would still be having to go and market in a venue where that may not be considered.  I think it needs to be the work of NIST; it needs to be the work of this board, the EAC, and local jurisdictions to develop the standards, do the research, and push it out there.  And I'm very much in favor of that, but I think just to make it a courtesy requirement every time a vendor rolls out a product that he's going to run this test routine, I don't see where that's valued process.
	MALE:  (indiscernible) change of the responsible entity as Paul suggested, to the ITA.  
	MR. CHAIRMAN:  Is that?
	MALE:  But the vendor will guaranteed to be doing it first.
	FEMALE:  Yes, that is true, if it's gonna be -- if it's gonna be tested by the ITA.
	I guess that would move this out of this section, however, wouldn't it, John?
	No, but, I mean, if it's an ITA test, doesn't that make -- doesn't that move?
	MALE:  (indiscernible) 
	MALE:  I don't think so.
	FEMALE:  I -- I don't view this as an ITA test but a documentation requirement, just like documentation of the software testing to -- to -- to -- so vendors that are doing best practice with the user-centered design and has -- have usability engineers on board, it's for free.
	FEMALE:  Hmmm.  I don't know (indiscernible). [laughing]
	MR. CHAIRMAN:  I thought the question was if this applies to ITA as opposed to vendors, does it belong in this section?
	MALE:  I think the answer to that is no, it does not belong in this section --
	FEMALE:  Right.
	MALE:  -- 'cause that becomes an official conformance test.
	FEMALE:  And because part of it --.
	MALE:  This is a -- now structured as a documentation requirement.
	FEMALE:  Okay.	
	MALE:  Your vendor can do the test and tell us what happened.
	FEMALE:  Do we have a --?  Is there a solution of moving it to a should?
	MALE:  It's okay with me.
	MALE:  That'll work.
	MR. CHAIRMAN:  Well, if we go to should, I mean, that's basically a recommendation --
	MALE:  Uh-huh.  (affirmative)
	MR. CHAIRMAN:  -- and if they see a value, that's fine.  If -- is that -- is that acceptable to you, Miss Quesenbery?
	FEMALE:  I don't --.
	MR. CHAIRMAN:   I mean, clearly this is something that needs to be addressed in version 2.
	FEMALE:  Yes.
	MR. CHAIRMAN:  So the question is -- 
	FEMALE:  Well.
	MR. CHAIRMAN:  -- what -- what would be the requirement for version 1?
	FEMALE:  Well, what if we change it to a should and make the document -- made the discussion have a note that in version 2, we expect to have IT -- 
	MR. CHAIRMAN:  (indiscernible)
	FEMALE:  -- similar tests run by the ITA as part of the conformance process.
	MALE:  Okay.
	MR. CHAIRMAN:  Okay, so we change this to sh -- should and then future versions of the -- what were your conditions?
	FEMALE:  Yeah, I'll -- I'll write this out.
	MR. CHAIRMAN:  So you will?
	MALE:  (indiscernible) discussion (indiscernible).
	FEMALE:  Yeah.
	MR. CHAIRMAN:  Okay.  Is that -- is that generally acceptable?
	MALE:  Yep.
	MR. CHAIRMAN:  Then you will come back with a modified version of this, Miss Quesenbery?
	FEMALE:  Yes.
	MR. CHAIRMAN:  Okay.  So now, there was a question about the 2.1.3.  
	MALE:  I'll withdraw that.  I noted, is already a should.
	MR. CHAIRMAN:  You are --?  Okay.
	FEMALE:  Sorry.  John, can you -- can you get that note since we're pushing ahead?
	MALE:  Let me clarify it before I write it down.  (indiscernible).  Okay.  So what I -- what I have here is that the requirement is written should replaces shall --
	FEMALE:  Uh-huh.  (affirmative)
	MALE:  -- and under the discussion that says "future" --
	MR. CHAIRMAN:  (indiscernible) documentation.
	MALE:  -- something along the lines of this testing --
	FEMALE:  Right.  This requirement --.
	MALE:  -- will be done by the ITA --
	FEMALE:  Yep.
	MALE:  -- in the future?
	FEMALE:  Maybe, "This requirement is meant to encourage that ACS -- ACCVS designers conduct some realistic usability tests.  For -- for now, it's -- some -- encourage that the vendors do it, but in future versions, it will be part of the ITA conformance tests."
	MALE:  Okay.  Got it.
	FEMALE:  Something -- or something like that?
	MALE:  Okay.
	MR. CHAIRMAN:  Moving right along --
	FEMALE:  We are on page 15.
	MR. CHAIRMAN:  -- we are on -- at page 15.
	MALE:  On 1214, the same comment as on 1212 and that is you -- you changed the "under control of a voter" to a should.  (indiscernible) keep the capability there, but -- but make it a future requirement that it be under the control of the voter.
	MR. CHAIRMAN:  This says "by default or."  
	MALE:  (indiscernible) 
	FEMALE:  Yeah.
	MR. CHAIRMAN:  That's an "or."
	MALE:  Okay.
	FEMALE:  Okay.
	MALE:  Okay.
	FEMALE:  Okay.
	MR. CHAIRMAN:  So we're okay on that?  
	MALE:  Yeah.
	MALE:  (indiscernible) 
	MR. CHAIRMAN:  Could you turn your speaker up?
	MALE:  I'm sorry.  That -- that -- as it's written, precludes doing it under the control of the poll worker, though.  So.
	MR. CHAIRMAN:  What's the recommendation?
	MALE:  "Or" -- "or poll worker."
	FEMALE:  "Poll voter or poll worker."
	MALE:  Yep.
	MR. CHAIRMAN:  Is that acceptable to everyone?
	MALE:  Uh-huh.  (affirmative)
	MR. CHAIRMAN:  So we're adding another "or"?
	FEMALE:  No.
	MALE:  "Under the control of the voter or the poll."
	FEMALE:  "Or poller."
	MALE:  Well, you could do the same thing back on 1212.  You could make that "under control of the voter or the poll worker." 
	MALE:  You could, yeah.
	FEMALE:  Oh, that was (indiscernible).
	MALE:  That'd simplify that.
	MALE:  That would.
	MALE:  (indiscernible)
	MALE:  (indiscernible) a global change.
	FEMALE:  So.
	MR. CHAIRMAN:  So we are changing --.
	FEMALE:  Second votes?
	MR. CHAIRMAN:  -- 212.
	FEMALE:  Sorry.  So on both 1212 and 1214, we're saying "under the control of the voter or poll worker" --
	MALE:  Yeah.
	FEMALE:  -- and we're adding a note that in the future, we expect to move this to be a required -- to be under the control -- to be under the independent control of the voter.
	MALE:  Okay.
	MALE:  And we might as well go ahead and change that into 1.5 and 1.6.
	MALE:  (indiscernible)
	MALE:  All the way through?
	MALE:  Okay.
	MALE:  We're through 1.6.
	FEMALE:  Do we need to do the same thing to 5 -- to 1.5 and 1.6?
	MALE:  Yeah.
	MR. CHAIRMAN:  I think that was -- that was being suggested.
	MALE:  I don't -- I don't know of any system that you can adjust the red, green, blue components.
	MALE:  I further state that I don't think it's desirable.
	MALE:  Yeah.
	MALE:  There's a NASA technical bulletin on this and I think that wording is preferable to what's here in the.  The discussion I've heard on this is that most users will not get the desired result with this solution.  What is effective is a range of color contrast combinations or simply the availability of pure black and white.  The voter will effectively choose the one they can see best, but allowing them to fiddle with knobs is not an effective way to get them to a color contrast ratio that works for them.  Plus it does bad things to time -- vote (indiscernible) time.  So I think we want to replace this with the language that's in the NASA technical bulletin on the topic which is to provide the voter with a range of selections and let them choose the one that works for them.
	FEMALE:  I would be fine with that.
	MALE:  Okay.
	MALE:  So -- so both those sections go together.
	FEMALE:  And I just heard Paul say that he'd like to make 1 -- 1.2.1.6 a should.  Should -- should -- should supply a range of options.
	MALE:  I think -- I think what Steve was suggesting that you combine 1.5 and 1.6 --
	FEMALE:  Uh-huh.  (affirmative)
	MALE:  -- into the wording that's -- that's in the current NASA document.
	FEMALE:  I believe we did use the current wording, but I don't have the bulletin in front of me so I can't confirm that.  
	MALE:  You may have, but there's an addendum.  There's something similar to this in the original --
	FEMALE:  Uh-huh.  (affirmative)  But.
	MALE:  -- 2002 standard.  But we came back with an addendum because this --
	FEMALE:  Okay.
	MALE:  -- (indiscernible) --
	FEMALE:  Okay. So.  All right.  That might.
	MALE:  -- (indiscernible) work.
	FEMALE:  Okay.  Maybe missed the addendum there.
	FEMALE:  So we're going to have revised language for 1.5, 1.6.
	MR. CHAIRMAN:  Okay, so we'll.
	FEMALE:  The addendum was a NASA technical bulletin?
	MALE:  Yes.
	FEMALE:  I believe that's what we used, but we'll -- we'll double check.
	MR. CHAIRMAN:  Okay, we'll check on that.
	2.1.7.
	MALE:  This probably -- the system should be capable of maximizing.  I think all these systems allow -- the color systems allow election officials to have some control over the colors on the screen.
	FEMALE:  Then we might want to add -- maybe we wanna add the voting system vendor, I mean, the -- the voting official as an additional responsible party.  
	MALE:  Yeah.
	FEMALE:  Jim, you're crackling.
	MR. CHAIRMAN:  Say that again?  Yeah.  So.  Do the suggestion on 1.2.1.7 was to add --
	FEMALE:  Well, one is to add --
	MALE:  -- responsible?
	FEMALE:  -- to add voting officials as one of the responsible parties since they often control the final design of the ballot.
	MALE:  (indiscernible) 
	FEMALE:  Yep.
	MR. CHAIRMAN:  Are we okay with the rest?
	FEMALE:  Okay.  I think this moves us on.
	MR. CHAIRMAN:  1.2, 1.8?
	FEMALE:  Yeah.  I think this moves us on to page 216.  And I'll withdraw my suggestion [laughing] that we change that to a shall.  The next is a should --.
	MR. CHAIRMAN:  Wait a minute.  I lost you.  Are we on 1.2?
	FEMALE:  1.9.
	MR. CHAIRMAN:  Okay, what happened to 1.2, 1.8?
	FEMALE:  I think we went right by it.  It's a sh -- everybody okay with it?
	MALE:  Mr. Chairman, I didn't even disagree with that one.  [laughter]
	MALE:  What was that?
	MALE:  I say, I didn't even disagree with that one.
	FEMALE:  Quick, let's curb it; it's done.
	MALE:  All right.  
	MALE:  We better move on before he changes his mind.
	FEMALE:  Yep.  [laughter]  
	Okay, we have --.
	MR. CHAIRMAN:  So we're back to 1.2.1.9.
	FEMALE:  And I'm withdrawing my suggestion that we change it.
	MR. CHAIRMAN:  So you are comfortable leaving it as should?
	MALE:  Yes.
	FEMALE:  Yes.
	MR. CHAIRMAN:  Are we okay with that?
	FEMALE:  Okay.
	MR. CHAIRMAN:  All right.
	FEMALE:  1.10 is also a should.  Are we okay with this as a should?  
	MALE:  Well, I guess.
	FEMALE:  I'm not sure it's necessary given 18.
	MALE:  Yeah.  What we want in place of that, we want controls to be tactile in nature, which, to me, "tactile" means that the voter can tell by touch what he's doing.  Obviously, they've got to be visually identifiable.  
	FEMALE:  Sharon or John, are we talking about tactile controls here?
	MALE:  The reason this is written the way it is, is this applies to all voting stations.  All accessible voting stations, so we do want to recommend tactile, discernible buttons on all voting stations.  We wanted to (indiscernible).  That was the --.
	MALE:  Okay.  In that case, leave it as a should.
	FEMALE:  Okay.
	MR. CHAIRMAN:  Okay.
	FEMALE:  We're up to another example of the usability testing and I would suggest that we would -- whatever change we're about to make for the previous version which is 1.2.1.1. that we make the same change to 1.2.2.1.
	MALE:  Actually, I wouldn't ask for it there, but if you wanna make it?
	FEMALE:  [laughter] Why?
	MALE:  I -- I believe for this issue, we're not able to provide sufficient objective verifiable requirements and so the testing has value.
	FEMALE:  This is actually interesting because in some research that was done at the National Cancer Institute, we had exactly the opposite.
	MALE:  Okay.
	FEMALE:  They -- they did research with both line voters -- I'm sorry, line users and with partially-sighted users.  And what they found was that it was easier to create firm design requirements for -- for the blind than it was for people with different visual disabilities because the range of problems is so much greater.
	MALE:  Right.
	MALE:  Right.
	FEMALE:  So --
	MALE:  (indiscernible) blind.
	FEMALE:  -- research is actually opposite.  [laughing]
	MALE:  So on this section, I'll value your expertise.
	MALE:  I guess my concern is that we need to define what specific functions and reliability we're looking at there because the requirement as stated isn't something that you can test and.
	FEMALE:  Which one?  1.2.2?
	MALE:  1.2.2.
	FEMALE:  1 -- 1.2.2, there's several of these that are high-level requirements.  I think Mark Scull and Sharon both also alluded to this that there are high-level requirements that are essentially satisfied by satisfying the indented requirements under them.
	MALE:  Okay, I guess perhaps this should be a should and then the indented requirements become shalls.
	FEMALE:  Well, but actually, HAVA says that -- I mean, the HAVA requirement is that it shall.
	MALE:  Well, it shall, but then it gives you some very specifics such as the audio ballot element.
	FEMALE:  Right, but if you look at 1.2.2.2. through -- the next several pages are all the specific requirements.  
	MALE:  Okay.
	FEMALE:  John?
	MALE:  (indiscernible) a little bit?  This gets to the question of testability and one of the things NIST was very concerned about from the VSS were what some requirements seemed like there's a pretty specific test for it and others seemed more general --
	MALE:  Right.
	MALE:  -- so we were very concerned to distinguish between let's say requirements that were more goals and general versus ones where you could really pretty well nail it down and we did that through this mechanism of high- and low-level requirements where the understanding is that the low-level requirements will be the ones that directly -- directly testable.  It's -- also, implicitly, the high-level requirements are not directly testable and I don't know, you can just say yes, this is accessible to the blind or no, it's not.  But the point is, by looking at the lower-level requirements under it, then that -- that higher-level requirement is served.  But we felt it was still valuable to make a statement about the high-level purposes for which the lower-level requirements were directed.  So that's why it was structured -- this has to do with the structuring of the standard as a whole and the rest of the standard uses this -- this scheme to try to make things clearer.  At least, that was the intent.
	MALE:  I guess.  My -- my concern is -- and for me and the other testing labs when we get to the point of defending our work product, this needs to be very, very clear, that yeah, that is -- that is the goal of this section is to make voting systems accessible to people who are blind and in that regard, the following things are shalls or mandatory.
	MALE:  Yes.  There's a general statement to that effect and I -- I agree and I -- I guess --
	MALE:  I guess that what I'm saying is --.
	MALE:  -- I would like to see each requirement tagged to say "this one is intended as a directly testable requirement" versus a high-level this is -- is intended as a goal statement.
	FEMALE:  Is -- is this (indiscernible).
	MALE:  But that's something we didn't -- we thought about that and didn't quite have time to do it, but I think that's something that needs to be.
	FEMALE:  Is what -- is what you're saying implicitly the accessible voting stations shall be accessible to voters who are blind by meeting the requirements in this section?  I mean, is that -- and so the --
	MALE:  That -- that -- that wouldn't (indiscernible), no.
	FEMALE:  -- implication of what you're saying.
	MALE:  Uh-huh.  (affirmative)
	MALE:  Yes.
	FEMALE:  And would that phrase help clarify it for people?
	MALE:  I guess -- I guess the trouble is if you do that, you'll wind up doing that all through the standard because the whole standard --
	FEMALE:  Yes, I know.
	MALE:  -- is structured in terms of this tree, so I don't want every high-level note to say and oh, by the way, you'll do this by meeting the low-level requirements 'cause you're just going to be saying that 40 times.  So we have a general statement up front that this is how the standard is structured and has to be understood in that way.
	FEMALE:  And this isn't just in this section.  This is throughout --
	MALE:  Uh-huh.  (affirmative)
	MALE:  Oh, right, yes.  Not just human factors.  Yeah.  Yeah.
	FEMALE:  -- yeah.
	MALE:  So if you buy into the hierarchical scheme, then this makes sense.  But -- but you do have to sort of -- I admit that there's a little cognitive low there; you have to sort of understand how to interpret what -- what we've written and I -- I think at some point, we do have to be much more specific about what we intend to be directly testable and -- and what not.
	MALE:  Well, I -- I definitely think you're going to have to do that because when you come to this document looking at what accessibility must you provide for people who are blind, you -- you don't read the entire document; you start with --
	MALE:  (indiscernible) 
	MALE:  -- okay.  When you come to this document looking for what standards apply to systems providing accessibility to voters who are blind, you're generally not going to be reading the entire document or taking it entirely in its context.  I think -- I think this section, as all of these sections, needs to stand alone and make it very clear that okay, yeah, this is our goal to make it accessible for people who are blind and these are the things we are going to do in that regard which are testable, but if -- if there's a blind person out there who cannot use this system because of something no one here thought of today, that then --
	MALE:  Yeah.
	MALE:  -- needs to flow into development of future standard rather than be held up as a failure of the (indiscernible) standards.
	MALE:  Right, yeah.
	MALE:  I -- I sympathize with that, but -- but I also disagree a little bit in that I -- I think if you sort of open the standard to the middle and start reading, you're gonna be confused.  I -- I think there has to be some understanding of the context up -- up front if you, you know, if you skip over the introduction, you might have a problem and I think that's true with almost any standard.  Any standard I've ever seen has some kind of notation, conventions, or whatever, or a glossary and, like I say, if you just sort of open it in the middle, you're going to be a little lost, so that -- I -- I think you have to expect the -- the reader, you know, the serious reader who is really gonna work with this to have some -- some sense of how the document is organized.  At least that's the hope.  That -- that was our thinking, so.
	MR. CHAIRMAN:  Okay.
	MALE:  But -- but I do -- I do think also that there should be a greater clarification, a greater distinction between what we expect to be directly tested and what not.
	MALE:  Okay.  So how do we do that?
	MR. CHAIRMAN:  Mark, did you wanna make a comment?
	MALE:  Yeah, yeah.
	MALE:  Sorry, sorry.
	MALE:  I just wanted to mention --
	MR. CHAIRMAN:  Okay.
	MALE:  -- there is a discussion of this in the overview --.
	MR. CHAIRMAN:  (indiscernible).
	MALE:  Mike.
	MALE:  Mike.
	MALE:  Can you hear me?
	MALE:  Yeah.
	MALE:  Okay.  There is a discussion of this in the overview, but what we could do is enhance the conformance clause and talk about the issue of structuring and testing and make this explicit so that people who actually pay attention to conformance clause will actually understand where we're coming from and what we're trying to accomplish.  Would that help?
	MALE:  I guess, Mark, I'm having trouble visualizing how you're going to do that.  I mean, are we going to say that six digit statements or standards are all high-level and seven-digit standards are intended to be testable?  I'm not sure --.
	MALE:  No, because that -- that -- that's variable.  I think we'll explain the concept of that the lowest-level tree, the leaf-type statements are testable and -- and it will probably -- we'll have to wordsmith it to -- to logically explain how we get there.  I don't have the answer for how -- what we will say right now, but what I'm asking is if we put it in a conform -- if we figure out a good way to say it and put it in a conformance clause, would that be helpful in the sense it will give people an up front indication of what we're trying to do?
	MALE:  Perhaps, I mean, we'll have to look at it.
	MR. CHAIRMAN:  Mr. Berger.
	MALE:  That discussion's raised a question.  Do we have anywhere in the document an equivalent facilitation clause?  The access board uses those where they're commonly -- which is if someone, some piece of equipment can meet the intent of a requirement but not the specific requirements of a document, is there a provision where that -- where those novel implementations can be judged to be compliant?
	MALE:  It's not there now, you know.  There are no such things.
	MALE:  I -- I'd like to suggest I think that's a useful and productive clause to have at some point.  That an ITA, some of these very specific requirements -- there be a provision by which a vendor can say I figured out how to build a better mousetrap.  They can prove it, I suggest, to the ITA and be judged in compliance.
	FEMALE:  Well.  Interestingly, although it isn't in via -- VVSG 1, that is kind of the intent of moving to performance requirements --  
	MALE:  Uh-huh. (affirmative)  Exactly.
	FEMALE:  -- is to get away from design requirements that are that specific.  I suspect that when we move to performance requirements, this whole section gets a great deal shorter.  
	MALE:  Yeah, I think that's a two-edged sword.  I mean, the first thing that comes out when you go there is magnifying glasses to deal with a font requirement for DREs and we don't really wanna go there.
	FEMALE:  Right.  Right.  So -- so if you have performance requirement that says not only do they have to be able to use it but they have to be able to use it effectively in a reasonable period of time and we've been able to specify what reasonable is and what effective is, then solutions that may sound plausible but don't, in fact, produce the performance you -- you were looking for, would -- would therefore not pass.
	MALE:  It is a useful clause to have because there's all kinds of novel innovations that come along that we don't foresee in a -- in a body like this.
	MR. CHAIRMAN:  I think the idea is with a performance-based standard, you don't need the clause --
	FEMALE:  Yeah.
	MR. CHAIRMAN:  -- because you're not asking them to do -- you're not specifying how to meet the standard; you're specifying the requirement for the standard and it's up to the vendor to demonstrate that they meet the requirement, provided of course, the requirement is quantitative and testable.  So, I mean, there is a whole change of philosophy.
	FEMALE:  I'd -- I'd also say that without disagreeing with you that it's valuable.  Without -- without disagreeing that it's value, since the focus of VVSG 1 is existing equipment, [laughing] it's sort of (indiscernible).
	MALE:  Yeah.
	MR. CHAIRMAN:  Where are we?
	MALE:  Yes.
	FEMALE:  I believe we're on page 17.
	MR. CHAIRMAN:  We're on page 17 --
	FEMALE:  These get easier as we go, by the way.
	MR. CHAIRMAN:  -- well, I hope so because --
	FEMALE:  I don't know.
	MR. CHAIRMAN:  -- we still have a lot of material to go through.
	FEMALE:  I -- I don't actually know why things are in italics.  [laughing]
	MALE:  What if we decide on 1.2.2?  
	FEMALE:  That was the word (indiscernible).  The italics mean nothing.  That's what (indiscernible).
	FEMALE:  Oh, it's a glitch?
	FEMALE:  (indiscernible) when they (indiscernible) it again.
	FEMALE:  We just (indiscernible) nothing.  We're leaving it.
	MALE:  1.2.2.6.
	FEMALE:  Yep.
	MR. CHAIRMAN:  We are on 1.2.2.2.
	FEMALE:  [laughing]
	MR. CHAIRMAN:  Is that correct?
	MALE:  Wait, we skipped 1.2.2.1, did we not?
	FEMALE:  I believe what we said, we were going to do to 1.2.2.1 whatever we did to 1.2.1.1.
	MALE:  Which was make it part of?
	MALE:  The ITA.
	FEMALE:  The IT -- yeah.
	MALE:  Okay.
	MR. CHAIRMAN:  Well, I thought we were going to make that a should.
	FEMALE:  We're -- we're gonna do the exact same treatment that we did to it in a parallel clause.
	MALE:  Should and go to the ITA?
	FEMALE:  Yep.
	MALE:  (indiscernible)
	FEMALE:  Okay.  Any comments on 1.2.2.2 or on its sub clauses 1.2.2.2.1?  (indiscernible) how 'bout pages 217 and 218 down through the last, what's italicized in our hard copies which is 1.2.2.2.4.  The ATI should allow the voter to skip over the reading of a referendum so as to able to vote on it immediately?
	MR. CHAIRMAN:  Secretary Davidson.
	FEMALE:  I just have a question.  If -- and this is tied to the system and the system is capable of going back, you know, and reviewing something they voted on or maybe they didn't vote on.  But when they have the ability to skip to the next one, can they back up?  That's my question because if they can skip, skip, skip, you've gone over votes.  I mean, there's a big concern about undervotes.  So I -- I just don't understand the technology well enough to know if it can do that?
	FEMALE:  It's a should clause, for one thing.  And other, you know, we have existence proofs, you know, for how -- how screen readers go over what pages, et cetera, to do this kind of skip navigation.  
	MR. CHAIRMAN:  It's not a should.
	FEMALE:  Not a should.
	MALE:  It's a shall.
	MALE:  1.2.2.3?
	MALE:  2.2.3.
	MALE:  You won't be able to navigate in both directions.
	FEMALE:  It's 3 and 4 and I -- I just don't understand the technology well enough, I believe, because it talks about skipping over the initiatives and referendums, skipping over to the next contest, so.
	MR. CHAIRMAN:  Could you turn on your speaker, please?
	FEMALE:  I'm sorry.  I can't find it, but I thought there was one later that said that they could go back and review.
	FEMALE:  I -- I think it's giving equivalent to skip over a contest, just like if you're sighted, you skip over a contest.  It's equivalent functionality.  I mean, you would still review and it would point out undervotes, just like with the visual, so.
	FEMALE:  And I just want to make sure they could back up on the video -- on the audio as well as skip, was my -- was my concern.
	FEMALE:  So -- so -- so you're suggesting shall be able to skip to the next contest and back up to previous contests?
	MALE:  Yeah.
	FEMALE:  Yeah.  Maybe we should add "and back up to previous contests." 
	FEMALE:  That's -- that's my concern.
	MALE:  And basically all the systems we've seen, I don't know about you, Brett, but all the systems that we've seen allow you to go back and review your input on any race, go back and change your input, basically do all the functions that you can actually do with a touch screen or paper ballot.
	MR. CHAIRMAN:  Okay, can we be specific?  Now, which one are we talking about?  Is it 2.2.2.3?
	FEMALE:  2.2.2.3 and we're adding "and --.
	MR. CHAIRMAN:  Allow the voter to skip to the next contest.... 
	FEMALE:  Or return to previous contests.
	MR. CHAIRMAN:  Or return to previous.
	FEMALE:  Mr. Chairman --
	MR. CHAIRMAN:  Yes.
	FEMALE:  -- I noticed that it is now 11:29 and we're actually -- perhaps we could --
	MALE:  It's 12:29.
	FEMALE:  12 -- I'm sorry -- 12:29.  And I'm looking for a good place to break.  So this -- so this might be a good place to break because we're at the end of a subsection.
	MR. CHAIRMAN:  Yes, and perhaps during lunch, we can find a -- find a little more efficient way of going through this rather than one-by-one --
	FEMALE:  That would be nice.
	MR. CHAIRMAN:  -- otherwise it will take a long time.  So I propose that we break for lunch and -- and we come back, resume at 1:30.
	MR. CHAIRMAN:  If everyone can take their seats, we'll start shortly.
	FEMALE:  Come up with a better system?
	MR. CHAIRMAN:  Huh?
	FEMALE:  Come up with a better system?
	MR. CHAIRMAN:  Well, we'll.
[End of Audiotape 2]
MR. CHAIRMAN:  -- position of making value judgment, and we should proceed there.
MALE:  John?
MALE:  I didn't mean it that way.  So I guess what I'm saying is that everything's imperfect.  For 2006, there's two methods that are acceptable.  Both would have to provide some compensating controls to overcome some of the imperfections that we have faced to that will attempt to raise the bar somewhat and make it less imperfect.  [laughs]
MALE:  I guess part of the problem with this entire subject.  A great disservice has been done, I think, to impress upholding systems security by writers who have the vision that these machines should be so secure that you can sit them out on the sidewalk unattended, and they will only let authorized voters vote in secret and only vote once.  And that's not the reality of the world that we're designing these systems to work at.  
And, you know, I think the new thought and this document is good.  I think it needs to be continued on.  But to say that a system is weak on security because it only has a single record, that's not logical.  There are systems that have multiple records that have people spending their entire lives trying to make the two records balance.  Whether you have one or two records is irrelevant.  Whether or not the system is adequately protected from manipulation and from sabotage, from operator error, whether it's accurate and reliable; those are important pieces of security and integrity.  And that's what we need to be getting to.
If the art emerges where we can do it with two independently maintained duplicate records with the ability to reconcile them against each other and do that in such a way that it doesn't create more errors than it solves, then yes.  That's where we need to go.  But we need to let the prototypes that are being worked continue to evolve.  And we need to look at how to make systems right now that meet the art that we have and that can be used to conduct elections.
MALE:  Well, can I come on now?
MR. CHAIRMAN:  Okay.  Last word.  Then we better go on to the quote, unquote, more useful part of the discussion.
MALE:  Paul makes a number of good points.  And I agree with almost everything ahead.  I just wanted to respond to that and a little bit to what Brit said too and to try and put things in context as I see it a little bit more, too.
I think one of the goals here that we're charted with, all of us are trying to collectively work with this, is raise the bar on security.  And one of the key lessons we've learned in security over the years is that single points of failure need to be strengthened and improved.  
And so the suggestions of this team here is to try to focus on one of the single points of failure that have been identified by many of the experts that have come to testify before us, which is the difficulty of assessing the software that's being used here.  It's not impossible to verify perhaps, but it's extremely difficult and costly and difficult to do well.
And so having a dual record proposal that's been put in front of us here as having a dual record system where one of the records is either directly verified or verified by a  different piece of software, with the help of a different piece of software can help strengthen against is the single point of failure.
It's not the only security issue to worry about.  There's lots of them.  Paul, you made a good list of them there.  You got to sort of cover the map and all the security issues and trade off against usability and so on too.  But this is a very innovative and interesting proposal I think that (Indiscernible) has put together.  And I think it's nice to have it in the version one here for people to start considering to see how we might integrate this kind of thinking into our future developments.
FEMALE:  Mr. Chairman, since I note that we're coming up towards a break, I wonder if it would be possible to decide what we're going to do with this section.  We're obviously not going to go through it and do line-by-line edits of any kind, so [laughs].  One hopes.  
MR. CHAIRMAN:  Well, as was pointed out, this is informational in nature.  It does not set requirements, and it's really to provide for some future thinking.  And do I hear a motion basically to adopt this section?
MALE:  Mr. Chairman, without committing to support the motion, I will make a motion that we adopt this section.
MR. CHAIRMAN:  Do I hear a second?  [laughter]
FEMALE:  I second it.  [laughter]  If we've had some discussion, I would note that we did have one suggested change to it that would need to be made as part of your editing process, which was the addressing the footnote and clarifying the intent of that line.
MR. CHAIRMAN:  Yes.  So have we –
MALE:  Also, we questioned whether or not we want to go into the level of detail we go into talking about design, the specifics of the design of systems that are on the drawing board.  I mean, this doesn't have to be 24 pages to get the idea across.  Now I think it's a disproportionate – You know, just – We got an elephant in the living room.  [laughs]  And that leads people to come to certain conclusions about us here.  And I don't have any objection to any of the things I've heard.  I think these are good designs.  They not only should be explored, they are being explored.
But to put them in this document whose stated purpose is to provide guidance for 2006 at the magnitude they are is what I'm questioning.
MR. CHAIRMAN:  Would you be satisfied if we have it or not, but a statement is put at the very beginning that this it to encourage some thinking –
MALE:  Mr. Caret?
MR. CHAIRMAN:  Encourage some thinking, etc. to make that clear.
MALE:  Maybe what we could do is offline somebody could edit the document so that the part that's in the main body is shorter and more succinct, and the detail designs are like examples in an appendix or something.
MALE:  Mr. Chair?
MR. CHAIRMAN:  Yes.
MALE:  I think that this entire work product that we are attempting to graft here is very confusing to people who aren't intimately involved in this process.  To hang out in that document at the beginning of security issues, a 24 page or whatever proposal for the future, I think it makes it difficult to tell what the real intent of this document is.  It's going to lead to confusion.  It will probably lead to litigation.  It will, to some extent, limit the creativity and innovation that vendors are going to do in coming up with prototypes, because it seems to suggest that this is where we're going.
FEMALE:  Well, --
MALE:  I think it's inappropriate for it to be in version one.
FEMALE:  If I could offer a pick up on Mr. Schitzer's (phonetic sp.) comment and try for another thing.  We've looked at a series of definitions that are fairly short and that I think are important because they lead forward into the language in the VB pat section.  I don't see why we couldn't pull out the core language of this section, which is specifically the definitions and leave it in here as informative definitions.  And then take the rest of this document and put it into an appendix for discussion.
MALE:  (Indiscernible).
FEMALE:  And just reference the appendix in the core, so we haven't lost the work.  We aren't forcing ourselves back into a long editing process.  I know there's going to be a lot of work in the next two weeks.  But we don't interrupt the flow of the document.
MALE:  Could I just clarify – Oh, I'm sorry.  You want to –
MALE:  (Indiscernible) still be starting (Indiscernible).  Starting with section 6013 would be the suggestion is I interpret it right.  It's on page 617.  And afterwards, by interpreting your suggestion, the core definitions, which I agree are the more fundamental thing (Indiscernible) just then preceding section.  So up through page 6-16 leave in the main document.  That sounds like an amendment to me to the original proposal.
MALE:  Well, are we going to –
FEMALE:  (Indiscernible).
MALE:  Point of order we have a motion and a second on the floor to adopt it as it is.
MR. CHAIRMAN:  Wait a minute.  We already – This was part of the discussion of a motion that was to adopt it as it stands.  Now the discussion has gone in a different direction.
MALE:  Which is an amendment to the original (Indiscernible).
MR. CHAIRMAN:  Okay.  So the amendment is to distill the parts that were basically in John's discussion, the main definitions.  To adopt them in –
FEMALE:  So am I offering an amendment – I think I'm offering an amendment to keep in the main document the material that's 6.012, the core definitions, and move the rest of the material intact to an appendix.
MALE:  Oh, so 601 would move to the end?
MR. CHAIRMAN:  Which one are we keeping?
MALE:  Whitney, if I could maybe clarify what I think I'm hearing is that I think you're saying that all the material up until page 6-17.
FEMALE:  No.  No.  I was actually looking at keep – I think – Sorry, correct me.  Dr. Revess (phonetic sp.), I may need your help on this.  But I think I'm saying let's keep the material on pages 613 through 616, which corresponds to the slides, that ends with the slide sections that's up here, which are core definitions written in fairly tight format.  And take the rest of this section, before and after it, and move it to an appendix beginning with – What did you just say?  601?  Right, 601, two.  
MALE:  (Indiscernible).
FEMALE:  No.  That's a long way, 6012.  6012 is where we begin what we want to keep.
MALE:  It seems like about two and half, three pages.
FEMALE:  I think we're taking 6011 all the way through line 18 on page 613.
MR. CHAIRMAN:  To do what?
FEMALE:  And putting it in the appendix. 
MR. CHAIRMAN:  Oh, okay.  So –
FEMALE:  And then we're taking pages 617 and on and putting in an appendix, or are we keeping those?  We haven't gotten that far, so I'm really not sure.  Because those all describe other possible systems, and I think those will probably end up moving as well.
MALE:  If I could comment on the proposal.  I thought what you were suggesting first was to keep everything up through the core definitions, because 6011 has motivation for the definitions.  You'd have a section with bare definitions and little motivation.  I don't think it would terribly readable.  So I would think the alternative of having everything up through 6012 inclusive, 6-1 up to 16.  Might be a more readable document.
MR. CHAIRMAN:  Okay.  May I suggest that the subcommittee get together?  This strictly a cutting and pasting issue.  John, can you basically recreate this section?  Pull out the part that's going to go into the actual text?
MALE:  Sure.
MR. CHAIRMAN:  And then separate the rest of it, put it under appendix, whatever X, and bring that for a vote tomorrow morning.
FEMALE:  But there –
MR. CHAIRMAN:  But the general understanding is that what's going to go into the version one is this section from 613 through 617, probably with some preamble.  And I think what we're discussing is how long a preamble.  So if you can work that out, we can then vote on that tomorrow.  Is that acceptable?  Would you withdraw your motion Mr. Kraft?  
MALE:  I will withdraw my motion for the sake of tabling the issue.
MR. CHAIRMAN:  Thank you.  Do we all agree on the action?  Thank you.  
MALE:  Okay.  At this point we could watch into VVPAT.  I'm not sure if we're near a break.
MR. CHAIRMAN:  What's your pleasure?  Do you want to take a break now, or do you want to go ahead with VVPAT?
FEMALE:  I think (Indiscernible).
MR. CHAIRMAN:  Okay.  Can we make a short break, and let's meet at a quarter to four?  Thank you.
[people talking during break]
MALE:  We're going to start in a second.  I just wanted to – Peter Ketchum offered one piece of advice, and I'm not sure how late we'll go.  If we do go past five thirty, it turns out that there is a bus, a ride on bus that will take you to the metro at five fifty.  And Peter has offered to be a guide right there if we do go that long.
The other thing is J.R., are you with us?  No.  Okay.
MALE:  I heard him a minute ago.  J.R.?  Are you there?
FEMALE:  Not right now.
MALE:  Just your (Indiscernible).  J.R., I think they have cut out.  I heard this (Indiscernible).
FEMALE:  And this is Joan Kirshellan (phonetic sp.) still on the line.
MALE:  Okay.  Good.
MR. CHAIRMAN:  Okay.  Ah, let's see.  Who are we missing?  Whitney and what was that --.  Okay.  Could we corral a couple of the members from out there?  Mark, Whitney, and Steven?  Whitney is there.  Okay.  We're moving onto the next topic, and at this time I call on again, Mr. John Wack (phonetic sp.) of our information (Indiscernible) laboratory to present the next report, bona verifiable paper or a trail requirements for VBSG version one.  John?
JOHN:  Thank you.  Okay.  I think we're – everybody's here who's going to be here.  Before I start, can everybody on the phone hear me properly?
MALE:  Yes.
JOHN:  Okay.  Thank you.  Okay.  What I'm going to talk about is basically our final version of the VVPAT requirements and I'll launch right into it.  I think based on what we want to get accomplished today, I'm hoping that we can do this within the hour.  And I'll take any suggestions you have for speeding things up or skipping any material you don't think is relevant.  
MR. CHAIRMAN:  J.R., is that you?  J.R. is that you?  Well, Sharon and Jim are there, but –
FEMALE:  Mr. Chairman, what page are we starting on?
MR. CHAIRMAN:  We are on the VVPAT requirements and it's on 6.28, six dash twenty-eight.
FEMALE:  Thank you.
MALE:  Now this is the TGD (Indiscernible).  But I was just concerned.  I'm trying to figure out how to check on J.R., because all the sudden he dropped off the line, and I could hear an open phone line.
MEDITATOR:  Excuse me.  Do you have a mute button there?  Thank you.
JOHN:  Okay, well I guess we'll go ahead.  Okay, we're looking at the overview slide here, and this is what I'd like to discuss here.  Basically, I've got a couple of slides that talk about our previous version and a couple of other things.  And then we can launch right into the requirements.  
So, in March we presented some preliminary requirements to you.  And essentially it was a document with three chapters.  The first chapter was a fair amount of boiler plate introduction to VDPAT.  The second chapter had a high level overview of various issues.  The third chapter had preliminary requirements.  
And I think at that particular point, looking at the overview of state legislation, I think we had six or seven states that had enacted VDPAT legislation.  And my last bit of research indicates that we have roughly 13.  I think some of those are by state mandate as opposed to actually enacted legislation.
Something else I looked at said that three more bills are awaiting the governor's signature.  And then we have approximately 19 or 20 other states looking at this issue right now.
Okay, so why don't I go into kind of an overview of some of the comments I received.  I received oh, I'll say roughly around 20 comments.  And I would say that the comments were fairly evenly distributed among the various issues.
One thread that I thought I'd point out was that some people felt the requirements were way too design specific.  And going through it again I'd have to agree.  As a result of that we tried to make the requirements a big more performance oriented as opposed to design specific. 
Now some of the major issues that came up in the comments regarding the VVPAT are privacy and accessibility.  And one of the big comments was basically VVPAT systems –
FEMALE:  (Indiscernible).
JOHN:  Folks on the line, can you hear me?
MALE:  Yeah.
JOHN:  We are getting a fair amount of feedback from somebody. 
MALE:  I'm hearing it (Indiscernible).
FEMALE:  I'm getting a lot of feedback on mine.
JOHN:  I'm guessing – Pardon me.  It sounds to me like J.R.'s phone connection may not be working properly.  If he's on a cell phone, that may be part of the reason. 
MALE:  (Indiscernible) dropped off (Indiscernible).
JOHN:  Yeah.  Okay.  Well, as soon as I started talking about the paper roll issue it got real quiet, so.  Basically the problem there, if you don't know already, is that paper rolls store paper records sequentially in the order in which voters voted, which affects privacy.  One of the comments I'll just make is that there are many pros and cons to the different paper formats that have to do with usability, accessibility, handling the paper.  So it's a difficult issue.
Accessibility, we had some comments on that as well.  And I think Dr. Leskowski (phonetic sp.) handled a lot of those very well this morning.  I will talk a little bit about that when I get to the specific requirements.
Okay, moving onto the next slide.  Did I skip one?  Issue resolution?  
MALE:  Is this being an optional piece handled in the conformance clause or does that need to be in the introduction to this document?  I mean, this very clearly is intended to be a mandated requirement or an optional component of the system.
JOHN:  It is basically for people who are considering VVPAT.  Here are VVPAT requirements.  It is not a mandate or a requirement to go the VVPAT route.  It is simply if you're going to do VVPAT, here's VVPAT.
MALE:  Yeah.  I understand.  I just – I'm not seeing that in the document.  I mean, this starts out reading as though these are requirements for voter verifiable paper audit trail systems.  It doesn't really tell you that the system itself is not required.
JOHN:  Ah.
MALE:  So that's why I was asking if that is in the conformance clause or if it needs an introduction explaining exactly what the (Indiscernible) is.
JOHN:  I think we're –
FEMALE:  Probably (Indiscernible).
JOHN:  Yeah.  That's a –
MALE:  It's not in the conformance clause per se, but there are words that talk about the situation.  But if it makes it clearer, we can specifically either in the conformance clause or in the introduction here make that very, very explicit.  That's probably what we want to do.
JOHN:  Yeah.  Okay.  So to be clear we will make that more clear in the conformance clause.
One of the things I wanted to talk about on this slide is just basically trying to get a little bit of perspective on VVPAT.  And one of the things that if you really think about it, that is the biggest issue with it, is that it's just new.  And people have been trying to develop approaches to it without consistent standards. 
Some of the vendors are a bit at a disadvantage, because they've been moving ahead and they haven't had consistent standards in some areas.  At the same time, they've come up with some interesting approaches and added a few things that I thought were impressive.
We think that the usability for voters and for voting officials has to be a very high priority with VVPAT.  It won't achieve its purposes unless it's useable for the voting officials.  The records need to be used in audits.  And if it's difficult to use the records in audits, then it really won't achieve its purpose.  Yes?
FEMALE:  Just one statement on 60211.  When you got to recounts, it says, "and in full recounts."  I mean, you know, I think it needs to say, "Possibility of use in a full recount."  Because the states are not – In some states.  I know in our state, we are not using that in a full recount unless the audit is not meeting the requirements.  And then we can go to a full recount if that is necessary.  But I don't want to say in our documents that it has to be a full recount that we use that paper.
JOHN:  You are right.  It differs from state to state.
MR. CHAIRMAN:  Yes, but, well.  This doesn't imply that to me.  It says "that can be used."  It doesn't say "must be used."  I think the idea here is that if it is to be used, it has to have all the information so that you can use it for a recount if you decide to have a recount.
So I think "can be" in the sense that it has all the tools.  It has all the information to enable you to use it in a recount.
FEMALE:  Okay.
MR. CHAIRMAN:  I don't know.  That's my interpretation of it.
JOHN:  Well, also in the discussion field for that particular requirement, the very last sentence says, "The paper records shall also be suitable for use in full, manual recounts of the election."  But –
MR. CHAIRMAN:  Again, the issue there is suitability.
JOHN:  Well, how about if we take up that issue again.  We'll get back to this requirement, and I'll go through the rest of this analysis here.  And I think I was really at the last bullet.  Just basically saying that we have decided that the best route with VVPAT is to stick to good technology, independent, performance drive requirements.  And essentially let the vendors, let the marketplace proceed and hopefully follow the requirements.
Okay, here's just a very brief overview.  We emphasize usability accessibility.  And in working quite closely with Dr. Leskowski, it seemed to make more sense that the human factor section really address as much as possible accessibility and usability and also privacy, I should say.  That's basically because we made a determination that a number of those requirements already do apply to the verification step in VVPAT.  So it seemed less confusion and proper to keep them there.
So in the VVPAT requirements regarding usability and accessibility, I mainly list only those that would be in addition to what's in the human factors section except for one or two I think that were included for emphasis.  And we do have a privacy requirement for stored records.  We've continued to stick with that requirement.  And there will be issues of grandfathering that we will leave to the EAAC.
And then the record formats, primarily we have a goal of making the records useful in valid audits.  That's really the important thing with VVPAT is make them useful in audits.  So the record formats kind of reflect that goal.  
Okay, we used to have eight.  Now we have seven.  Try to make it a little easier.  Number eight, that requirement really basically centered around procedures.  And one of the comments I did receive is that we really shouldn't be talking so much about procedures here.  It's really not our domain.  And largely, I removed a number of the requirements within that section.  Where I thought they were appropriate to keep, I put them in other sections, other requirements.  And you'll see that when we go through the individual sections.
So now we're down to seven.  And those are largely the same wording from before except for two and three.  And we're basically just saying that usability requirements from the human factors and accessibility requirements apply to voting stations with VVPAT.
Now, I'm not sure the best way to go through for you, or what's going to work best for you.  What I thought I would do would be simply to go through the requirements.  And if that would be most suitable for you, I can continue on and do that.  And perhaps that would give you an opportunity to comment on specific requirements or make changes as you wish.  Does that sound like a good approach for everybody?  I see no objections.  Okay.
All right.  Well, we're really talking about the first requirement.  And if you're looking at your documentation here, I think we're on page 628.  And we're looking at requirement, let me make sure.  Yeah.  628.  We're looking at requirement 60211.  The requirement above at 6021 is basically the high level requirement that basically says what we're going to do in VVPAT.  We're going to print and display a paper record.
And this requirement here, up on the top, basically says we're making clear that the paper record can be used in audits.  Audits that can help determine whether the voting machine is recording ballots correctly as cast and audits of the election.  So that we want the paper records to be useable in audits.  Useful for audits.  And we want the paper records to contain all the information stored in the electronic record.  Are there any issues with either?  Yes.
MALE:  Well, I continue to object to the misuse of the term audit.  If you want the paper records to be used in a recount or in the canvassing board's determination that they can certify results, that is an administrative and accounting process.  That is not an audit.  An audit is where after the fact, an independent third party comes in, reviews the records, and determines if in fact the people who conducted the election did it properly and consistent with the standards and the election code.
I continue to object to the misuse of the word audit when we're talking about accounting and internal control validation within election administration.
MR. CHAIRMAN:  Do you have recommendations for alternate wording?
MALE:  I think we – Within the glossary, if I'm correct, we were working on making audit a commonly accepted version of audit.  I think the controller general's auditing standards provide certainly an acceptable definition.  None of the definitions out there in any of the literature give the meaning that we're applying to audit here.
MALE:  Which are these here.
MALE:  We seem to be using audit for recounts and for validation of the election process during the election.
FEMALE:  What do you think it should be?
MALE:  I think an audit should be an independent third party coming in to review the records of an election and make a determination as to whether the election was held in compliance with the standards for that jurisdiction.
Voting system audit is an important part of the election administration process.  And I think a jurisdiction that wants to be very careful could actually have periodic audits and take the information from those audits and incorporate them back into the election process.
JOHN:  Well, I know where you're coming from, and audit generally does imply a third party.  Audit does – The word audit is found in at least the enacted state legislation I looked at.  And the requirement 60211, towards the end it says basically, "The paper records shall be useful in audits of the election results."  And that's where I generally see audit being used, in audits of the election results.  
But I'm happy to change that to different wording if we could make it more precise.
MALE:  We can look for some words.  Validation of the election results is probably closer to what you're looking for.
JOHN:  Assessments as well.
MALE:  Or assessments.
FEMALE:  Assessment.
JOHN:  Assessment?  That requirement, I think it could be reworded basically to say, "The paper record shall constitute a complete record of ballot choices that can be used in checks of the accuracy of the voting station's electronic records in assessments of the election results and in full recounts."
MALE:  Yes.  Uh-huh (affirmative). 
MR. CHAIRMAN:  Are we creating a nomenclature of our own?  I mean, would that be clear to election officials if we start using words like checking?  Verification, is that in our glossary in that sense?
FEMALE:  Verification is in the glossary, but I don't (Indiscernible).  The word audit is in the glossary (Indiscernible), and we are lacking a definition or classification of what audit here would be in the sense of it – You know, adding a word to it like ballot audit or election audit.  So in order words refining or replacing it.
MR. CHAIRMAN:  How about validation?
FEMALE:  Validation is also in the glossary.
MR. CHAIRMAN:  Well, it says, "Process of evaluating a system or component during or at the end of the development process to determine."  But I guess that's the development process not the voting process itself.
MALE:  Well, in the glossary it says, "A systematic, independent documented process for obtaining records, statements, a fact, or other relevant information in assessing them objectively to determine the extent of which specified requirements are fulfilled."  Which is very different from the way that we're using audit and the standard that we're looking at.
MR. CHAIRMAN:  No.  I understand.  I'm trying to see if there is a – Yes?
MALE:  John, isn't there a definition for the word audit in the computer security domain that is more what was intended here?
MALE:  (Indiscernible).
MALE:  You talk about (Indiscernible) related to (Indiscernible) that verified (Indiscernible).
JOHN:  This is my question.  I believe there is a definition for audit there, and you would think that I would know that, but I don't.  I did a Google search on audit a couple days ago.  Actually, no.  I went to Dictionary.com.  And their definition was it could be an examination of records or financial accounts to check their accuracy.  It could be an adjustment or correction of accounts, or it can be an examined and verified account.
Paul is right to bring up this issue a little bit.  It is confusing.  And there are a number – Even validation or verification are used a little bit inaccurately.  Michael Shamus, Dr. Michael Shamus or Carnage Melon calls it a valid audit.  And I, for lack of a better term, tried to use that.  But I think it is best to be most precise here.  I'm just not sure of which words to use.
MR. CHAIRMAN:  I think in this context, validation works.
MALE:  Yeah.  I continue to see, and this is close to it.  I continue to see written references and official stuff talking about the reconciliation and the numbers of voters who voted in a precinct versus the ballots cast in the precinct as an audit.  Well, that's not an audit.  That is a basic administrative step that you take before you decide that you're going to certify your election results.
MR. CHAIRMAN:  Could I ask clarification?  Do you think audit, the term audit, is okay in the second part of that statement?  "In audits of the election results and in full recounts."  Is that the proper use?  
MALE:  Let's see.
MR. CHAIRMAN:  In the 60211.
MALE:  I don't think you should be doing – I mean I don't see audit of an election result as being an audit.  Audit of an election result as you're using here is I think the validation that the number of votes and the number of voters are equivalent and all the records are in place.  And that's good administration.  Audits come in to auditing the election process.
MR. CHAIRMAN:  So audit applies to overall process rather than the results?  Is that –
MALE:  Yes.  And with the intent of determining if in fact the process was in compliance with standards.
MR. CHAIRMAN:  Yes.
FEMALE:  You know, I agree.  And one of the things that we looked at is you know you're testing the equipment prior to the election.  This is part of the test, to make sure that that test after the election it also verifies.
So we looked at it in our state, do we continue – That is one of the tests that is run.  You run tests before the election of several different types and then you run a test after the election to make sure that – Whether you're checking a machine to the verify paper.  And that's really what you want to do.  You don't want to check a precinct, because then you're checking – You know, you want to do more of a – You want to do a test of so many pieces of equipment.  And so it's equipment to that and it's not the precinct count.  
So you could even refer to it as one of your tests.  And if you're glossary defined it well enough and so on, because it's a test that you have to do just like you do before an election.  It's one after the election.
MALE:  And it is a combination of validation, valid accounting, reconciliation.
MR. CHAIRMAN:  Yeah.  In the first part, I think you can easily put verification, because you're talking about the verification or validation of the accuracy of the voting station's electronic records.  But it doesn't quite fit that.  Do you want to say (Indiscernible)?
MALE:  Well, in this case it could be in certification of the election results.
MR. CHAIRMAN:  Now certification is certainly in the I saw 1700 etc.  It has a very different connotation.
MALE:  Well, under election law it's usually the election board's certificate of the results.
JOHN:  Well, one suggestion might be to make them into verbs.  
MR. CHAIRMAN:  In what?
JOHN:  We could say – The first could read, "That can be used to assess the accuracy of the voting station's electronic records to verify the election results."
MALE:  Uh-huh (affirmative).  Yeah.
JOHN:  That might work a little better.
MALE:  I think that works better.
JOHN:  Okay.  All right.  Okay.  Very good.
MR. CHAIRMAN:  Okay.
JOHN:  Are there any other comments on this particular slide?  Okay, well then we'll go to the next slide.  And here what I've done on this slide is just summarized, in essence, the requirements that are on page 6-30, 6-31, 6-32, and 6-33.  Kind of lumped them together. 
The first one, "The voting station shall be capable of showing the information on the paper in a font size of three millimeters and should be capable of showing the information that goes onto the font range."
Based on this morning's discussion, I'm not sure if that requirement should stay as is or if it needs to be changed.  And I'm kind of looking at John Kujini (phonetic sp.) and Sharon to nod their head.  [laughs]
FEMALE:  (Indiscernible).
MALE:  (Indiscernible).
JOHN:  Uh-huh (affirmative).  Well, in the interest of time, I think – I could suggest that I could take this off line, because basically that wording needs to conform to the wording in your requirements.
MALE:  What we did on the other ones, we said, "Under the control of the voter or poll worker."  
MALE:  Uh-huh (affirmative). 
MALE:  Right.  And we need that consistency.
MALE:  All right.  Then my procedural question is when we do approve this, will we approve chapters two in its entirety?  And what about chapters –
[End of Audiotape 3, Side A]
FEMALE:  (Indiscernible).
MR. CHAIRMAN:  That's not the issue.  The issues is we are making changes to certain sections of the 2002 standard creating the VBSG version one.  
MALE:  Right.
MR. CHAIRMAN:  The question is do we need to approve formally the sections where we're not making any changes.
MALE:  And I think yes.  Because we're forwarding to the EAC a total package.
MR. CHAIRMAN:  There is a tacit approval by the fact that we are leaving those in place so that it seems to me requires approval that we are saying not only are we making these changes, but those other sections are generally okay.  I mean there is a sort of tacit approval there.  So I agree with you.  I think we should, even though we haven't made any changes, we should have it clear that we are approving the whole document not just parts of it.  Okay.  So, we will then make a motion at the end to approve the whole rest of the document where there were no changes so that we have approved formally the entire document.  Okay.  I think that's a good point.  Thank you.
FEMALE:  Before we move on I would just like to thank the new staff for all their hard work on this.  I know it looks like we started into the first section with lots and lots of changes, but this is one of the big substantively new sections.  And I'd like to just formally thank them.
MR. CHAIRMAN:  Thank you.
MALE:  Sorry.
MR. CHAIRMAN:  Okay, we'll then proceed.  And at this time I call on Mr. John Wack (phonetic sp.) of a misinformation technology laboratory to present the newest report overview and security requirements for VBSG version one.  John.
JOHN:  So there's nothing new in 228?  Or are we not covering that?  Or?  I'm a little confused I'm afraid.
MR. CHAIRMAN:  Yes.  The only change in – Actually, if you – Yes.  There is in section two all the changes are in section 227.  No changes in 228 or 2.3.  And 2.4, five, six, and sections three.  Let's see.  Yes.  No changes in three, four, five.  The next set of changes are in section six.  Go ahead then.
WACK, J.:  Okay.  Well, my name is John Wack.  And you heard from me I guess approximately six weeks ago, seven weeks ago.  And it's a pleasure and an honor to be here again trying to work on this with you.  And we took longer than I initially thought right now.  So I'm going to try and do you a favor and myself as well, if you don't mind.  And what I'm going to try to do is skip through some of the slides, and that may allow you a little bit more time for discussion. 
I'll talk a little bit about what we're going to do.  Specifically, we're talking about section 6.0 –
MR. CHAIRMAN:  John.
WACK, J.:  Yes.
MR. CHAIRMAN:  For the benefit of the people on the phone, will you make sure you point us to which view graph, which slide you are referring to so the people can follow?
WACK, J.:  I certainly will.  Okay.  We're starting pretty much on page 6-3, which is section 6.0.1.1, Independent Verification Systems.  And what I'm going to talk about in this particular section goes all the way up to VVPAT, which I think is page 6-27.  So we've got 24 small pages to get through.  
And really, what we have here in this document is an overview that goes on for about nine pages and then a series of definitions.  
Now let me talk a little big about this just for a second or two.  Actually, let me move to the next slide here.  Okay.  For the background.  This section really wasn't intended to be in this document to begin with.  Basically we presented the VVPAT requirements, draft requirements back in early March.  And we had some feedback.  We had some good feedback from that.  And part of it was that it may appear to other states that we are recommending VVPAT as the solution, because we aren't talking about other sorts of solutions, other sorts of systems.
So we had some requests that we talk about other sorts of voting systems that kind of fall within our security framework that we're proposition for VBSG2.  And we thought that would satisfy that request.  And at the same time, it would allow us to get some information out that you could comment on and that we could hear comments back from other people as well.
With the VVPAT guidance, we had a number of vendors that commented.  And I found those very helpful comments basically.  And I think the requirements have improved as a result of that.  So I thought this was a good opportunity to do somewhat the same.  And I'll talk a little bit about the chronology of this and just go over it briefly.
Way back in January we had a couple of resolutions.  And specifically those were resolution 1205, which was voter verifiability one and resolution 21-05, multiple representation of ballots.  And those got approved.  And then John Kelsey presented several presentations to you back in March.  One on an approach that we call DVIV, direct verification indirect verification.  And we got a number of comments back from you on that.  And that was basically material that we intended to put into VBSG2.  And then as I said, we had some comments about were we by not recommending, or by not talking about other approaches to independent verification, are we in fact promoting VVPAT.  And we didn't want to leave anybody with that impression.  So we included this material.  
Now at the same time, we looked at other system that are being marketed out there.  And I have to say I was fairly impressed.  Because when I started this whole project, I tended to feel that some of our requirements were kind of out there.  And it actually turns out that a number of vendors are actually working along fairly well in certain areas with security and coming up with some interesting and some impressive approaches.
So we felt that it wasn't entirely premature to talk about some of these other approaches here.  So basically we're not talking about anything that is required in 2006.  What we're talking about is including an informative section in VBSG1.  But these are not requirements for anybody to meet in 2006.  And essentially again, they are four states who are considering VVPAT.  This is other material, other information they can take a look at and use in their decisions.
I feel good we got all this material done.  I feel a little bit bad because – I'll just have to say that usability and accessibility weren't things that we could adequately address at this point.  And I don't want anybody to have the impression that we didn't think that that was important.  And I tend to think that it's an iterative process where you basically start with a security solution.  You see if you can make it useable and accessible.  If you can't, you go back.  You keep trying.  You work all three.  And finally you end up with something that basically satisfies everybody's needs and desires.
Okay.  With that, I think I'll start in.  I don't want to forget to thank a few people.  First of all, I want to thank John Kelsey who contributed quite a bit of material to this.  And had a lot of help from the rest in his staff as well.  John hasn't been around as much because he's been helping his newborn son enter life in the greater D.C. area for the past couple of weeks.  And I talk to John actually for the first time in a couple of weeks last night.  And at one point I had to get up, answer the door.  I came back and John didn't know I was on the phone.  And I could hear his wife complaining that the baby just won't go to sleep.  She's done everything she can.
And so John started reading section 6.0.3.1 and the kid went out like a light.  [laughter]  So, a little bit of humor there.  Okay.  
MALE:  (Indiscernible).
WACK, J.:  You are hearing that very correctly.  It is a should in 6.01 and I will furthermore point out the paragraph right up above 6.0.1.1, which basically says that the remainder of this section is an informative section with discussion of independent verification systems.  These definitions are preliminary and will be evolving with further research.  So I know for a fact that we did not get everything right here.
MALE:  Can I just clarify something?  It's not all of section six.  It's just the overview part.
FEMALE:  Just 601.
MALE:  601 is the part that is informative only.  And their not even shoulds.  They're just definitions.
MALE:  Well, I guess I'm looking at paren (phonetic sp.) three and 601, Use of Wireless Network and Voting Systems.  How wireless networks and data sent across wireless networks should be secured.  Is there in this a measurable standard that would be applied in '06?  Or is this simply a should in its entirety?
MALE:  (Indiscernible).
FEMALE:  Let me clarify.  In the new section 6.0, 6.01 is purely informative.  6.02, which is wireless is normative.  
MALE:  (Indiscernible).
FEMALE:  Oh, I'm sorry.  602 is VVPAT and is normative for systems that use VVPAT.  6.03 is normative, which is wireless.  And 6.04 is normative, which is setup and distribution.
MALE:  Okay.
FEMALE:  Okay?  And I've made that correction in my text.
MALE:  (Indiscernible).
FEMALE:  602, VVPAT is normative, but it is only if your system does VVPAT, then you should follow these – 
MALE:  Right.  Okay.
FEMALE:  Okay.
WACK, J.:  Okay.  We did that just to keep you on your toes.  Okay.  What I shall do is move onto slide number three, which is terminology.  And I just thought it was worth it to talk about these terms a little bit.  
Direct verification, basically directly verifying presumably an electronic record, a paper record directly verifying ones choices with human senses.  Indirect verification you're using a voting system, for example, to indirectly verify.  The voting system is recording your verification.
Now audit.  A lot of definitions for audit, and in the past I don't think I've used it properly.  A ballot audit, we're really talking about basically a process whereby the voting records from a system are audited.  And your goal basically there is to determine whether the voting system is recording the ballots as cast.  That's what we're talking about when we say a ballot audit as opposed to a system audit and a vant (phonetic sp.) log audit, a financial audit.  
And electronic records, I just want to make sure that really talking about valid images in electronic form.  Okay.
I'm on slide four.  I think I've talked about the resolutions there.  And I'll go to slide five, which basically has what are our goals here.  And I included that quote there simply because Dick Tuck apparently had a good sense of humor, and he had confidence that he actually did lose.  Things have changed, and I think what we're seeing is more contentious elections, more litigation, and people want more proof that they actually lost.
So in a sense, what we're trying to do when we're talking about independent verification with ballot audits is we're trying to ensure that someone very quickly understands that they actually did lose.  They have faith in the voting system.  They trust that the records are correct.
Okay, if you don't mind, I'm going to skip slides six and go onto slide seven.  And here I'm kind of repeating some things that John said.  Basically, why are we moving in this general direction in VBSG2? 
And in a sense, basically we're seeing increasing sophistication and technology, which breeds more threats in a sense.  And we're seeing that down the road we may have more sophisticated voting systems.  Already we're seeing some that are highly networked in a sense where we have the voting terminal talking with a controller throughout the voting session.  We are seeing the introduction of wireless.  Things of that sort.
So everything that we do now in terms of procedures, testing, all of that is important.  And we aren't going to change any of that.  We have to do that in the future as well.  But we think here that it is also a good idea and it's prudent for the future that we do independent verification.  We actually produce multiple records of votes in a way that we can actually run reliable audits on them.
Okay.  I'm going to skip over to slide 9.
FEMALE:  You may (Indiscernible).
WACK, J.:  Which is called Missed Analysis and Approach.  And I just basically want to say that VVPAT is an interesting approach.  Is it the best?  Is it the only?  No.  There are other approaches.  What we're doing here with this presentation is drawing a larger circle around a class of voting systems that have independent verification capabilities.  And we're providing this for comments, and in the future we may recommend these definitions as mandatory, as requirements I should say.
And moving onto page 10.  Let me just stop here for a second.  I don't want to go so fast that I'm preventing you from asking a question.  If you have questions, please raise your hand at this point.  Otherwise, I'll just continue.
Okay.  So this is the general class.  In your handouts, we're calling it independent verification.  Earlier we called it dual verification.  When we called it dual verification it was DV, and then people may confuse that with direct verification.  And then we started calling it independent verification, which people think it's indirect verification.  And we decided really to confuse you some more and just keep IDV.  Being good government workers, we conserved on the number of letters in the alphabet.  We just stuck to I-D and V.  
And actually the state of Maryland hosted a meeting sometime within the past month where they took a look at a number of different systems that had independent verification capabilities.  And they actually came up with that term.  Or that's where we first saw it is independent verification.  And we decided that our approach really is we're talking about two sets of records.  And we're talking about being able to independently audit the records, in a sense.  So we basically decided to use IDVER, independent dual verification.
Moving onto slide 11, IDV properties.  Again, John presented a lot of this material.  And essentially what we're saying is down the road in the future we think we're all better off with systems that produce multiple records that are just basically more resistant to fraud.  More resistant to damage, to loss, being able to determine whether ballots or records have been inserted, deleted.  
By doing that we're also in a sense making voting systems more resistant to subversion.  Done properly, there could be potential reductions in testing expense and overall greater confidence that if you lose an election, you actually really did lose the election.
Okay, up to the next slide, which I think would be slide 12 if I'm right.  IDV record production.  Again, to repeat this a little bit.  Here's an example of how this might work.  And may be I could just walk you through with one particular technology.
Let's say you're standing at a DRE.  You make a record of your choices.  You press a button.  So there you've done some indirect verification.  And the DRE could then send your verification in a sense onto a different system.  In this particular example, let's say there's another system that's able to capture with a picture your verification.  It actually takes a picture of the DRE screen as you're verifying it.  So then you have a record.  You've got another record.  It is independent of the voting system.  It can be verified by looking at it.  It is another indirect verification.  But it is on a separate system. 
So at that point you have two records right there.  If the voting system were to be sabotaged in a way or if there were accidents, whatever, you do have another record that has been verified.  Is that fairly clear?  We've kind of gone over that material before, but – Okay.  Then let me skip –
FEMALE:  Can I ask a question?
WACK, J.:  Oh, sure.
FEMALE:  That's clear, but if the voter then felt like that wasn't because of maybe even an accidental voting for the wrong thing that he wanted to vote for, how is he going to change that?
WACK, J.:  Well, in that specific technology I don't know how best to answer that.
MALE:  (Indiscernible).
WACK, J.:  Well, actually it's not imaginary.  There is a company producing something similar to that, which doesn't actually take pictures but it actually takes screen snapshots.  
MR. CHAIRMAN:  I assume that that gets done after you have verified your vote.  Is that right?
WACK, J.:  Yes.  Yeah.
MR. CHAIRMAN:  I mean, you look at the screen.  You say, you know, accept or whatever.  At that point the next verification happens.  Is that right or not?
WACK, J.:  Yes.  You would be right at that point.
MALE:  Why show it to me if I can't do anything with it.  What's the whole purpose of it?
FEMALE:  Yeah.  Isn't this like if you have an op scan?  You finish the ballot.  You walk up to the reader.  It says you have an over vote.  You can – In that case it's sort of easy because you're holding onto the thing.  But you can take it back and get anew ballot and vote again.  So isn't it somewhat similar?
WACK, J.:  Well, in this particular case you want to know did the camera do its job.  And I would think a video monitor would be connected.
FEMALE:  The question was if the voter perceived there to be a problem, do they have a means to essentially restart their ballot or to roll back?
WACK, J.:  I would think there would have to be a means for doing that.  Yeah.
FEMALE:  Then my concern is – There's a reason why I brought it up.  You really have to think about the whole election process.  And if that voter – There's already somebody else in that voting booth voting.  So how are you going to know what ballot to take out of that electronic device, whether it was the direct record device?  And how are you going to get that vote back?  You can't.  Because they cast it on that machine, so you can't send them back to that same machine and then cast something.  So that was part of my problem that I've seen with some of the things.
MR. CHAIRMAN:  (Indiscernible).
MALE:  Couldn't the same thing be said of the verified paper trail?  The same thing.  The very same thing.  I see it.  I can't undo it.  Well, you can undo it because you can indeed say that that vote that I saw I will just subtract a vote like that.
FEMALE:  I don't believe so.
MALE:  If you don't know what the electronic vote had.
FEMALE:  You're seeing your paper at the time you're voting.  It's right there beside you, and you verify that before you – It's asked you, "Are you ready to cast your ballot?"  And you've got it on both.  And if it's not what you wanted to see, you could cancel it and start over.  And it rolls it up and you could start over.
MALE:  But can't the same be done with this camera snapshot?  
WACK, J.:  I think the point is you need to commit to both of them at the same time.
FEMALE:  That's exactly right.  I think you're going to have to.
MALE:  Right.  Correct.
MALE:  Yes.
FEMALE:  I don't know how you can do that.
MALE:  You push a button and the camera goes off, and the electronic record get (Indiscernible).  You can make that work.  You hit the nail on the head.  That's exactly the property you want.  You commit to both of them at the same time once you verify both of them.
FEMALE:  It can't be a different station.
MALE:  You verify what you see indirectly and then you verify the thing at the same time.  Next to each other.  Right.
MALE:  It's fun to design voting systems, but these systems we're talking about right now don't exist.  They're not going to exist probably until 2008, maybe 2010.  Could we get back on track and get more directed toward our stated goal of providing guidance to election officials in 2006?
FEMALE:  I think this whole thing is a big should.  In the language of the last section there's a big should statement to point forward.
MALE:  I don't have any objection to this.  I think these are nice designs, and it's a lot of fun to design them.  But they're more appropriate in version two then version one.  In fact, that's going to be my recommendation John when you get through is that we take this whole section out.  Because we've got 24 pages here of version two, not version one.  And if you want to get it out for comment or what have you, then put it in an appendix or something like that.  But it has no place where it is.
MALE:  (Indiscernible) and make that a motion or second it.  Whichever way you want to do it.
MALE:  Well, I don't now if it's time for a motion yet.
FEMALE:  I was going to say –
MALE:  I think our time here is precious, and I think we've got other items that are going to go in the standards that need to be addressed that we need to discuss.  And if this entire piece is drafted as a should, it is a nice work product.  It is some nice original thought.  It's certainly the basis for further study.  But I don't know that we need to take the time today to go through it if it's all going to be a should.
FEMALE:  Well, I'm sorry.
WACK, J.:  May I get in one comment?  I just want to answer Dr. Williams.  Actually, a couple of the systems that we're talking about here actually are fielded today.  Cryptographic systems right now we describe in here.  And do fit this category.  The other approach that I was talking about with screen snapshots is something that's out there today.  There are systems being field tested right now that do, in a sense, an audio verification.  So we are talking about today's technology, although I think the technology is not there all the way.  But we're certainly – 
MALE:  Those are prototype systems, John.
MALE:  VVPAT fits into this category too.  So those are more real in a sense (Indiscernible).
MR. CHAIRMAN:  And we've been asked by EAC to work on these.  Mark, did you have a comment?
MALE:  Yeah.  I just wanted to make a comment to Brid (phonetic sp.).  Like John explained, this is put in here for two reasons, and I think it would lose a lot if it was removed and put in an appendix.  
Number one, we were told by many different people, including concern from some EAC commissioners or at least one, that in fact even though we make many, many, statements that were not necessarily endorsing the VVPAT, we've had a resolution.  It still looks like we are if it's the only technology mentioned to do independent verification.  So we were very conscious of that, and we were asked by a few different sources to put in at least some discussion so that it doesn't stand alone.  I think that's very, very important that it stay in here.  It's not mandatory.  It's normative.  It's not even a shoulder, by the way.  Everyone keeps saying it's a should.  I'm sorry.  It's informative.  But it's not even a should.
We don't have shoulds or shalls.  We just have definitions.  We discussed them.  So it's clear these are not requirements.  Secondarily, I think like John said, these are things we're looking for to put in the next version, and we really need discussion on them.  And by putting them in now we'll get comments.  If people ignore them and it's hidden in an appendix, we won't get that.
So I think it's very important to put them in.  It's clear they're not mandatory.  It's clear they're not normative.  And it's there for the reasons I just sited.
MR. CHAIRMAN:  Secretary Davidson.
FEMALE:  I tend to agree on this because then states that are being really, whether you want to use the word pushed or really reviewing that they need paper verification on the equipment that they're purchasing.  This might help them and help their legislators understand there is – This is all brand new.  And so making statements now and putting it in law may be a little early.  
So I would think something like this might help them. 
MR. CHAIRMAN:  Maybe what I would suggest John is let's try to get – I mean, this is clearly an information part of the presentation.  Maybe we can get through this a little more quickly so that we have time for the rest of – 
WACK, J.:  You will hear no objections from me.  [laughter]  Let me think for a sec here on how best I can do that.  Because I think it's a good suggestion.  We do have a lot of other stuff.  I know you can't wait to hear about VVPAT.  
Why don't I move ahead in a sense here to – Am I going in the right direction here?  I'm going to –
MALE:  I'd like to make one more comment on this while we're on the subject.  If this is informative, why do we go through all of the – Why not just give the definitions of them?  Why go on for 24 pages listing features that they've got to have when they're not even designed yet?
WACK, J.:  Well, I think that's a good suggestion.  And I would suggest that we actually take a look at what we're calling the core definitions for these systems.
MALE:  Yeah.
WACK, J.:  And take a look at that.  And maybe that's where we can best use our time, and we can get them relatively quickly.
With that, I think – Let me make sure what slide I'm on here.  You would end up turning to slide number 14, which is titled, "IDV Definitions."  And what I've done there is I've actually got the requirements right out of the document.  And so you could either go to the document or you could look at the slides here.  And let me make sure that I am on the same page here.
Okay.  So if you were looking at the document, you'd be looking at section 6012, which is on page 6-13.  Okay.  
MR. CHAIRMAN:  You're confusing us, because you're referring to slide numbers and then page numbers.  Which one are –
MALE:  Slide 14.
MR. CHAIRMAN:  Well, slide 14 is not this.
FEMALE:  Yeah.  They changed the format.  The title is there.
MALE:  Yeah.  You're right.  It's not the same.
MR. CHAIRMAN:  Slide 14 is not this.
WACK, J.:  I have core definitions starting on page 6.
FEMALE:  The title is different on our printouts.  On our printouts it says, "Core IDV Requirements."  Okay.
WACK, J.:  Oh.
MR. CHAIRMAN:  That's true.  It's the same thing, but (Indiscernible).
FEMALE:  It's the same text but it's got a different title.
WACK, J.:  Okay.  Okay.  Yup.  
FEMALE:  And if you're in the document it's 6-4 and 6-5. 
WACK, J.:  Well, originally this was going to be right after lunch, and I thought I'd do that so I could wake you up a little bit.  Okay.  I apologize for that.  That's true.  We did make a couple of changes here.
Okay.  Looking at the requirements.  Why don't we just go through these?  And if I'm going too quickly, stop me.  But in a sense, what I'll try to do is just summarize each requirement quickly and kind of just say what it's saying.
And really the first one is the fundamental core definition for IDV systems.  And it basically just says that it's producing two records, one or both which can be verified directly and indirectly outside the control of the voting system.  And the second one basically says that if one record is compromised it should not end up compromising the other record.  That we actually have two independent records.
And the third requirement, the processes of verification don't all rely on the same voting system.  The voting system produces two records.  You can verify one of the records independently of the voting system.  That is very necessary.  And moving to the next slide, which would be slide number 15.
The records can be used in audits of one another.  In other words, the records formatted properly can be cross-checked.  Can be counted against each other and can result in a ballot audit of high precision.
Now I've added another requirement there.  Sorry about that, but it's in bold.  And it was supposed to be in the core requirements.  And I ended up deleting it accidentally.  But basically that's an important one.  We're basically saying each record needs to have some sort of unique identifier so that if you had two sets of records, each record can be identified uniquely within its set, and it will point to its corresponding record in the other set.
And we also want the records to contain other information that will be useful to auditors, to voting officials.  And these would include identification of the voting site, the precinct, ballot style, any other information that could be of use in identifying the records.
We have some requirements in there.  Basically a voting session identifier.  I know that's already done by at least one of the voting system vendors now on their VVPAT system.  We would like the serial number of some sort of identification of the voting system that produced the records.
And the last requirement.  Basically we're saying that crypto is very difficult to get right.  It's one of these things that we feel fairly firmly about that ought to be a design requirement.  We really think that cryptographic software and voting systems ought to use modules that have been through the government's crypto module validation program as applicable.  They may be using a different form of an encryption that may not be applicable here or feasible here.
And with that, I've really been through our basic requirements.  Are there comments on these that I could entertain?  Questions?  Anything to make more clear?
MALE:  Could I just point out one thing?  When John says requirements, he's using that term.
WACK, J.:  I'm sorry.
MALE:  What they will be in VBSG version two.  Right now, again, they're just definitions of concepts.  They will return into requirements after they're massaged and more research is done in VBSG version two, unless you tell us not to.
MALE:  That, Mark, is what I don't see here.  In a footnote on page 6-4, you summarily dismiss all existing systems.  And then go into this long discussion about these theoretical systems that are not going to exist for two to four years.  And then you go from there into a discussion of VVPAT.  Now what conclusion am I supposed to draw from that except that the current systems are no good?  There's not going to be anything worthwhile for at least for years except VVPAT systems.
WACK, J.:  I think the footnote on page one – Well, I understand where you're coming from there.  But I see it a little bit differently.  Basically, we're saying there that electronic voting systems today that create multiple records generally create copies of their records, and all the records are under the control of the voting system.  So if the voting system let's say is sabotaged somehow or other, all those records are in peril.  
And what we're talking about, just to be clear, is that we're talking about multiple records, one which exists outside the voting systems.  I don't want that footnote to say that current voting systems are bad.  I'm not saying that.  But I'm saying in the future, we want it done differently, because we think it's going to be a rougher environment, and we need more reliability in the records.
The second thing, I again want to take a little bit of issue.  We're seeing products that are going in this direction today.  And I know of one cryptographic software voting system vendor who would probably disagree quite a bit with your statement who does have a system today that pretty well fits into this category.  So I don't think we're talking about systems four or five years down the road, but we're talking about the very near future.
MALE:  Is that system qualified?
WACK, J.:  I do not know yet.
MALE:  Okay.  I do.  It's not.  I know the systems you're talking about.  They're in prototype stage.  I'm not disagreeing with you.  These things are on the drawing boards, and that's good.  But what are we saying to people for 2006?
FEMALE:  Well, Burt, I mean here's – It seems to me that we're sort of once again up against the sort of rigidity of the standards process, which is that we're both trying to address now and kind of cast forward.  Because if we only – I think this is another situation where looking only at this year without anything else – I don't – You know, should it be an annex?  Should it be a whole section?  Should it be a white paper?  Should it be a what?  I don't quite understand the format or channel possibilities that we have.  But ignoring the question of whether this should be in the standard in a section like it is now for a moment.  I think the concept of having this discussion –
I mean, this was not easy reading.  I have to say.  It's hard concepts, and it was hard to get your head around the abstraction of it.  But once I did, I found it quite helpful as a way of thinking about systems in a different way than did I punch a button?  Did a piece of paper come out?  Which are all very design specific.  
So I found a lot of value in thinking through this process in reading this section.  Maybe there's a question about where and how it ought to be presented in a way that will get it paid appropriate attention.
MALE:  I agree, but it should be in version two, not version one.  And if you want –
FEMALE:  Or should it be –
MALE:  It is, it is –
FEMALE:  One of the things that Mr. Schitzer (phonetic sp.) suggested a while ago, and actually we have a draft circulating on this, is that there are a number of issues where there's some kind of – I guess I would call them white papers where there's some discussion issues that have come up that might be useful to communicate more broadly to get input on rather than just six people on a subcommittee having talked about.
And we've never quite resolved how those will fit into the workload.  Let's start there with a practical issue.  But get communicated.  Get commented on.  We have no way to submit anything to EAC except by putting it into a piece of the standard.  So I have sort of all kinds of procedural questions about how we move the discussion forward in a constructive way.
MR. CHAIRMAN:  I think there were two purposes for including this in this set of discussion.  I don't think anybody agrees that this is really a target for version two, but I think there were two issues.  One is the perception issue that you're quite aware of, and I think it was discussed before.  That we did not want to present VVPAT issues in a vacuum making it sound like that's the only possibility.  That's the only choice, and implicitly endorsing that.  So we needed to put that in context, number one.
Number two, this computer security issues have a much longer time constant probably in terms of getting things done.  And it's a complex issue.  Therefore, it needs a lot more discussion, a lot more feedback.  And we did not want to wait until we're finished with version one, you know, in nine months from now, because then we will be told that we're too late for perhaps the 2008 cycle.  So we wanted to start the discussion and the feedback process now.
I understand it takes away from some of the valuable time we have at this meeting, but I think this is a very important discussion.  And we felt that we needed to get this discussion started.
MALE:  Would it also be possible to kind of get in here somewhere, footnote not withstanding, that it is entirely possible to run safe, accurate, secure elections with existing systems?
MR. CHAIRMAN:  Is that a function for VBGC?
MALE:  There's a clear implication here that you cannot run a secure, accurate election on existing systems.
MR. CHAIRMAN:  I think what the statement says is that you are not in fact creating two, independent records.  That one may be the screen.  One may be a paper.  But in fact, the source of both sets of information is the same.  And the core requirements that John is trying to address, if my understanding is correct, is how to generate two independent records that cannot be intertwined, and therefore, by changing one you can't change the other.  That's the most secure form that we're seeking in the future.
FEMALE:  Perhaps we should simply say that.  I mean, that's a much clearer statement.  I'm sorry.  It was a long winded statement, but nobody took it down.  But that's a very clear statement.  That the real requirement you're talking about is that you have two records, which once completed are in fact independent of each other.  Not simply a re-printout of the same record.  And that's actually a pretty clear thing to say, and maybe we should just say that.
MR. CHAIRMAN:  I think maybe what's down here at the bottom of page 6.4 is half the story.  It states where things are now and then maybe we need to add something that says, "This is what we're trying to accomplish."  Not simply show the same information from the same source in two different forms, but to provide a facsimile of two independent (Indiscernible).
FEMALE:  Yeah.  I don't hear a disagreement with that.  I just hear some objection to the tone.  I would rather get to the substance.
MALE:  Let me see if I can unravel what we're – Okay.  If we perform an election today with a DRE equipment without a verifiable paper trail, it still can be a good, clean election.  There are some concerns.  In case it was challenged or something, you wouldn't be able to reproduce that record for someone to see.  
MALE:  We have methods for dealing with challenged elections.
MALE:  Okay.  Now, I think it was also said that some of the implementations of the VVPAT that people are buying right now has some equal flaws.  Good, but has equal flaws.  So what we're saying is neither system is ideal, and we want to shoot for something higher.  
Now are there any VV paper trail systems out that I can buy today in 2006 elections that will meet the guidelines that we would be saying even for verifiable paper trials to make it more secure.
WACK, J.:  Uh, you're asking me.
MALE:  I don't know.  I'm asking the question.
WACK, J.:  It's a matter of opinion.  I think a number of the vendors would say yes, for sure.  And some other people would say no.  
There were some issues in the VVPAT area.  And one that was brought up earlier was the paper roll sequentially stored records issue.
MALE:  The privacy issue.
WACK, J.:  There are some VVPAT implementations right now that do things differently.  And then there's this whole issue of grandfather.  Can I punt on that question a little bit?
MALE:  The only reason I'm asking that is in other words – Otherwise, let's say that was the case.  That what you're going to write as the guidelines for verifiable paper or the trail would basically say that nothing in 2006 is totally compliant, then you're saying a district in 2006 has a choice.  They can either go without a verifiable paper trailing or procedures and so forth and punt as best they can.  It's imperfect, but it'll work.  They can have the verifiable paper trail and overcome some of the objections, and it will work.  Neither one will be the target that you want to have.  And so they can use either/or in 2006.  And beyond 2006 here comes the phase two and here's what we have to say about what the ideal system would be, whether you're using a paper trail.  And here's how you design it.  We're using some indirect method of two independent records.  Here's how you design that.  And so you will be looking for designs either A or B that would satisfy that.  And it would be lamentable, but in 2006 we're going to have to go along with a variety of different solutions that are all relatively imperfect, but that's life.  I mean, we'll cover it through procedures and etc.
MALE:  Mr. Chairman, did I just hear that it's regrettable that we're going to have to go into 2006 with systems that aren't perfect.
MALE:  That's what I thought I said.  [laughter]  But you'll probably see the same answer in 2007, and eight, and nine.  
MALE:  I've never seen a perfect system.  I don't think we're ever going to see a perfect system.
MALE:  Yes.  I agree.  Right.
MALE:  And if we make perfection our goal, we're never going to get there.  Systems have strengths and weaknesses.  You have to put management procedures around them to effectively use them.
MR. CHAIRMAN:  Actually, I was going to make the statement then.  The function of this committee is not to make value judgments.  I think our function is to –
J.R.:  J.R. is on the line now.
MR. CHAIRMAN:  Thank you J.R.
J.R.:  Where are we by chance?  [laughter]
MR. CHAIRMAN:  We were wondering that ourselves.
[END OF AUDIOTAPE 3]
WACK, J.:  I will talk up line with Sharon and John and make sure our requirement is accurate with what was decided upon this morning.
MR. CHAIRMAN:  John?
WACK, J.:  Yes. 
MR. CHAIRMAN:  Why does that say in the bond size of three millimeters?  Shouldn't there be a minimum?  Because in the next sentence you're saying in the range of three to four millimeters and then six point three and nine.  I don't understand that.
WACK, J.:  Well, yeah.  In the discussion, the first sentence ends with but at least be capable of three millimeters.  But it isn't reflected in the requirement.  
MR. CHAIRMAN:  Right.
WACK, J.:  To me it seems like reasonable language to put it in the requirement.
MR. CHAIRMAN:  It should be consistent wit that.
WACK, J.:  So perhaps I would recommend that it be changed to, "In a font size of at least three millimeters."
MR. CHAIRMAN:  Yeah.
WACK, J.:  Okay.  All right.
MALE:  If it's important, John, it needs to be in the rule, the guidelines, because the deductions, people don't go down there very often.
MR. CHAIRMAN:  Right.
WACK, J.:  Okay.  Good point.  Okay.  Then if there are no objections, then I'll move onto the next requirement.
MALE:  (Indiscernible).
WACK, J.:  [laughs]  Yeah.  You caught that.  [laughter]  Okay, the next requirement is that paper and electronic records shall be presented so as to allow for easy, simultaneous comparison.  I think that's probably self-evident.  And that has a couple derived requirements underneath it basically talking about the paper records being positioned so that at the same posture you can look at them.  
Talking also in 60222.  If the paper record can't be displayed in its entirety, there shall be a means for moving the paper so that you can look at the entire record.
MALE:  (Indiscernible) both directions.
WACK, J.:  I think that question came up, and it could.  You could read it that way.  The implementations I know of today move in one direction.
MALE:  I think we should be more explicit.  (Indiscernible).
FEMALE:  If you move the paper both directions, aren't you getting in more of a problem then where it's going to stop.  I can see real problems then and voting on if you're moving it in both directions.  I mean, I think about Colorado and some of the states that have initiatives on their ballots.  And our paper will be a lot longer than most, because we have judges and we have so many candidates.  And then we get on into all the different initiatives and referendums.  Our paper will be quite lengthy.  And so moving that paper back and forth really worries me.  I think it should move forward.
MALE:  I agree.  I've raised the question (Indiscernible).
MR. CHAIRMAN:  Do you want to replace the word "moving" with "advancing?"  
MALE:  Yes.  Also, the question should that be on the voter's control.  Because it calls for, especially an advanced person, a voter be able to indicate (Indiscernible).
MALE:  Well, -- 
FEMALE:  Is this on now?  We have –
MALE:  Moving (Indiscernible) either forward or backward.  Advancing is only a forward direction.
FEMALE:  Right.  We recognized when John and I discussed this that there are lots of issues with moving backwards and a lot of confusion.  The intention of this, I think what we finally decided was that rather than having the paper just scroll, scroll, scroll automatically whereas the voter might miss part of it scrolling by, it would be under the voter's control.  So a page would scroll up.  Stop.  A voter could verify.  Press a button.  Scroll some more.  And it was a usability issue.  So that was the intention of this.
MALE:  So we would want this to say "advancing the paper."  And then at the end say "under the control of the voter."  
FEMALE:  Under the voter control.  Yes.
MALE:  Right.
WACK, J.:  Okay.  I think I have that.  If the paper record cannot be displayed in its entirety, the means for advancing the paper to show all paper record contents shall be provided under the voter's control.
MR. CHAIRMAN:  No.  I think you want to put for advancing the paper comma under the control of the voter comma to show all paper record contents shall be provided.
WACK, J.:  Okay.
MR. CHAIRMAN:  Is that agreeable to everyone?
MALE:  Do we need to re-think (Indiscernible) there as well?
FEMALE:  Yeah.
MALE:  Well, there's an interesting implication here.  And that is that this paper is on some kind of a roll.  If this is producing cut sheets of paper –
WACK, J.:  Yeah.
MALE:  The word advance seems to go with forward.  But it's probably not intended here.
WACK, J.:  Earlier I thought maybe we could reword it to say, "A mechanism shall be provided to show all paper record contents."  Something along those lines.
FEMALE:  Could we maybe help this by saying the paper record "should not" instead of "cannot?"  Or no.  That won't help it.  I'm sorry.  But I was trying to say this is not a mandate right now.  But it could be looked at more in the version two.  I see this as being a real problem with what's possibly out there right now and what the vendors are doing and have them certified.  And if this doesn't meet the needs by 2006, I'm hurting.
MR. CHAIRMAN:  Yeah, but isn't this something necessary?  I mean, if you cannot see the entirety of your paper ballot, what is the point of having it?
FEMALE:  Well, one of the things they have, the ones I've seen is as you're voting, it marks it on that paper right then.
MALE:  It just keeps moving up?
FEMALE:  And then if you changed and decided, "Oh, I'm not going to vote yes on that issue."  And you change it.  It says, "cancel" on that one vote.  And then you can go on and vote however you want to, and it indicates it on that paper.  It's there simultaneously as you vote so the verification kind of takes place, the whole process, as you're voting.  And if your ballot is really long, that paper is only twelve – Or that pack is only what?  Eighteen inches maybe at the most.
You're going to have – That's going to be rolled around twice for us possibly.  So backing it up and seeing – You're never going to see the whole ballot at one time.  Even if it's on a scroll of it it's being cut.  You're never – You're going to have to get it back to show.
I just don't know like we're at the position of making statements there today with what's being done.  Like you said, the vendors have been out already moving on this and not having direction to go by.  And they've even been certified.  And now if they have to start over, they'll never meet that mandate for the states that need to buy it to have the paper verification.
WACK, J.:  Yeah.  There is at least one vendor who prints out on an eight and a half by eleven sheet of paper.  I don't know what their specific procedure is.  If they have to use multiple pages.  But it seems that the requirement should make it clear that the voter should have some control over the process of viewing the next part of the record.
FEMALE:  Mr. Chairman, to back up what Secretary Davidson said.  Our ballot was not set on an eight and a half by eleven piece of paper.
FEMALE:  Ours don't either.
FEMALE:  When you have 90 choices, it just won't go on one piece of paper.
FEMALE:  Ours is the same way.  We have two sides on our scanned ballots, and I'll tell you what.  The print is so small that it wouldn't approve any of this that they are doing.  If we make the print size it is here, we would have three to four pages that it would be printed onto.  So there is really issues with this.
WACK, J.:  Do I understand that there are issues with the way the requirement is worded?  Or issues in being able to actually accommodate multi-page records?  Is it the latter?
MALE:  (Indiscernible).
MR. CHAIRMAN:  Yes to both it sounds like.
FEMALE:  So I can clarify.  I think there are two cases.  And I believe I've seen both.  One is that you verify at the end, so it's scrolling by whatever mechanism.  And that needs to be under voter control.  The other case is where you verify one at a time back and forth, not clear if that's very useable.  But at this point without doing some further study, we can't make a statement on that one way or the other.
So we can qualify this particular thing with saying if it's being verified at the end, you'd have to have the scrolling under control of the – Advanced scrolling under the control of the voter.  I don't think there are any other cases that are implemented.
MALE:  How about if we change that to say (Indiscernible).
MR. CHAIRMAN:  Use the speaker.
MALE:  Paper record cannot be displayed in its entirety, a means must be provided for allowing the voter to view the entire ballot.  And leave it up to the vendor how to implement that.  
MALE:  I think something like that sounds good to me.  This is not a security issue.  It's a question of usability.  These are new systems, and having a bit of flexibility here to try to explore the design space here seems like a good idea.  So rather light language here that allows vendors to experiment with a number of different approaches to managing (Indiscernible) seems like a good idea.
MR. CHAIRMAN:  Did you write that down Brit?
MALE:  If the paper record cannot displayed in its entirety, a means must be provided for allowing the voter to view the entire record, the entire ballot, record, whatever you call it.  Record.
WACK, J.:  Okay.  I don't see.  It looks like everybody's nodding I think.
MR. CHAIRMAN:  Did we capture it?  That's the question.
WACK, J.:  Oh, yes.  Okay.
MR. CHAIRMAN:  Would you read that Barbara?
FEMALE:  If a paper record cannot be displayed in its entirety –
MR. CHAIRMAN:  You got to get up here.
FEMALE:  If a paper record cannot be displayed in its entirety, a means must be provided to allow the voter to view the entire ballot.
MALE:  (Indiscernible).
FEMALE:  Shall.  Got it.
MALE:  (Indiscernible) to be preventable (Indiscernible). 
MALE:  Yeah.  We're letting the vendor decide how to implement it.  We're just saying that you've got to be able to show the voter their entire ballot.  And if your mechanism is such that you can't display all of it at once, then you've got to demonstrate how the voter can see the entire ballot.  It's the vendor's problem instead of ours.  [laughter]
MALE:  That's a performance issue, and that's what we're supposed to be doing.
FEMALE:  And I understand, but I'm a little concerned that I don't know if they can meet it by 2006. 
MR. CHAIRMAN:  It seems like they're already meeting it.  
MALE:  They've got to.  I mean, you don't have a bona verified ballot without this requirement.  If I can't look at the whole ballot, how can I verify it?
WACK, J.:  The one implementation –
FEMALE:  Maybe I'm crazy.  Maybe I haven't gotten the point.  But I mean, as the DRE screen moves up, you've got another segment to it.  It's the same way with that paper.  To be able to see – What we're saying here is you've got to see that whole ballot.
MR. CHAIRMAN:  No.  That's not what it's saying.  I mean, I think that may be a perception, but that's not what it's saying.
MALE:  No.  Think summaries.
MR. CHAIRMAN:  That's a higher level requirement.  If you require that the whole thing is seen all at once, you know, I think that's something that the committee needs to think about.  But this language simply says, "I need to be able to see everything that's on that paper." 
FEMALE:  Very good.  I'm all right then.
MR. CHAIRMAN:  Is that the appropriate interpretation?
FEMALE:  Thank you.
WACK, J.:  Yeah.  And just the one VVPAT implementation I've seen that I think is certified basically does do that.  If you look at a page on the electronic record, it prints out that page on the paper record.  You essentially say, "I'm through.  Let's go onto the next page."  You press a button.  It has the next page on display.
MR. CHAIRMAN:  Okay.  Let's go on John.  Okay.  [laughter]  Yes, sir.  Okay.  Well moving to the next one.  If the paper record cannot be displayed in its entirety, each page of the record shall be numbered and shall include the total count of pages for the record simply just to help the voter know where they are.  If they're looking at page three, it might be useful to have that three of seven just to make sure they know where they are in the verification process.  Because you can imagine it would be confusing otherwise. 
FEMALE:  Would they know?  I mean in the case of something that's printing a screen.  You know, it's matching a screen display to the print display, would the system actually know how many more pages of print there are?
WACK, J.:  Yes.  That would be entirely capable.  Or entirely doable.  
J.R:  Word processor does it, so why couldn't a voting machine?
MALE:  Say that again J.R.
J.R.:  I said the word processor, when you open up word it tells you one of two, one of twelve.  Likewise when you print.
MALE:  Right.
J.R.:  So it has an electronic image of the page numbers of the bottom of your computer screen, and then the numbering system can also appear on the printed page.
MR. CHAIRMAN:  Well, should we make that clearer and maybe put an example there that says for example, page one of three?
MALE:  There it is at the bottom.
MR. CHAIRMAN:  Oh, okay.
MALE:  I want to wordsmith this a little bit too.  We've already said that you've got to be able to display the ballot in its entirety.  I want to change that to say, "If the paper record will not fit on a single page, then each page much be, etc., etc."
MALE:  Thereby combining them.
MALE:  I wanted to add as well that I think there is a concern about the number of pages.  J.R. said that word processors do it.  But the word processors know the document entirely ahead of time.  If you have a write-in ballot and you write in for somebody's who's got a 494 character name, or even just a small name that happens to hit the end of the page, you could run over.
So I would actually prefer to see each page be numbered and the last page shall be clearly distinguished.  That's suffice.
FEMALE:  I agree.  I mean, I can begin to think of a lot of things.  Like you only voted for one of six, and the page number changes.  And I would think that having a situation where there would normally be three pages, but you only have two because of how you voted and now you don't know where your third page is, would actually cause more consternation than it solved.
MR. CHAIRMAN:  What is the suggested wording?
MALE:  I guess I would propose that each page of each record shall be numbered and the last page shall be clearly distinguished.
MR. CHAIRMAN:  But we need a (Indiscernible).  How about if the paper –
FEMALE:  If the paper record cannot be displayed in its entirety, each page of the record shall be numbered –
MR. CHAIRMAN:  Well, I actually – If it's on three pages, it is still displayed in its entirety.  I don't think that's correct.  I think it should say, "If the paper record cannot be displayed on a single page."
MALE:  That's right.  Each page shall be numbered and the last page (Indiscernible).
MALE:  Yeah.  That's good.
MR. CHAIRMAN:  Does that capture?  Thank you.
WACK, J.:  Okay.  We have that.  And moving onto the last requirement in the usability section there.  There shall be instructions for performing the verification process made available to the voter in a location on the voting system.  And I don't think I see any issues with that. 
So I would favor moving onto the –
MALE:  Question.  One question John.
WACK, J.:  Yes?
MALE:  (Indiscernible).  I hate to go back to accessibility and kick a – the constant force.  Is that assumed it's going to be in an accessible format to the voter?  If you're giving them instruction?  Will it be audited?  Will it be audible?  Will it be print?  Will it be large print?  Will it be brail?  What do you do for the people who are handicapped in order to access the instruction?
WACK, J.:  Well, you may have brought up a point.  I think we originally had some sort of a requirement.
FEMALE:  We have a section in 227 that addresses the need for instructions to be in a format.  And I think we could simply reference it.  I mean, I could go look it up, but I think if we simply reference that section, we'll be fine.
J.R.:  Yeah.  That's what I was suggesting.  We (Indiscernible) set it up there, but some notation needs to be made here to either reference back to that or to make it clear to the election official that the instructions have to be there in a format understandable by the individual. 
FEMALE:  I personally would rather just reference it so we can wordsmith in one place. 
J.R.:  I have no objection.
MR. CHAIRMAN:  Okay.  So we'll find that particular section to refer to.  6023. 
FEMALE:  You have a typo at the top.  I assume you mean accessibility requirements from section 227, not 224.
WACK, J.:  Ah, yes.  I'm sorry about that.  [laughs]  Okay.  All right.  We will reference the appropriate requirement.  And okay.  Then moving onto page 632.  Talking about the accessibility requirements.  
Starting with 60231, voting stations shall display print store paper record in any of the alternative languages chosen for making ballot selections.  Okay.  I think for the purposes – The next requirement underneath that, 602311 for the purposes of auditing, candidate names on the records shall be in English.  I might anticipate a problem with the use of the word auditing there.  We could even leave out the four purposes of auditing and just say candidate –
MR. CHAIRMAN:  How about verification?
MALE:  Actually in that case, wouldn't auditing be acceptable?  Because it would allow third parties to come in and function.
MALE:  (Indiscernible).
MR. CHAIRMAN:  Is verification acceptable in that case?  Okay.
WACK, J.:  Okay, that shall read for the purposes of verification.  Okay, down below, 602312, other markings not related to ballot selection on the paper ballot shall be in English.  Essentially the precinct name is included and so on and so forth.  Those shall be in English.  I see no problems with that.
FEMALE:  Does this section allow for those languages that are not written?  
MALE:  (Indiscernible).  [laughter]
FEMALE:  If you know the – Most of the Indian languages are not written languages.  Will we have to provide – 
At least in (Indiscernible) jurisdiction we have to provide for five Indian dialects.  
MALE:  Uh-huh (affirmative). 
WACK, J.:  Sharon, can I – I'm not going to – I'm going to ask for your help there, because we've talked about this issue, and I don't want to misstate how you've handled it already.
FEMALE:  Well, the audio ballot is the alternative for a non-written language, obviously.  Now if you're going to insist on a fully accessible VVPAT voting, a voting station with VVPAT to be fully accessible, then you need something in addition to the paper audit trail to do the verification in an audio way as well.  Same for blind or anyone using the audio ballot.
MR. CHAIRMAN:  Is that a topic for version two?
WACK, J.:  The next requirement addresses in a sense the audio ballot, the audio verification.  60232.  And that requirement is repeated from the human factors section. 
FEMALE:  Okay.  We've got a normalization problem that I missed.  Because the section from 227 is on page 221.  It's number 2271226.  This is a shall, and that's a should.  And sorry.  It was on my list of things to deal with, but we did a lot of other things.  And I think it should be a shall in both cases.
MR. CHAIRMAN:  Which number was that again?  
FEMALE:  It is 2271226 on page 221.
MR. CHAIRMAN:  Yes.
FEMALE:  It says – It actually – If the normal procedures includes VVPAT, the accessible voting system station should provide features that enable voters who are blind to perform this verification.  This section, which is supposed to be a direct repeat says, "If the normal procedure includes VVPAT, the accessible voting station shall provide features that enable voters who are blind to perform this verification."  
So except for some orthographic differences that we also ought to clean up, we've got a should shall difference, which is a subtenant one.
And I'd like to suggest that we actually go back to section 227 and make that a shall.  
MR. CHAIRMAN:  Okay.  So noted.
FEMALE:  Okay.  And Sharon, would you note it on that piece of paper that we're going to give to Mary.  The one that we're editing just so we keep in all in one place.
WACK, J.:  Okay.  I would like to move on, but I want to make sure that the question –
FEMALE:  Can I interrupt for a moment?  The ratifications of making that a shall means I don't believe there's any systems that are marketed right now that will meet that requirement.
FEMALE:  That's what I was just saying.
FEMALE:  Point that out.
FEMALE:  There again, can we meet it?  I understand it's very important, but I think it has to be in the – I mean I think it has to be in version two that it should and that we ought to have a should here.
MALE:  This is Jim Elkes (phonetic sp.).  How about leaving the should in there and saying that it will be required as part of the version two for purposes of moving this –
FEMALE:  That's what we say in section 227.
FEMALE:  (Indiscernible).
FEMALE:  Yes.
FEMALE:  And in both sections we'll use the language pointing forward that we've used before.  Either way, it just has to be the same.  [laughs]
WACK, J.:  Okay.  
FEMALE:  Thank you (Indiscernible).
MR. CHAIRMAN:  Okay, so we're back to 6024?
WACK, J.:  We are.  And let me move onto the next slide here.  Approve or spoil.  Start with 60241, voting stations shall in the presence of the voter mark the paper record as being accepted by the voter or spoiled.  No problems there.
60242, the voting station shall also mark and preserve electronic and paper records that have been spoiled.  I'm sorry if I'm confusing you a little bit.  I added that also for emphasis.  That isn't actually in the requirement.  Ron, looking over these earlier, pointed out that it may be confusing to people that we're saying to preserve the spoiled records and not the approved records.  
So by that requirement, it is assumed in the top level requirement that we are preserving the accepted records.  We have a requirement here that we're preserving the electronic and paper records that have been spoiled.
MALE:  Electronic records aren't spoiled.  You don't maintain a –
MR. CHAIRMAN:  But they're erased.
MALE:  Huh?
MR. CHAIRMAN:  They're erased or they're not?
MALE:  They're changed in place.
MR. CHAIRMAN:  Right.
MALE:  You know, I voted for Ron.  I changed my mind.  I deselect that.  I vote for you.  When that ballot is finally recorded, the fact that I deselected Ron is never recorded.  
MALE:  I think you're saying something else.  You're saying – Are you saying you want the electronic record that's got the same linking number to indicate whether (Indiscernible).
WACK, J.:  Essentially we're saying if we have a spoiled paper record, we'd like to know if there was indeed a spoiled electronic record as opposed to that electronic record actually being accepted.
MALE:  You don't spoil an electronic record.
MALE:  It's a better definition.  I think the question is if you want to maintain a one-to-one correspondence of your paper records and your electronic records so that for every piece of paper you've got you have an identical check so that you can mark the electronic records.  You're right that it's not spoiled in the sense that you can erase it or whatever.
MALE:  I strongly suspect that none of the systems out there right now are capable of doing that.
MALE:  Well, it's a matter of programming (Indiscernible) if we save it.
MALE:  No.  They basically are designed for security sake to make sure that no actions other than the actual casting the ballot create the electronic record.
MALE:  Well, there's two types of spoiling paper records right now.  One of them Donetta (phonetic sp.) was just describing.  It does it on a race by race basis.  I vote for you and the paper record says vote for Ron.  I change my mind and change my vote to Donetta, and the paper record says, "Spoiled."  And it puts Donetta.  So I've got this interactive record of the way I preceded through the ballot.  But when I get down to the end, I've just got one electronic record, and it's whichever one is the final.
MALE:  So there's issues with that.  The incremental commitment scheme, if you want to call it that, or the incremental casing of your vote also has issues for privacy and so on, too.  Because the voter can potentially mark his ballot by canceling this record, erase five times, and canceling that one three times and so on too.
MALE:  Yeah.
MALE:  So there's other issues of security with that.  When you get down to the summary, putting that aside then as a separate category.  If you just have the electronic record created, the paper record created to correspond to that, they're both clean.  They don't have any erasers or anything like that, then there should be a nice one-to-one correspondence.
MALE:  Right.  Agreed that if you didn't print the paper record until you go to the summary record then you could do it.  But their systems now, they don't do that.
MALE:  If they print incrementally then you've got other issues too with privacy, which I think may be more important.
FEMALE:  But the privacy issues can be handled in other ways too.  I mean, yes I agree.  Every ballot has to be private.  But you can handle those privacy issues by never – I mean, you've got more than one unit in a polling place.  You never record what unit that voter is voting on.
MALE:  That's a separate question.  That's an important issue, but you're right there.  The issue I was raising, I guess I wasn't clear.  Let me try to be clear.
If you know, you can write in a write-in vote that says Mickey Mouse or some other name.  You're essentially marking your ballot and to the extent we care about that.  You have to worry about, you know, is there a way for some voter to mark his ballot so that he can point to it later and he's got some procedure by which he can be paid off for marking his ballot in a certain way.  He can say, "Look.  I did it this way."
And so with this incremental kind of voting that Rick's talking about and that you mentioned earlier, there is the potential – I'm just noting that there is the potential for marking your ballot.  You can say I have this particular pattern of voting.  (Indiscernible) one this way and then I changed my mind and I voted that way.  You know, I've got enough leverage there to be able to mark your ballot because by the pattern of changes. 
And maybe this is a minor issue, and we shouldn't worry about it too much.  But I'm noting there is a privacy concern there that should be addressed.
FEMALE:  And I think states have been addressing it.  I know in Colorado, we only do a write-in on somebody that has filed an affidavit for a write in.  And so you don't have the Mickey Mouses and the Donald Ducks or something like that.  It's only for a verified candidate that is been indicated.  So that's how we've handled it in Colorado.  And that way there's only one possibility maybe, or two possibilities that you can write in.  And they can't be – You know, you can't go back and sell that vote.
MALE:  If you've allowed this incremental voting then you're opening the barn door again to people being able to mark their ballots in some way.  So I'm not sure what the right procedure is.
WACK, J.:  Well, I think the issue right now is do we want voting stations to preserve spoiled records to maintain a one-to-one correspondence?
MALE:  (Indiscernible).
MALE:  Again, we could state that as a requirement and leave the implementation to the vendors.
FEMALE:  Then one solution is to just make that the requirement and leave the rest of it alone.  The other is to say  if in fact we're up against a problem of how the systems work today, should this be one of our shoulds with the point forwards as a shall.
MALE:  I think that that's probably the best post you could take right now.
FEMALE:  And I think that would let us make the technical point about where we want to go and still – 
MALE:  Change 242 to a should with that caveat that you think.
FEMALE:  And I agree, because I think that when we get into this area – You know, you're paper records, if it says cancelled, you're going to have a cancelled record here.  And on that machine, you want to know what the end results are.  So we even need to look and see if it has to be both.  Because as Brit says, right now.  You change it immediately, and then when you cast the vote, it's cast.  You never – The electronic is never cancelled.
MALE:  Okay.  If I can get a mic (phonetic sp.) here.  Probably the desktop engineering, the best way to handle this would be to have the ballot images reflect only those ballots that were actually cast.  To have the spoiled ballots preserved in the system and then to have a system log file, which reflects a number of ballots that were spoiled.  And obviously your log file entries and your ballot image files in memory should equal the number of paper slips or entries on the spool.
MALE:  I was going to point out that one of the ways to bring a closer equivalence is using write only medial electronically, which frankly I have been surprised we don't see more of in this field.  Where the only thing you can do is write to it and possibility put a cancel after and put a fresh record.
MALE:  It's much more like the paper.
MALE:  Exactly.
MALE:  I think one of the questions – I think should is probably fine for language here, but from a security viewpoint maybe, Paul, you can address that too.  Whether having the spoiled records around helps in the security evaluation of how did this election go.  You know.  Was there a bias in what was spoiled for example?  Are there any strange things happening with the way records are spoiled?  I think having a complete record of what happened there, I don't see any issues with – other concerns other than just keep trying to have a complete record of what happened.  And a copy of the spoiled ballots could be of some, maybe not large value in accessing how well the election went.
MALE:  Basically, you need to be able to show that the number of votes cast in the precinct are equivalent to the number of voters who signed in.  And there has to be a process of balancing provisional ballots, actual cast ballots, and spoiled ballots that were issued to that number.  So yeah.  I think you've got to track your spoiled ballots.  You've got to track the occurrence of spoiled ballots.  And that all should reconcile.
MR. CHAIRMAN:  Okay, what I'm hearing is we're changing 60242 to a should.
MALE:  There's a problem with that, because when you get down to – If that's a should, then you can avoid the nested things up under it.  And 2422 and 423 should be shalls.  
MALE:  Yes.
MALE:  So whether you're keeping that with electronic records or not, you need to let people know when they are spoiled the maximum number of records.  And there should be some procedure once they have spoiled to go on and cast the electronic ballot.
WACK, J.:  Brit?
MALE:  So as I understand the nesting here, if we make 242 a should, then a vendor could complete avoid 2422 and 2423.
FEMALE:  Yes.  So we have to elevate that.
MALE:  So we've got get those out from under that nesting.
WACK, J.:  I agree.  Yeah.  Yeah.  I agree.  They should be moved to the left and be higher level.  So we will un-nest those.  Okay.
MR. CHAIRMAN:  So are we basically talking about changing the numbering system?
MALE:  I would take those two and (Indiscernible) 4.2 and 4.3 and (Indiscernible).
MALE:  Another alternative would be to move the one that we just changed to a should to a sub-bullet and to create a new super bullet that encompasses all of them.  
MALE:  (Indiscernible).
FEMALE:  (Indiscernible).
WACK, J.:  Okay.  Just to be clear, 60242 has a should in it.  The voting station should.  602421, let me just make sure we're not keeping that requirement?
MALE:  (Indiscernible).
WACK, J.:  Okay.
MR. CHAIRMAN:  Well, the next three are all shalls and they need to be maintained so the nesting is inconsistent.  So we have to change it somehow.
FEMALE:  I know what to do.
WACK, J.:  Okay.  We got it.  Could I infer from that that you all agree with those three nested requirements and we could move on to 60243, which reads, "In case of conditions that prevent voter review with a paper record, there shall be a means for the voter to notify an election official."  And simply, that requirement there is a common sense requirement.  If the voter can't – If something has happened, then there shall be some means for the voter to notify a pool worker or an election official.
That has a nested requirement underneath it.  Conditions that prevent voter review of the paper record that are detectable to the voting station shall cause an error message to be displayed and shall prevent recording of the electronic record.
MALE:  (Indiscernible).
J.R.:  John?  J.R.  If the voting station is going to give an error message of some sort, you got to have the accessible message as well.  So some kind of flashing light.  Some kind of dinging or something to cover the various distility (phonetic sp.).
FEMALE:  I think the assumption we're working under is that all general display requirements for accessibility in 227 apply to anything here.
MALE:  Okay.
FEMALE:  And that we're only calling out additional requirements.
WACK, J.:  That is correct.  Yeah.
FEMALE:  Okay.
MALE:  My concern with 431 is that if say the printer jams and that prevents me from casting an electronic record, have I been disenfranchised?  What happens?
WACK, J.:  Well, the way I read the requirement it is to prevent an electronic record from being stored and recorded if there is some other error that prevents the voter from viewing the paper record.  It's really to handle – There was a situation where voter's electronic records were accepted in some particular situations; however, they really weren't.  They really weren't being recorded by the voting system.  There wasn't an error display.
MALE:  I agree with your attempt to keep this one-to-one correspondence, but I think the wording here is flawed.  What it needs to say is that if there's some sort of an error that prevents – Where did it go?  I've lost it again.  Oh, if something that prevents me from reviewing the paper record, then there needs to be a means to void that transaction and allow me to start over on another voting station.  And I don't know how you want to word that.  Okay.  But the way it's worded right now, you put me in limbo.
FEMALE:  Isn't that the same as if the maximum number of spoiled ballots occurs, procedures shall be in place for the voter to otherwise cast a ballot.  Just above that.  423.  It'll serve the same problem
MALE:  Or 245.  The voting station should not record the electronic record as being approved by the voter until the paper record has been stored.  The paper record won't be stored in that case, so nothing has happened.  There's no transaction.
MALE:  Then maybe we don't need that at all.
FEMALE:  (Indiscernible).
MALE:  Yeah.
WACK, J.:  Okay.  So we're basically considering getting rid of 602431 because we think it's covered in other requirements.
MALE:  Yeah.  431 has a condition that stops me from voting without giving me a remedy.
WACK, J.:  Okay.  That's –
MR. CHAIRMAN:  Well, the only that did was actually to have this requirement for an error message of some sort.  If we take that out, are we removing that requirement?
MALE:  (Indiscernible).
MALE:  Well, you're removing my objection.  My objection is saying that you're going to prevent me from voting.  My objection is from the and on.  And shall prevent recording of the electronic record.
MR. CHAIRMAN:  Well, it seems like that part is covered by 60245.  
MALE:  Yeah.  I think so.
MR. CHAIRMAN:  So if we just take out that last part, is that acceptable then to everybody?  Are we okay on that?  Ron, does that –
MALE:  Yeah.
WACK, J.:  Okay.  Well, in a sense we've talked about the next couple already.  60244, procedures by which election officials can be notified and prescribed actions can be taken to address discrepancies if the voter indicates that the electronic and paper records do not match shall be documented.
In the, I would think highly unlikely event that the electronic and paper records actually do not match, there should be some procedure that election officials know how to follow at that point to deal with this.  It could be a variety of different things.  I would probably indicate something wrong with the system.
MR. CHAIRMAN:  6045.
WACK, J.:  Okay.  The votings – Okay, on 45 the voting stations –
MR. CHAIRMAN:  (Indiscernible).
WACK, J.:  I'm sorry.
MR. CHAIRMAN:  I think we already discussed that.  So I assume we're okay on that.
WACK, J.:  Okay.  45 is okay as written?
MR. CHAIRMAN:  60246.
WACK, J.:  Actually, would it be simpler for me just to call out the requirement numbers.  If you have an objection or a comment.  Why don't we do that.  Okay.  So we're looking at 46 and 461.  Going onto 47.
MALE:  Ah, 246.  I guess 246.  This is a shall.  It caused the capability to address situations in which an electronic or paper record has been recorded approved and stored without the intention of the voter.  We need to give the vendors fairly specific information on what we expect them to do.
MALE:  Well, that goes against standard practice now. 
MALE:  Uh-huh (affirmative). 
MALE:  If you push the cast ballot button on a DRE voting machine, you've recorded your vote, and there's no way to go back and unravel that even if you did it inadvertently.
FEMALE:  Yeah.
MALE:  That's a different situation than what it's talking about here.  It says, "without the attention of the voters."  So if the voter didn't push anything.
MALE:  Well, I'm saying that voters do that unintentionally.  We actually changed the face of a voting system because it had a tendency to cause voters to do that.  The scroll bar was right over the cast ballot button, and if they're hand slipped they'd cast their ballot.  But once they cast that ballot, --
MALE:  It's gone.
MALE:  Thanks to the secrecy of the ballot, it's in the box and there's no way to retrieve it.
FEMALE:  And currently you have voters that come to you always and say, "I only voted for one thing on the ballot, and I forgot to vote everything else.  And I had pushed the cast ballot."  You don't know if they did that or if they voted a whole ballot.  Because you can't get back their ballot.  You have no idea what they voted.  So you've got to be very careful there.  Your ballots are never equal.  If you give them another chance of voting, it's a problem.
MR. CHAIRMAN:  Is this strictly a matter of having the capability to basically say spoil the record.  I want to start all over again?  I'm not quite sure what we're asking.
MALE:  Well, at this point the voter is past the point where he spoils the record.  How he got there, we don't know.  
MALE:  Yeah.  You've can spoil a record up to the time you cast the ballot.  Right.
FEMALE:  I just – When I read it, I really wasn't sure what it meant.  I mean, it sounded good, but then I thought about it and I really wasn't sure what kind of situation –
[End of Audiotape 4 – Side A]
FEMALE:  In the previous one we say that you can't record the electronic record until the paper record has been stored.
WACK, J.:  Well, that's a should.
FEMALE:  Oh, it's a should.  But I mean, I guess I – 
MR. CHAIRMAN:  Well, maybe that should be a shall.
MALE:  I think this maybe should be struck.
FEMALE:  Yeah.  This is just going too far.
MALE:  (Indiscernible) – And not be able to retrieve it.  The printer doesn't have to run out of paper.  It can run out of ink, and you don't even notice that's happening because you're intent on what's going on over here.  And all of the sudden you cast your ballot and you notice that the paper's blank.  Now it's cast.  You can't go back and regenerate that missing piece of paper.  
MR. CHAIRMAN:  Do I hear a motion to strike this?
MALE:  Yes.
MALE:  Second.  [laughter]
MR. CHAIRMAN:  Any objection?  Thank you.  247.
WACK, J.:  247.  Any problems with that?  Onto the next page.  
MR. CHAIRMAN:  Section 6025.
WACK, J.:  We're on page 637, 60251.  Anything on page 637?  And 638?
MR. CHAIRMAN:  There are a lot of items here.  My suggestion is to adjourn.  Your homework would be to review these items –
MALE:  Corrections.
MR. CHAIRMAN:  And come back with a list of issues and concerns, because I don't see us finishing this any time soon if we go one by one.
FEMALE:  Do that.
MALE:  We can at least (Indiscernible).
MR. CHAIRMAN:  Okay.  Let's do that.
FEMALE:  (Indiscernible).
MR. CHAIRMAN:  6025.  60251.
MALE:  Do you want to do this now that the resolution –?
MALE:  (Indiscernible).
MR. CHAIRMAN:  Yeah.  Give me that.  (Indiscernible).  60251.
MALE:  Good.
MR. CHAIRMAN:  Two?
MALE:  Good.
MR. CHAIRMAN:  Three?
MALE:  Good.
MR. CHAIRMAN:  Four?
MALE:  Yeah.  Whatever.
FEMALE:  It's good.
MR. CHAIRMAN:  Why do we need the last part of that sentence?
FEMALE:  Why do we even need that?
MR. CHAIRMAN:  I mean, the voter should not be able to leave the voting area with the paper record of a ballot.
WACK, J.:  I can address that.
MR. CHAIRMAN:  Okay.
WACK, J.:  In some schemes of the voter could actually leave with paper record that has markings on it, encrypted codes, things of that sort, but it doesn't reveal the voter's choices.
MALE:  Yeah.  I think John's right.  There are some cryptographic proposals, which uses cryptography in an innovative way.  The voter actually leaves with a paper record.  The voter can't prove to anybody else how they voted with that paper record because it's encrypted.
MR. CHAIRMAN:  It just proves that he or she has voted.
MALE:  It proves he's voted and also allows him to check that his vote was counted later correctly in an interesting mathematical technique.  So that last clause is actually important.
MR. CHAIRMAN:  Okay.  Any objection?  255?
MALE:  (Indiscernible).
MR. CHAIRMAN:  255?
MALE:  Yeah.  Information for the purposes of auditing the electronic or paper records that may permit a voter to reveal his or her ballot choices shall be displayed as not to be memorable by the voter.
WACK, J.:  Well, I think having about a week's perspective on that, I would probably word it differently.  [laughter]  And I would basically say unique identifiers shall not be displayed so as to be memorable by the voter.  The unique identifiers –
MALE:  (Indiscernible) say (Indiscernible).
WACK, J.:  Exactly.
MALE:  So that should not be displayed period.
MALE:  No.  No.  You could display them in the glyphs that are not the usual ones.  Bar code or the Xerox dated glyphs in a way that you look at them and it doesn't look like anything you can memorize.  It doesn't look like a sequence of digits even.  So that there are ways to display information that you look at them and you can't walk away and say I can go back later and recognize my vote, because the unique I.D. that was on that vote was displayed in 64521.
MALE:  What would be the value added of having it displayed at all.
MALE:  Ah, there was a requirement that we had earlier that said that the paper and the electronic information display should be the same.  And so that either one you could not display it.  The paper record and the electronic record should have the same information so that if you don't record it on the paper, then you've got no way to link the ballots to correct it with the electronic record.
WACK, J.:  The other issue too is that earlier we kind of said that it had to be hidden in a bar code.  And we've had a little bit of push back on that.  Some people don't want a bar code because then it – What could the bar code be hiding?  So that's the wording there.
MALE:  (Indiscernible).
MALE:  You could perhaps change it to say not to be easily memorable.  Some people can remember amazingly.
MALE:  Photographic memory.
MR. CHAIRMAN:  Okay.  256.
FEMALE:  Well, besides suggesting that you edit this so it's not in passive voice, I think it's fine.
WACK, J.:  This particular requirement I think was maybe a repeat, I'm not sure, from the human factors section.  And I guess it's pretty clear what the issue is.  You recommend rewording it, and I could do that and show it to you tomorrow morning when we start in again if that would be acceptable.  It sounds like it is.  Okay.
MR. CHAIRMAN:  You're going to redo this?
WACK, J.:  I will.  I'll talk with Sharon.  That's the reason I'd like to do it off stage.
MALE:  Question.
MR. CHAIRMAN:  Yes.
J.R.:  J.R.  The way it read for me it says, "Unable to handle paper and use the accessible machine."  So is it a double prompt or is it one or the other?  Meaning, is this only applicable for someone who can handle paper, can use the accessible machine, or one or the other or combination thereof?
WACK, J.:  As it was explained to me, I think it's the former.  I think it's the accessible voting station requires one to manually handle paper.  So obviously something needs to be done about that to maintain privacy and anonymity.
FEMALE:  J.R., Sharon had to leave and I'd like to check with her.  But I do believe that part of the intent of this was to address systems like the – Oh, dear.  What's it called?  The auto mark where you end up with a ballot where you would in fact have to remove that ballot from the machine.  And if you can't see it or if you can't handle it, that someone would have to help you and that could compromise your privacy.  And that doesn't mean it can't be done.  It just means it has to be done in a way that does not compromise your privacy.
J.R.:  Right.
FEMALE:  So maybe a little wordsmithing on this with Sharon.
MR. CHAIRMAN:  Okay.  Why don't we stop there.  And before we go, if you remember we agreed early on about tabling a motion which was reworded.  This is resolution number 3905.  You have been just given a copy, an updated version of this.
J.R:  Read it aloud for the record for those of us who don't have one.
MR. CHAIRMAN:  Yes.  I will read that J.R.
J.R.:  All right.
MR. CHAIRMAN:  This is titled, Voter Verified Paper Audit Trail Assignment.  The TGDC recognizes that voter verified paper audit trails, VVPAT, has been developed in some jurisdictions without guidelines.  The TGDC is aware that some states currently require or intend to require use of VVPAT.  During this January 18, 2005 meeting, the TGDC received a request from the EAC to develop VVPAT guidelines for use by states and election jurisdictions that have chosen to acquire VVPAT so that those states can more effectively implement VVPAT.  Subsequently, the TGDC instructed in this to develop and submit VVPAT formal requirements as a part of its voluntary voting system guidelines technical assistance work product.  The TGDC neither endorses nor opposes the use of VVPAT. 
This is really sort of statement of the obvious and to make sure that it's clear that this is not endorsement.  We know these machines are being used out there, and this is simply to make their use more effective.
J.R.:  (Indiscernible).
MALE:  Second.
MR. CHAIRMAN:  Thank you.  Any comments or discussion?  Do we have a unanimous consent?  
MALE:  Yes.
MR. CHAIRMAN:  Or do we have to vote on this?
MALE:  Ah, it would be a good style to at least take a voice vote.
MR. CHAIRMAN:  All those in favor?
MANY VOICES:  I.
MR. CHAIRMAN:  Any opposed?  The resolution number 3905 has been adopted unanimously.  Thank you.
MALE:  Mr. Chairman?
MR. CHAIRMAN:  Yes.
MALE:  I have a writing here that somebody sitting behind me wrote and suggested that we go on the record dealing with the issue of the sticker this morning.  So should we go ahead?
MR. CHAIRMAN:  Issue of the?
MALE:  The sticker issue on who the work product belonged to that we had this morning.
MR. CHAIRMAN:  Oh.  I see.
MALE:  And I've got that ready to read in the record if it's your pleasure.
MR. CHAIRMAN:  Please go ahead.
MALE:  Okay.  Mr. Chair, I have a point of clarification regarding our meeting document.  A sticker has been affixed on the cover of our documents that states they are TGDC work products.  I wish the chair to state on the record that no document is a work product of the TGDC unless and until such document is adopted by vote of the TGDC.
MR. CHAIRMAN:  So stated.  [laughter]
MALE:  Thank you sir.
MR. CHAIRMAN:  For the record.
MALE:  (Indiscernible).
MR. CHAIRMAN:  Thank you very much everybody.  You can leave the documents here.  And see you bright and early tomorrow morning.
[END OF AUDIOTAPE 4]
MR. CHAIRMAN:  If we could all take our seats, we'd like to start.  Thank you.  
MALE:  Good morning.  Do we have anybody on our teleconference yet this morning?  Nobody yet?  Okay.  Good morning.  Who's joining us?  
FEMALE:  This is Helen Purcell.
MALE:  Morning Helen.  All right, we'll begin the Thursday morning session.  Good morning to everyone who is here and on the web cast as well.  The agenda has somewhat shifted today as a result of our progress yesterday.  There are new copies of the proposed or drafted agenda for today out on the front desk.  TGDC members, you each have a copy as well to fit in your folder.  While I think of it so you TGDC do not have to look like you're carrying two Manhattan telephone books home with you.  We'd be more than willing to send them to you at the end of the day.  If you have a business card or something, stick is in there so we know which copies are yours, and we will send them to you.
Briefly, to go over our usual items, please turn off cell phones and pagers.  There were a couple of cell phones that went off yesterday.  That does go out to the web and it is disconcerting.  So that would be most helpful.  No food in the auditorium as I said.  Everybody's been very good about wearing their name badges, so we haven't had to call the police.  And again, our signer will be up front, although she is not here yet.  She will be shortly I'm sure.
MR. CHAIRMAN:  She is here.
MALE:  Oh, she is here?  Okay.  Good.  Quickly, to take a look at our emergency exits one more time.  We have two exits right out the back door and two exits here on the front as well.  J.R., both myself and John Wack have keys to get you out should something happen.  So we'll take care of you.  And we'll take our breaks again in the morning and in the afternoon about the regular time.  There are also evacuation directions on the sides there of the aisle.  
With that, I turn it over to Chairman Samergian (phonetic sp.) to begin today's proceedings.
MR. CHAIRMAN:  Good morning.  Welcome back everyone.  For those of you who were not here yesterday, I'm (Indiscernible) Samergian, Acting Director of the National (Indiscernible) of Service and Technology and chairman of the Technical (Indiscernible) Development Committee.  I hereby call to order the fourth meeting of this committee today, Thursday, April 21, 2005.  Let us now stand and pledge allegiance.
EVERYONE:  I pledge allegiance to the flag of the United States of America.  And to the Republic for which is stands, one nation, under God, indivisible, with liberty and justice for all.
MR. CHAIRMAN:  At this time I recognize Mr. Phil Green as the TGDC parliamentarian and request that he determine if a chorum of the committee is present.  Mr. Green?
MR. GREEN:  Thank you.  I'd like to begin by calling role.  Williams?  
WILLIAMS:  Present.
MR. GREEN:  Williams is here.  Berger?
BERGER:  Present.
MR. GREEN:  Berger is here.  Caldus (phonetic sp.)?  Caldus is absent.  Kraft?  
KRAFT:  Here.
MR. GREEN:  Kraft is here.  Davidson?
DAVIDSON:  Here.
MR. GREEN:  Davidson is here.  Elokeys (phonetic sp.)?  Perhaps he'll be joining us by phone.  Gannon?
GANNON:  Here.
MR. GREEN:  Gannon is here.  Harding?
HARDING:  Here.
MR. GREEN:  Harding is here.  Miller?
MILLER:  Here.
MR. GREEN:  Miller is here.  Quisonberry (phonetic sp.)?
QUISONBERRY:  Here.
MR. GREEN:  Quisonberry is here.  Rivest (phonetic sp.)?
REVEST:  Here.
MR. GREEN:  Rivest is here.  Shutzer (phonetic sp.)?
SHUTZER:  Here.
MR. GREEN:  Shutzer is here.  Tuner-Buwi (phonetic sp.)?  Not here.  Samergian?
MR. CHAIRMAN:  Here.
MR. GREEN:  Samergian is here.  I may have missed Purcell.
PURCELL:  I'm here.
MR. GREEN:  Purcell is here.  We have 12 present.  That does constitute a chorum.  We can proceed.
MR. CHAIRMAN:  Thank you Mr. Green.  We have distributed a revised agenda that I'd like to review with the committee.  Our goal today is to complete the review and editing of VBSG version one.  We will then consider any additional resolutions and plan our next steps as a committee.  If there is time at the end of the day, we will discuss VBSG two.  
Yesterday, we approved the conformance clause of VBSG version one.  We will begin this session with a review of the VBSG sections that have been edited as per the committee's instructions.  We will then vote on those sections.
Before we go there, just in case you think we are working in a vacuum or our work is not being appreciated perhaps.  Just in case you're feeling a little down on yourself, let me assure you that the world is actually watching us.  And not only that, I understand there is some fan mail coming in, encouraging us to stay on the path.  [laughter]  So that has come in, I guess, through e-mail.  But there is a formal letter I understand.  And Mr. Harding would like to read this letter for the record.  Mr. Harding?
MR. HARDING:  Thank you Mr. Chairman.  This letter comes from the executive director of the governor's ADA working group for the state of Florida.  Subject, voluntary voting system guidelines.  
"Congratulations on your draft voluntary voting system guidelines.  The technical guidelines committee has clearly gone a tremendous amount of work to ensure the needs of Americans with disabilities are met on Election Day.  The committee appears to have successfully balanced the needs of the Federal standardization with the needs of states to have flexibility to implement the standards in a manner that is appropriate for each state population.  We support allowing flexibility of states to address geographic cultural diversity of populations such as the Hispanic and Asian population groups.  The guidance on personnel and training also allows needed flexibility at the local level to address the needs of the community, in particular, demographic groups.
Many features of the guidelines will inspire voter confidence in the process.  They include excellent standards for rigorous, electronic and paper validation process including applying accessible requirements to the paper validation process.  The performance testing of equipment and software provide a foundation for voter confidence in the process.  
Also, the strong system data telecommunications network security procedures will facilitate voter confidence.  The processes set up to allow voter access to the validation process will reinforce the trust and the reliability of the process and outcomes.  
We encourage the committee to consider specifically recommending individuals with disabilities to be actively involved in the quality assurance efforts, including accessibility, usability, setup validation, and compliance processes.
We also encourage the committee to look at voting processes as more than the interaction between the individual and the ballot on a given election day.  Access to information about election and voting process must be accessible and usable by individual with a wide range of disabilities.  In order for the guidelines to achieve their full potential, individuals with disabilities need information about how to fully participate in the electoral process. 
Thank you for your excellent work.  The committee has truly set the standard."
MR. CHAIRMAN:  Thank you very much.  We have three revised documents distributed to you.  Sections 277, I'd like to make sure that in my copy page 23 was missing, but there are others – Will you please make sure that you have no missing pages on this 2.2.7.  Maybe it was just that I got special treatment.
FEMALE:  Mine has two copies.  So perhaps I have yours.
MR. CHAIRMAN:  Oh.  Maybe.  Okay.  Well, just make sure that you have all the appropriate pages.  And then we have two revised documents for the security standards section 146.0.1.  And the other for 6.0.2.  I want to make sure that everyone has these three documents.
MALE:  Mr. Chairman?  
MR. CHAIRMAN:  Yes.
MALE:  It's Jim Elekeys from the U.S. Access Port. 
MR. CHAIRMAN:  Okay.  Jim, first of all let me make sure that your presence is duly noted in our records.  Mr. Green, will you please make a note that Mr. Elekeys has joined.
MR. GREEN:  Thank you.
MR. CHAIRMAN:  So that makes 13 members present for this meeting.  Yes?
ELEKEYS:  Thank you Mr. Chairman.  While I'm confident of my personal assistant's capabilities to edit the material we heard yesterday, would it be possible for someone to get an e-mail out to me so I have the document and I'm working from the same papers that everyone else is?
MR. CHAIRMAN:  Yes.  Ellen is doing that as we speak to you and Ms. Purcell.
ELEKEYS:  Thank you.
MR. CHAIRMAN:  So this morning, we'll begin this session with a review of these sections that were worked on yesterday and that were edited per the committee's instructions.  And then we will vote on those sections.  So at this time, I call on Dr. Sharon Leskowski (phonetic sp.) on this information technology laboratory to review the edited sections of VBSG version one, section 2.2.7.
LESKOWSKI:  Okay.  Good morning.  Should I just run through the changes, or are there any other issues we need to discuss first?
FEMALE:  Well, why don't we just start with a brief statement about what we did, which is that places where we had simple – Changes that were simple edits, changes of shalls to shoulds or changing of simple wording, we've made the changes.  There were several places where the changes that we've requested will require a little bit of research.  For instance, the section where we're going to normalize language in two standards.  What we've done in this case is in this draft we have put a note in that we will do that.  There was not time between five thirty yesterday and eight thirty this morning to get that work done.  And we will recirculate that draft with the pleasure of the committee.  But it seemed better to have a well-considered draft than a fast draft.
MR. CHAIRMAN:  I suggest that we assume that the normal, simple editing changes are done properly.  People can look at them later on.  But they were I think pretty clearly noted yesterday.  So we'll assume that they are done.  So I think the only thing I would talk about is there were a couple of areas where there are some issues or some questions.
FEMALE:  I did want to raise one issue just to make sure that we as a committee are clear on it.  One of the things that we did yesterday was vote on two sections.  One in this section – Two clauses.  One in this section and one in the VVPAT section.  The sections are 2271226, which is at the bottom of page 21.  And then the VVPAT document is section 60232 at the – the only thing on page 67.  
We voted to make this a should, and in both cases it reads, "If the normal procedure includes VVPAT, the accessible voting station should provide features that enable voters who are blind to perform this function."  I don't know the answer and I'm not a lawyer, but I do know that the havoc language is very specific about the participation of people who are blind in the voting process in an independent manner.  And I just want to call this back to our attention.  One of the reasons this was one of the sections that came up against our wish to ensure that equipment – That the standards, the guidelines that we create here are capable of being implemented with existing equipment or perhaps it should be existing technology.  And I just want to re-raise this question briefly.
MALE:  Would it be appropriate to ask a lawyer to give us –
FEMALE:  I think it would be.
FEMALE:  That might be something worth doing.  I mean, I see both sides of this.  I see one opening us up to a problem of not being able to meet the standard and the other opening us up to a problem of lawsuits because we have set the standard in this way.  So perhaps this is a place where asking for some legal opinion and reconsidering it with a little more input would be useful.
FEMALE:  We could talk to Craig.  I don't think he's here right now.  Okay.  Phil?
PHIL:  Craig and I can work on that.  Can we get the site from the hava (phonetic sp.) that discusses that?
FEMALE:  Yes.
FEMALE:  When we get done with this section, I'll bring this over to you.
FEMALE:  Yes.  We quote this section.
MALE:  I think it's 212 of this.
MR. CHAIRMAN:  Okay.  We'll get a clarification on that.  Let's proceed.  Any other issues?  Sharon or Ms. Quisonberry?
FEMALE:  Okay.  I can go through very quickly those changes that were substantive.  Is that what we'd like to do?  The first substantive change is on page 2-15.  Excuse me, 2-14.
MR. CHAIRMAN:  Five zero.
FEMALE:  I could quickly summarize.  We did change all the clauses that talked about summative usable test to shoulds.  Um, we added – Those phrases where we said under control of the voter, we changed those to under control of the voter or poll worker. 
MR. CHAIRMAN:  Could you turn your –
FEMALE:  Starting on page 214 at the bottom.
FEMALE:  Thank you.
FEMALE:  If you look at the bars on the left, those denote any changes that were made.
FEMALE:  Oh, yes.  Okay.  And we did add the clause that it is anticipated in future – In the discussion section, it is anticipated that in future versions of the VBSG will require whatever the – is to be under the independent control of the voter.
MR. CHAIRMAN:  Okay.  So I guess the main change there is –
FEMALE:  Yeah.  They are there.  I just wanted to point it out.
MR. CHAIRMAN:  Because in the previous version is said, "May require."  Or, "May include" for the version two. 
FEMALE:  Right.  Okay.  That's right.
MR. CHAIRMAN:  This says will.  I mean, it's a more definitive statement.
FEMALE:  Yes.  It's a more definitive statement, but it allows a broader interpretation of what meets the possibility for version one with the anticipation of narrowing it for version two.  
MR. CHAIRMAN:  Okay.  So obviously there are a number of them like this in different places that we noted yesterday.
FEMALE:  Yes. And they have different wording.
FEMALE:  Okay.  Then on page 2-15 we have that same change to adding "or poll worker."  We had a question about 1215 and 1216.  Those two?
MALE:  Yes.
FEMALE:  Because when we looked at the nasad (phonetic sp.) bulletin, those were unclear as well.  I think what we're really trying to get at and what we assumed from the discussion was that the voter should not have full control of the knobs to try to adjust contrast and color.  That's just too confusing.  What they need is to be able to select from a small range.  We were confused last night and tired, so this is not reflected in the re-write here.  But we will do that if there's no disagreement.
FEMALE:  So the plan as I understand is and for approval by us is to broaden – to actually more generalize this language to say that the system shall allow the voter or poll worker to adjust the color and contrast without specifying exactly how that's done.  
FEMALE:  Well, there's two ways to do it.  We could be kind of vague about it.  But since there was so much confusion with the VSS 2002 and the nasad (phonetic sp.) follow-up bulletin, it might be better to just say that there is a range that the voter can select, voter or poll worker can select from.
FEMALE:  Yeah.  We did some technical discussions last night about the nasad guideline.  It seems that there is a consensus that emerged after that about allowing selections as a better option.  So rather than carry disputed and probably precluded, or superceded by research language forward simply because it existed but not wanting to put in very specific language that we haven't carefully crafted.
FEMALE:  So I assume that there's no disagreement.  We will reflect that change when we do the final edits.
MR. CHAIRMAN:  Would you please repeat the change again, just so that there is a clear understanding on everybody's part, including me.
FEMALE:  Okay.  The current language reads that an accessible voting station with a color-only electronic image display shall allow the voter or poll worker to adjust the red, green, and blue components of the foreground and background color.  We will change that to wording that will say in effect, sorry, without specifically wording it that it will allow the voter or the poll worker to adjust the color contrast without specifying that it's the red, green, or blue components.
MALE:  (Indiscernible).
FEMALE:  No.  That's one five is the color contrast.
FEMALE:  I'm sorry.  The color combinations.  One states that –
MR. CHAIRMAN:  Okay.  One will say to be able to adjust the color contrast.  The other one will say the color combination.  
FEMALE:  One five is about contrast specifically.  One six is about color.  What we'd like to do is remove the – Well, not just imply but written discussion that the voter or the poll worker can adjust specific elements.  That is can do a three-way adjustment to "can simply adjust."
MALE:  Just the color.
FEMALE:  The color.
MALE:  Got it.  I think what we want to specifically allow is for a selection of presentations that have been prepared to avoid the common color contrast combination.  Color blindness issues. 
FEMALE:  But also visual perception.  Other –
MALE:  Right.  So a range of presentations should be allows.  The poll worker or voter can go through and select the one that they see the best.
FEMALE:  Right.  But we don't want to go as specific as that in this (Indiscernible).
FEMALE:  So would we put that in the discussion then?
FEMALE:  Yes.  I think that's going in the discussion.
FEMALE:  Feed sprays goes in the discussion.
FEMALE:  Yes.  Not in the guideline.
FEMALE:  Okay.
FEMALE:  I just fear creating language that will cause more problems than it's intended to solve by doing it quickly.
FEMALE:  Okay.  So we'll clarify that in the discussion.  I think that makes sense.
MALE:  Do you want the same thing for one five, the color contrast as opposed to the black and white contrast?  Or leave that as is?
FEMALE:  One of the suggestions we had was to combine these and simply say that – Because when you look at vision issues, it's often both the color and the contrast together that makes it possible for people to see the screen.
MALE:  Okay.
MALE:  Yeah.  I would concur with that.  In the research we did preparing the nasad bulletin, it appears that all the issues are satisfied by presenting a pure black and white, high-contrast display.  So that alone satisfies the need that's trying to be addressed here.
MALE:  Okay.
MR. CHAIRMAN:  Okay.  So let me see if I captured the spirit of this then.  We will combine these two and it will say, "To provide the ability – allow the voter or the poll worker to adjust contract and color to provide best visibility."  Or something to that effect.
FEMALE:  Can I?  Boy, I know time it tight, but I would love to just get this drafted and then pass it quickly around the committee in the next week just to put eyes on it from people who have been looking at this issue in the field.
FEMALE:  Well, we can edit it and e-mail it out to the TGDC list.  
FEMALE:  Yeah.  I mean, I think we all understand what we're trying to do, but the devil's going to be in the details of the wording.
FEMALE:  (Indiscernible).
MR. CHAIRMAN:  I would suggest that if we are going to have reviews after this meeting, it's going to be on a very short fuse. 
FEMALE:  It will be on a very short fuse.  And it will be just –
FEMALE:  Minor edits.
MR. CHAIRMAN:  The approach will be to send the e-mail and give you 48 hours or something to that effect.  And whoever wants to comment on it is fine.  If we don't hear from you, we will assume concurrence.  Because we cannot wait for everybody, etc.  Time is ticking.
MALE:  Yeah.  I think one thing that will probably be helpful in preparing the language.  If the three examples in the nasad bulletin that were found to be acceptable are clearly allowable under the language that's drafted, then I think we've satisfied what's being sought after.  
One of those is that as long as you provide a high-contrast, black and white display, you've satisfied the requirement.  The second one is you can provide a range of color and contrast combinations.  The user can select the one they see best.  And the then the third is this.  If someone chooses to, they can provide knobs where they can -- 
FEMALE:  Twiddle.  [laughs]
MALE:  Twiddle.  Yeah.
MR. CHAIRMAN:  Okay.  Next item.
FEMALE:  Page 2-16, 21217, we added voting official to the list of responsible entities.  Page 2-17, that was the usability test change, and we just added the discussion as we decided on.
MR. CHAIRMAN:  Yeah.  That's consistent with the previous change.  So let's go on.
FEMALE:  2-18, we added to 12223 the phrase "or return to previous contests."
MR. CHAIRMAN:  Right.
FEMALE:  Page 2-19.
FEMALE:  This is another section where we're going to have to do a little work on it, but the intent is to make both of these sections conform to C63.19.  
FEMALE:  That's the intention.  We put that in the comments bubbles on the right.  But given the time crunch –
MR. CHAIRMAN:  So this is something we are going to handle afterwards?
FEMALE:  Yes.
FEMALE:  Yes.
MALE:  There's actually – I sent an e-mail to Allen a short while ago, so he's got some suggested language (Indiscernible).
FEMALE:  Okay.  Great.  Thanks.
MR. CHAIRMAN:  Well, certainly.  I mean, if we can – I don't know if it's doable.  If we can do this today, we can –
FEMALE:  If we can, that would be great.  
FEMALE:  Well, we don't have easy internet access.  There's some logistical problems to put that in.
FEMALE:  Well, let's –
MR. CHAIRMAN:  Okay.  Let's go ahead.  
FEMALE:  Okay.  2-20 at the top.  
MR. CHAIRMAN:  That became a should.
FEMALE:  That became a should.
MR. CHAIRMAN:  Okay.
FEMALE:  We fixed up the typo where the DB was missing the SPL afterwards.  We increased the audible speech range frequencies in 12237 to 10 kilohertz to reflect the range of speech.  
Page 2-22, that was the usability test again.  2-23, we generalized 1.33 from (Indiscernible) to a more general phrase to now allow non-manual input that is fully functionally equivalent to tactile input.  And reflected that in the discussion as well.
Okay.  On 2-24, towards the bottom.  14223, there is a comment.  We have to harmonize the wording with the adad (phonetic sp.) guidelines.  We did not have time yesterday evening to do the research to do that editing.  We'll run it by the access board to make sure we've done the proper harmonization if that's acceptable.  
Moving onto 2-27.  717, that became a should.  
FEMALE:  Uh-huh (affirmative). 
FEMALE:  Oh, what was it?  
MALE:  (Indiscernible).
FEMALE:  Oh, yeah.  There is a comment.  Actually we got from the access board a couple of days ago that we should make inches the primary length.  Metric in the diagrams to coincide with the phrasing of the standard itself.
MALE:  (Indiscernible).
MR. CHAIRMAN:  I don't know if we can get this through the werb (phonetic sp.) with the –
FEMALE:  [laughs]  There's a couple things that are against the werb rules.  [laughs]  Our editorial review board (Indiscernible).  
Let's see, 2-29, that was the summit of usability change again.
MR. CHAIRMAN:  Let me get back to that for a minute.  These charts have both English and metric units.  Are we saying --?
FEMALE:  Inches was the primary unit, so we're going to swap them.
MR. CHAIRMAN:  So simply exchange the order?
FEMALE:  That's the proposal.
MR. CHAIRMAN:  Is that the idea?  Okay.  So both units will be there.  Just the order will be different.
FEMALE:  Yes.
MR. CHAIRMAN:  Okay.
FEMALE:  2-33, that was a usability change again.  And we changed – Let's see.  We added instead of the voting process, the voting system shall support a process.
FEMALE:  Uh-huh (affirmative). 
FEMALE:  In 321 and 322.
FEMALE:  Uh-huh (affirmative). 
FEMALE:  And also on the next page, the same change in 324.
FEMALE:  Uh-huh (affirmative). 
FEMALE:  Let's see.  At the bottom 733, we left this as a shall, because let's see.  Oh, because it's a higher level requirement.  The sub-requirements include both shalls and shoulds.
Let's see, we changed at the top of page 235, 331 to a should.  We deleted 332.  
MALE:  (Indiscernible).
FEMALE:  Yeah.  We just left it in and marked deleted because we didn't want to mess up all the numbering, because then we couldn't trace back to the document we saw yesterday.
MR. CHAIRMAN:  The only recommendation I would make there is let's not leave the text in there.  
FEMALE:  No.  That's going to be deleted, but for today we just left it in as a place holder so that we could keep the numbering and the paging the same.
FEMALE:  When you remove one of these the numbers all change, and we'll never be able to keep track of where we were.
MR. CHAIRMAN:  I understand that.  But I just don't want the –
FEMALE:  It will be deleted.  Yes.
MR. CHAIRMAN:  Okay.
MALE:  I want to show what was being deleted.
FEMALE:  The entire section.  The entire clause is being deleted.
MR. CHAIRMAN:  Yes.  Okay.
FEMALE:  Yes.  If you look to the right, you'll see the entire clause what it was originally.  And we just kept enough so that we could remember what it was we were deleting in line.  
MR. CHAIRMAN:  Okay.  Page 36. 
FEMALE:  Well, there was system or related materials was –
MR. CHAIRMAN:  Yeah.  Those were just added.
FEMALE:  Yeah.  Those were.  And then at the bottom, that was deleted.  Rewording 334.  I think that's it.
FEMALE:  Do I need to –
FEMALE:  I think that's it.
FEMALE:  Okay.  I think the next process is for somebody, and I can do it, to make a money to accept these edited sections.
MALE:  I second.
MR. CHAIRMAN:  Okay.  Are there – We have to do this formally.  [laughter]  Are there any motions or requests for unanimous consent to change the content of the human factors requirements for VBSG version one that we have just reviewed?  Are there any other changes?  If not, there being no further motions to change volume one, section 227, I will now entertain a motion for the TGDC to adopt this draft of section 227 as part of the first set of recommendations – Well, I should say adopt this draft of section 227 with the noted changes as part of its first set of recommendations to the executive director of the EAC.  Subject to change is expressed in any motions that we have adopted today that express the applied to section 227, which changes shall be made pursuing to TGDC resolution number 37-05.  Do I hear a second?
MALE:  Second.
MALE:  Second.
MR. CHAIRMAN:  Any further comments?  If not, we'll take a roll call.
MR. GREEN:  Voting on section 227, Williams?
WILLIAMS:  Yes.
MR. GREEN:  Williams votes yes.  Berger?
BERGER:  Yes.
MR. GREEN:  Berger votes yes.  Kraft?
KRAFT:  Yes.
MR. GREEN:  Kraft votes yes.  Davidson?
DAVIDSON:  Yes.
MR. GREEN:  Davidson votes yes.  Elekeys?
ELEKEYS:  Yes.
MR. GREEN:  Elekeys votes yes.  Gannon?
GANNON:  Yes.
MR. GREEN:  Gannon votes yes.  Harding?
HARDING:  Yes.
MR. GREEN:  Harding votes yes.  Miller?
MILLER:  Yes.
MR. GREEN:  Miller votes yes.  Purcell?
PERCEL:  Yes.
MR. GREEN:  Purcell votes yes.  Quisonberry?
QUISONBERRY:  Yes.
MR. GREEN:  Quisonberry votes yes?  Rivest?
RIVEST:  Yes.
MR. GREEN:  Rivest votes yes.  Shutzer?
MR. CHAIRMAN:  Um, he stepped out.  We'll try to get him in a minute.
MR. GREEN:  Samergian?
MR. CHAIRMAN:  Yes.
MR. CHAIRMAN:  Samergian votes yes.  It's 12 voting and four.  Two absent, or three absent at the moment.  The motion passes.
MR. CHAIRMAN:  Thank you.  At this time, I call on Mr. John Wack of (Indiscernible) information technology laboratory to review the edited sections of VBSG version one, section 6.0.1, overview of security requirements.
WACK, J.:  Good morning again.  Okay.  I don't think I really need slides here.  If it's okay with you, I'll just quickly go over what our instructions were from yesterday and then go through the changes I made. 
Okay, specifically I'm talking about the security overview that started on section 6.0.1.1.  And that overview consisted of several sections describing IDV systems.  Then several more sections describing different types of IDV systems.  And then it went on to include core definitions for IDV systems.  And then it had other definitions for other types of IDV systems.  
Now, I believe the instructions were from yesterday to essentially keep the overview for IDV systems and stop there.  So that's what we did, and we removed the remaining text in the overview that described different types of IDV systems.  And then we kept the core definitions for IDV systems.  And then we removed the remaining definitions for different types of IDV systems.
So in the handout that we prepared for you, you see now that we have roughly a short overview that has two sections.  Section 6.011 and two sub-sections, 1.1.1 and 1.1.2.  And then we go directly to 6.0.1.2, which are the core definitions for IDV systems.  And we stop there.  
I reviewed – Barbara and I reviewed the overview for tone.  We didn't want to say things that implied anything about existing voting systems as far as their security.  And therefore, we removed the one section we had up front that talked about the voting systems that produce single records.  And there was a footnote along with that as well that's out.
So that's it.  Are there any questions?
MR. CHAIRMAN:  Let me add something.  We were talking about putting the rest of the material in the appendix.  And my suggestion to the staff was that I did not want the appendix to be missing the part that was in the main text.  So that appendix, what goes into the appendix should be the original material in its entirety.  So if somebody simply looks at the appendix, all the material is there so that this material that is in the front, in the main body of the guidelines, is in the appendix as well as the additional information.
MALE:  And those sections (Indiscernible).  Are you including that in the appendix too?
MR. CHAIRMAN:  That was my suggestion so that it is a complete text in the appendix.  So that it doesn't leave part of the discussion or part of the preamble out.  It is repeated.  But if somebody simply looks at the appendix, it will not be missing part of the information.  It is redundant, but it's better to repeat than to be missing.
MALE:  Well, the part I'm talking about is not redundant, because you deleted it from the revised draft.  I'm talking about the one that says, "Problems in auditing single elected voting systems." 
MR. CHAIRMAN:  Well, I'm assuming that what's going to be in the appendix is this revised version of the preamble.
MALE:  Okay.
MR. CHAIRMAN:  And everything else that was there.  So the two parts will be consistent.  The two sections will not say different things.  The appendix will have additional material, but the front part will be consistent.
WACK, J.:  In other words, the section that addressed single record systems in the footnote will not be in the appendix.
MALE:  Thank you.
WACK, J.:  What will be in the appendix will be what I've just described to you is in the security overview as well as the remaining text on different types of IDV systems and then the definitions for those.
MR. CHAIRMAN:  Is that acceptable?  Do we have any objections to that?  Okay.  So any --  Yes.  Mr. (Indiscernible).
MALE:  Yes.  Just so that we're clear on which sections have been deleted or extracted out of 6.0.1, could you quickly go through and just from the version that we had from yesterday, just tell us exactly which sections are being extracted?
WACK, J.:  Okay.  I'm looking at page 6-4, section 60111 is removed, problems in auditing single record voting systems.  That's removed.  That also removes the footnote.  
In 60112, we removed some text at the very end that described an example.  We didn't think that that text was really necessary in there and it shortened the overview somewhat.
Okay, now turning to page 66, section 60113, example independent verification systems.  That section is gone.  That section has been removed.  Okay, turning to –  Yes.
FEMALE:  So, John.  Is that removed and will appear in the appendix?  I think the question is removed and will appear – Removed entirely versus removed and will appear in the appendix.
WACK, J.:  Removed from the overview.  Will appear in the appendix.
MR. CHAIRMAN:  Okay.  But that's not for 1.1.1.
FEMALE:  Right.
MR. CHAIRMAN:  1.1.1 is not going to be included anywhere.  Is that correct?
FEMALE:  Right.
WACK, J.:  That is correct.
MR. CHAIRMAN:  Okay.  So let's make that clear.
FEMALE:  So is that the only subsant (phonetic sp.) of change to the text that will appear anywhere in here that is – It sounds to me like what we've done is split up the pieces.  Decide some of it is abstracted into the main document.  Some of it goes into the appendix.  But that 60111 is removed entirely.  Is that a clear statement?
WACK, J.:  That is true.
MALE:  Why don't we use the word deleted if it's – Removed means moved to the appendix.
WACK, J.:  Deleted from the overview and deleted from the appendix as well.  I'm sorry.  [laughs]
MALE:  So removed to the appendix.  Deleted all together.
WACK, J.:  All together.  That's correct.
MR. CHAIRMAN:  Does that answer your question (Indiscernible)?
MALE:  (Indiscernible).
WACK, J.:  Okay, starting on 66, section 60113, removed.  Deleted from the overview and moved to the appendix.
MALE:  And all of its subtitles?
FEMALE:  And all of its subs go with it?
WACK, J.:  And all of the subtitles go with it that include and to and, witness, and so on and so forth.  Okay, now looking at page 6-11, section 60114.  We kept that section in the overview.  We shortened it a little.  There were a couple paragraphs at the end that seemed more commentary than anything else that didn't need to be in there.
MALE:  (Indiscernible).
WACK, J.:  Those paragraphs are gone completely from all text.  Deleted all together.  They will not appear anywhere.
FEMALE:  So that's page 6-12 starting line 43?
WACK, J.:  Line 43 all the way up to the end on page 6-13.  Okay, 6-13, section 6012 remains.
MR. CHAIRMAN:  That's actually in the front now. 
WACK, J.:  That's in the overview.
MR. CHAIRMAN:  As well as in the appendix.  Right?
WACK, J.:  That's correct.
MR. CHAIRMAN:  Okay.
WACK, J.:  In both areas.  Okay, on 617, section 6013 and every section thereafter, all the way up to VVPAT, those sections are removed from the overview but are in the appendix.  So that goes all the way up to page 630.
MR. CHAIRMAN:  Okay.
WACK, J.:  Okay, do we –
MR. CHAIRMAN:  So any questions, comments on this section 601 that will go into the main body?  There is basically no new information, no new text here.  This is a shortened version of the front end of the report from yesterday that we discussed.
MALE:  Mr. Chairman?
MR. CHAIRMAN:  Yes.
MALE:  Just a general question.  With all of these repositionings and deletes, we will get fresh documents when it's all over so we can delete and throw away and keep the latest?
MR. CHAIRMAN:  I think – I'm just talking off the top of my head, but obviously until we are truly finished with all the changes, we will keep the numbering system so that there is no confusion since people will be referring to them as they comment.  But once we get through some of these clarifications after this meeting, once that's done then we will create a new document where the numbering will be done in a consistent manner.  And we'll make sure that all the committee members get a copy.  Of course, that will also be the text that will be sent to EAC.
MALE:  Great.  Thank you.
MR. CHAIRMAN:  Are there any more motions or requests for unanimous consent to change the content of the overview of security requirements for VBSG version one that we've just reviewed?  There being no further motions to change VBSG version one, volume one, section 601, I will now entertain a motion for the TGDC to adopt this draft of section 6 – 
[End of Audiotape 5 – Side A]
 MR. CHAIRMAN:  -- As part of its first set of recommendations to the executive director of the EAC.  Subject to change is expressed in any motions we have adopted today that expressly apply to section 601, which actually we don't have any at this point.  
MALE:  (Indiscernible).
MR. CHAIRMAN:  Do I have a second?
MALE:  (Indiscernible).
MR. CHAIRMAN:  Okay.  We have a motion.  A second.  Any further comments?  If not, we'll take a role call.  Mr. Green.
MR. GREEN:  This is section 6.01.  Williams?
WILLIAMS:  Yes.
MR. GREEN:  Williams votes yes.  Berger?
BERGER:  Yes.
MR. GREEN:  Berger votes yes.  Kraft?
KRAFT:  Yes.
MR. GREEN:  Kraft votes yes.  Davidson?
DAVIDSON:  Yes.
MR. GREEN:  Davidson votes yes.  Elekeys?
ELEKEYS:  Yes.
MR. GREEN:  Elekeys votes yes.  Gannon?
GANNON:  Yes.
MR. GREEN:  Gannon votes yes.  Harding?
HARDING:  Yes.
MR. GREEN:  Harding votes yes.  Miller?
MILLER:  Yes.
MR. GREEN:  Miller votes yes.  Purcell?
PERCEL:  Yes.
MR. GREEN:  Purcell votes yes.  Quisonberry?
QUISONBERRY:  Yes.
MR. GREEN:  Quisonberry votes yes?  Rivest?
RIVEST:  Yes.
MR. GREEN:  Rivest votes yes.  Shutzer?
SCHUTZER:  Yes.
MR. GREEN:  Shutzer votes yes.  Samergian?
MR. CHAIRMAN:  Yes.
MR. CHAIRMAN:  Samergian votes yes.  It's 13 votes in favor.  The motion passes.
MR. CHAIRMAN:  Could we go back and record Dr. Shutzer's vote on the previous section, 2.2.7?  We did not receive your vote.
SCHUTZER:  I vote yes.
MR. GREEN:  Record reflects that Mr. Shutzer votes yes on section 227, bringing that tally to 13 in favor.
MR. CHAIRMAN:  Thank you very much.
WACK, J.:  Okay, what I'd like to do now is just simply pick up where we left off with VVPAT, and I'm hoping that we could fairly quickly go through this section.  You instructed us to do some edits and add a little bit of text.  And I'm wondering if what we could do in the interest of time go over those in the afternoon.  Would that be acceptable if we just pick up where we left off with the requirements, and then we'll deal with any edits later on?  No objections?  Okay.
MR. CHAIRMAN:  Okay.  Let's just make sure that we know where we are.
MALE:  I don't object, but I'm not sure I understand what is proposed.
MR. CHAIRMAN:  Okay.  Yesterday we went through – If you go back to your binders, we had the section marked as VVPAT with the VVPAT tab, and we covered through page 6-38.  Okay.  So now we will pick up from that point on and review the rest of the material.  And then come back, unless there are major changes to be looked at now.  We'll come back and look at the edited version of this based on yesterdays' discussion, and approve that.  But let's pick up – Basically, is this section repeated in this edited version or is that only for the first --?
WACK, J.:  Yes.  It is repeated.
MR. CHAIRMAN:  So, in fact then we can look at the version that's distributed to you this morning rather than the one from yesterday.  But it is the same material, so it – Is it the same page number?  Let's see.
WACK, J.:  We would have preferred to do the same numbers.  Microsoft word started working non-deterministically.  
MR. CHAIRMAN:  The numbering is different, so now we're starting from page 613.  Is that correct?
WACK, J.:  That is correct.
MR. CHAIRMAN:  So now we're reviewing the section starting on page 6-13.  Section 6026.  Okay.  Why don't we go ahead.
WACK, J.:  Okay.  At the risk of maybe hurrying you along a little bit, what I'm just going to do is read off the requirement number.  I'll pause for a brief second.  If you have anything, raise your hand or call out.  Otherwise, I'll just zip on through.
Okay, 60261.  
MALE:  Reading the comment down below, you say that the paper record should contain information identifying the voting station.  Now just as a point of information, the Sequoia reel-to-reel system was approved by nasad with the condition that that paper record not contain any information that identified the voting station.  
The reason for that being that if you can identify the voting station, then you can use that information plus the order of voting to identify individual's ballots.  So the thinking was that if there was no identification of the voting station.  In other words, if you could not identify a real of paper with a voting station, then you couldn't identify a ballot with a voter.  That's just for information.
WACK, J.:  The suggestion is to – Perhaps the requirement should read "shall be able to include information" as opposed to shall include information.
FEMALE:  (Indiscernible).
WACK, J.:  Oh.  Nothing?  Okay.
MALE:  (Indiscernible) that system.
WACK, J.:  Do you --?
MALE:  (Indiscernible).
MR. CHAIRMAN:  Could you put your mike on please?  
MALE:  Based on what I heard it means to take out that particular example, because that particular piece of information is apparently not appropriate.  But that doesn't mean there isn't other information you might want to include in that record.  
WACK, J.:  Okay.
MALE:  Well, here's something the committee can keep in mind as we go through this.  The current system that has been certified in California, was certified by nasad on the condition that the paper records, including the bar code on the paper record, not contain any identifier of the individual voting station.
Now there are other systems coming on the market that use that same reel-to-reel technology.  And as we go through this, we have to keep in mind what the impact of these guidelines are going to be on those types of systems.
Now with a reel-to-reel system, obviously if you see somebody vote and you walk over to that voting station and you record the voting station I.D. and the public counter number, you can take those two pieces of information.  And if you can get your hands on the reel of paper off of that voting station, you can identify that individual's ballot.  That's a violation of the standards.  
So to avoid that, we put in the caveat that those reel-to-reel systems, the paper record, could not contain any voting station identifier so that you could not – The fact that I knew that you were the fifth voter on the voting station wouldn't do me any good if I couldn't identify that reel of paper with that voting station.
FEMALE:  So Brit, what you're saying is that when you decked a privacy concern against – I'm sorry.  I'm going to use the word Paul, audit ability concern.  I'm not sure what the right word is.  That you decided the privacy concern was paramount.
MALE:  That's correct.  Because almost every state has a law concerning the secrecy of the ballot.  Very few of them have laws about the audit ability of a ballot.
MALE:  I think the audit ability should be preserved here though because the ballots will still have unique identifiers allowing you to correspond with paper record on the reel with the electronic record that corresponds.  Right?  Without having the voting system –
MALE:  And Ron, I agree with you completely.  And I personally would not approve a system that I couldn't audit back to a ballot station.  So this is the catch 22 here see.  This came up in a situation where something had to be done, and that was what was done.
MALE:  I don't think the audit ability is suffering actually on this.  The only thing you're missing is if you're discovering some problem with the audit – I'm sorry Paul.  With the correspondence checking you're doing later to verify –
MALE:  Shouldn't we say verify –
MALE:  It is an audit ability issue because if the problem is identified in the ballot in a reel paper and I can't identify that reel of paper back to a voting station, that becomes an audit ability issue.
MALE:  You have a question of being able to identify the machine that was misbehaving.  All right.  But you won't be able to do if you don't have the information on the ballot.  But you will be able to tell if there's a mismatch in the electronic and the paper records because they still have cross-linking identifiers.  And you can tell all of the votes that were produces on a given machine or produced on a given reel because they're all on the same reel, so that you've got pretty good ability to do whatever kind of evaluation you think you need to do to figure out how to recover.  It probably would mean the paper looks damaged somehow or something.  Trying to trust the electronic records in that case instead.  
But I think there's sufficient information here.  I'm actually comfortable with John's suggestion to revise the wording to say "shall be able to include identification of the voting –"  Ah, let's see here.  Where does it say that?  This is voting site and precinct.  It's not talking about machine here right?  But you're saying, Brit, is they shouldn't identify the machine.  But this is actually not requiring that right?  It says voting site.
MALE:  (Indiscernible).
MALE:  Oh, I see.
MALE:  So if you just change (Indiscernible).
MR. CHAIRMAN:  I'm not the expert here, but this is not a catch 22.  The reason we're getting into this situation is because you're keeping the reel intact.  
MALE:  That (Indiscernible).
MR. CHAIRMAN:  Well, I thought that was part of the issue.  That if you didn't keep the reel intact, then you wouldn't worry about the order.
FEMALE:  Right.  But I think Brit's point was that there are systems that are proposing a reel-to-reel solution, and how do you put constraints around them to protect ballot secrecy while preserving their verifiability.
FEMALE:  (Indiscernible).
MALE:  I'm not in love with our solution there.  I'm perfectly open to suggestions if anybody could think of a better way to do that.  But the question is, how do you preserve secrecy of the ballot on a reel-to-reel voting station?
FEMALE:  (Indiscernible).
MR. CHAIRMAN:  Yes (Indiscernible).
FEMALE:  Yeah.  I mean, I come from the country.  And you look for solutions.  And you could even say after the – The public number could be covered after it was recorded early in the morning and then uncovered after the voting so nobody could take and connect that number to the number of person that voted.  So I mean, you could do things like that so it protects this person's right to vote.  I mean, there's some things you could do by rules.
MALE:  Right.  There's some procedural things you could do.  But you can't get around the fact that if I can somehow know the record the order of voting on a voting station and then get hold of that roll of paper, I can reconstruct everybody's ballot.  And there are a lot of ways to record the order of voting on a voting station.  I just mentioned the public count as an example.  But a less dignified way would be for some poll watcher to just sit there with a yellow tablet and write them down.
MALE:  Mr. Chair?
MR. CHAIRMAN:  Yes.  I think part of our problem here is we're trying to solve someone else's problem.  I think logically when you try to have accountability in the system, you try to have a secret ballot, and you try to have an automated reel-to-reel recount process, those three notions are incompatible.  And when you embrace that technology, you make a decision to compromise some elements of one of those three.
Either you're going to cut the ballots up and get away from the reel-to-reel.  You're going to take the accountability I.D. off the receipt.  I'm sure there's another option, but I think I've made the point.
I think we need to prescribe what the capabilities of the system should be and let the jurisdiction buying these devices resolve how they're going to handle the necessary compromises.
MR. CHAIRMAN:  Well, I think that was – I thought that was John's recommendation basically so that the machine would have the capability of providing that information, but it's up to the local jurisdiction depending on how things are done to include or not to include that, depending on other requirements.  Is that a fair interpretation?
MALE:  I don't know what John intended.  I think that's the way the issue needs to be addressed.  Whether it takes us back to his original recommendation or not.
MR. CHAIRMAN:  Dr. Rivest, did you have a comment?
MALE:  Yeah.  I think that this section was primarily about the audit ability.  And so the notion here is to include the identifiers to allow the electronic and paper –
MR. CHAIRMAN:  To allow it.
MALE:  Well, that's – I think we're getting ahead of ourselves.  But include information about the election so that we can have verifiability of these things.  And Brit brings up a good point though that this information could conceivably used if we have precise indication of the machine as well to allow privacy.  
So we get back into the other section, which talks about privacy of (Indiscernible), which we've already been by.  That was section 6025.  But as Paul says, these things are butting up head on head here.  
We have a high level statement of the sort of goal to preserve privacy, which we previously talked about and (Indiscernible) upon.  And then this section, which talks about the identification information that needs to be put in for verification.  And I think that if we're precise about what we're including here, we can try to – We have a path that's pretty clear.  I think the ability – Having requiring that the system include which election it is, which polling site it is should be okay I think.  Other committee members can comment on that.  Identifying the machine is less valuable and probably should stand down in respect of the privacy goal in general.
I think it's useful for determining what to do should a machine be misbehaving, but that's a lesser goal than the privacy goals.
MALE:  I don't think that identifying the machine is unimportant.  Very frankly, when you would actually be using these types of records would be in the case where you found there was a discrepancy in the results coming from a precinct.  You had 15 more voters sign in than there were ballots on the machines.  And you want to go find out why.  To be left with solving that problem for a polling place with 12 machines and a pile of 12 rolls of paper that you can't trace to any particular machine.  Those records are not –
MALE:  You should identify (Indiscernible).
MALE:  I think if you want accountability, then yeah.  You've got to have machine identifiers on those records.  That compromises voter secrecy.  And that's a fact.  It's a problem we can't solve.  And jurisdiction such as California and Nevada are going to have to decide how they work that out.
The machine has to have the capability with providing them with the tools to administer their elections however they're going to do it under state law.
FEMALE:  I hate to introduce this documentation idea, but I always think about clarity of communication.  And I wonder since a lot of this discussion has in fact circled around one specific design implementation if maybe this should be called out as if you're using a reel-to-reel time system, then things apply.  Because that is really what we're talking about.  I hate to suggest structural changes at this point.
MALE:  I think there's ways around it.  You know, I mean if you didn't have it down to the machine but you knew it was at a precinct level and you had the right kind of diagnostics in the machine, you could probably hunt down where the problem lied.
So I would say if you're not that prescriptive.  If you're just indicating the fact that you want to have a system devised that preserves privacy, which is somewhat dependent upon the design of the system whether it's a reel or not.
You also want to be able to have information in the electronic records and the paper that could match things up and do an audit.  And you would leave that design and that test as more of a function performance test to see to what degree the vendor comes up with a solution that can accomplish those two objectives.  We have those function requirements in there.  That's the way I would leave it rather than give this one example versus another.
MR. CHAIRMAN:  Well, would it help simply to put a statement that says in the case of reel-to-reel systems, we caution – Or caution should be e
MR. CHAIRMAN:  Well, would it help simply to put a statement that says in the case of reel-to-reel systems, we caution – Or caution should be exercised regarding privacy issues.  Or something to that effect.  That basically raises a flag.  That I mean, you may have to make a choice in some case.  Would that be right?
MALE:  Yeah.  All I've done is bring up an example.  The inherent problem is that secrecy of the ballot great impedes audit ability.  [laughter]  That's the dilemma of a voting system.  That as long as we think secrecy of the ballot is concerned, is the more important issue, we can't let audit ability tromp secrecy.
And so if compromises have to be made, then the question is where do you make the compromise?  And I think the answer is in the audit ability, not in the secrecy of the ballot.
MR. CHAIRMAN:  But to me, I think this committee would be doing its job as long as we point out these issues and say that, well, in this case.  And then we'll leave it up to the local jurisdictions to make those choices depending on their particular situation.  So –
MALE:  We could solve a lot of problems we're dealing with if we could deal away with the secrecy of the ballot. [laughter]
WACK, J.:  Dr. Semerjian, could I propose a change –
FEMALE:  I think that's a policy decision beyond this committee.
WACK, J.:  Could I propose a change to one of the requirements then to take care of that issue?
MR. CHAIRMAN:  Okay.  Which one are we talking about?
WACK, J.:  Okay.  I would like to propose a change to requirement 602621.  
MR. CHAIRMAN:  And that's at the bottom of – line 38 of page 613.  The new 613.
WACK, J.:  And I would like to propose that that say "the voting station shall be able to include."
MR. CHAIRMAN:  Are you adding?  You're adding a sentence?
WACK, J.:  I'm changing it just so there is the option to include the information.
MR. CHAIRMAN:  Changing what though?
WACK, J.:  Well, I would like to change the whole sentence to something difference.
MR. CHAIRMAN:  Instead of the record shall include identification to the voting sites/precinct?
WACK, J.:  I would like it to read, "The voting station shall be able to include an identification of the voting site, precinct, and voting system."
MR. CHAIRMAN:  Could you repeat that again?
WACK, J.:  The voting station shall be able to include an identification of the voting site –
MR. CHAIRMAN:  You got to go more slowly.  My short hand is not that good.
WACK, J.:  Oh, I'm sorry.  I had a couple triple espressos.  The voting station shall –
MR. CHAIRMAN:  Shall or should?
WACK, J.:  Shall be able to include an identification of the voting site precinct and voting station.  And a possibility would be in the discussion field to note the purpose of this.  I guess basically some words to the effect of "precincts may wish to include this information or not depending on paper reels."  Something along those effects.  Would that, Dr. Williams, would that be something you would advise?
MALE:  I wish I could give you the magic solution.  This is one of those instances where I'm really just identifying a problem that we have to try to work around when unfortunately I don't think any of us have a real neat solution to this.
I mean, we're dealing with the inherent conflict between secrecy and audit ability.
MR. CHAIRMAN:  I guess I'm having a little bit of a problem here, because maybe I'm not looking at the right line.  Because I don't see a – Are we talking about 262?
WACK, J.:  602621.
MALE:  (Indiscernible).
MR. CHAIRMAN:  Yeah.  But that doesn't say put together a machine.  Is that what you mean by voting site?
WACK, J.:  And voting station.
MALE:  (Indiscernible).
MR. CHAIRMAN:  Where does it say voting station?
WACK, J.:  Well, I am adding that.
FEMALE:  He is proposing to add voting station in the language but also add a caution in the discussion about the implications of using that, and that's why it's shall be able to but not shall include.
MALE:  Also, I notice that there's isn't any leaf level requirement that corresponds as saying what election it's for.  I mean, I think the high level one says about the election but it doesn't say what year or which election it is or which state.  We could add something along those lines to instantiate the high level goal.
MALE:  And (Indiscernible).
MALE:  Yeah.  There's privacy issues with date if you have multi-date voting and there's only one person voting on a given day perhaps.  But –
MALE:  (Indiscernible).
MALE:  Even that, that would (Indiscernible) privacy (Indiscernible).
FEMALE:  Microphone.
MALE:  Most voting stations, all of them that are in what you call the major group right now have the ability to protect the secrecy of the voter.  Once that ballot is cast, the only way that you would violate the secrecy of the voter with the current voting system would be if some extremely small number of people voted on a single voting station.  
Obviously, if one person voted on a voting station, that's their ballot.  If two voted, you could toss a coin and be right 50 percent of the time.  And if as many as five voted, then you're getting into an area where you're probably protecting the secrecy of the ballot.
So that's not an issue unless they just took this machine right back out of service.
MALE:  Well, what we've got here is we've got a chain of system design events which now have frozen in place.  I mean, when the people promoting voter verifiable paper ballots started out, they wanted to print out the voter's choices on a piece of paper and hand it to the voter.  They realized that wouldn't work.  
Then someone came up with this concept of a ballot under glass.  And the issue was raised then protecting the secrecy of the ballot.  And the designs morphed into something where the paper tape would be cut after the voter approved it and drop it in a box, which preserves secrecy.
And then a couple of states looking at the real difficult issues said, "Okay.  If you're going to use those things for recount, how do you do it?"  They came up with this concept of bar coding and doing a reel-to-reel, which goes back and compromises the secrecy of the ballot.  
I suspect that this evolution isn't over yet.  But unfortunately, we do have a snapshot in time of a design that's been deployed in some states that those states plan to take into the 2006 elections.  So, I don't know how we solve it except that it remains yet to be solved.  And anything we can do to lay a groundwork for solving it, we need to do.
MALE:  Well, that's why I say we might want not to be too prescriptive except for the rights of discussion so people understand the complexity.  But essentially I think what we're saying is we don't necessarily have the solution.  We think it's going to evolve as you say over time.  But we can't indicate that.
There's a desire to do two things, preserve privacy and to be able to audit and do all those things you can in terms of tracing back problems and so forth.  And that one has to be sacrificed over the other.  The audit ability gets sacrificed over the secrecy.  And then we're looking for solutions so we can evaluate those solutions as they come up.  And when those different solutions come up, we may find that one solves them both better than another.
MR. CHAIRMAN:  Let me suggest something and see if we agree on this.  I suggest that we change the language to read, "The voting station shall be able to include an identification of the particular election, voting site, precinct, and voting station."  Under discussion, I would add to the sentence that's already there, "Some of this information may have to be excluded to protect voter privacy."
MALE:  Right.
MALE:  Yeah.
MR. CHAIRMAN:  Does that capture the –
MALE:  Right.
MALE:  Because over time, we may see solutions.  As Ron knows, you think of some of the things that David Jom's (phonetic sp.) done in the electronic money area.  It's possible that some of those solutions could be adapted to achieve both of these objectives.  But to sit here now.  [laughs]  (Indiscernible).
MALE:  Yeah.  People are working on that one.
MALE:  In the guideline you say shall, but then over here you say you can exclude some of them.  So if you can exclude some of them shouldn't it be should?
MR. CHAIRMAN:  No.  No.  It says shall be able to include.  The important thing is the machine has to have that.  And then you may have to make some decisions locally.
MALE:  Right.
MR. CHAIRMAN:  Are we okay with that?  All right.  So we'll make that change.  Go ahead John.
WACK, J.:  Okay.  I have that noted.  Okay.  I would like to skip to then requirement 60263.  60264.  Next page 60265.
MR. CHAIRMAN:  Slow down just a little bit.
WACK, J.:  Yes.
MALE:  I have a comment or question on 60265 and 602651.  In the sentence on 602651 where it talks about the export of a (Indiscernible) record shall be on open not priortary (phonetic sp.) format and should preferentially be in a format that is commonly used by electronic voting system manufacturers.  I'm not sure today that the voting system manufacturers are using a common format today.  So it's almost in contrast to what's in the discussion, which is suggesting to use a standard format.  But in fact the statement here is saying, "Well, just use whatever the manufacturers are using today."  Which may not be an open standard.
MALE:  Why not just put a period after non-proprietary format.
MR. CHAIRMAN:  I would recommend that.
WACK, J.:  Okay.  All right.  I have that noted.  Any other comments on leaf requirements under 60265?  And moving –
MALE:  Let's back up to 63.  I'm sorry, 64.  The voting station shall generate and store a digital signature for each electronic record.  What –
MALE:  Could you use the microphone please?
MALE:  Oh, sorry.  60264, the voting station shall generate and store a digital signature for each electronic record.  What are we talking about, and is that out there now?
WACK, J.:  There we're talking about a digital signature for the purposes of integrity and also for linking it back indirectly to the voting system itself.
MALE:  So you're going to hash out and store to memory a digital signature on every ballot cast?
WACK, J.:  That's right.  As well as then on the entire set of records.
MALE:  Let's talk about how you do that just a minute.  Shallots are stored as a bitmap.  If on the ballot you've got say 30 choices.  You've got five elections with six candidates in each election.  So you've got 30 choices.  What's stored is 30 bits.  Their either on or off to indicate those choices. 
So you're not going to do a very sophisticated digital signature on a 30 bit word.  What would you do with that Ron?
MALE:  Certainly you can.  You can do a sophisticated digital signature on a one bit word.  The point here is not secrecy.  [laughs]  The point is integrity.  So you want to have some indication that this is a record that's – And a media record identifier which makes it more unique than just the one bit information.  But you want something that gives you integrity for that record.  The point is integrity, not secrecy.  Short message links are not a problem.
MALE:  I'm trying to think how you compute digital signature records the way they're stored now.
MALE:  There are digital signature algorithms such as those that nistes (phonetic sp.) is worked with and did fit all government standards.   So we had digital signature algorithms.  These are our routine, state of the art technology.  It allows authentication of the message contents as well as the message source.  And the message length is not an issue on any of these.
FEMALE:  I was asking to clarify that bitmap has two meanings.  You mean a digital string of zeroes and ones, not a graphical image.
MALE:  It doesn't matter for the purposes of the signature whether you do a pixel map or a text or anything else.  Yeah.
MALE:  What's the purpose (Indiscernible).
MALE:  The goal is to add integrity to the record.  So if you have an electronic record that's accompanied by a digital signature, that record cannot be altered and preserve the validity of the signature along the path of transmission.  So it's to preserve that – It's not just a hash.  It is a digital signature that requires a cryptographic signing key and a separate public verification key.
MALE:  I think it's no secret that I'm not an advocate for voter verifiable paper ballot.  But I have to tell you that if you leave 60264 and this document as a shall, you won't have to worry about voter verifiable paper ballot for probably six to ten years.  [laughter]
MALE:  Just concerned about the implementation.  The difficulty of that.
MALE:  Yeah.  
MALE:  I think the manufacturers are up to this if that's – 
WACK, J.:  Actually, there is one manufacture I did take a look at.  The only one that's certified right now.  In their documentation, they say they do include a digital signature in their bar code.  I hold out that they may not be using digital signature the way we're using it here.  They may be thinking of something a little bit different.
MALE:  But they do (Indiscernible).
WACK, J.:  They include it in the bar code. 
MALE:  We're moving to an area of clearly a more electronic information storage, electronic transmission, and the use of digital signatures as a way of maintaining integrity on this kind of information.  It's clearly a direction I think we want to be moving in.  Not only here in the VVPAT sections, but more broadly the communication between the various components of the system.
MALE:  Well, it's fine with me.
MALE:  (Indiscernible).  [laughter]
FEMALE:  (Indiscernible).
MALE:  Maybe they should and maybe they shall (Indiscernible).
MR. CHAIRMAN:  I thought Paul agreed.  So let's move on.
FEMALE:  (Indiscernible) shall.
MR. CHAIRMAN:  Yes.
WACK, J.:  Okay.  Moving on to – Okay, I noted a change on 602651.  Are there any remaining changes on those leaf requirements there?  Okay.  Moving then onto 60266.  67.  60268.  69.  And any of the leaf requirements under 69.  And then 610.  Okay.  Very good.  Then we're on to the last requirement on page 619.  
Okay.  And then 60271.  And any of the leaf requirements under 60271.  
MALE:  I have a question on 712.  What's the purpose of the last phrase, "as specified by local law?"
WACK, J.:  Well, to be honest, it may be a clumsy bit of words there.  If access needs to be provided to a poll worker to an election official, then it has to be provided.  And I don't want to make a requirement that says you can't – I guess basically what I'm trying to say is it shall remain a secure, sealed container.  Actually, I'm not real good at rewording this right now.  I suspect that is probably something that should say something alone the lines of a should statement.  This should remain sealed.  Or access should not be provided unless required by a poll worker or election official.
MALE:  Let me ask, do we lose anything if we just put a period after election official?
WACK, J.:  Okay.  Looks good.
MR. CHAIRMAN:  I guess the word authorized sort of implies that you are authorized by law.  So, yeah.  I think that's fine with me.  Is that okay?
WACK, J.:  Okay.  Very good.
MALE:  Um, I've got a problem with 60271 in total.  I mean, this is very much a restriction in design.  It provides that the voting station shall communicate with its printers over a standard publicly documented printer port using a standard communication protocol.  That tends to imply that the printer is to be separate from the voting station and that vendors would be precluded from building printers into their voting stations.  
That whole thing carries through back in further on there's a requirement that the printer not be able to do various networking and communication functions.  Well, what is the printer?  Is it simply a print engine and print head module in a case?  Or is the vision that we are going to restrict printers to being separate components that connect to a voting station?
WACK, J.:  I can tell you the background behind that.  First of all, even though the printer could print in some of the units now, could look like it's integrated into the machine, it could still have an internal port, a USB or whatever.  
The other thing is that a lot of printers these days have amazing networking capabilities.  Telenet (phonetic sp.), FTP servers, and other things.  And the philosophy here was basically to ensure that the printer is just a printer and does not have any additional networking or anything else that could be enabled somehow.  So it's just basically saying we want this to be a printer and nothing but a printer.
MALE:  (Indiscernible).
MALE:  (Indiscernible).
MALE:  I said and yet a separate component.
WACK, J.:  Well, again going back to the one that's certified.  It can be removed.  In fact, if there's a problem with the paper it has to be removed and then a new module has to be put on.  So it's integrated but at the same time it is a separate component.
MALE:  So we've got basically a technology now that has evolved by cobbling these two separate devices together running wire between them.  And we're starming (phonetic sp.) our standard in such a way that they're going to stay that way rather than evolving into more elegant, integrated products.
MALE:  John.  Let me tell you.  You talk about the one that's certified now.  You're referring to the Sequoia?  The way that came about is that the Sequoia edge did not have a build-in printer.  They plug a printer into the back to print results on.  So when they wanted to put the verifiable printer on it, they used that port.  So it's like Paul said.  This came about because of things in place, not because it's necessarily good design.  And I don't think we want to perpetrate that. 
I don't see any problem with the printer being integrally built into the device as opposed to connected via port.
FEMALE:  Well, but I think the point you're trying to make John is however the printing function is integrated into the station that the connection – That it shouldn't be able to talk to anything outside of that station.  Is that fair?  
WACK, J.:  Well, that as well as –
FEMALE:  Let me just say that more clearly.  Instead of implying that it's a separate physical device.
WACK, J.:  There's also the other factor that printers fail.  And we want basically a printer to be able to be replaced.
FEMALE:  I'm just suggesting that we change the wording to instead of to imply that it's a printing device that's somehow separate, however well-enclosed it might be, that we broaden it to say the printing component or the printing function or whatever the right technical word would be.  Because I think you could build the thing completely into the system and nonetheless have a communication protocol to talk to it.  And that's what you want to avoid.
WACK, J.:  Okay.  I'm sorry.  Could you point to the – If you could point to the specific requirement where you're recommending the language –
FEMALE:  Well, just for an example.  In 2711, it says, "the voting station shall communicate with its printers over a standard publicly port."  And I think the point that they're trying to make is that that could be a piece of hardware that's built into the station and isn't using an external printer port.  But that nonetheless you still want it to communicate in a very tightly bound way.
MALE:  I really don't (Indiscernible) paragraph is necessary.  I think that your main ones are one three and one four.
FEMALE:  Uh-huh (affirmative).
MR. CHAIRMAN:  Your mike please.
FEMALE:  Mike.
MR. CHAIRMAN:  Microphone.
MALE:  Oh, okay.  What I was saying is I really don't think 711 is germane.  I think that the ones that give you what you want are one two, one three, and one four.  
MR. CHAIRMAN:  I'm not sure that I agree with that.  Here, this is partly associated with the testability.  I mean, you want to make sure that there aren't some unusual configurations that cannot be tested otherwise.
MALE:  The only way you'd get that would be if the vendor decided to manufacture some off-brand printer.  Because they're going to go out and buy a commercial printers.  They're going to have standard ports and all on them.
FEMALE:  It (Indiscernible).
MALE:  They may just wire it into their machine through their own connection.
MR. CHAIRMAN:  Would it solve this problem if we said at the beginning of that "a separate printer is used as part of the system" or something like that?  Would that solve the problem?  Is that – Because clearly if it's an integral part of the station, then this may not apply.  Does that solve the problem?  
MALE:  It depends on what the problem is you're trying to solve.  One of the – Some of the voting system vendors I've heard have proposed systems that try to monitor the printer port for auditing purposes and so on.  There's some kind of tap.  Maybe for accessibility reasons even.  And so I don't know if the intent here John was to in part make that available for those kinds of purposes or whether – Which would be one goal, which wasn't mentioned before.  It may not be the goal that's intended here.  The other one would be to enable the replacement of printers with other standard printers.
I guess the high-level question is what's the main purpose for this?
MALE:  Well, let me ask you a question.  Ron, you and John appear all – The availability of a standard port would enable external devices like you're talking about in some of your alternative designs.  So maybe what we want to do is require the existence of a standard port.  Now whether the vendor attaches his particular printer to it or not – Is that important to us?  But I can see the importance of the availability of a standard printer port.
MALE:  Yeah, that makes sense to me.
MR. CHAIRMAN:  What is the proposed change?
MALE:  The following (Indiscernible) language.  John, I don't know if you have any comments on this, but the (Indiscernible) shall –
MR. CHAIRMAN:  Hello.  Ah, one of the folks on the phone, we're hearing some noise.  Thank you.
MALE:  What if you just said it shall provide a standard public documented port. 
MALE:  I'm happy with that.
WACK, J.:  The voting station shall provide a standard publicly documented printer port.
MALE:  Yes.
WACK, J.:  Using a standard communication protocol.  Okay.
MALE:  I'm sorry.  Did you just say a standard printer port?  I thought we were dropping the word printer.
WACK, J.:  Oh, let's drop the – Yeah.  Right.  Okay.  The voting station shall provide a standard publicly documented port using a standard communication protocol.
MR. CHAIRMAN:  For what?
MALE:  To communicate with its printers?  Is that –
MALE:  Do you want to be that vague?  
MALE:  Why not leave it there?
MALE:  Because you've got parallel ports on all these things now, because that's where they plug in most of the accessibility devices.
WACK, J.:  So it seems as if we want to say that for the purposes of connecting a printer we want this requirement.
MALE:  Yes.
WACK, J.:  So, --
MR. CHAIRMAN:  Okay.  So what is the wording? 
WACK, J.:  I would –
[END OF AUDIOTAPE 5]
	MALE:  -- the word printer out of that line there, Mike, so.
	MR. CHAIRMAN:  Yeah, but then we need to say what it is for, so.
	MALE:  Well, it says, if we read the original statement 6.0.2.7.1.1, “The voting system shall communicate with its printers over a standard perfectly documented port using a standard communication protocol.”  Is that?
	MALE:  It’s a little different since you’re not necessarily making it available if it’s internally bound inside and you’ve got a USB port internal.  So if -- if the goal here is to make it printer -- port -- port and printer -- the printing output available externally, then I think Brett had some good language earlier on.  It was, “voting station shall”….
	MALE:  (indiscernible)	
	MALE:  Yeah, printer port or equivalent, I think.  I think that would be language, so.  “Voting station shall provide a standard publicly-documented printer port or the equivalent using an equivalent”….
	MALE:  (indiscernible) verification.  (indiscernible) verification to find a USB port to be a standard documented printer port.  That’s what they’re used for now.  
	MR. CHAIRMAN:  Okay, so it -- it reads: “The voting station shall provide a standard publicly documented printer port (indiscernible) or the equivalent using a standard communication protocol.”  Is that the language?
	MALE:  I have that noted.
	MALE:  Yes.
	MR. CHAIRMAN:  Okay.  Are we all okay with that?  Thank you.
	MALE:  Okay.
	MR. CHAIRMAN:  We already covered the next one.
	MALE:  Mr. Chairman?
	MR. CHAIRMAN:  Yes?  Sorry.
	MALE:  Just because we’ll be doing this for years to come, perhaps if we have a real-time editor available to us, that may facilitate our -- our thinking quicker in the future.  And then it can be up on the wall and then all of us are on the same page as opposed to cognitively following each other’s thinking.
	MR. CHAIRMAN:  You mean you’re having trouble reading our mind?
	MALE:  I guess.  [laughter]
	FEMALE:  Now, that would be a real danger to ballot seekers.
	MALE:  That would violate voter privacy.
	MALE:  Yes, duly noted.
	MALE:  Okay, I would like to move on then to 620, page 620, requirement 6.0.2.7.2.  
	MALE:  Question.
	MR. CHAIRMAN:  Yes?
	MALE:  Back on 6.0.2.7.1.4.  The statement that it cannot spool information.  That seems to be counter to (indiscernible) that most modern printers are spooling information.  
	MALE:  We -- we -- you -- you have a point, and -- and really, the idea behind that is that we wanted this to be a dumb printer, as dumb as possible so that it was verifiable -- verifiably easy to determine that it is just a printer and contains nothing else.  But I -- I -- I get your point.  Most printers to have that capability.  But that’s also a capability provided in the operating system as well, and it -- it -- we’re not saying that you can’t spool information to the printer, it’s just that the printer itself -- we would prefer it not have memory on board and things of that nature, just a printer.
	MALE:  Getting harder to find.
	MALE:  Yeah, I mean, I think in terms, especially with modern printers even now to the point where they’re accepting markup language, (indiscernible), things like this where there are proposals for using, you know, markup language, for being able to communicate from the DREs to the printers.  We may be actually getting in the way of progress here.
	MALE:  There are concerns about those kinds of printers.  I mean, you have a highly complex printer language that you’re (indiscernible) off to the printer.  The security, you know, you have to in principle at least, worry about the security of the printer.  Has it been programmed to (indiscernible) with the votes somehow?  So.
	MALE:  As I understand printer operation, unless you have some memory and spooling capability in the printer, your CPU then becomes dependent on the printer function before it can resume process.  Basically, wind up like we did in the old days -- you’re hung up while the printer catches up your CPU.
	MALE:  CPU can manage -- I’m -- maybe I should defer this discussion and remove that language, I think, re my proposal, but I think Paul, that statement, just for the record, modern CPU can do multitasking and manage the printer as well as something else, but I think that having a printer that can spool information at the minimum should be allowed.  I think that’s a good catch there and I would recommend that we just delete the language about spooling information.
	MALE:  So change that to delete spool information or?
	MALE:  Okay.  I’m sorry, I didn’t get that, so could you -- from the semicolon on, could you read how that should go?
	MALE:  It cannot contain any services or any other -- other services.  
	MALE:  Okay, are you also saying (indiscernible)?
	MALE:  (indiscernible) the word spool information or.
	MALE:  Okay.  Great.  I have that noted.  Okay.  Thank you.  Are there any other remaining on that -- on that page?
	MALE:  Down there.
	MALE:  (indiscernible)
	MALE:  Microphone.  Microphone.
	MALE:  What does 7.2 do that 7.1.1 that’s revised doesn’t do?
	MALE:  Well, looking at it right now, I think it doesn’t do anything else that early requirement does do.  You are right.
	MALE:  I like the wording of that better than I do 7.1.1.
	MALE:  I think when we put in 7.2.1, perhaps we’re getting too design specific here.  I think -- our thought there was that if you had to connect another printer, you know, you could do it.  If -- if -- this was really more a reliability issue if you had to connect another printer because your existing printer didn’t work.  You have that capability, but.  I could be argued out of that.  
	MALE:  That -- that’s not gonna do you any good unless the voting station is -- is programmed to divert to that second port and I’m not sure you want that capability in there, either.  
	MALE:  Well, first off, I don’t think you want to experience a printer failure in a precinct and have your precinct worker doing R&R of parts on your voting equipment.
	FEMALE:  [laughing]	 
	MALE:  I mean, if -- if the unit fails, they’re going to set it aside and perhaps have another unit brought in from a backup supply.  You’re not going to start taking equipment apart and putting it back together again on election day.  That ain’t real.
	MALE:  No, that’s an election management issue.  That’s really poor election management to start trying to repair equipment in the precinct.
	MALE:  But not to argue again, it’s a should requirement in -- in the ideas that, in general, a voting system should be -- be configured such that if you -- you could connect just a commercial.  It’s just a nice thing to be able to connect a commercial off-the-shelf printer as opposed to a highly specialized printer.  And that’s not a shall.
	MALE:  I should probably draw up this.  So basically we now have specified antique printers of extremely high reliability.  [laughter]
	MALE:  Well, I think we have a should here which -- which, you know, could be ignored.  Seemed to be same as the previous one.  No, the previous one was a shall, however.  So there’s -- there’s -- with a change to 7.1.1, we had shall; now we have a should.  I think we should drop at least one of these.
	MALE:  Let’s drop the should.
	MALE:  Drop the should?
	MALE:  Okay.  
	MALE:  Should.
	MALE:  Okay, so we’re deleting 6.0.2.7.2.1.  Okay.  Moving on to the next page, 621.  Are there any comments on any of the requirements on page 621?
	MALE:  Ed, I have a comment on 7.2.4 and the same thought will extend over on the next page, but given the use scenario for these printers which is different from what we’ve had heretofore, that is, hundreds of them have to operate for long periods of time and if they don’t, they potentially disrupt the flow of an election or even potentially stop it in a given precinct.  I really think this needs to be tested -- testable which means there need to be numbers that represent that.  I think, clearly, that many printer technologies will not be usable in this use scenario without creating a lot of service problems.  So.  I’m not sure today what that number outta be, but I think we can come up with it in a reasonably short time.  
	MALE:  Okay, I have to take extreme exception to 2.7.2.2. in view of what has just passed because we want an antique, highly-reliable printer which will be a separate module from the voting station which now must enable the voting station to detect errors and malfunctions such as paper jams, low supply of supply of paper and ink.  Guys, I don’t think it’s out there.  And once again, I’m -- I’m not an advocate of these devices, but I -- I think you’re making it impossible to field them.  And if our -- if our intention in this is to support those states that have decided to adopt this by giving them a standard for how these devices should be created, I’m not sure we’re doing it.  
	MALE:  If I can comment on 7.2.2, I think the intent there is clear and it’s something you have to be concerned about when you’re using printers, if you’re using printers which isn’t performing its function, then the voting station should know about that and I think this is a high priority item on our list here, I think.
	MALE:  Okay.
	MALE:  In a previous item.  I don’t -- I don’t remember precisely where, but we -- we have a requirement previously that says that if -- if for whatever reason, the paper ballot will not print, the voting station is to suspend operation and allow the cancellation of both the paper and the electronic.  Doesn’t that take care of what you’re trying to do here?  Well, this is basically what you’re saying is that if -- that if for some reason the printer doesn’t print, and we’ve already addressed that in a previous -- John, you’re more familiar with this.  You can probably put your hand faster on it than I can.
	MALE:  Yeah.  I know what you’re talking about.  
	MALE:  So this is really a function of the overall voting station.  And I think we’ve addressed that previously.
	FEMALE:  You know, I just wanna state a concern.  And I will admit that a lot of this is way above my head.  But I am concerned that we are putting requirements in that the equipment that has been certified up to now that a lot of states will be buying cannot meet.  And if we are putting that kind of requirements in, we cannot meet the 2006 with the states that have to meet the 2006 with the paper verification.  What kind of a situation are we putting these states in?
	MR. CHAIRMAN:  Are we saying that currently installed equipment cannot meet or the technology is not -- cannot meet?
	MALE:  (indiscernible) current.
	MALE:  Microphone.
	FEMALE:  Microphone.
	MALE:  Yeah.
	FEMALE:  Can you repeat that, Brett?
	MALE:  The currently -- the currently certified -- qualified systems can’t meet.
	MALE:  Well, my -- the individuals I worked with at NIST on the printer parts of this standard aren’t in the audience.  They -- they did conduct research with voting system vendors and actually, there is one person in the audience right now who did work with me.  They did conduct research with some vendor equipment and felt confident about these requirements.  
	FEMALE:  John, is that feeling comfortable with these requirements in the future after -- I mean, like we said, once these are done, it’ll take 12 months for the vendors to be able to meet a lot of the requirements that we’re putting here, or are they already meeting them?  That’s my concern.  I mean, it even goes back to the one we passed a while ago, 6.0.2.6.4.  I’m not sure that that’s being done right now, and that’s really a concern of mine.  I -- I mean, I think that you’re putting some of the states in a possibility of looking at lawsuits by saying they want paper verification.
	MALE:  There’s a difference, John, between an existence and an availability.  When you say that there exists voting stations that can meet all of these, the one we’re using in Georgia does not meet that 6 -- 2.7.1.1.  It does not have an available external printer port on it.  And that’s the leading DRE in the marketplace right now.  
	FEMALE:  Well, we do have one -- one option which is to -- to make these shoulds with the same provision we did in accessibility, that we’ll be look at them as (indiscernible) requirements later.  
	MALE:  But I -- I agree with you.
	FEMALE:  I hear, John, that what you’re saying is that this is good practice and the question I think that Secretary Davidson is wrestling with is whether it’s practice that we can implement now, but I think we had the same battle, you know, the same conundrum in accessibility, which is how do we point forward to good practice so that as people evaluate systems, they can choose the systems that meet more of the best practices.
	MALE:  Well, I -- I understand and I won’t argue.  We were charged with coming up with requirements which, you know, required us to do research, basically.  Some of the requirements -- I can’t get into specifics right off the top of my head -- are actually in some inactive state legislation, some of the printer reliability requirements.  We -- we took a look at what was out there.  These were available for review as well, and we didn’t, to my recollection, get comments specifically on these sorts of requirements.  So I feel as if we did our research and we’d stand by it.
	MALE:  Right.  John, having said that you did your research, that doesn’t preclude a state from raising the bar and keeping it as a should and indicating the shall the coming that’s putting everyone on notice, but it’s not telling the state that they can’t continue to do what they’re doing.  
	MALE:  And, John, basically, I mean, this is overall very good work product.  I think y’all have done good research.  These are things that really should be there if you’re gonna have voter-verifiable paper audit trails.  I’m just concerned that I don’t think we really know what effect this is going to have on the systems that Nevada and California are currently planning to rely on for the January -- or the 2006 elections.  And I think perhaps we need to determine what that will be.  One thing we could do, I think we have engineers from the companies in the audience.  We could perhaps on the break which is now ‘bout 20 minutes past due, see if the -- the two companies that are particularly affected, see this as being something they can meet or that they already do meet.  
	MR. CHAIRMAN:  For the break, I’ll make a statement and then maybe we can ponder this.  I don’t think we are here to basically approve the operations of currently available equipment.  If that’s all we’re here for, then we’re wasting everybody’s time.  We are here to set minimum requirements to established trust and confidence in voting systems.  If there are equipment out there that may have been purchased by certain states that don’t meet those criteria, I don’t think it is our function to basically approve their operati -- continuing operations.  I will not go any further.  I will just stop there and let’s think about that whether you agree with that statement or not and at this point, I’ll -- I suggest that we break for -- until 10 after 10 -- I mean 10 after 11.  And then we can continue with this discussion.  Thank you.
	MR. CHAIRMAN:  John, could you set up (indiscernible)?  Are we on page 6-21, item 6.0.2.7.2.2?  Is that?
	MALE:  That is correct.
	MALE:  Mr. Chairman, you challenged us to think about it during the break and come back to discuss it.  Before John continues, I’d like to make a statement, if I may.
	MR. CHAIRMAN:  Please.
	MALE:  Okay.
	In consultation with the engineers here from ES&S, Sequoia Pacific, and Diebold, all three gentlemen agree that number one, the goals for functionality and security and reliability that we’ve put into this standard are quite desirable.  They all agree that the functions that we’re calling for are doable.  They are very concerned, though, that the functions that we’re calling for with the design limitations that we’re putting on the solutions are not doable.  I think that needs to be addressed very short order.  I don’t know if it’s a product that we can do as a committee.  
	We need to come back, though, to the basic premise of non-restrictive design.  Things such as -- probably one of the best examples is the printer restriction on what printers can do.  If you want a printer that can print in multiple languages and different-sized fonts, that becomes a fairly sophisticated printer.  If you also want a printer that, perhaps, can process and export part of the data coming into it in an audio file to start dealing with some of the accessibility issues once again.  That’s almost a freestanding computer in and of itself.  Some of the security issues and the maintenance issues can be better addressed if we weren’t restricting printers to be separate freestanding articles.  I think we need to concentrate on the function requirements, the security requirements that we want and then leave design elements open to the creativity of the people who have to meet those requirements.
	MR. CHAIRMAN:  Well, certainly that’s in the spirit of what we’re trying to do in terms of performance-based standards.  Of course, in some cases, to set performance standards, you need benchmarking, you need some research and some data, some of which is not currently available.  In those cases, I thought we were trying to set some design specifications with the understanding that the next step would be to migrate towards performance-based standards.  Certainly, that is the desire and the intention of this committee.  Secretary Davidson.
	FEMALE:  I think you’ve hit on something that is very key.  I mean, obviously, with the legislation that came about with HAVA and the deadlines that was put into place, we obviously are way behind our deadlines, not due to problems of what we’re setting today, I mean, it’s not because of NIST or anybody else.  I don’t want to point fingers there.  But even the legislature themselves, the -- the Congress and the president in appointing the EAC directors, everybody was slow in getting things done.  
	But they have not moved our date for, you know, making sure we meet our requirements.  And, so it’s put this group and all elected officials in this nation under a very delicate situation where we have legislators in our own states that’s mandating laws and so we’re balancing.  We have a law in place that we have to meet the standards.  We also have to meet the HAVA deadline, and we also have to have paper verification by state law.  That’s my concern.  And when we did the human factors, we looked at last November when we put out these two.  It’s -- it shall say “shall”.  Because at that time frame, it should say shall.  But my concern is, part of it should be -- should be should because I don’t think we can meet those time frames in certain aspects of this.  
	MALE:  I’d just like to make an observation.  I think it’s the same thing we’ve been facing all along is that we have this complexity of solutions and the fact that there’s nothing’s ever gonna be perfect.  You can have an intelligent printer that’s programmable and you can then provide all kinds of safeguards we’re talking about for processors and procedures and probably make the thing work.  And frankly, as you move forward in the future, if you had a programmable printer, then you probably have your dual verifiable approach because you can build a lot of that stuff in to the printer and you can have the actual records into the separate machines verifiable with everything you want.  You don’t have that today, but ultimately, I bet that’s the way it may evolve, so, I would say, yeah, keep the performance-based stuff talked about -- maybe we’ll have to talk about how, in testing, you have to do compensating controls.  We were talking about that at one point, you know, where if something’s programmable, has software, has memory, has spools, there’s different kinds of tests and procedures you have to do, just like they’re doing right now in the practice of the districts.  I think they need that kind of guidance, though, as to how to do it and best practices in that area.  
	MR. CHAIRMAN:  If I may add to this discussion, I had a little bit of a discussion with Miss Paquette (phonetic sp.), the Executive Director of the ACU (phonetic sp.) and I think there are different, I mean, in our deliberations, we are concerned about the phasing issues, you know, the transition issues and perhaps that’s not only our responsibility, but it’s the EAC and other state legislatures, you know, election officials, et cetera because these are, after all, voluntary standards and it’s up to EAC and it’s up to local election officials and legislatures to decide when they become mandatory for particular jurisdictions and they can, at that time, take into account how much of this can be accomplished within a given time frame, et cetera, so perhaps we’re trying to take on too much of the burden of the transition issues that, in fact, our responsibility is to set the standards for the features and the performance requirements that are needed and then let that -- let others decide when these can actually be implemented.  
	Dr. Schutzer?
	MALE:  No, but I was suggesting that you may not wanna specify a memoryless programmableless printer.  You may, in fact, want to allow that but provide sufficient guidance in how to test that, which gets involved all the things that the (indiscernible) group for the processors and the programs you’re gonna have to spec the source code, make sure it hasn’t changed or that kind of thing, but it can be done.
	MALE:  Mr. Chairman, I must respectfully disagree, in part, with your statement, and I think it’s important that we differentiate your role as Director of NIST from your role as Chairman of this committee.  I agree that NIST is tasked with providing technical expertise and developing standards, and NIST has no role in assisting either the EAC or states and local governments with the issues of transition.  However, the Technical Guidelines Development Committee as a body, is expected to give recommendations to the EAC, not only on standards based on our work with NIST, but I think that it extends to issues such as transition.  As been said many times, there are number of jurisdictions waiting for guidance to come out of this group as to how they’re going to comply with HAVA, how they’re going to spend their HAVA dollars, and I don’t think it’s inappropriate for this group to give the EAC a recommendation on how to best do that.
	MALE:  John -- I would take that a step further and say that it’s not only -- not inappropriate; it’s almost mandatory.  I can quantify that for you a little bit.  There are over 48 million people in this country today that -- that vote on punch card and lever voting machines.  They have been directed by HAVA that they’ve got to do something about that.  That’s 615 jurisdictions.  Those are the people that are looking to us for guidance.  Right now, not something that might be available 6 years from now, but they want to know of the technology that is available to us right now.  Are there any safe harbors?  Are there ways that we can go that would -- that will get us through whatever comes up next?  And I think that we’re remiss in our duties if we do not provide some guidance to those 615 jurisdictions that represent 45 million Americans, registered-voter Americans.
	MALE:  Mr. Chairman, that’s, I think, the essential component to this equation is how do we move those voting precincts forward as well as setting the standards in a visionary kind of fashion.  I think that’s the heart of our mission before next week.
	MR. CHAIRMAN:  Thank you.
	Miss Paquette, would you like to make a comment?
	FEMALE:  Thank you.
	MALE:  It’s on now.
	FEMALE:  [laughing] Okay.  Mr. Chairman and members of the TGDC, I would simply like to observe that the EAC is looking for advice and guidance from the TGDC.  We cannot make decisions about transition effective dates for the standards.  These issues that we’re all wrestling with, the EAC needs the advice of this body, we’ll certainly be looking for the advice from our board of advisors and our standards board, so we certainly welcome any input that the TGDC would like to make to this very important set of decisions that the EAC is going to have to deal with.  Thank you.   
	MR. CHAIRMAN:  Thank you, Miss Paquette.  
	Having heard those statements, shall we proceed with the remaining of this so that we can then come to some closure?  I think we need to complete the review and then we may have some additional discussion.  But obviously, the recommendation we make we’ll keep that -- those statements in mind.
	We were on 2.7.2.2?  What -- where are we on that, John?
	MALE:  We are on 2.7.2.2.  There’s been some debate about this.  I think where we left off is some debate about whether that should be a shall or a should.  
	FEMALE:  (indiscernible)
	MALE:  6.0.2.7.2.2, page 621.  I’ll just note that thermal printers do not use ink.  They -- they can run out of paper.  I’m not entirely positive if all thermal printers used by voting system vendors are capable of telling the voting station that they have run out of paper, although it can be done.  With other VVPAT systems that use standard off-the-shelf printers, those are certainly capable of telling the operating system that they’re low on ink or out of paper.
	MR. CHAIRMAN:  So is the issue strictly a matter of whether it should be a shall or a should?  Is there a proposal to?
	MALE:  (indiscernible)
	MR. CHAIRMAN:  Any objection?  Change that to should, then.	
	MALE:  Okay.  Okay.  Very good.
	MR. CHAIRMAN:  7.2.3?  
	MALE:  Expedite this, Mr. Chairman?
	MR. CHAIRMAN:  Could you put on your mikes, please?
	MALE:  Sorry, sir.  To expedite this area because the whole printer thing is kind of interrelated.  Should we not just follow the same accessibility approach and do this as a should with an indication for shall for (indiscernible)?  I mean, and then we put this one to rest.
	MR. CHAIRMAN:  Okay, so the proposal, then, is change to -- 7.2.2.2.3 and 2.4 is already a should. 
	FEMALE:  2.5.
	MR. CHAIRMAN:  2.5?
	MALE:  2.7.  
	MALE:  I have a problem with 2.5, 2.6, and 2.7.  Those are election management issues that have nothing to do with standards that voting system.  There’s no way that standards for the voting system can assure that there are supplies on hand at the polling place.  There’s no way that standards for the voting system can see to it that the temperature and humidity ranges are correct.  And there’s no way that standards for the voting system can see to it that there’s a sufficient number of backup printers.  These are -- these are election management issues.  People in the -- in the field have to decide how many -- how many -- how much redundancy they want, how many backups they want, and things like that.  There’s -- these are not issues that can be decided by standards.
	MR. CHAIRMAN:  Do we?  Let me -- let me -- do we have a motion, then, to strike out 2.5?
	MALE:  I make a motion that we delete 7.2.5, 7.2.6, and 7.2.7.
	MALE:  It’s --.
	MR. CHAIRMAN:  Lemme -- lemme ask about 2.7.  I don’t think it should be a shall, but you do -- I mean, if indeed some of the materials are stored in such high humidity, conditions, et cetera that you may actually modify the performance of the machine, I would propose that we should leave 2.7 as a should.
	MALE:  2.7.
	MR. CHAIRMAN:  2.7 -- 2.6.
	MALE:  2.6, I believe’s what you’re talking about.
	MR. CHAIRMAN:  2.6.  Printer consumables should be stored within the temperature/humidity ranges.
	MALE:  These are issues that come as recommendations from the manufacturer and -- and sometimes pass through the ITA and sometimes not.  But -- but again, as -- as -- in working with elections, on -- on these three issues, these are not things that you look to the standards for; these are election management issues that are under the control of the election --
	MR. CHAIRMAN:  Yeah.  I.
	MALE:  -- the local election management people.
	MALE:  Elsewhere -- elsewhere.
	FEMALE:  Elsewhere --
	MR. CHAIRMAN:  (indiscernible)
	FEMALE:  sorry.  Elsewhere, we’ve said the vendor shall provide documentation recommending blah, blah, blah.  Is this?
	MALE:  The -- the vendor has to specify the environment for his system and the ITA process should be evaluating both the documentation and the accuracy of that specification.  In addition, there are already requirements in the standard for both operating environment and storage environment which have to be met, so I think this can go away. 
	FEMALE:  So we can either make it go away or we can simply do what we’ve done in other cases which is because this is a special section is call out that printer consumables would be included in that specification.
	MALE:  Yeah.  I would -- I don’t have any problem with -- with changing this to say that the vendor shall provide a recommendation for these three things.  But there’s no way the standard’s gonna -- I mean, what is a sufficient number of replacement units?
	MR. CHAIRMAN:  No.  I’m not talking about that.  I -- I was only referring to 7.2.6 because, in fact, that could affect the performance.
	MALE:  There’s no way that the standard can make me buy a warehouse that has those attributes.  Now, what you can do in the standards is require that the vendor tell you what those attributes should be.
	MALE:  If I could interrupt, on 7.2.7, the discussion field says it may be best for the vendor to recommend that sufficient number, at least, one replacement printer should be available.
	MALE:  Okay, that’s not what the standard says.  That -- that’s the discussion.	
	FEMALE:  Once again, perhaps what we’re looking for in several of these cases is to ensure that the documentation from the vendor includes appropriate operating procedures as in 5.2.8, appropriate storage procedures, and their best recommendation based on their assessment of failure rates of how many replacement parts you need on hand.  It’s then up to voting officials to follow those recommendations for the systems they purchase.
	MALE:  And the idea is to force a vendor to document that to test it --
	FEMALE:  Right.
	MALE:  -- and then when I go to the market looking for a voting system in Florida, I know there’s a possibility that, you know, November and September and hurricane season, there’s a strong possibility equipment will have to work at 105 degrees and 95% humidity, and we’re not going to consider that can’t meet that requirement.  Other states may have a problem with low humidity in November.  But we want -- that operating temperature range stated, we want it validated, and we want it to be something to be relied on.
	FEMALE:  Exactly.
	MALE:  But it -- the requirement to keep the system within that range is as Dr. Williams said, a -- election administration issue, not a voting systems standard.
	MALE:  Well, then, Mr. Chairman, I would propose we use the discussion as the standard for that section, so take the 2.7 discussion and make that the standard, which is this prescripted language from the manufacturer.
	MALE:  I would suggest that in 7.2.7, there’s something that we need to provide and that is what is the target we’re gonna ask the vendor to provide a recommendation against.  I would think we want the number of replacement printers required to assure that any particular precinct has a 99.99% probability of having at least 80% of its polling stations available.  With that, the engineers can go back and say, okay, 80% availability of 99.99% confidence, how many replacements do I need?  And they can come back -- and I see a little table that every vendor provides that says if you have 2 polling stations, you need this number of replacement printers; if you have 5, it’s this number; if you have 10, it’s this number.
	MALE:  Even that is difficult because my way as election administrator dealing with that issue rather than buying any extra printers, I’ll buy, like 115% of the machines I actually need so that every precinct has enough machines that if one has to be taken off line, we’re not damaged.  So.
	MALE:  But you wanna make sure the reliability engineer who feeds you the information you’re making those decisions on is working on the same mindset that you are --
	MALE:  Right.
	MALE:  -- and I think that’s what we should provide here.  Is whatever that number is, all throughout 99.99% for the precinct and 80% on the polling places, or, you know, some such.  And then -- then we know what those numbers mean.  
	MALE:  Right.
	MALE:  Way -- way we may go otherwise, you’re gonna get too much variability -- vendor -- because they don’t know what you’re really asking.
	MALE:  I like Whitney’s suggestion (indiscernible) this be a documentation requirement for 6.2.6.  The sufficient number of replacement printers being available.  I’m cognizant of your earlier remark all about the fact that (indiscernible) be replacing entire systems rather than replacing printers, too.  And -- and probably issue of reliability and having enough available equipment really belongs at a higher level in this document.  This is within the (indiscernible) of the VVPAT section and the, you know, some point, you know, being able to service a given number of voters with 99% confidence, 99.99% confidence, 80% availability is an issue which I would like to see at a higher level in this document.
	FEMALE:  So are we moving to strike 7.2.7?
	MALE:  The question is to strike 5, 6, and 7.
	MALE:  And I second that.
	MR. CHAIRMAN:  Any other comments on the?
	MALE:  So what we’re talking about is striking these three with the understanding that we’ll draft a higher-level requirement regarding availability and (indiscernible)?
	FEMALE:  Does that include storage?  Does that include?
	MALE:  (indiscernible)
	FEMALE:  Yeah, so storage and availability?
	MALE:  Yeah.
	MALE:  If you looked at the -- the existing standard, some of the parts that we’re not looking at where we talk about the -- the environmental and (indiscernible) environmental requirements and the non-operating requirements, so forth, I think you’ll find some of those things are already there.  
	MALE:  Yeah.
	MALE:  Yeah.
	MR. CHAIRMAN:  Okay.  Then let’s do a quick show of hands.  Those in favor of deleting 7.2.5, 7.2.6, 7.2.7?  Anyone against?  Okay, so we’ve deleted those three.  John, you’ll develop a -- maybe you can work with Dr. Revest to draft a higher-level requirement?
	MALE:  Certainly shall.
	MALE:  Well, and John may also want to review the other sections and see if there’s not a requirement already there.  I mean, we do require vendors to specify the storage and use requirements for their systems and then we have a overall maximum specification for both operating and non-operating storage.  So there’s a good bit in the 2002 standards covering that already.
	FEMALE:  Mr. Chairman.
	MR. CHAIRMAN:  Yes.  Go ahead.
	FEMALE:  I would like to go on record that I would support that -- the last motion.
	MR. CHAIRMAN:  Thank you.
	MALE:  Okay.  So noted.  We’ll -- we’ll take a look at that again and see --
	MR. CHAIRMAN:  Okay.
	MALE:  If there are other requirements in the 2002.
	MR. CHAIRMAN:  7.2.8.
	MALE:  Okay.  Can we move on to 7.2.8, 7.2.9?
[End of Audiotape 6, Side A]
	MALE:  There.  7.3, and then turning to the last page, 623, 6.0.2.7.4 and its leaf requirements.  
	MR. CHAIRMAN:  Mr. Craft, are -- are you comfortable with this language auditing?
	MALE:  I am not.  [laughter]  I think there should be --
	MR. CHAIRMAN:  Manual verification?
	MALE:  -- verification.  Verification.
	MR. CHAIRMAN:  Is that better?
	MALE:  Actually, it’s verification, reconciliation, and recounts, I would think would be quite appropriate.
	MR. CHAIRMAN:  Verification, reconciliation --
	MALE:  And recounts.
	MR. CHAIRMAN:  -- and recounts.  So we take out “manual” and “machine”?
	MALE:  I think so.
	MR. CHAIRMAN:  Let me journalize it.
	MALE:  For verification, for reconciliation --
	MR. CHAIRMAN:  To be used for verification, reconciliation, and recounts.
	MALE:  -- and recounts.
	MR. CHAIRMAN:  Yeah, it already -- “manually” and “machine” is already repeated again.
	MALE:  Okay.
	MALE:  6.0.2.7.4.1 is already covered elsewhere in the standards.  
	MALE:  There is a -- there is an item related to that, though, that I’d raise a concern about.  I’m not sure this is sufficient for all our concerns, specifically that the paper record may be able to withstand 22 months at normal temperature and humidity.  I think also that we want some short-duration overstress, so we don’t want a bunch of paper ballots in a trunk of a car in a hot climate to be unreadable at the end of the journey.  So, I don’t think that test -- excuse me -- currently exists in the other sections.  I think we need something like that.
	MALE:  Well, the 1990 standards, and I think perhaps 2002 standards actually referenced standards for punch cards which actually went into the tex -- Textile and Paper Producers’ Association standards for punch cards.  And I suspect there probably exist a similar standard for paper documents are expected to survive in somewhat hostile environments over long period of time that could be adapted.  
	MALE:  I know there are standard thermal overstress requirements -- excuse me -- and I just think we need to make sure that the paper -- type of paper and ink conform to those.  
	MR. CHAIRMAN:  Okay so we will come up with a recommended addition to that and that will be part of the approval process after the meeting?  Is that acceptable?
	MALE:  Yeah.
	MALE:  If there’s an existing standard, we can state -- we need to find it.
	MR. CHAIRMAN:  Yes.
	MALE:  Another way we could do it is --.
	MR. CHAIRMAN:  What -- which standard were (indiscernible)?
	MALE:  I’ll -- I’ll suggest the IEC, my memory is 721 series.  That series provides recommended ranges for both use, storage, and transportation.  And then it points to test standards in the IEC 68 series for specific tests.  So from the 721 series, it may be 731.  We can get recommended ranges of temperature overstress expected in transport and storage, and then the IEC 68 series will give test to those requirements.
	MALE:  Okay.
	MR. CHAIRMAN:  Are we okay with 742?  Okay.
	MALE:  Okay.  Thank you.  You’ve given me some work to do over lunch.  One last.
	MR. CHAIRMAN:  Yeah.  Let -- let’s see.  We’re not quite ready to break for lunch yet.  
	So we have basically gone through the section -- the pages 613 to the end.  I have particular changes that we agreed to, so those will be made based on our agreed procedure.  These are changes to items 6.2.1, 6.2.1 -- both the standard and the discussion, 6.5.1, 7.1.1, 7.1.2, 7.2.2 -- that became a should -- 7.2.5.6.7. have been deleted.  We will come up with a higher-level language.  That’s pending.  And 7.4 has been modified.  7.4.1 we will come up with an additional language based on IEC 721 to 731 series.  So these are the changes we’ve agreed to that will be made and sent to you for quick approval.  
	Yes, Secretary Davidson.
	FEMALE:  Two issues.  I wonder if we shouldn’t make some of the shalls that we had agreed to prior shoulds after our break that we were able to talk to some of the -- the vendors.  And then the other thing is I’d like to refer back to page 6-17 of the handout, line 32, 6.0.2.6.9.4.  I guess we went over this one pretty fast, but a scanner for reading and displaying the bar code shall be made available to a voter at the request, so you also want a scanner at each and every polling place besides the paper verification?
	MALE:  Now, this -- this specific item here is -- if the paper record contains a barcode, then the voter may wonder, you know, what’s in that barcode?  And we’ve recommended that the barcode be a publicly-documented barcode, like, you know the ones used by Fed Ex or -- or the major shippers and that an off-the-shelf scanner be made available to satisfy a voter in that particular case that they -- that there is nothing in that barcode other than what should be available to them on the human readable part of the paper.
	MALE:  Yesterday, we were going to include in that barcode a serial number for the ballot with the assumption that voters couldn’t read the barcode so there’d be no danger of them remembering what the serial number was and taking it out of the polling place with them.  How does that reconcile?
	MALE:  The -- the actual language for the unique identifier was to be made not memorable so it could be included in there.  It would just not have to be readily memorable to the voter.  I think it was -- actually, we modified it to make it easily memorable by the voter.
	FEMALE:  Is this a scanner at every station?
	MALE:  No, we didn’t specify that it should be at every station.	
	FEMALE:  But if you can’t take the paper away, how do you transport the paper to read it?
	[laughter]
	MR. CHAIRMAN:  Do I have a proposal -- motion to delete this?
	FEMALE:  (indiscernible)
	MALE:  Well --.
	MR. CHAIRMAN:  Any opposed?
	MALE:  Just to make clear what the point is here -- the concern is obviously that the voter may be concerned that there may be personal information of some sort in the barcode in trying to get some ability for the voter to get some assurance that there’s nothing identifying him in the barcoded information.
	MALE:  And we were going to do that by giving him a scanner that will only read part of the information there.  [laughter]
	MALE:  Can read all of it (indiscernible).
	MALE:  Well, if he can read all of it, then he can memorize the serial number.
	FEMALE:  When we have people who are concerned with issues like that, we -- we ask them -- and they’re always very willing to come down to our office or to actually see what is in the barcode and that way it’s not their own ballot, but they can, you know, actually see, even sometimes when you have numbers that are -- they want to know what those numbers relate to.  And we talk them through that and show them and they’re -- they’re very pleased with the testing and -- and we handle it that way.  But the expense of having a scanner or -- and giving out possible information we shouldn’t, worries me at a precinct.  That’s extra cost that would be very costly.
	MALE:  I think your (indiscernible) -- satisfactory of the voters is a better approach, yes.
	MALE:  Can we call the question?
	MR. CHAIRMAN:  All those in favor of deleting this item?
	PARTICIPANTS:  Aye!
	MR. CHAIRMAN:  Those opposed?  Okay.  Item 6.0.2.6.8.4 deleted.
	MALE:  Okay.  Got that.
	MR. CHAIRMAN:  Okay, so we worked the part of this document, the front end, pages 2 through 12, reflect the changes made yesterday.  The changes suggested yesterday.  Do we need -- my recomm -- my recollection is they were fairly straightforward editorial changes.  Do we need any further discussion on this?
	FEMALE:  You know, I need -- I need to rely on everybody else’s.  Are there any shalls that should be made shoulds?  That’s the only thing I’m concerned about; that’s the only thing.
	MALE:  In the process we went through, Secretary Davidson, I’m not sure if, in fact, we converted enough shalls to shoulds.  I think after lunch, we probably -- or whenever the document comes back to us, we probably should do a final pass and look for any shalls that, in fact, restrict design and either delete them, which would be preferable, or at least convert ‘em to shoulds.
	MALE:  During the break, one of the NIST staff suggested that perhaps the 6.0.2.6.4 on page 614 on digital signatures could be made a should for more parity with parts of the standard where we don’t yet require those.  There’s a certain direction we want to go in, but.	
	FEMALE:  I mean, I understand that John’s going to have to do it -- what we did yesterday with him and human factors, just go through and do a quick edit pass and maybe if you would look at those things carefully as you do it and then come back to us and point out anything that you picked up in the spirit of the communic -- of the conversation we’ve had.
	MALE:  I can just say one last thing besides thank you for -- for all the comments and getting through this [laughter], is that it is okay in the area of security to restrict design.  It -- it -- and I think in the VVPAT standard, it’s -- it’s a bit of a different beast here.  I would like as much as possible for all of the requirements to be purely performance driven, but I think in the areas of usability, accessibility, reliability, and security, there are times when design has to be restricted, such as how to do encryption a particular way.  
	MR. CHAIRMAN:  Let me -- let me suggest this.  Now that we’ve made all the changes in this session and you have the document in front of you, you can go back and compare to your notes from yesterday to assure yourself that all the suggested changes were made appropriately and then we can bring this up for a vote after lunch.  Is that acceptable?
	MALE:  Uh-huh.  (affirmative)
	MR. CHAIRMAN:  Okay.  Thank you, John.  Then I propose that we proceed and at this time, I call on Mr. David Seifer (phonetic sp.) of the NIST Information Technology Laboratory to present the NIST report, Wireless Requirements for VVSG Version 1.  David.
	MALE:  Thank you.
	MR. CHAIRMAN:  And this presentation was part of your handouts from yesterday.
	MALE:  So, new subject to discuss.  Wireless.  Soon as we get my display up.
	This is to resolve -- or, to address, Resolution 3505 which basically said, NIST cannot say wireless can’t be used.  So that’s the premise under which I’ve now tried to make the requirements for securing wireless.  Doesn’t mean that I’m happy with the solution, but that’s the way it was proposed to me from the group.  So, none of my recommendations say wireless can’t be used, but I do try to control its usage.
	MALE:  (indiscernible)
	MALE:  Okay.  We’re having technical difficulties, so.  I’ll try to talk.  
	I’m on slide 2 under goals, so if you’re following through the slide presentation.  So I’m trying to reach an understanding of what wireless communication is by providing background.  That was the background provided at the March 9th, and based on that, I’m identifying where the technical requirements for use of wireless communication devices including systems.
	I’m now on slide 3 for progress.  I created a draft which is what is in your document today.  It has been refined from the March meeting based on the input from this group saying I’m only to look at what’s currently used for wireless technology, not everything, which is what I brought in with the original request that is just wide open wireless usage.
	You will find that most of these requirements are simply re-emphasizing the requirements that already exist in 2.0.2 that need to be applied in wireless systems that are currently not applied simply because they’re not called out as wireless.  You’re thinking, “Oh, wireless isn’t mentioned so I don’t have to do these things.”  You do have to do these things.  These are -- this is a voting system.  Wireless is a component of that system.  If you compromise the system by adding wireless, you didn’t follow the current VSS 2.0.2.  Keep that in mind.
	The 4th slide which was existing locations, shows four places that wireless is currently used.  That being from the election management system to the DRE, the DRE to a precinct count, precinct count to central count.  Thank you.
	So those are the four areas that I’ve had the opportunities to talk with vendors and review their usage in those locations.  
	Okay.  Now.  So three general areas of the layout of the section we’re dealing with on wireless.  I want everybody to know that we are to apply the telecommunications section, which already calls out some wireless points of view.  The second point is the information that’s transmitted is of critical importance.  It’s also important to know when it is transmitted, how it is transmitted, but the bottom line is the thing that most people curr -- in current technology fail to recognize.  The system itself is now vulnerable because it has another additional path.  But those requirements already exist in 2.0.2.  	Okay.  I don’t know whether I should continue with the slides now or go directly into the document.  So.  One suggestion was go directly into the document, so on page 650 is the first recommendation.  I will leave the slide that says “Requirement Overview” up so that you understand where we’re at in the view of things.  So we’re on the first item.  Applying telecommunications.
	So my first recomm -- requirement is that at a minimum, you must, or you shall follow the requirements in telecommunications section 5.
	MALE:  I have a comment about that.  In your -- in your narrative leading in (indiscernible) lines 27-32, those are an opinion and should be stricken -- opinions don’t have any place in standards.
	MALE:  This is not an opinion.  You cannot secure a wireless device by physical means if the wireless is going to a base station.  It is physically impossible for me to secure that.  So it is not an opinion.  It is fact.  
	MALE:  Let me ask a little earlier than that, you take a very broad description of wireless including, I assume, audible sound and visible light.  Tell me what -- what the reason for that selection was.
	MALE:  The definition of wireless does no -- does not exist in 2.0.2, nor does the definition exist in the Resolution 35.  I made this point at the March meeting.  DDC (phonetic sp.) did not disagree with that definition at that time.  So that was the definition I proceeded upon.  At that time, I made it known the difficulty in trying to prescribe or describe a wireless system when you’re looking at specific technologies rather than as a categoric -- as a way of categorizing something.  Wireless means no wires and you’re communicating information.  That’s in the simplest form.  That’s the definition I had at March, didn’t have any disagreement with it, that’s the tack I took.
	MALE:  Well, in spirit of keeping to the prior resolutions passed by this board and the discussions that we had, I suggest that on page 650, lines 27-31, that that paragraph be replaced with the prior resolve language regarding the risk of wireless, which I believe -- if memory serves me well -- wireless communications introduce extreme risk and should be approached with caution.  The last sentence almost brought the text of that resolution in, but I -- I think that -- that would solve Dr. Williams’ problem with that.  
	MALE:  It’s my understanding we have two issues going around.  You just jumped to another issue.
	MR. CHAIRMAN:  Yeah.
	MALE:  I just came back to one that we skipped.
	MR. CHAIRMAN:  Skipped.
	FEMALE:  The -- the language from the resolution 3505 is: “The TGDC has considered the advisability of using wireless technology within voting systems from securities perspective.  It is concluded that for now, the use of wireless technology introduces severe risk and should be approached with extreme caution.”
	MALE:  ‘Kay.  I’d like to move that lines 27-31 be replaced with that -- with that sentence and I don’t need another lecture.
	MALE:  That’s a good suggestion.  (indiscernible)
	MALE:  Yeah.
	MR. CHAIRMAN:  So the -- if I interpret it right, what we’re talking about, deleting lines 27-30 --
	MALE:  31.
	MR. CHAIRMAN:  -- no, 30 and leaving the sentence that says, “The use of wireless technology introduces risk and should be approached with extreme caution”?
	MALE:  No, sir.  That doesn’t match the language of the resolution.  I believe, Whitney, you read “extreme risk”?
	MR. CHAIRMAN:  Yes.  “With extreme caution.”
	MALE:  If we just quote the entire resolution, it’d just replace that sentence as part --	
	MALE:  Yeah.
	MALE:  -- so.
	MALE:  Okay.
	MALE:  Yeah.
	MR. CHAIRMAN:  Was that 35?  What resolution?
	MALE:  3505.
	MR. CHAIRMAN:  3505.  Okay, (indiscernible).
	MALE:  Okay.
	So that addressed the first issue brought up.  Is the second issue addressed or not now?
	MALE:  I’d like to move that we take some language out that I’ve got some difficulty with on a couple of points.  Starting in line 8 at the end where the sentence starts this going down to sentence, or, line 14, the sentence ending in “only unidirectional”.  My concern there is I think we’re getting too wide in some interpretations that display which by visible light showing the voter the ballot would come under as being wireless.
	MALE:  That is correct.  It is correct and it is covered under usability.  You’re trying to protect the privacy of the user so you can’t see.  You’re trying to prevent that communication.  
	MALE:  I think in this section, we want a more restricted definition so we can focus in on a specific set of concerns.  
	MALE:  (indiscernible)
	MALE:  So, anyway, I suggest removing those and then down in line 21, the sentence starting “also, the generation of some of these wireless signals” ending in line 23.  I -- I just suggest we drop those sentences.
	MALE:  (indiscernible)
	MALE:  I’ll make that a motion.
	MR. CHAIRMAN:  Okay, could you -- I caught the ones about lines 21 through 23.  What was the other change?
	MALE:  Okay.  There’s two deletions I’m -- this motion’s recommending.  The first starts in line 8 at the word “This” right at the end and goes through line 14 to the words “only directional” at the beginning of that line.  The second deletion starts in line 21 at “Also, the generation of some” goes through 23, the first three words “voting system accuracy”.
	MALE:  This is a comment, if I may, on the proposal.  The second one, I have no problem deleting the second one.  The first one, the requirements written here do take cognizant distinction between some of these wi -- political wireless uses that are presented to the user versus those that are device to device.  So there’ll be additional changes.  Of course, if you wanna try to narrow down the resolution.  (indiscernible) of these resolutions.
	MALE:  Part of this may be an organization of the document issue, you know, some of those concerns, I think, better are in other sections.  When we say wireless, I think we’re mostly thinking about RF intentional transmission and -- and there’s certainly a set of issues we want to be careful and handle.
	MALE:  This is admittedly a broader definition than the more traditional one that you’re suggesting, in fact, and I think it might be useful to -- to segregate those.
	FEMALE:  I’m sorry.  This is all a little over my head technically, but [laughing] -- but I -- I understand and I -- well, I think I understand your point that there is a lot more to wireless than what we think of as wireless.  But it might be useful to sort of say that and then say nonetheless, this section is specifically discussing, so that we haven’t thrown out the broader point, but are helping people focus in on what aspects of wireless we’re really discussing here in this section.
	MALE:  Well, I think the issue is, if I understand, everything that generates electricity generates wireless, including the wires that transmit the electricity and the communications from the boxes.  But generally, the way that’s handled is in sections that talk about trying to maintain low levels of that kind of electromagnetic radiation, it’s probably in the specifications already.  
	MALE:  It is.
	MALE:  Right.  Where this is talking about intentional communications, replacing the wires with much stronger signals.  
	FEMALE:  I mean, I realize that much of these sections are aimed at a technical audience, but -- but some of us also have to read them and -- and -- so I think something that says, “Look, it’s broad.  We’ve covered this here, this is what we’re covering here.  Look here for other things” would really go a long way.
	MALE:  But what we’re actually trying to address here is the use of wireless interfaces between components of a voting system.  Period.  We’re not concerned if the telephone call outside goes to a satellite or not.  And we’re not concerned -- within this, I don’t think we’re actually concerned with leakage of signals outside.  That -- that’s a security (indiscernible).
	MALE:  (indiscernible) what should be, I mean (indiscernible).
	MALE:  (indiscernible) this is going to speak to what communications between pieces of the system should be expected to do.
	MALE:  (indiscernible) should not be expected to do as well.  I think that, you know, unexpected use of their radio transmitter in a device is a security concern that needs to be addressed here today.
	MALE:  Yeah.
	FEMALE:  Yeah.
	MALE:  And I think that’s -- we want to focus in on those intentional radio transmitters that somebody may build into a system and make sure that they’re adequately secure.
	FEMALE:  Okay.
	MALE:  I would like to bring everybody’s attention to the -- section 5, telecommunication, which is part of the problem that needs to be solved before we can address it in my section.  Page 5.2.  Talks about types of components where the term wireless is used as one of the bullet items.  Microwave is defined.  And a very small aperture terminal is also defined are as technologies.
	MR. CHAIRMAN:  David, (indiscernible) page?
	MALE:  Page 5-2 in VSS.
	MR. CHAIRMAN:  Yes.  And which paragraph are you referring to?
	MALE:  5-1.1.
	MR. CHAIRMAN:  Okay.
	MALE:  Talks about types of components.  There is a dial-up communication technology as the first diamond bulleted and then the next bullet items start the standard landline.  Starts “Wireless, what does this mean?”  It needs to be defined here, not in my section.  Microwave, which according to my definition, it is still wireless.  Small (indiscernible) terminal isn’t a wireless technology, or isn’t wi -- it’s a device, not a technology, so it’s still using wireless means.  So I think the change needs to occur here first in order for me to address mine, otherwise I have a problem.  And continuing that, going down on the next page, top -- talks about cabling technologies.  It has wireless connections and then in parentheses, radio frequencies and infrared.  So there is said, okay, I want to limit wireless technology to RF and infrared, which is completely separate from the wireless talked about in 5.1.1.  This is the confusion that already exists, so I ask that.
	MALE:  So since section 5 comes first, wouldn’t that be the place to make some kind of explanatory statement about how all these things fit in, what you’d be addressing in this section, what’s being addressed there, and so forth?
	MALE:  Well, I wasn’t given access to change anything in 5 because that was telecommunications, not wireless.  But I had to live and try to exist with it which is why I did what I did.  And since I did what I did isn’t being accepted, I’m now going to say that the VS 2.0.2. has to be changed other places, not just mine.
	MALE:  I think we could make a definition of this section, something of the line Steve was saying for the purposes of this section, wireless should mean “intentional transmission or reception of radio frequency signals” think would probably be.
	MALE:  And I think David raises a good point.  That the definition in section 5 may deserve some reworking.  Probably something along the line of transmission of data through an unsecured network.  And -- and there’s better language than that that we can find, but I think that’s what we’re talking about.  And in wireless, we’re talking about intentional transmission of data in an unsecured conduit, you know, over the air.
	MR. CHAIRMAN:  At this stage, it’s probably too late to go back and work on section 5.
	MALE:  Yeah.
	MR. CHAIRMAN:  I would suggest, to go along with what was suggested, maybe changes, language that says this normally, you know, the line that you suggested to delete, maybe we can modify it and say this normally covers the entire electromagnetic spectrum.
	MALE:  Yes.
	MR. CHAIRMAN:  And is not -- and I think we can take that and the rest of it out.  And then put a statement that says, “For the purpose of this section, we are referring to the use of -- the use of wireless technologies to weigh communications between systems” or something like that?  Is that?
	MALE:  I would restrict it to 2.1.
	MR. CHAIRMAN:  (indiscernible)
	MALE:  I question, too, because I think in some applications that we saw in the chart, you would want to have it only capable of one-way transmission.
	MALE:  Yeah, I think right now, we’re dealing with RF, we’re dealing with infrared, and we’re dealing with magnetic when you start looking at some of the currents that could be swiped in the different devices.
	MALE:  Yeah.  Okay.  Wording to that effect would be fine with me.
	MR. CHAIRMAN:  Have you captured?  Has anybody captured?
	FEMALE:  (indiscernible) along the lines of, “this normally covers the electromagnetic spectrum” for this section we are referring to RF, IR, and what was your third call?  
	MALE:  Magnetic.
	FEMALE:  Magnetic?
	MALE:  That is not correct because they’re all magnetic.  So you need a specific range of that magnetic frequency which your magnetic reader is reading.  That’s.
	MALE:  (indiscernible)
	FEMALE:  (indiscernible)
	MR. CHAIRMAN:  How ‘bout “this normally covers the entire electromagnetic spectrum”.  In parentheses, including radio frequency, infrared, and microwave.  Or maybe not in parentheses.  It just finishes that sentence.  And then it says, “For the purpose of this section, wireless refers to” -- “For the purpose of this section, we are referring to systems -- wireless systems used for communication”.
	MALE:  Between components of the voting system.
	MR. CHAIRMAN:  Communications between the components of the voting systems.
	MALE:  And -- and RF, infrared, and.
	MR. CHAIRMAN:  Well, that we already mentioned.
	MALE:  (indiscernible) spectrum would be fine.
	MALE:  Okay.
	MR. CHAIRMAN:  Is that?  Mr. Berger, is that going to be?  Okay.  So we’re -- we’re trying to basically narrow it down to definition and define it.  Clearly, we recognize that there is an inconsistency with the previous section, so we want to set the record straight for the purpose of this section.
	MALE:  Okay.
	MR. CHAIRMAN:  Okay?
	MALE:  So, the definition as agreed to, but you haven’t reviewed it yet, is adopted.  The point is there’s no guidance given if you use a wireless system that doesn’t use these technologies.  Correct?  That’s my understanding of your current definition.
	MR. CHAIRMAN:  Right.
	MALE:  So somebody comes along with a new wireless technology, the document doesn’t apply.
	MALE:  And we’re going to have to come up with a standard to address it at that time.
	MALE:  Well, I think that’s standard procedure for your certified engineers to know how to take the requirements as they are and adapt them to new technologies or seek guidance if they’re not able to do that.
	MALE:  And the process, when they hit that, they come back to the AC with deals with whatever technical committee is running and figures out how to deal with that issue until the next version of standards can come out.
	MR. CHAIRMAN:  What -- what technology are we talking about that’s not covered here?
	MALE:  I think --.
	MALE:  We’re talking about the entire electromagnetic spectrum.  [laughter]
	MALE:  So you could have -- you could have sound waves, use audio waves to communicate from one device to another.  So any kind of technology that’s broadcast where an eavesdropper could listen in or a (indiscernible) signals have some of the same security concerns.  I have no problems with the revised language as we have it here, though, to talk about the electromagnetic spectrum which has the greatest range.
	MR. CHAIRMAN:  Okay.  I think we have noted the.  Okay.  We will make that change.  Let’s proceed.
	MALE:  Okay.  For the first requirement, can I now have as a minimum for wireless communications to implement the telecommunications section?  
	Okay.  Onto the information section about controlling usage, on page 6-51.  First requirement is on documentation.  Major concern since wireless is being used is you gotta document it’s being used.  You have to know what you have, how to use it, and this is what this requirement is addressing.  And the sub bullet items to support it.
	Now, 6-52, 6.0.3-2.2.  If the voting system includes wireless capabilities, then the voting system shall be able to accomplish the same function if the wireless capabilities are not available due to an error or no service.  This is a requirement simply from the fact you cannot control the air interface around you.
	MALE:  Okay, now that is a problem for at least one of the current voting systems which relies on a infrared data stream to activate a voting terminal and, very frankly, if that infrared device can no longer communicate, then that particular machine will not work.  So it’s never going to function if wireless infrared is not available to it.
	MALE:  So the system has a single point of failure which is a violation of 2.0.2.
	MALE:  Actually, a single point of failure, but you have multiple devices in precincts.  This is basically the ES&S PEB device.  On the Ivotronic (phonetic sp.), you have numerous Ivotronics and you have numerous PEBs, so I don’t think it’s a single point of failure within the system, but yes, without -- without the infrared communication from a PEB, you cannot activate an Ivotronic.
	MR. CHAIRMAN:  Are we okay if we make this a should?
	MALE:  Yeah.
	MALE:  Paul, could I ask a little more information on that system?
	MALE:  Yeah.  Understand that the receiving device is a -- a station. 
	MALE:  What’s the transmitting device?
	MALE:  I’m not sure if it’s two-way or one-way, but at least part of the initiation of the transmission comes from a PEB device and there’s an infrared window --.
	MALE:  What is a PEB device?
	MALE:  That’s called a Personal Electronic Ballot.  It’s the activation device for the Ivotronic.
	MALE:  What I’m asking is, if the infrared were interrupted in some way, is that something that’s very feasible to bring it up very close, virtually giving it a close channel for the transmission?
	MALE:  It is -- it is, for all practical effect, a closed channel.  Yeah, it’s window-to-window.
	FEMALE:  So, Paul (indiscernible) -- ‘cause it sounds to me like the problem here might not be that infrared was interrupted, but that the devices failed.
	MALE:  Right.
	FEMALE:  So, in fact, it’s not -- the -- the fail -- the fact that the infrared failed to activate the device would actually be an indication of a greater failure of some kind.
	MALE:  Correct.
	MALE:  Well, it seems to me there’s a conceptual thing here that David’s putting in that in -- in the use of wireless in general, he’s right, the electromagnetic spectrum in a particular location may be hostile and -- and we don’t want that to affect the whole precinct.  I think you’re talking about something that, conceptually, is a closed channel, you know, and --
	MALE:  We could take that position.
	MALE:  -- it would be hard to see how that could be interfered with since obviously you can’t flood the thing with light.  It’s in a closed channel.  Can we maybe craft some language?
	MALE:  (indiscernible) this concern.  But he said wireless in general so it’s applicable.
	MALE:  Right, and I agree if you’re dealing with, you know, wireless communication or RF across the room, then the devices need to have an alternative for communication.  But there are going to be instances, I think, in system design where the system will be dependent on a wireless communication and as in the design, the Ivotronic, the system design needs to be such that that wireless communication is very well protected and can be very reliable.  
	MALE:  Well-protected not only from -- from, you know, extra -- you know, environmental random noise that may be present but also malicious --
	MALE:  Yeah.
	MALE:  -- channels.
	MALE:  Well, I guess I suggest either making this a should or putting in some language that says if the communication can be put in a control channel where there isn’t a concern about environmental -- hostile environment -- uh-huh (affirmative) -- then it doesn’t apply.
	MALE:  Yeah, okay.
	MALE:  One vote for the should.
	MALE:  I would like to -- the question -- I know Ron in our committee, we talked at great length about the single point of failure of that and -- and just before we discard that, I would like to clearly understand what we’re -- what we’re allowing if we drop away from the shall on this -- on this particular item.
	MALE:  I think this is a question along the lines of the human factors committee where we’ve got a should intended to move to a shall here.  I think letting the vendors digest this a bit, give us some feedback, move towards this, you know, this is more, in my mind, one of these transitional issues rather than view of alternate positioning.
	MALE:  But let me just say (indiscernible) discussion.  I think -- I think if we’re talking about components failing, then I think it’s a larger issue that should be addressed in the whole voting system, the memory, the printer, the processor, et cetera, and the way to accomplish something fails could be that extra systems.  The only thing I think that’s unique in the wireless case is that somebody were to walk around with some kind of a noisemaker and try to jam the communications, in which case, frankly, there’s other ways to overcome that in an environment like a voting precinct, like being able to locate that and go after that person [laughing] and shoo ‘em away as opposed to necessarily having to have an alternate means of communications.
	MALE:  How ‘bout this?  Sorry.
	FEMALE:  Sorry.  We might wanna look at the next section in this discussion.  Does that address the single point of failure?
	MR. CHAIRMAN:  323.
	MALE:  Well, we’ve gone past something that I wanted to comment on.  Page 652, 6.0.3.2.1.4.1.  The review should be done by the ITA.  
	FEMALE:  (indiscernible)
	MALE:  Ma’am?
	MR. CHAIRMAN:  The responsible entity, it says, testing.  
	MALE:  Testing authority.
	MR. CHAIRMAN:  Maybe it should say testing authority.
	MALE:  No, that’s a comment under the requirement.  The requirement is that the --.
	MALE:  You’re correct, Brett.  But I think this language -- I don’t think I’ve seen the details of that before, but I -- line 13 and 14.  The concern was that when you’re talking about cryptographic protocols and so on, the ITAs may not have the expertise required to do that.  And so this is calling out for admittedly somewhat unusual process to have cryptographic protocols or whatever the techniques made available there.  Maybe there’s another way to address that.  Maybe the ITAs (indiscernible).
	MALE:  Well, I think that this is addressed by the NAVLAB (phonetic sp.) program.  It’s up to the NAVLAB program to specify how this gets done.  You know, we’re introducing a constraint on the NAVLAB program saying, okay, when you start certifying laboratories to do these reviews, you’ve not only got have ITAs, but you gotta go find people to do this, too.  So I think that this is best left to the discretion of the -- of implementing the standards rather than trying to state them in the standards.
	MALE:  Is it your expectation that the NAV -- that the certified laboratories would be required to staff up on the cryptographic well enough to evaluate these?  Is that the requirement we should be putting on them?
	MALE:  NAVLAB certifies to IC 17025 --
	MALE:  Right.
	MALE:  -- which one of the core requirements is that the personnel be examined as to being appropriately expert in the fields in which they’re being certified.
	MALE:  So the requirement right above this is that this is to be closely reviewed for accuracy, completeness, and correctness.  Now, we don’t need go beyond that because NAVLAB will look at that and decide how, which, obviously, will be to refer it to one of these labs.
	MALE:  I think as long as there’s an adequate procedure --
	MALE:  Yeah.
	MALE:  -- to do that, it doesn’t matter how it’s done, but we make sure that the process is such that.
	MALE:  Well, you know, you have to -- you have to have confi --.
[END OF AUDIOTAPE 6]
		*		*		*		*		*
                        
	CERTIFICATE OF AGENCY

	I, Carol J. Schwartz, President of Carol J. Thomas Stenotype Reporting Services, Inc., do hereby certify we were authorized to transcribe the submitted cassette tape, and that thereafter these proceedings were transcribed under our supervision, and I further certify that the forgoing transcription contains a full, true and correct transcription of the cassette furnished, to the best of our ability.

					_____________________________
						  CAROL J. SCHWARTZ
							 PRESIDENT

 

(START OF AUDIOTAPE 7, SIDE A)
	MALE:  -- And trying to make sure you got the best people looking at it and to inspire some confidence in a review process where it's admittedly a high risk area.  
	MALE:  (indiscernible) 
	MALE:  It says that.  
	MALE:  Or by a subject area recognized.  I'm not sure there's any problem with the language as it's stated. 
	MALE:  So can I move on or --
	MALE:  Yeah, I think the only thing we did was add the word authority after testing.  
	MALE:  Okay.  
	MALE:  So we were actually on the --
	MALE:  We're still discussing. 
	MALE:  -- next page. 
	MALE:  Yeah. 
	MALE:  3. -- 2.3 
	MALE:  This is the single point of failure, and I have the -- under the discussion exactly where I pulled it out from, which is again under the telecommunications section.  We don't wire wireless to be your point of failure because you really don't have full control over it.  
	MALE:  (indiscernible)  
	MR. CHAIRMAN:  Microphone, please.  
	MALE:  Section 241 is election management issue.  I recommend that that be deleted.  
	MALE:  241.
	MALE:  603.
	MR. CHAIRMAN:  We're talking about 3.2.4.  
	MALE:  That's where I am. 
	MR. CHAIRMAN:  Yeah, are we okay with 3.2.3?  
	FEMALE:  Yes.
	MALE:  Yes. 
	MALE:  Yes.
	MALE:  Okay, 3.2.4.  Dr. Williams has (indiscernible).
	MALE:  3.2.4 is fine.  3.2.4.1 should be deleted.  That's election management.  We're telling the election management people they should do their job.  
	MALE:  I think the question is whether the -- in part, whether the software turns on the wireless or whether it's turned on by some confirmation of the (indiscernible).  Maybe that's captured in the --
	MALE:  Well it is in the --
	FEMALE:  (indiscernible) 
	MALE:  I think it's captured in 3.2.5 already.  We have 3.2.5  
	FEMALE:  Yeah.  
 	MR. CHAIRMAN:  So do we have a motion to -- suggestion to delete 2.4.1?
	MALE:  Second.
	MR. CHAIRMAN:  All those in favor?  
	PARTICIPANTS:  Aye. 
	MR. CHAIRMAN:  Any opposed?  Okay, we delete 2.4.1 -- 3.2.4.1.  
	MALE:  Onto the next requirement, 3.2.5.  This requirement is -- you don't want the wireless communication on without knowing it's on.  And if it's on, you want to confirm that it's on.  You want -- voting official to actively know to put it on or take it off? 
	MR. CHAIRMAN:  Okay with that?
	MALE:  Okay.  
	MALE:  Well that poses a problem again for systems such as the ES&S, where in fact some of the voting officials turning the thing on and off aren't going to know that it's a wireless or infrared and basically it's designed to it only turns itself on when it's appropriate, when it's ready to communicate it's in place.  So, I think I could go without activation or appropriate activation from the user or something like that. 
	MALE:  In that case, the act of the voting official inserting that device into that slot is confirmation from the (indiscernible).  
	MALE:  The thing (indiscernible) has a confirmation, and -- 
	MR. CHAIRMAN:  Conformation can be interpreted broadly. 
	MALE:  Okay.  
	MR. CHAIRMAN:  Yeah.  Next?
	MALE:  Okay, next section I specifically called out for radiofrequencies under the wireless technology because these different electromagnetic spectrum ranges have different characteristics and this is also one of the technologies that are being used by a current system.  For ray of frequencies, you can't guard against it, so you have to be prepared for unintended interference.  
	Next one for reducing potential interference and then the radio emissions site wise test.  And that completes the section on controlling wireless usage. 
	MALE:  Okay.  Let me make a motion that we delete 3.2.6.  I want to ask a question or two first.  
	MR. CHAIRMAN:  All --
	MALE:  In its entirety.  Let me ask first in 3.2.6.1 it sounds like you're saying wireless has to use dedicated frequencies.  Am I reading that accurately?  
	MALE:  No. 
	MALE:  Okay.  
	MALE:  The reason this is in place is I'm not allowed to constrain any technology being used.  At the same time, whatever technology is being used, the -- not necessarily the vendor in this case but who gets the device is going to have to be aware of that radio technology.
	For example, if I use Blue Tooth in my voting system, there are a lot of other Blue Tooth devices out there that are not voting systems.  I need to know that my system -- my voting system may be interfered by anybody who walks in with another Blue Tooth device, and that could hamper the performance of my voting system.  And I'm not saying you have to use something other than what's commercially available.  I'm trying to make the user of this device aware of the problems of wireless communications. 
	MALE:  Well the FCC assigned frequency use and you have to use the frequencies that are available for your proposed application.  All of  those are general use.  There is no dedicated band for voting  technology.  So it would not be possible to comply with .1 here.  In fact, with Blue Tooth specifically, those are designed to interoperate and depending on the security settings they either will or won't ignore each other.  And obviously in this application, we would want them to have dedicated use only to other components of the system and ignore all other Blue Tooth devices in the area.  That's quite doable built into the protocol staff.  
	MALE:  That's not doable to the actual protocol. Blue Tooth protocol cannot ignore other Blue Tooth devices in its area.  It can ignore -- it can choose -- 
	MALE:  That's not accurate. 
	MALE:  Yes, it is.  It's a frequency hopping system.  It hops frequencies.  
	MALE:  Yes. 
	MALE:  You can't defend -- you can't tell another device, "Don't use the frequency I'm using because it's the frequency I have to hop through.  It's a requirement of the FCC that I have to hop through a certain number of channels," and there is no way to guarantee that Blue Tooth devices will not hop on other Blue Tooth devices.  They can ignore to join a Blue Tooth pico net, but they cannot avoid the interference caused by the other device.  That's actually in their own specification. 
	MALE:  Okay, let's separate the issues.  One is inclusion of another device in the communication, which is what I was talking about.  The frequency hopping is over a 75 megahertz spectrum, and it's really a non-issue from this standpoint because the protocol is designed to allow multiple pico nets to operate independently in a fairly close area.  That's one of the reasons for the hopping.  
	So beyond that, the concern here is that any voting system is pretty well going to have to use off-the-shelf components and really we want that to build on infrastructure that is already in place.  And that means that if they use Blue Tooth 80211 or whatever, they don't have a choice of frequencies and transmission protocol.  Those are all set up in the standards in the chip sets that implement them. 
	MR. CHAIRMAN:  Is part of the thinking here that you need to be aware of potential for interference that, in fact, in some cases maybe the election of (indiscernible) will have to tell people that you cannot bring such a device into the precinct because we may have -- is that part of the thinking?  I'm trying  to get a clarification. 
	MALE:  It is part of the thinking; it's not all the thinking.  For example, again with Blue Tooth, I have studied this protocol.  I'm actually one of the people who are involved in it, and I think you can tell me I'm an expert in the first version of version Blue Tooth.  You can ask the people involved.  You cannot prevent the interference of Blue Tooth devices.  Now 80211 divides up its technology to direct spectrum technology.  It divides that spectrum up in to multiple channels and you can selectively say, "I want to use this channel to avoid the other channel that might be by a nearby system."  We have the problem internal to this, the same thing, trying to manage wireless networks so they do not overlap in frequency so that they cause interruption. 
	FEMALE:  Mr. Chair?
	MR. CHAIRMAN:  Yes.
	MALE:  Go ahead.
	FEMALE:  First of all, it's 12:38.  
	MR. CHAIRMAN:  Yes.
	FEMALE:  And I'm cold and I'm hungry.  [laughter]
	MR. CHAIRMAN:  I was -- 
	FEMALE:  So we may be reaching a decreased level of usability of this committee, if we don't give people a break.  But here's the non -- sort of non-techno concern I'm hearing here, which is that what I'm hearing Mr. Flater describe is good design practices and thought -- and good thought that ought to go into the design of any sort of system, especially in this case a wireless system.  What I'm not hearing come out of it is clearly is requirements, is testable requirements.  So, in a way, we're back to the discussion of the usability test, which is, you know, we should -- you should do these things but we had one step further on the usability test, which is we actually had a way of documenting that you've thought about it through the CIF.  
	So I just am wondering what the requirement is because, as we pointed out before we don't include my new reading devices, so how is it that we're going to know that someone has considered these issues carefully?
	MALE:  And I guess I have a question with the issue of frequency hopping and Blue Tooth causing interference with other Blue Tooth devices.  Is that interference of such a level that it actually introduces risk of degraded performance?  
	MALE:  No.  And that's a good point.  They hop at a 1,200 times per second rate.  And that's chosen so that when they do collide, they're quickly on to another frequency, both of them.  And so, they, you know, effectively get their data through. 
	MALE:  So probably what we want here is a design, if we (indiscernible) at all, is a design that will ensure that the device is not -- or is at low risk for interference in its communication. 
	MALE:  I want to say something about the design and the tolerance level of interference.  
	MALE:  Yeah.  I understand that you don't want the devices on the police telecommunications channel, particularly if you're polling places sitting next to the police station.  We're not talking about that.  That's not a reality anyway.
	MALE:  Well, remember I think in many we're exceeding our jurisdiction, actually exceeding the jurisdiction of the AC.  Any device that incorporates a radiofrequency transmitter has to get an FCC equipment grant.  All the power transmission requirements very carefully reviewed by the Federal Communication Commission.  I think we're trying to do their job for them. 
	MALE:  May I suggest something? 
	MR. CHAIRMAN:  Instead of this being an item under radiofrequencies, perhaps this actually -- some comment like this could be part of the preamble, not so much a requirement but established awareness that these issues are issues of concern to be paid attention and not as part of one of the item -- standards.  And then go onto a couple of the other ones.  
	Let me leave you there.  I want to respect our desire to break on time.  We're about ten minutes late.  Yes, Mark?
	MALE:  If I may, I would like to just make on comment before we break because I think it's very important.  
	MR. CHAIRMAN:  (indiscernible) 
	FEMALE:  (indiscernible) 
	MALE:  Can you hear me?  
	MR. CHAIRMAN:  Yeah.
	MALE:  Okay.  I'd like to just make one comment because I'm concerned there might be a misperception about something that we've discussed before.  In my overview and in the conformance clause, we've talked about requirements for voting officials.  We've said these are not mandatory requirements, these cannot be tested, we're going to put those in appendix for best practices.  When they've come up here in some instances we've had objection to them in the -- with the reasoning that they don't belong here.  We've discussed this at the last meeting and we discussed this again.  These are not requirements in a sense the others are requirements, and we've made that clear in the conformance clause.  They are best practices for voting officials.  We put them there because we obviously think they're important.  If the voting official does not turn off the wireless capacity, for instance, you're going to have problems.  We're not telling them how to do their job but their practices so that people can use them.  And I guess I'm concerned by eliminating some of these arbitrarily.  We're not being consistent here.  We've said we're going to put them in, and I guess I'd like the committee to just think about why we're eliminating some and not others, again making sure that they understand these are not testable requirements that affect conformance.  
	So I'd just like to leave that and let people think about it over lunch.  
	MALE:  Yeah, that's fine.  
	MR. CHAIRMAN:  We will break for lunch.  And when are going to get back?  
	FEMALE:  1:45. 
	MR. CHAIRMAN:  Okay.  We will get back at 1:45.  Please let's be back in time.  Thank you.  
	[off the record]
	[on the record]
	MALE:  One other administrative note.  I did provide to all of you TGDC members a sheet with potential dates for a September meeting.  It's basically two weeks in September when at least I know that the folks at NIST and Dr. Semerjian are free, but I also asked if you have October -- what days in October would be available as well for a plenary meeting.  
	So with that, I open the meeting to Dr. Rivest. 
	MALE:  Thank you, Allen.  
	MALE:  Question of clarity Dr. Rivest? 
	MALE:  Yes. 
	MALE:  Do we need to respond to our plenary opportunities in September at close of business today?
	MALE:  Allen, could you -- Allen, this is a question for you. 
	MALE:  Allen?
	MALE:  (indiscernible) e-mail.  Just take it with you.  You don't have to (indiscernible). 
	MALE:  Okay.  Okay.  And then on that note, I would like to make it for the record that this group ought to leave the beltway for our future meetings and get out to the grassroots communities to allow them to interact and to watch and to observe because the beltway doesn't count for anything but the beltway.  And I would -- [laughter] I think it would go a long way to educating the public in general, of being able to reach Colorado or Florida or California.  
	FEMALE:  I will say that there is a NIST that's located in Colorado, so you could easily come there and it would be very -- you know -- 
	MALE:  Almost sounds like an invitation, yes. 
	FEMALE:  Uh-huh (affirmative).  [laughter]
	FEMALE:  I don't know.  
	MALE:  (indiscernible) 
	MALE:  Thank you.  Those comments are well noted.  I believe we probably should start with attendance.  Is that the first step, or do we need that after lunch?
	MALE:  Why don't we do another roll call for (indiscernible) a couple of people (indiscernible).  
	MALE:  Taking roll for the afternoon session.  Williams?  Williams is absent.  Berger?
	BERGER:  Here. 
	MALE:  Berger is here.  Caldas?  Craft?
	CRAFT:  Here.
	MALE:  Craft is here.  Davidson?
	DAVIDSON:  Here.
	MALE:  Davidson is here.  Elekes?
	ELEKES:  Here by teleconference. 
	MALE:  Elekes is here.  Gannon?  Gannon is not here.  Harding?
	HARDING:  Here.
	MALE:  Harding is here.  Miller?
	MILLER:  Miller is here by teleconference as well.
	MALE:  Miller is here by teleconference.  Purcell?
	PURCELL:  Purcell is here by teleconference also. 
	MALE:  Purcell is here by teleconference.  Quesenbery?
	QUESENBERY:  Here.
	MALE:  Quesenbery is here.  Rivest?
	RIVEST:  Here.
	MALE:  Rivest is here.  Schutzer?
	SCHUTZER:  Here.
	MALE:  Schutzer is here.  Turner-Buoy?  Semerjian?  Absent.  I'm counting that we have ten, which does represent a quorum so we can continue. 
	MALE:  Thank you.  As Allen noted, I was appointed by the chair in his absence to proceed as chairman.  And if that's okay with the committee by your unanimous consent I will do so.  
	MALE:  That works.
	MR. CHAIRMAN:  Okay.  Thank you.  So I would like to suggest we proceed from where we left off on the wireless section.  David Seifer is still here.  I believe we were talking about section 60326 on page 653 and running onto 654.  Is that correct?
	MALE:  That's correct.
	MR. CHAIRMAN:  Or are we further -- I guess that's -- 
	MALE:  Mr. Chairman?
	MR. CHAIRMAN:  Yes?
	MALE:  Before we proceed, I'd like to just make a suggestion that may assist us with all of the -- it struck me this morning that the wireless and the telecommunications, both of those components to these are -- regs are complicated.  [laughter]  
	MR. CHAIRMAN:  Yes.
	MALE:  And that we appear -- or I in general, we may represent a minority out there.  And some of us up here are having great difficulties keep track of what needs to be laid out in layman's terms versus some more technical kinds of things that might be more appropriate in an appendix for the technical people to really grasp and understand and fight over. 
	And so what I would suggest is that perhaps by the end of the day we could agree that we come up with really an input and an output on this level so this average voter understands what the intent is and what the expectation is and how that is derived to then be placed in another section as to not to confuse the average voter and the average precinct person. 
	MR. CHAIRMAN:  Thank you.  Yes, I think the clarity and accessibility of the intent of this committee to the public at large is certainly important and how we reach it is a good subject for discussion.  So I guess I'll open it up to the committee to follow up on  that if there's any suggestions or comments on the proposal just made.  
	MALE:  Yeah, let me just second J.R.'s suggestion and just report to the committee that we had a -- I think a very productive conversation over lunch with Dr. Seifer and I think we share concern about the same issues, but there's some work to be done on getting a set of words down that will reflect a common agreement on what would be an adequate way to address them.  It may be better for the committee if we did that off line and brought it back rather than trying to hammer it out here.  But that's -- of course, it's a pleasure of the committee.
	MALE:  We have several ways of proceeding.  If this particular section isn't right for approval with minor edits then we probably should figure out another path, if it's something we can clarify here.  If it's a matter of repartitioning, then we have an example already of where we can move things around and do that if it's ready for approval, but merely moving things around, I think it sounds like you're talking more about the first category where when we get to the end of the section, when we decide there's enough substantial rewriting to do that it would need a different other pass or some other procedure?
	MALE:  I'd like to ask Dr. Seifer's opinion, but my opinion is that it's probably a little more than we want to try and do as a full committee. 
	MR. CHAIRMAN:  I think what we were trying to do at lunch is reach agreement on the current issues of this one section that we're dealing with and when we came back it was brought up by J.R. that there was a broader scope that we were probably too specific for this technology for everybody to understand.  And so that could be viewed as a complete restructure or it could be viewed as pull out the high level effects.  And I'm going to make the suggestion do those high level effects there on the screen -- if I would elaborate on what I mean by controlling usage at a high level or identifying usage, protecting the transmitted data, protecting a wireless path, and then have the technical details therefore, would that satisfy?  If that's the case then that's something that could be done quickly like section 227 was -- or not it wasn't 227.  It was the security section.  Pull certain ones out and move other sections.  But I guess my first concern is there any problem with the text that's in there because what's the point of doing high level if there's still -- the devils are in the detail issues. 
	I realize that not everybody will be knowledgeable on the subject matter, but again, from this high level view, do we understand at that view what this is?  What we're trying to do for security?  
	MALE:  Let me just make sure we share an understanding on the last two points, but it looks like a pretty good list to me.  But when we get to wireless, what do you mean by protecting the transmitted path and protecting the wireless path? 
	MALE:  Okay.  Protecting the wireless path is again dependent upon the wireless technology being used.  For example, if it's RF, the path is going to be going in multiple directions.  The distance of which it goes is going to be based on the technology used.  And if it's over a short breach, there's a potential that you can protect it, but you have to keep the emissions from being received.  The RF is a better example of protecting the path.  The RF isn't omni directional.  It's very --
	MALE:  By saying RF, you mean infrared?
	MALE:  Infrared, sorry.  Infrared, sorry.  Infrared.  It's line of sight.  You can protect it over short distances.  Over long distances, like if I had an IOR from here to there and if the IOR reached, I wouldn't be able to secure the path.  But as was mentioned earlier with another implementation with the PEB, that is a real close transmission and you're able to protect the path.  What I'm trying to do also is -- was cover the microwave effect.  You definitely wouldn't have a microwave in your voting station, talking to another voting station.  But you may use microwave on the top of your building to transmit and in that case you can't protect the path either from a physical means.  So you have to be prepared for interference from that path.
	Did that clarify what I mean by a wireless path?
	MALE:  That's very helpful.  And I think it's a good list.  
	MALE:  So based on my description of that, if I add other descriptions similar to that to these issues, will that satisfy Dr. Harding's -- 
	MALE:  (indiscernible) [laughter]
	MALE:  Okay, there's a proposal or understanding here that the other data in the very near future draft some language that would elaborate a little more for the layman, explaining some of the goals of this section and making it accessible.  Is that the -- 
	MALE:  That's my understanding.  
	MALE:  Okay.  And I think then further some of the more detailed requirements to adequately protect RF would go into an annex because I think we share a concern like if someone is using 80211 that there's a fairly careful review that we want to make sure happens so that -- of specific implementation.  
	MALE:  And so that -- yes, and then those detailed analyses of the expectations would be in an appendix or some other kind of agreed format that doesn't confuse the average (indiscernible) from the reading of these regs.
	MALE:  I think there are two separate issues here, if I may suggest.  One is what recommendations -- what goes into the guidelines in terms of what's a requirement of the guidelines, what are the shalls and shoulds?  And then the question is how best to organize it and present it to the audience?  And as much as possible I'd like to suggest we defer the latter, well motivated as they are, clearly, because we need to make this communicable to everyone until we understand what's in the guidelines and then we know what we're explaining so that we have a package of recommendations that vendors know what they can bill to and election officials know.  
	So I suggest we go through these as they are to figure out what we like and what we don't like there and then organize them appropriately.  If we don't like any of them, there's nothing to worry about.  If we like them all, we have to -- okay?  Let's try that methodology.  My concern, just to express it, is that on some of these in the abstract when we have problems agreeing until we know, if you will, what the test plan is going to be and what the specific implementation is going to look like.  But let's go that way and see if we end up with that problem. 
	MR. CHAIRMAN:  Good.  Okay.  So we are then back to, if we go sequentially -- is going sequentially all right with what we've been doing?  Should we do that?
	MALE:  Correct.  We've been doing it sequentially, yes.  
	MR. CHAIRMAN:  So, 60326 is the current topic of discussion, and I -- my notes don't have any suggestive mods to that yet, although I know there's considerable discussion, but I wasn't taking careful notes on that.  Do we have any agreed-upon modifications to any of this yet or suggestions?  Are we happy with this?   
	MALE:  (indiscernible) take it out. 
	MALE:  Leave it out, yeah.  Repeat any motions regarding this that were previously made.  
	MALE:  These three requirements here received a great deal of discussion before lunch and at lunch.  I think maybe on this one I'll suggest we can try and craft some language here but it's liable to be rather time consuming, to be honest.  
	MALE:  So, you're not happy with the language but you're not sure what to propose at this stage?
	MALE:  Yeah.  Before lunch I had made a motion to remove these sections as really being adequately covered in the FCC equipment grant requirements of anything that would have a radio built in.  My concern specifically is that frequencies are the domain of the FCC and those are carefully controlled, so even if you don't like what they do, you don't have much purview in changing them.  In 262 many common technologies that are available don't allow dynamic power control.  I would note that it's a should so --
	MALE:  As is 261. 
	MALE:  Well, I've gone from 261, which talks about frequency to 262, which talks about power control.  And in 263, there the concern is that the people who are using wireless understand the environment and understand, you know, the potential problems with it.  My concern is that I don't know that this is the most effective remedy.  To do an RF site survey at each polling place is going to be at least 3,000 to 5,000.  It's going  to take some specialized people with the right equipment.  I'm not sure it's the best way to address the concern, although the concern is very real.  When you use wireless, you need to understand the environment.  You need to understand the environment may be hostile to the use of that technology, and you need to know how to apply appropriate remedies.  
	MR. CHAIRMAN:  So I'd like to make progress, so either a motion a delete, a motion to leave as it is because they're all shoulds, or a volunteering to rewrite on the (indiscernible). 
	MALE:  He moved to delete, I'll second it, and I guess I would add to that if staff wants to come back with alternative language that meets some intent that we're deleting here then they do so.
	MALE:  I'd like to ask Dr. Seifer's opinion on that.  Do you like that approach, or would you like to --
	MALE:  Well, I would not like to delete them.  They are shoulds.  They are not shalls.  That's the stand I'm going to take.  And I have a concern in doing my research with the community is that they don't know the problems with wireless inherent in their system.  And so it was an education process on mine learning how they do things, but I believe it was also an education process on the other side learning how their systems are vulnerable that they didn't know about.  
	And the 80211 is a perfect example.  It's documented about work -- I can't think of it now.  Go around and see what 80211 devices are available and start hacking away.  They don't know that they have 80211 that can be hackable.  This is for information.  Again, there is no requirement.  They should.  It doesn't address the determined hacker to get into your voting system. 
	MALE:  Dr. Seifer, I've got a question.  You said you've researched and you've basically found their knowledge lacking.  But to my knowledge, there is only two uses of wireless on the market right now.  One is the ES&S PEB with its infrared data stream, which isn't terribly high risk.  And the other is a process for uploading election definitions to voting systems in a warehouse.  What other systems were you reviewing?
	MALE:  Well, the system to which you are referring to does more than upload databases.  It opens and closes polls, which is a very significant thing to be protected.  If I cannot send a wireless signal to open the device, to open the poll, that's a very real problem for the system.  And if a poll worker doesn't have a way around it or know that that's a possible point of a problem, it's important.  The same thing goes for the closing of the poll.  I need to protect that closing of  the poll signal as well.  And if they don't know that there might be other devices in the area that use that same channel beyond our control, and it could be a warehouse, and the example was in a warehouse.  There were three other 80211 devices running.  So, I'm trying to give guidance to say --
	MALE:  Mr. Chairman?
	MR. CHAIRMAN:  Yes.
	MALE:  I hear our staff's words, and I think what he's referencing here is this is unexplored territory.  And perhaps this could be better served as an information piece or a white paper piece on an addendum section for this particular area because, you know, it's really uncharted -- thank you -- territory.  And as you --
	MR. CHAIRMAN:  So the motivational -- let me let you finish.  Sorry. 
	MALE:  -- of these three sections.  So it's an information piece that we need to explore this because we can't really -- we're not in a good position to regulate it well.  So let's identify it as one of those high risk areas, as we've already articulated, and leave it at that, because we don't want this to be a show stopper here for 06.  
	MALE:  Well, I think equally we don't want to put something here because of our current time pressure and then find it starts to propagate because that was in version one and, you know, you get -- start setting precedence. 
	MR. CHAIRMAN:  I think we have a motion on the floor to delete and then -- which was seconded.  Is that correct?
	MALE:  Yes, it is.
	MR. CHAIRMAN:  In which case, is there more discussion on that motion per se?  
	MALE:  (indiscernible) informational piece.  (indiscernible) 
	MR. CHAIRMAN:  I think we're talking about deleting the section 60326.  Is that correct?  The motion on the floor is to delete -- so the general -- certainly, the resolution in the past saying that use of wireless introduces severe risk and should be approached with extreme caution is on the record and available -- and deleting the sections wouldn't do that --
	FEMALE:  Yeah.  I mean, I think you're going to a step further, which is to say -- I'm not sure that conveying information to voting officials about how to best use wireless technology ought to even be in a should, but that seems to be the only available instrument we have to work with, but we certainly have other places where there's informative text that aren't phrased as one of the requirements. 
	MALE:  Right. 
	MR. CHAIRMAN:  So it sounds like to me there are two separate issues on the table here.  One is what to do with 60326 as drafted and the other is to whether we should add an informative piece, which would further elaborate on some of the risks involved in wireless.
	MALE:  Right. 
	MR. CHAIRMAN:  So maybe if we could treat those as two separate motions, if you like and proceed with the first one. 
	MALE:  (indiscernible) 
	MR. CHAIRMAN:  I'm ready to call the question.  Okay.  Should we do it voice vote, or do we want to have a --
	MALE:  Take a voice vote and then if it's unclear then we'll call the roll call.  
	MR. CHAIRMAN:  Voice vote.  All in favor?
	PARTICIPANTS:  Aye
	MR. CHAIRMAN:  All opposed?  Okay, so that passes.  So we have deleted 60326. 
	MALE:  (indiscernible) informational piece (indiscernible). 
	MALE:  I'll second that.  
	MR. CHAIRMAN:  This would be to be placed where?  At the beginning of the section 603, or somewhere else, or don't you care? 
	FEMALE:  I think we have a body of text at the beginning of 603 that would be easy enough to redraft the sense of these three things into a paragraph that would be added to that, I mean, without creating whole new structures and --
	MR. CHAIRMAN:  Yes?  Was somebody on the dial in?
	CALL-IN FEMALE:  Yes, Mr. Chairman, could the motion be repeated?  We couldn't hear it.  The microphone wasn't on. 
	MR. CHAIRMAN:  My apologies.  The motion that was just passed, and if you didn't hear it and you want to express a --
	CALL-IN FEMALE:  The motion that was passed, I heard it. 
	MR. CHAIRMAN:  Sorry.  The new motion was to --  needs to be precisely stated.  Thank you for correcting -- was to have an additional -- if I can try to phrase it -- was to have an additional section added to the introductory portion of 603, which would be informational in content, which would convey the motivation for the detect section 60326.  
	CALL-IN FEMALE:  Thank you. 
	MALE:  Ask somebody to make that motion and somebody to second it. 
	FEMALE:  I so move. 
	MR. CHAIRMAN:  Move seconded? 
	MALE:  I'll second. 
	MR. CHAIRMAN:  Seconded, okay.  Further discussion?
	MALE:  I would just say I think this is a very important point and I look forward to the contribution.   
	MR. CHAIRMAN:  Other discussion?  Anybody in the dial-in?  So the voice vote then?  All in favor?  
	PARTICIPANTS:  Aye. 
	MR. CHAIRMAN:  All against?  Motion passes.  So let's move on to 6033.  
	MALE:  This section is trying to identify the wireless usage.  Wireless can be hidden anywhere and this is the point to call out, if you have a device, you know, it's wireless, and you know how to deal with it from there.  So, it's just again trying to identify that whoever is using it knows that the wireless is there and available.  So that's 331.  You should have the capability of turning wireless there.  It's there.
	332 is you have to have a capability to know that it's on, when wireless is on and when it is not on.  And the sub-bullet item there is we hoped the indication would be visual, but it's not a requirement.  
	333 we need to label the system to make sure what wireless it's using.  So if you do have the knowledge to know that there's other interferings, you know what's going to be interfered with.  
	Okay, that completes 6033.  
	On to 34, protecting the data -- transmitted data.  This is the critical information that almost everybody is concerned about for using wireless.  It's the actual data.  Listed here as the examples are those informations that are being currently used by wireless.  So, first requirement is to make that all information transmitted by wireless communications shall be encrypted.  The only exception to that is the wireless coupling for the T coil because that is in the section 227 for usability and accessibility requirement.  The term wireless is again used there.  And so I had to -- since I couldn't change the text, because that's what they call it, I had to accommodate it.  So that's the only exception to encryption.  
	MR. CHAIRMAN:  So we're talking about 60341 now? 
	MALE:  Correct. 
	MR. CHAIRMAN:  I had a proposed change to that -- I'm not sure how -- does the chair make motions on --
	MALE:  You can state it and have somebody adopt it.  
	MR. CHAIRMAN:  (indiscernible) shall be encrypted and authenticated to the cryptographer.  Encryption and authentication are different techniques, and encryption by itself does not provide any message integrity.  So that I would add the word and authenticated after encrypted in 60341 and 603412. 
	MALE:  Okay.  Except for the integrity, we're only looking at authentication right now.  Are you counting digital signage as an encryption?  If individual ballots (indiscernible) counts or passwords are transmitted that's confidentiality and integrity if valid definition (indiscernible) --  
	MR. CHAIRMAN:  Authentication is an integrity mechanism, yes. 
	MALE:  Okay.  
	MR. CHAIRMAN:  Encryption provides the confidentiality -- exactly.  Encryption is the common technique for providing confidentiality, a message authentication code or a digital signature is the common cryptographic techniques for providing authentication.  The section as it is just talks about confidentiality as encryption and neglects the very important concern about integrity.  And so I suggest that we add the word and authentication there, leaving the technique again up to the vendors that it has to be provided. 
	MALE:  Do you need somebody to make that motion?
	MR. CHAIRMAN:  Yes, please. 
	MALE:  Okay.  With your permission, I'd like to add one change to it.  And that is I suggest we change wireless coupling to wireless T coil coupling so that it's absolutely clear what that means. 
	MR. CHAIRMAN:  Where does that appear?
	MALE:  Second line -- line 39 on page 655.  So, I would move adding and authentication, as you proposed, and wireless coupling to wireless T coil coupling.  
	MR. CHAIRMAN:  So we have a --
	FEMALE:  Second. 
	MR. CHAIRMAN:  -- motion on the floor seconded for --
	MALE:  (indiscernible) 
	MALE:  I have a comment to address to that.  We would have to update section 227 to reflect the same terminology so there's no confusion because that was the terminology used from that section.  
	MALE:  Good point.  And I think that probably should be done in the reference standards that are incorporated.  You will find a technical definition of T coil.  So we can point to that. 
	FEMALE:  (indiscernible) and it's a section we're already (indiscernible).  
	MR. CHAIRMAN:  So we have a motion on the floor for an update to 60341 and the revision to 227, I guess, we can look at later or -- I'm not sure where that is. 
	FEMALE:  That's a section we're already revising in any event to reflect one of the standards.  So we can --
	MR. CHAIRMAN:  Corresponding change there as appropriate. 
	FEMALE:  I think we can take that as an edit for simple consistency in editing.  
	MR. CHAIRMAN:  Yeah.  It's not uncommon in the literature to have the word encryption used in a way that implies that it's being used for integrity purposes as well.  But it's a bit of a misuse and I think that we should be clear here and use encryption when we're talking about confidentiality and just authentication.  We want authentication as well.  
	FEMALE:  I think we're all there.  Let's vote on it. 
	MR. CHAIRMAN:  Yeah.  All in favor?
	PARTICIPANTS:  Aye. 
	MR. CHAIRMAN:  Any opposed?  The motion passes.  So that's 60341 with those two changes, adding the word and authentication and adding the word T coil there.  There was a similar change, I think, for 603412 that should follow.  I think we just propose that as an edit. 
	FEMALE:  We add authentication to that paragraph?
	MALE:  412 is -- 
	MR. CHAIRMAN:  603412, yeah, where it says encrypted --
[End of Audiotape 7, side A]
	MR. CHAIRMAN:  -- be encrypted and authenticated shall not be present would be the motion that I understand.  So we have a proposal, a second.  All in favor?
	PARTICIPANTS:  Aye. 
	MR. CHAIRMAN:  All against?  Motion passes.  So we have those changes.  Are we ready to move on to 6035?  
	MALE:  Actually in that sub point 4121, I think for consistency we may want to change the subject to wireless T coil coupling.  That's what you intended there, isn't it David?
	MALE:  Yeah, again, that's the text extracted from 227.  Yeah, 2272, I actually --
	MALE:  For consistency, let's just use the same term and --
	FEMALE:  I think we can take that as an edit and not as an amendment.  
	MALE:  Okay, very good. 
	MR. CHAIRMAN:  6035?  
	MALE:  6035 that's protecting the wireless path, which I discussed earlier to try to give what I meant by wireless path.  Again, some of these wireless technologies you cannot protect the path.  It's not like protecting cable.  So if I cannot protect the path, I have to be prepared for denial of service attack for that access and that's what this section tries to make the system and users aware of.  If you can't protect the path, you cannot guarantee delivery.  So --
	MR. CHAIRMAN:  6035 doesn't enter the period.  I'm not sure what the -- 
	MALE:  Doesn't what? 
	MR. CHAIRMAN:  -- the (indiscernible) construction is there.  
	FEMALE:  I just have a question.  I don't quite understand 60352 at the top of A675.  Do you mean shall function even if -- if the wireless goes down then it still functions properly?
	MALE:  (indiscernible) 
	FEMALE:  It just says shall function as if the wireless capability were never available for use.  Oh, I see.  You're seeing this as a series of clauses.  
	MALE:  If you cannot guarantee the path --
	FEMALE:  No, I just -- I'm not questioning it.  I just didn't understand it. 
	MALE:  Okay.  So the first comment was there's a missing period in 60351.  
	FEMALE:  And the reason that paragraph is missing is because you've taken a complex sentence and broken it into clauses.  
	MR. CHAIRMAN:  60351, if we just add a period, it doesn't make a lot of sense.  
	FEMALE:  Right. 
	MR. CHAIRMAN:  The main -- it just says the voting system --
	FEMALE:  I think if we all agree on the sense of these together, I think we could take this as an edit comment for clarity and not have to debate the exact wording and let someone clear it up.  I think this is a paragraph that was broken up into clauses.  And it -- 
	MR. CHAIRMAN:  (indiscernible) 
	FEMALE:  -- it's all three or four of them in a row that's really one big sentence.  If you read them together, they make sense.  If you read them separately, they don't.  
	MR. CHAIRMAN:  I think that's a useful suggestion.  If we read them together, do we have comments?
	FEMALE:  I'm just saying -- 
	MR. CHAIRMAN:  Yes.
	FEMALE:  -- if we agree on them, we can just -- 
	MR. CHAIRMAN:  We can do the editing later, yes. 
	FEMALE:  -- let (indiscernible) handle this as an edit.  
	MR. CHAIRMAN:  No motions?  Shall we move on and consider that an edit? 
	MALE:  It's just an editing note, right?
	FEMALE:  Yeah. 
	MR. CHAIRMAN:  60354 is a new sentence.  
	FEMALE:  Yup. 
	MR. CHAIRMAN:  Okay.  60355?  Do we have --
	MALE:  (indiscernible) 
	MR. CHAIRMAN:  55 comments?  
	MALE:  Okay.  Can we go onto protecting the voting system from wireless based attacks?
	MR. CHAIRMAN:  6036?
	MALE:  Okay, the concern here is, as I made mention and left it up here, there's another aspect to having wireless added to the system.  You are no longer just worried about protecting the data you transmit.  You now have to worry about another door, another window of opportunity for that system to be potentially hacked from another device.  And so that's what this section is for.  Now, all of the requirements in the section are the same requirements that are in DSS 202.  
	FEMALE:  Okay.  So you've just moved these forward and called them out specifically as also applying to wireless?
	MALE:  Correct. 
	FEMALE:  Sounds great.  
	MALE:  The only additional was the one extra leaf about 3621, which was to make a good design -- we're not doing design specs here.  We don't want to be putting wireless communication in there that screws up your system. 
	FEMALE:  Okay.  
	MALE:  Okay.  Last page, 6-59.  The log requirement, the leaf added here is what we want to be added to the log and then 365 is authentication.  We want the devices authenticated that are in the system and we want the user who is using those systems authenticated because you don't want systems coming in that aren't supposed to be in the system.  Okay.  
	FEMALE:  Sounds good. 
	MR. CHAIRMAN:  Any further comments?  Are we done with wireless?  What's the procedure? 
	MALE:  (indiscernible) 
	FEMALE:  (indiscernible) changes.  There's only one that's moving it to an informational section.  (indiscernible) 
	MALE:  So we can go ahead and go with the motion then?
	FEMALE:  (indiscernible) 
	MALE:  (indiscernible) this here. 
	MR. CHAIRMAN:  Start here?
	MALE:  Uh-huh (affirmative).
	MR. CHAIRMAN:  So are there any more motions or requests for unanimous consent to change the content of the overview of security requirements -- no, this is not the right section.  [laughs]  It's the wireless we just did.  Right here.  To change the content of the wireless requirements for VVSG, version 1, that we have just reviewed?  There being no further motions to change VVSG, version 1, volume 1, section 603, I will now entertain a motion for the TGDC to adopt this draft of section 603 as part of its first set of recommendations to the executive director of the AAC, subject to changes expressed and any motions we have adopted today expressly applied to section 603, which changes shall be made pursuant to TGDC resolution number 3705.  
	MALE:  (indiscernible) after discussion. 
	MR. CHAIRMAN:  So it's moved and seconded, okay.  Please call a roll call, Mr. Green.
	MALE:  Berger.
	BERGER:  Yes.
	MALE:  Craft?
	PRATT:  Yes.
	MALE:  Davidson?
	DAVIDSON:  Yes.
	MALE:  All three voted yes.  Eliquise?
	ELIQUISE:  Yes.
	MALE:   Eliquise votes yes.  Harding?  Harding has stepped out.  Miller?
	MILLER:  Yes.
	MALE:  Miller votes yes.  Purcell?
	PURCELL:  Yes.
	MALE:  Purcell votes yes.  Quesenbery?
	QUESENBERY:  Yes.
	MALE:  Quesenbery votes yes.  Rivest?
	RIVEST:  Yes.
	MALE:  Rivest votes yes.  Schutzer?
	SCHUTZER:  Yes. 
	MALE:  Schutzer votes yes.  That's nine votes in favor.  The motion passes. 
	MR. CHAIRMAN:  The motion passe.  Thank you.  So we're not finished with the wireless section.  Before we move on to the next section, notice from our parliamentarian. 
	PARLIAMENTARIAN:  Yes.  I just need to make a statement of the record.  This is for the benefit of our audience members, both via Internet, as well as those present.  There's been reference to conversations which took place over lunch, these being one-on-one conversations between members of the TGDS and perhaps members of the audience, as well as among themselves.  Since we are a federal advisory committee, I want to assure the audience members that no decision making has taken place outside the public confines of this meeting.  All decisions which have been made by the TGDC are being made and fully discussed on the record.  So despite those references to those legally conducted one-on-one conversations, I want to assure everybody we're in compliance with the federal advisory law. 
	MR. CHAIRMAN:  Thank you, Mr. (indiscernible).  So I propose we proceed on with the next section.  
	MALE:  Mr. Chair? 
	MR. CHAIRMAN:  Yes.
	MALE:  We have two issues that I'd like to go back to and verify a paper audit trail section, if we may.  
	MR. CHAIRMAN:  We do have a time set aside later, I think, for going over that, or not -- 
	MALE:  Oh do we?  Okay.  Okay. 
	MR. CHAIRMAN:  So there will be an opportunity to do that.  So at this time, we can move on to section 604, distribution of voting systems software and set up validation.  
	FEMALE:  (indiscernible) finish up the (indiscernible) first before going on to that?  (indiscernible)  
	MALE:  (indiscernible)  
	MR. CHAIRMAN:  Let's wait a little bit.  Let's do the -- so Nelson Hastings can lead us through this section. 
	MALE:  Okay.  Good afternoon, everybody.  I was hoping to say good afternoon yesterday to you guys, but we have fallen a little bit behind.  But so -- I'm going to talk about software distribution and set up validation requirements.  
	We'll start off with a little bit of background.  There's two slides there.  And then we'll just start going through the requirements.  I've got summaries on the slides with references to the requirement numbers in there.  So we'll just start doing that.  
	This section is to respond to the resolutions 1505, software distribution, and 1605, set up validation.  And so the goals of those are to determine whether the identified voting software has been distributed without modification for software distribution and for set up validation to ensure that the system only contains authorized voting software and no unauthorized voting software is installed and the systems are in proper initial state. 
	Just a little bit of changes from last time that we met.  The two original documents were combined to form the one section.  The detailed analysis and scope that was in the previous two documents were removed or reduced to include readability.  Some refinance in addition to the original requirements that were proposed at the last meeting and finally the correspondence between the requirements in VSSA and IEEE that were included last time have been removed to reduce complexity of the document.  However, those relevant sections in the VSS and IEEE were considered during the development of these requirements.  
	So, we can start off -- I guess we're on 660 -- is where the requirements begin in the draft that you have.  And the first requirements in software distribution requirements are just essentially documentation requirements to enumerate all software that's supposed to be on the system, including third party software.  
	The sub -- the first sub requirement basically just says you need to enumerate some of the things that should be found in the documentation, such as file names, locations, possibly memory and those types of things. 
	The second sub requirement basically wants to designate -- to filter the files to show whether it's a static file that doesn't change from election to election or if it's a file that changes based on the different election or if it's a file that changes continuously while the system is in operation.  So -- basically so you can determine what pieces of software you can actually provide a hash value for a digital signature for later on. 
	The next requirements basically relate to the testing authorities, witnessing the build of the final qualified system.  The first sub requirement basically says a complete record of the final build should be created in details some things, such as the time, location, who was present, the configuration of the compiler, those types of  things. 
	The second sub requirement basically says that the source code that was used and the executables that resulted from that compilation or that build would be placed on the right once media is uniquely labeled.  So you could say this is the origin of the software.  And those records should be kept by the testing authorities until disqualification of the voting system.   
	The next one talks about testing authorities -- the next requirements relate to testing authorities distributing a subset of final record of the build.  So places such as (indiscernible) or all other repositories can use that software to generate hash values, digital signatures, those types of things. 
	This first bullet, sub requirement basically says that the executables and installation programs will be placed on the right once media -- so no source code would be included in that distribution.  Vendor -- okay.  Okay.  
	MALE:  We actually require source code so that when we evaluate future revisions to the system and we're going through the vendors release notes, we can actually tell where the original source was.  We've got the original application that was compiled out of that source and we can go forward into our next round of certification with a fair amount of efficiency.  So yeah, the -- I absolutely am dependent on the labs providing me with not only the object code that came out of the (indiscernible) compiled but with a source code that is compiled and with a description of the compilation environment in which they witnessed it being compiled. 
	MALE:  Could that be addressed by putting in a sub requirement at that same level, basically as a should?  
	MALE:  No.  Basically, there can be no prohibition against putting source code on this particular record.  No source code going out to be installed on sites is a problem. 
	MALE:  Okay. 
	MALE:  I would prohibit that.  As far as going to the National Software Reference Library, any copies back to the vendor, states that require it, there can be no prohibition of putting source code on that media.
	MALE:  So, just adding say source code in addition to the executables and the installation programs, just to add that in?
	MALE:  Right.  Yeah. 
	FEMALE:  (indiscernible) Where do you want to add what (indiscernible)? 
	MALE:  Only build executables, installation programs, and the source code from which the executables, installation programs were compiled, are placed on right once media with unique labeling. 
	MR. CHAIRMAN:  I'm not sure where we're talking about.  Do you have the slides that -- 
	MALE:  Okay. 
	MALE:  I'm on the slide. 
	MALE:  662.  
	MALE:  Top of the page. 
	MALE:  Top of the page.  
	MALE:  So we have -- 
	MALE:  604124. 
	MALE:  604124 is good.  Okay. 
	MR. CHAIRMAN:  So we have a proposal to modify 604124 and the particular language again?
	MALE:  Well, I want to get the source code in the (indiscernible) [laughter]  I don't care what we call it.  
	MR. CHAIRMAN:  So this is --
	MALE:  Just put source code as an -- to the left. 
	FEMALE:  (indiscernible) 
	MALE:  Yeah.  Well, I want this disk to contain both the source code use for the bill and the file resulting from the bill.  
	FEMALE:  That's already required, isn't it? 
	MALE:  Not in the subset.  Remember? 
	FEMALE:  (indiscernible) 
	MR. CHAIRMAN:  So 604124 is talking about the testing authorities and what they retain and not something that's distributed yet.  This is all under 60412, which is talking about the testing authority shall witness the final build.  And then they have a record that's created.  So I think that your comment may be addressed to a later section, Paul? 
	MALE:  Say that --
	FEMALE:  (indiscernible) 604122, Paul, on 661.  That's what you want a copy of, right? 
	MALE:  That's what I want but I'm not seeing where that flows then to the National Software Reference Library.  
	FEMALE:  Well the National Software Reference Library doesn't want that since we don't accept source code.  We only want the executables.  
	MR. CHAIRMAN:  There's several versions of -- if I may speak, there are several versions that we need to create, right?  One is for state officials or election officials to use to monitor updates and so on, which is what you're concerned about.  There's the records set, which is used to check installation, which may be a subset of that or different anyway.  And then there's.  
	MALE:  There's the actual release media that goes to buyers in the system. 
	MR. CHAIRMAN:  Release media.  There's also those that go to the NSRL, which may be somewhat different in character as well.  So there's a number of different copies that are created here.  So this copy of 604121 is the master copy that contains everything -- 
	MALE:  Right. 
	MR. CHAIRMAN:  -- and that's maintained by the testing authorities.  And 60412 is only talking about what's maintained by the testing authorities.  Is that correct, or is that talking about a distribution?  
	MALE:  Okay, wait.  121 is able to create it. 
	MALE:  121 is the complete master.  The 124 is the subset.  
	MALE:  So 22 is basically requiring that 121 to be on right once media and 123 they'll retain it, and then 124.  Okay.  
	MR. CHAIRMAN:  So the difference between 124 and 121 is what, Nelson?
	MALE:  The difference between 121 and 124 is really -- rather there is source code on the Write Once media, is the way I read it. 
	MR. CHAIRMAN:  And the intention of 124 is to be used for what purposes?
	MALE:  For people such as the NSRL that do not wish to have the source code available to them.  
	MR. CHAIRMAN:  Okay.  Can you continue then?
	MALE:  Yeah.  So far.  
	MR. CHAIRMAN:  So let's continue with 60413.  
	MALE:  Okay, so back up a second, the record created under 4124 can only be sent to the National Software Reference Library and any other repository named by the Election Assistance Commission, but the record in 4121, which should be all of that plus source code is sitting there pretty much available without restriction.  
	Now, in the current environment what we are looking for under 421 is proprietary / trade secret as a vendor and is released to groups such as me or other test and review labs based on specific (indiscernible).  
	MR. CHAIRMAN:  So 604121 does not mandate or prohibit any particular pattern of distribution is my understanding.  Is that correct?  
	FEMALE:  Uh-huh (affirmative)
	MALE:  You should probably clarify that there is no pending motion. 
	MR. CHAIRMAN:  That's true.  There is no pending motion right now.  Yes.  
	MALE:  Okay.  So where are we at now?
	MALE:  I think we've cleared 4126, for me at any rate.  
	MALE:  And the next subset, the next sub requirement, is basically saying that the subset -- the record will be kept by the testing authority until it's -- the systems default -- disqualified.  The next requirement is that the vendors are responsible for providing the repositories with a copy of all required third party software in order to generate the reference hash values and digital signatures.  
	The next requirement -- 
	MALE:  Let's go by the requirement numbers because we're getting lost already.
	MALE:  Okay.  Let's see.  So, I'm going to give you -- 
	MR. CHAIRMAN:  Excuse me.  Did someone just join on the dial in? 
	MALE:  Yeah, this is Britt.  
	MR. CHAIRMAN:  Britt, thank you. 
	MALE:  Hey Britt, welcome back.  We're on software distribution.  I missed you. 
	MR. CHAIRMAN:  (indiscernible) just joined us. 
	MALE:  So I believe we're at 414, is that -- 
	MR. CHAIRMAN:  We're at 60414, I believe. 
	MALE:  Okay.  So, it's basically the same programs we distributed on our Write Once media such as a CD.  The next requirement says that the software be received from the system vendor, an EAC testing authority or a voting official.  
	The next one talks about vendors documenting the process used to verify the software on the Write Once media, using the reference information provided by the NSRL or an accredited repository.  
	When election officials receive the software, that next requirement basically says that they'll check it -- check to make sure that the software hasn't been modified using the reference information.  
	MALE:  Whoa.  Whoa.  Whoa.  I'm looking through the software that I receive from the -- 
	FEMALE:  Paul, you're not going to get much help from Britt if he can't hear you.  
	MALE:  Okay.  So I'm looking at that point --
	MALE:  Okay. 
	MALE:  -- at 4143.  I'm receiving my gold copy of the witness compile software from the lab and yet I'm to verify that the software is a qualified software by comparing it to the reference information produced by the NSRL or other EAC accredited repository. 
	MALE:  Correct. 
	MALE:  The reason being that in transit from -- to verify that disk hasn't been substituted or something like this. 
	MALE:  So the NRSL then is going to have to maintain two different sets of hashes, one for this disk and another for in-style systems. 
	MALE:  For in-style systems?
	MALE:  Uh-huh (affirmative).  I mean the NSRL is going to have to basically have a hash value for a system that's actually sitting on a server with all of its directory structure and as it would appear once it's installed but they're also going to have to a hash for this particular disk because they're not going to (indiscernible).
	MALE:  That's correct. 
	MR. CHAIRMAN:  There may be other techniques for achieving the same goal and maybe we're getting a little low level here.  I mean, a digital signature on the information may suffice as well as you (indiscernible) to guarantee that you've received something properly from the ITAs and they're digitally signing it.  So perhaps I would not worry much (indiscernible) TGDC members at here, if I may.  I'm not quite sure what the proper procedures are.  So, verify that the software installed is the qualified software and we have a mechanism here by comparing it to reference information produced by the NSRL or other EAC accredited repository and maybe other techniques which are also suitable or -- so I'm just trying to think of the appropriate wording. 
	MALE:  Okay, I guess I finally figured out what's bothering it.  The voting system equipment shall verify that the software is a qualified software by comparing it to the reference information produced by the NSRL or other accredited repository before installing the equipment.  So we've got the equipment now --
	MALE:  So that's (indiscernible) one -- 
	MALE:  -- installing its own -- 
	MALE:  That's in 4 -- 144. 
	MALE:  I think the system administrator should verify that the software is a qualified software by comparing it to the reference information before installing -- 
	MALE:  Before he begins his installation process?
	MALE:  Hardware is not going to install the software itself, particularly before the software is installed.  
	MR. CHAIRMAN:  The voting software could check a digital signature on the software before loading it (indiscernible) --
	MALE:  Yeah, but the responsible person is a system administrator and I don't want to create an environment where system administrators stand by and say, "Oh, it looks like it installed just fine.  Okay we're good."  I want the system administrator taking responsibility for that and since we're not going into election procedures here, that should be probably a should and the system, you know, has to be configured so as to allow that. 
	MR. CHAIRMAN:  If a system administrator wants to install improper software, I guess, my question would be what's the check?  So, is there any way to detect or prevent that?  
	MALE:  In some states, going to jail. 
	MR. CHAIRMAN:  So there's deterrents, right, but do we have a technical means for either detecting or preventing a system administrator from installing improper software?
	MALE:  No.  The only thing that you can do is provide tools for the system administrator to verify that the software is a qualified software before installing software on the system.  
	MR. CHAIRMAN:  So the system administrator can do that, but it could also be the case that the system itself would check an appropriate signature and install software without having an appropriate signature on the software from the Secretary of State or whomever might be authorized to approve the software for that --
	MALE:  That's a nice theory, Ron, but (indiscernible) could be difficult, particularly on a new box that hasn't had the software installed.  And somebody is going to compromise -- if somebody is going to compromise the software and it's got a self-authentication piece, they'll probably compromise the self-authentication piece as well, particularly if they're sophisticated enough to grab a Write Once CD at out of the U.S. mail and manage to rewrite it and put it back in the mail without showing any sign they did it.  
	MR. CHAIRMAN:  Was there a comment from somebody in the dial in?
	MALE:  Britt. 
	MALE:  Yeah, you don't really want a (indiscernible) want a system to do a self-check.  I think you want your validation software to be external, a separate part of the system.  
	MR. CHAIRMAN:  I'm sorry, Britt.  You're talking through a tunnel full of water, it sounds like.  
	MALE:  Okay.  I'm sorry.  I'm on a cell phone in the airport. 
	MR. CHAIRMAN:  Just speak a little more slowly, please, and repeat yourself. 
	MALE:  Can you hear me now?  
	MR. CHAIRMAN:  Yeah. 
	MALE:  Okay, what I said was that I don't think you want the system to be self-checking.  I don't think you want that validation to come from the vendor.  You want the self-checking to be external from the system and you want to be able to run it on command.  You want the election administrator to be able to run that anytime they want to because, you know, you're not just talking about the bad guys here.  You could have a lightning strike on the tree outside that can cause your system to hiccup.  Now, did that damage it?  You'd like to know. 
	MR. CHAIRMAN:  I think you're referring actually to the section that is coming up, which is the set up validation part, which is a check on that.  Secretary Davidson?
	FEMALE:  Basically I think Britt was covering what I was thinking also is not only -- I mean, in our state, not only are we having them -- and this is the vendor themselves certify the software that they have in their equipment, but it has to be on file with our office, and anytime it's changed, it has to be on file.  That way we're trying to keep more of a permanent immediate file of software being used in the state because we have found in the past that we didn't know.  
	MR. CHAIRMAN:  So just to clarify your -- your office actually has a repository then of what's being used, or are you asking of a distribution of cold, standard copies?
	FEMALE:  They are depositing with us.  
	MR. CHAIRMAN:  Okay.  
	MALE:  Okay, I'd like to introduce a motion to reword 4144 to read:  The voting system equipment shall be designed so as to allow the system administrator to verify that the software is a qualified software by comparing it to reference information produced by the NSRL or other EAC accredited repository.  
	MR. CHAIRMAN:  Is there a second?  
	MALE:  Second. 
	MR. CHAIRMAN:  Comments?  Point of clarification, Paul.  Is the intent that -- of this motion that the voting system itself will be doing the comparison that should be done on other systems?
	MALE:  No.  The intent of this is that nothing in the system design shall preclude and perhaps it will even facilitate the system administrator in their task of validating their system at any time they want to do it.  And my hope -- 
	MR. CHAIRMAN:  (indiscernible)
	MALE:  My hope is the NSRL application will be come sufficiently mature and user friendly enough that this is a task that at that point we can require voting system jurisdictions to do before a reelection.  And if there's an easily usable application out there to do that with, I think they will.  But the system must be designed to facilitate that.  I'm not interested in a self-checking. 
	MR. CHAIRMAN:  There's three steps here in my mind.  Right?  There's the distribution of the software to the -- and polling site or whatever, the warehouse.  There's the loading phase and then there's the check after the loading phase, if you want to check the things have been done properly.
	MALE:  Well for firm ware, basically, with current state-of-the-art, Firmware is going to have to be validated before loading and you're going to have to control getting certified Firmware on your DREs through physical custody and access restriction.  There is not really any way with the current DREs that I'm aware of to actually validate software once it's been loaded in the DRE.   
	MR. CHAIRMAN:  May I me interject, if nobody else had a -- the gambling industry has addressed the same issue too.  Slot machines, they do have procedures for routing out Firmware and comparing that the Firmware is --
	MALE:  If you want to make this a should and you want to make it a requirement for O8 --
	MR. CHAIRMAN:  I'm just commenting that the technology exists. 
	MALE:  I know.  I know.  The technology exists and there are many technologies that exist that are not currently integrated into voting systems.  And if you'll make that an O8 should then that's something that can be looked at, but it's not viable for O6. 
	MR. CHAIRMAN:  So we have a motion on the floor, seconded.  Do we have any other comments on the motion?  All right, shall.  Can somebody read back the motion as it was made and seconded? 
	MALE:  The voting system equipment shall be designed so as to allow the system administrator to verify the software is a qualified software by comparing it to reference information produced by the NSRL or other EAC accredited repository.  
	MR. CHAIRMAN:  Period.  So I'd like to motion the question then, if I may.  Should we do a voice vote on this one?
	MALE:  Yeah. 
	MR. CHAIRMAN:  All in favor?
	PARTICIPANTS:  Aye.
	MR. CHAIRMAN:  All against?  Motion passes.
	FEMALE:  (indiscernible) 
	MALE:  So the next requirement is basically documenting who the vendors and testing authorities give their Write Once media to?  
	MALE:  Yeah.  
	MALE:  So that's the end of the --
	MALE:  Who are they are going to provide that to?
	MALE:  Who will they provide what to?
	MALE:  Well, they're going to document who they provided the voting system software at Write Once Media II for what purpose? 
	MALE:  Just for the records.  
	FEMALE:  We --
	MALE:  To be used --
	FEMALE:  We do have them certify it to us, and they have to sign a statement under oath and I mean we do hold their feet to the fire, trying to anyway.  And we even had some, I believe, even some offenses go with it that they haven't certified it to us.  
	MALE:  The reason I put that in there is let's say something happens and they burn a bunch of CDs that have a rogue file on it or something like that.  They could then trace back who they gave those specific CDs to and clean up the mess that way. 
	MALE:  Okay. 
	MALE:  That's really what that's -- 
	MALE:  Okay.  
	MR. CHAIRMAN:  Okay, moving on to 6042.  
	MALE:  So, 6042 is a generation of reference information requirements.  The first requirement basically says that the NSRL or repository shall generate reference information using the qualified voting system binary images that they receive from testing authorities.  And if an election specific software from jurisdiction.   
	MALE:  Okay.  Do you mean election specific software as, I think, my office has provided you as samples for the hashing or are you anticipating some other --
	MALE:  I'm anticipating possibly jurisdictions may want to put their ballots -- give their ballot formats to the NSRL for -- to generate reference information.  That's why that specific line is in there. 
	MALE:  Okay.  
	MALE:  Okay.  So the first sub bullet basically says that complete -- the reference information can take the form of complete binary images, cryptographic hash values, or digital signatures.  
	The next sub bullet underneath that talks about documenting recording -- creating a record of the creation of the reference information.  So who created it, what type is it, what files were covered by that.  
	The next requirement says that the repository -- repository -- sorry about that -- shall retain the Write Once media that they generate until the system ceases to be qualified. 
	The next requirement basically says that if a digital signature or a hash value is created, that a fixed approved algorithm for hashing and signing of the software will be used.  
	The next requirement basically says that when the NSRL or repository creates a hash value or digital signature or cryptographic keys to be used with digital signatures that they'll use a Phipps 140-2, level one or higher validated module.
	MALE:  Okay. 
	MALE:  The next requirement -- oh, the next requirement basically says that with sets of hash values or digital signatures that are used as reference information will be a hash value or digital signature that covers that set of hashes or digital signatures essentially. 
	MALE:  Okay. 
	MALE:  It's a little complicated.  [laughs]
	MALE:  Yeah, I'm not sure where you're going with that, but it's your responsibility so I'm going to leave it to you.  
	MALE:  The next requirements actually are if public key technology is used to create a digital signature.  The first sub requirement underneath that says a 20/48 bit key or greater will be used to do that.  
	The next sub requirement underneath that says that the keys will only be used to sign -- to create digital signatures for a period of no more than three years and then you'd have to change to another key.  
	MALE:  This is within the library?
	MALE:  Yeah. 
	MALE:  Okay. 
	MALE:  The next one talks about public -- oh, the next requirement talks about public keys that are used to generate digital signatures shall be put on a Write Once media or -- oh yeah, if not contained in a signed, non-proprietary format for distribution, such as a digital certificate.  So that's -- 
	And the next requirement basically talks about making copies of the public key Write Once media and that data should be uniquely identified.
	The next requirement talks about documenting who they provided the public keys to.  And basically the reason that requirement exists is the next requirement so that if a private key does become compromised, they know who they need to tell that that took place. 
	MR. CHAIRMAN:  Let me pause here for just a second to ask if anyone on the dial-in has any comments on what we've just been over?  Any questions, suggestions?
	MALE:  Nope. 
	MR. CHAIRMAN:  Okay.  I'd like to add a short one on 6042-1161, which is the one about 20/48 bit keys.  That's clearly an algorithm dependent kind of parameter if you're using existing signature schemes.  That's probably fine that over time we may find that we have other algorithms with other significant things.  So, just note it in our revision for version 2, and I'm sure we can take care of that. 
	Let's proceed with 60422. 
	MALE:  60422 basically says that the NSRL and repositories will make reference information available on the Write Once media as well as its associated documentation so that people can know how it was created and know what they're getting.  
	The next requirement says that the reference information -- (indiscernible) 
	MR. CHAIRMAN:  6043 now, another major section. 
	MALE:  6043?  Oh, okay.  I was just down to the reference information, just the 4221 about storing of reference information in a secured container when it's not being used, if it doesn't have a digital signature associated with it.  
	DIAL-IN MALE:  I think that would need to be moved to (indiscernible) appendix on S practices. 
	MALE:  Okay.  Continuing on.  We're into set up validation methodology requirements.  The first one -- the first requirement basically talks about checking that no one authorized software is present on the voting equipment.  The first sub requirement there basically says that the vendor shall have a process to verify that the correct software is on the system and no one authorized software is there using the reference information from the NSRL or other repositories. 
	MR. CHAIRMAN:  If I could ask a question.  Is there a requirement here that this process should be disclosed to the election officials?
	MALE:  Well we've already required that the system be designed so as to facilitate the system administrator's validation of the software.  I think it's appropriate if you want to move to a best practices part of the document, that set of validation should verify that no one authorized software is present from the voting equipment, but I --
	MR. CHAIRMAN:  This is a documentation requirement is my understanding.  The vendor shall specify at least one process to the submission process and for use by the election officials. 
	MALE:  Well this is the vendor shall have a process --
	MR. CHAIRMAN:  That's why I was noting that --
	MALE:  So, let's say vendor shall -- user documentation shall include a process to verify.  
	MALE:  Actually, let me point out that if you go down to 3112 there is a vendor documentation requirement at that point. 
	MR. CHAIRMAN:  Oh good.  Okay.  
	MALE:  Then we just need to strike 311 --
	DIAL-IN MALE:  I would prefer to a see a requirement that the vendor be able to provide you with a list of every file on that system, including all of the files that come in from other, you know, software that he's included in the system. 
	MR. CHAIRMAN:  I think we have that already. 
	MALE:  We don't have that in the user documentation.  I think we have it in a technical data package and the information provided, the NSRL.  
	MR. CHAIRMAN:  So we have what sounds like an additional question to be added.  Are you making a motion?
	MALE:  I'll make a motion.  I'd like to see 60431 in its entirety. 
[End of Audiotape 7]
	  MALE:  -- the system, additional files that would be created during system use and basically any steps and process, I mean, I don’t want to re-write the whole thing at the table right now.  But, yeah.  I think they have to present their users with a process that has to be documented.  The information has to be there.
	MALE:  Is that a full -- is that a motion that you’re making or is that?
	MALE:  It’s kind of a half-baked one. [laughing]
	MALE:  It sounded like a wish list or something.
	MALE:  Britt, jump in ‘most any time.  [laughing]  We lose Britt?
	MALE:  J.R., what page are we on?
	MALE:  We’re on page 6-67.  
	MALE:  (indiscernible)
	MALE:  6.0.4.3.  We’re -- we’re addressing the setup validation which is a response to one of the resolutions we passed earlier.  Technically, this is a challenging problem because you’re talking about validating the system to set up properly in a situation we don’t know the system has the correct software so you can’t trust the software that’s running on the system to help you with a check much when you’re starting off and so I think some of the detail that went into this section actually reflects the technical challenges there of adjusting that difficulty.
	MALE:  Well, actually, it ain’t that hard.  You do an f-disk if you’ve got any doubt about what’s on the machine.  You reinstall the operating systems, the supporting Cott’s (phonetic sp.) elements, you get the vendor’s actual release disk, you take steps to authenticate that back against what was qualified, and do an install --
	MALE:  That’s (indiscernible).
	MALE:  -- and then you put it under a password and put it in a locked room.
	MALE:  If I may, that’s solving a different question.  That’s -- that’s how to do a install with confidence if you got the right system -- 
	MALE:  That -- 
	MALE:  -- but what the resolution is for --.
	MALE:  -- doing an install better include sy -- setup validation.  Setup begins with your install and that goes through security and maintenance.
	MALE:  Absolutely.  What you’re doing should be part of the process.  Absolutely.  But we have a requirement based on our previous resolution that it be possible for an election official to validate that the machine he’s got in front of him contains all and only the proper software.  And that’s something you don’t want the election official re-installing all of the system after it’s delivered.  If you pull a machine out of --.
	MALE:  Exactly, Ron.  That’s where I’m going.  Validation of your software is not setup.  Validation of the software was back a couple of pages --
	MALE:  Setup validation.
	MALE:  -- where we, in 4.1.4.4, where we passed a resolution, the voting system equipment shall be designed so as to allow the system administrator -- or to verify the software is qualified.  Now, we’re talking about setup validation.
	MALE:  Yes.
	MALE:  And setup validation involves making sure you do it right, basically.  It ain’t rocket science.
	MALE:  Secretary Davidson?
	FEMALE:  I just wanna make sure, this is -- at the time you receive the equipment or at the time it’s -- any maintenance is gone on --
	MALE:  Right.
	FEMALE:  -- a vendor has been in and worked on the equipment at all, you want to be able to verify the software.
	MALE:  Yeah.  Or any time --
	FEMALE:  Or the firmware.
	MALE:  -- or any time that you’ve lost custody of some passwords or security of your computer room.
	FEMALE:  Okay.
	MALE:  You want to be able to do that without re-installing everything.
	MALE:  Right.
	FEMALE:  And I just want to make sure it covered everything.
	MALE:  Yeah.  And one of them back on the prior motion, is the ability to walk in there any time and validate what you’ve got.  And now we’re talking about software distribution and how to validate that you’ve properly installed the system.
	MALE:  No, I think we’ve changed sections, Paul.  We’re down to 6.0.4.3 which is a new major section.
	MALE:  Right.  Which is validation methodology requirements.
	MALE:  Yep.  So now I believe we’re responsive to a different -- there are two resolutions we passed in January.  One was having to do with software distribution; one was having to do with setup validation.  They were different.  The prior sections that we’ve been discussing up to now have to do with software distribution.  We’ve now made a major change in our focus.  6.0.4.3 is talking about setup validation, the ability to take a machine and check that the -- its configuration is entirely proper without having to -- to re-install the software.  
	MALE:  Then you can strike that ‘cause you’ve already covered it in 4.1.4.4.  
	MALE:  John, can I say a word about this?
	MALE:  Please!
	MALE:  Please!
	MALE:  This is Britt.
	[laughing]
	MALE:  I missed part of Paul’s discussion so this may be out of place a little bit.  But in -- in the area of best practices, generally, you want the vendor to install the system.  And the reason for that is because of warranties.  If you install the system or anybody other than the vendor installs the system and you got problems, they’re gonna come back and say well, you didn’t install it right.  So our practice is to let the vendor install the system.  And then when they get through, we go out with our validation tools and validate what they’ve installed is, in fact, what it’s supposed to be.  
	MALE:  That sounds entirely consistent with what the goal is here, yes.  Good!
	So if I may comment to your suggestion, Paul, unless somebody else wants to speak.  I’m wearing two hats here, both as a member of that chair, so I apologize to the members.  I hope everybody’s getting a chance to speak when they want to.
	But I wanted to comment to Paul’s suggest that 6.0.4.1.4.4 addresses that.  I believe it does not because it says the voting system equipment shall verify and I think we need to have --.
	MALE:  No, it doesn’t.  It says the voting system equipment shall be designed so as to allow the system administrator to verify.  That resolution passed.
	MALE:  Oh, this is a change.
	MALE:  4.1.4.4.  That passed.
	MALE:  Yes, I guess I don’t have that written down in my notes here.  That was -- read it to me again?
	MALE:  The voting system equipment shall be designed so as to allow the system administrator to verify the software is a qualified software by comparing it to reference information produced by the NSRL or other EAC-accredited repository.  Period.
	MALE:  And the process for doing such needs to be specified somehow, right, so there’s something missing there.
	MALE:  Yes.
	MALE:  And that -- so this adds -- this adds a requirement.
	MALE:  I think there’s already -- vendor shall document the process in 4.1.4.2.  Vendor shall document the process used to verify the software distributed on write-once media is a qualified software using the reference information provided by the NSRL or other EAC-accredited repository.
	MALE:  So I don’t think we’re quite covering all the bases there, myself.  There’s -- there’s an issue when you’re veri -- doing setup validation of checking that the software you want is the correct software, which is partly what you’ve got covered.  But then there’s also the issue of making sure that there’s no -- nothing unauthorized on the machine.  
	MALE:  Right.
	MALE:  And that’s not covered by the previous resolution.
	MALE:  And that can be covered if you have any doubts by doing f-disk on the machine and re-installing the Cott’s environment for the system and re-installing the software.
	MALE:  It could be done (indiscernible) way.  I don’t believe that’s consistent with our previous resolution which asks for a way of doing that without running or modifying the software in the system.  That’s my (indiscernible).
	MR. CHAIRMAN:  If I -- if I may --
	MALE:  I came in the middle of this.
	MALE:  It would be great if you would please resume this chair (indiscernible).  I’ve been wearing (indiscernible).
	MR. CHAIRMAN:  I thought the whole idea was not to re-install anything.  And by doing what you suggest is, you’re sort of going back to square one.
	MALE:  No, sir.  4.1.4.4 handles do -- validation without re-installing anything.  And then Dr. Rivest asked the what if you don’t know.  Well, what if you don’t know you’ve lost custody and you don’t have time to audit the entire system, then you do an f-disk and it re-installs everything.  It’s your choice.
	MALE:  There’s two different goals.  One is making sure that you’ve got it in the correct configuration.  And the other’s checking to see if it’s in the correct configuration.  
	MALE:  Right.
	MALE:  Those are different operations.  The resolution we passed asked to solve the second.  We’re proposing a mechanism for the first.  So if you’re just re-installing, you’re just wiping out any evidence of tampering.  That’s all.
	MALE:  I would only advocate re-installing as a last resort.  If you’re incapable of following the vendor’s instructions in 4.1.4.2 and following whatever methodology is brought forth in 4.1.4.4.  But --
	MALE:  I believe --.
	MALE:  Yeah, and if you can’t do that, then your only real option is to re-install.
	MALE:  Ron.
	MALE:  Let me see if I can -- what I understand going on is -- is the previous section was dealing more with the initial installation process.  And what I’ve understood is that this section 6.0.4.3 is at some point in the future, when you need to go back and re-validate -- I think the different types of occurrences, you’ve lost control of the system or something, your passwords, whatever --
	MALE:  Validation --.
	MALE:  -- (indiscernible) to them, simply say, “We have a system here.  It’s been installed.  We think it’s done incorrectly.  We want to do a re-validation.”
	MALE:  Validation is identical in steps and goal whether you do it during your install, five minutes after your install, or five years after your install.  You have to be able to walk up to a system, sit down, and do an analysis and validate the code on it.  That should be done as part of the acceptance testing when a system is purchased and installed.  It should be done any time there is a question as to a loss of custody or corruption of the software.  It should be done anytime there’s an upgrade to the software.  Validation is validation.	
	MALE:  Okay.  But 6.0.4.3 is simply going into a little more detail than what was covered in the previous sections.  Then move it to the best practices section where it belongs.  
	MALE:  This requires documentation on the part of the vendor so it’s specific information about what the vendor needs to supply.  You know, for example, the process shall not modify the voting system software and the voting system during the verification (indiscernible).
	MALE:  Well, let’s concentrate -- let’s concentrate on what we want the vendor to design, publish, and provide to the user.  And get away from this vendor shall have a process da, da, da, da.
	MALE:  That’s a high-level requirement.  We have a -- Nelson led us through these, but we have a requirement that the vendor have a process for doing this setup validation, that it doesn’t require execution of software on the target machine.  Shall document it.  Shall not modify things on the target machine.  Those are the three leaf bullets there.
	MALE:  Right.  Good.
	MALE:  Those are pretty clear.
	MALE:  How are you going to validate the system or target machine without running something if nothing more than a directory command on the target machine?
	MALE:  You need to have access to the memory.  There -- there’s a, you know, standard practice for doing these kind of things where you look at the memory without executing.  A directory listing is the first place a hacker will target --
	MALE:  (indiscernible)
	MALE:  -- if you try to modify it, so, I mean.  Right.  So you know that.
	MALE:  So you want an application that will give you direct access to a memory on a server?
	MALE:  I think it’s one -- one of the approaches that you could use for this -- this is used in the gambling industry all the time.  You have an approach for examining the memory of a computation system without running any processes on the computation system.  It’s essentially what you want to do.  Right?  You’ve got a question as to what are the bits on that machine --
	MALE:  Uh-huh.  (affirmative)
	MALE:  -- and you wanna do that -- what are the bits on the machine? -- without running any processes on that machine.  So you have to have access to the bits in the way that doesn’t change any of the bits or run any processes on that machine.  That’s the essential requirement for doing this properly.  So it may involve a second memory port or something like that that you have access to for this process.
	MALE:  Ron, I just don’t see how you are going to, with any confidence, examine the bit map of a machine’s memory which changes continually in use at every state, changes during its history, changes every time you boot up --
	MALE:  It’s a separate validation.
	MALE:  -- and reach any kind of conclusion.
	MALE:  That -- that’s standard practice in the gambling industry, as I said.  You know, they take that machine, they can walk up to it and do it.  I don’t think this is something you’d wanna do during the voting process.  We’re talking about setup here and -- and being able to tell at the beginning of the day if you’ve polled a machine, is it in the right initial configuration which is well defined and reasonably static or static.  Except for maybe the clock or something if you’re running a clock.
	FEMALE:  Well, I wonder if this is an appropriate point to ask whether this is stuff that can be done on existing machines or whether this is shoulds for the future.  
	MALE:  I think it is at least stuff for the future.  
	FEMALE:  I mean --.
	MALE:  I think if you -- if you verify the CD that you’ve got is, in fact, the qualified system, you verify that you have the proper environment for it, and you install it, I don’t think you need to go in and tap into the machine’s memory and do an analysis to make sure it’s installed properly.
	FEMALE:  I mean -- I mean I hear a very interesting conversation, but I’m also hearing that this is something (indiscernible).
	MALE:  I think that -- that you’re right.  The (indiscernible) machines are not designed by and large to support --
	FEMALE:  Right, so.
	MALE:  -- they -- they may support something close to this with -- with executing processes on the machine, but not -- not what corresponds to the resolution passed.  So maybe it should --
	FEMALE:  (indiscernible) mindful of time a little bit.
	MALE:  --	for that if we want to do that.  But I think the resolution we got now is in certainly the right direction.  The phase in question is, you know, what you’re addressing there in terms of (indiscernible).
	MALE:  Hey, Paul and Ron, this is J.R. again.
	MALE:  Yes.
	MALE:  This is one of those issues back with, like, the wireless.  Making it too complicated.  
	MALE:  I agree ‘cause I don’t understand it, J.R.  
	FEMALE:  [laughing]
	MALE:  The equ -- the basic situation is, I hope, clear J.R. that you want to be able to tell that a voting system -- election officials should be able to tell at the beginning of the election day whether a voting system is, in fact, loaded with the proper software and ready to run the election as expected or whether there’s something funny going on.  
	MALE:  And J.R., my position -- my position is that there is a very simple way of doing that you and pretty much anyone in this room could follow through, understand, and Dr. Rivest is suggesting that the only way to do it is with some memory spinal tap situation which I don’t actually understand.
	MALE:  I’m saying that’s what, you know, an approach in that direction.  I haven’t specified that fully.  The vendor -- the burden would be on the vendor to do this, but the requirements that we set forth in our previous resolution is that it should be a process where -- which election official can run that the vendor specifies and may involve other procedures that’s.  Yes, Secretary Davidson.
	FEMALE:  Well, believe it or not, I oversee bingo raffle in the state of Colorado.  So I’m a little familiar with the gambling industry and -- and we make sure that we don’t have any certain types of equipment in our bingo halls such as slot machines.  But to be able to do that, we have to call in really very professional people that are -- are on staff with the -- the gaming industry.  And does this require that type of technology?  If Britt doesn’t understand it and Paul doesn’t understand it, I’m beginning to get a little worried that what am I going to have to hire to be able to do what you’re talking about?
	MALE:  Sorry.  If I could respond to that, I might.  The proposal that is drafted here by the NIST staff says that, you know, the vendor shall provide a mechanism and so this will be part of the package they specify and the difficulty of implementing that package is part of what you evaluate when you look at the voting systems.  So hopefully the vendors would provide reasonably simple process.  I have no reason to think that this needs to be a complicated process.
	MALE:  No, it doesn’t.  And you don’t need to go into 3.1.1.1 saying that it shall not require the execution of software installed in the voting system.  Let’s see.
	MR. CHAIRMAN:  Well, is the -- is the question 3.1.1 or 3.1.1.1?  Because what I’m hearing, actually, is that you agree on the major heading.  The question is does this have to be without execution or with?
	MALE:  So I think that -- that is the question -- is one of the major questions here.
	MALE:  I think it is -- I think it is being made more complicated than a local election official and their system manager can deal with and I think it, basically, is more complicated than anything needed to mitigate the risk that we’re trying to mitigate.  We’ve got the National Software Reference Library piece set up, we’ve got the ITAs, we’ve got a chain of custody from the witness compile to the end user, there has to be documentation, and it has to be verified in the system testing piece by the ITAs to verify that, in fact, following the users documentation, you can properly install this system, and I’m just -- I’m not sure that we need to make it any more complicated than that.
	MALE:  I think there’s -- there’s a need for having some complexity here in the sense that, you know, any computer security fellow will tell you, or woman, will tell you that you can’t have a system test itself.  If the system has been hacked, it cannot test itself.  You can’t do a directory listing and trust the results and so on, too, so the complexity we’re talking about is intrinsic to the issue a bit.  You know, every -- every piece of software that’s on that machine could be.  So the question is, you know --.
	MALE:  Well, I use -- I use directory listing as an indication or basically an analogy on the issue of running software on the computer.  We do a binary file compare.  And we either do a binary file compare by copying off the software to another machine, or by running the compare on the machine that’s the object.  Either way, you can’t do it without running some application, even if it’s a low-level DOS command on the target machine.
	MALE:  I’ve got a question for Ron.
	MALE:  Yes.
	MALE:  Ron, are you there?
	MALE:  Yes.
	MALE:  Can you hear me?
	MALE:  Yes.
	MALE:  What -- what do we gain over what you’re talking about that we don’t get from the hashing algorithms.  They’re not intrusive and the ones that we use in Georgia that are based on fifth algorithms, it’s estimated that you couldn’t modify that system without us detecting it and with odds something like 10 billion to 1.  So what -- what -- what --
	MALE:  Yeah, there’s a whole ‘nother subject there with the hashing out --
	MALE:  -- I need? 
		MALE:  -- in fact, there, a conference running in parallel with ours in hashing algorithms and some of the recent advances there, and if you’re using the Shaw 1 (phonetic sp.) algorithm, I recommend you change your algorithm for it because that’s no longer as collision-resistant as it was once believed to be.  But by and by, even putting that aside, there is a significant difference here.  When -- when you’re running a hashing algorithm, that hashing check is worthless if the hash check computation you’re doing is compromised, so you’re trusting the integrity of the hash re-computation algorithm and, you know, if you’re running a hash computation on a compromised machine, you have no confidence of what you’ve got there is correct, so there’s a big qualitative difference between trying to run something on a potentially-compromised machine or not.  
	We’ve had a lot of go ‘round here.  I’d like to, you know, this is a topic that clearly dear to my heart, too, and one that I think is important to us, but I think we need to make progress on all of these, too, so I’d like to.
	MR. CHAIRMAN:  May I -- may I suggest something?
	MALE:  Yeah.
	MR. CHAIRMAN:  What I’m hearing is the issue we’re struggling is 3.1.1.1.  Would it -- we could either propose to delete 3.1.1.1 if we are comfortable with the rest of it, or we can make that a should or could say the process used to verify software should -- should preferably require the execution, or something like that, for future reference.  Would that accomplish?
	MALE:  Let me -- let me make a motion, Mr. Chair.  If you’re -- are you back in the chair?
	MALE:  I’m just --.
	MR. CHAIRMAN:  No, I’m -- I’m acting as a member at this point.
	MALE:  Okay.
	MALE:  Is that a motion then or is that just a suggestion?
	MR. CHAIRMAN:  Well, I was asking whether that’s.
	MALE:  So that’s a statement from (indiscernible).
	MALE:  Let me make a motion that we revise 4.3.1.1 to read, system user manuals shall provide users with a process to verify -- well, with a process to correctly --.
	MR. CHAIRMAN:  This is a brand new text or are you reading?
	MALE:  This is brand new text.  I’m making it up.  [laughter]  System user manuals shall provide users with the process to correctly install the system and verify that the system has been correctly installed and that the software has not been modified using the reference information from the NSRL or other EAC-named repository.
	MR. CHAIRMAN:  What is different in that from what’s here?
	MALE:  The fact that I’m going to suggest to strike everything else in 4.3.1. 
	MR. CHAIRMAN:  You mean 1.1.1 et cetera?  What do you mean strike everything else?
	MALE:  Yeah.  Replace 4.3.1.1 with that, which we said in 4.3.1, “System validation method shall verify that no unauthorized software is present on the voting equipment.  System user manual shall provide users with a processes to properly install the system and verify the correct software is loaded.  There’s no unauthorized software and the sys -- the equipment has not been modified using the reference information from NSRL or other EAC-named repository.”  And I understand that I changed that slightly that time around, but that’s what I’m trying to get to.  And then strike the rest of this.
	MALE:  So, anybody wish to speak?  If not, I will.  And I think that what we’ve got here essentially says that you want the vendor to supply the appropriate information and procedures to do that --
	MALE:  Yeah.
	MALE:  -- and so I think that’s what you’ve got and so I would recommend over what Paul suggested that we just stick with what we’ve got.  So you proposed a motion.  So there’s a motion on the floor.
	MALE:  Motion on the floor to re-word 4.3.1.1 somewhat close to --
	MALE:  So (indiscernible)
	MALE:  -- what I got out and to strike 4.3.1.1.1  through 4.3.1.2.4.  
	MALE:  So you’re proposing -- you had some language which I didn’t capture, but I hope somebody did.  Yeah.
	FEMALE:  I got it.
	MALE:  Which would replace all the sub leaves of 6.0.4.3.1.1.  Is that correct?
	MALE:  Correct.
	MALE:  Okay.  Does anybody need that to be re-read or wish to comment on?
	MR. CHAIRMAN:  Do we have a second?
	MALE:  Further discussion?
	MALE:  Okay, I would speak against the motion.  The -- trying to look through here, what I see some of the stumbling blocks is one, the -- the use of shall and I think maybe we can take a -- go back through here and see if should would be another alternative to that.  Secondly, where -- where it said shall or where -- where 4.3.1.1.1 is worded, it basically says that any process must do this.  So therefore, it’s an inline requirement that if you’re validating, you must go through this step.  And yet what I hear from -- and again, I’m not an expert on the practical aspects here -- but what I hear is that there may be times when that is stated and there may be times when it’s not needed --
	MALE:  Uh-huh.  (affirmative)
	MALE:  -- in terms of the kind of degree of risk they think has gone on and therefore, making 4.3.1.1.1 more of an option in terms of the process, but that the vendors should provide documentation on how to do it is one of the things I keep hearing is it’s our job to provide, you know, guidelines and recommendations and so one of the guidelines is -- and here is the best practice, that there are occasions when you need to be able to, you know, test the system in a resting state, not running anything on that system, with an external kind of device or whatever that’s needed.
	MALE:  Uh-huh.  (affirmative)
	MALE:  But not a requirement that it’s always done.  In order to do a validation, you don’t always have to do that.  You may not have the capabilities or whatever.  So wording it such that vendors should document a process that can be used to verify, et cetera, et cetera, would be a proposal alternative.
	MALE:  I think that’s consistent with what’s actually here, isn’t it?  Because it says that they shall specify and it shall not require, et cetera, but it doesn’t say when it has to be done, so this -- this procedure at the discretion of the election officials, in fact, well, this section right here does not need to be performed.  I think there may be a later section that talks about that that we can talk about.  But when it needs to be performed.  But I think we’re consistent with that.  
	We have a motion on the floor and a second.  Further comments?
	Call a motion.  I think there’s apparently going to be disagreement, so should we do a roll call?  Parliamentary, do we have a recommended procedure here?  Why don’t I ask for a roll call vote since I suspect this will be a divided vote?
	MALE:  This is voting on the motion to -- to leave 6.0.4.3.1.1.1 et cet?  And to re-write --?
	MALE:  Yes.  Maybe we should re-read the motion in its entirety.
	MALE:  Okay, as I understand my motion at this point, [laughter] I -- I was suggesting a re-write of 4.3.1.1, the spirit of the re-write to require system user manuals to provide users with the necessary information to do the task --
	MR. CHAIRMAN:  Just a point of clarification.
	MALE:  -- and striking every.
	MR. CHAIRMAN:  Just a point of clarification.  We cannot hold user manuals responsible for anything.  They’re not entities.  I mean, who generates users manuals?
	MALE:  Okay.
	MR. CHAIRMAN:  That’s why we have vendors.
	MALE:  Vendors shall --.
	MR. CHAIRMAN:  And that’s why I didn’t understand because the rest of it, it sounded very much like what you have here.  I don’t think standards should say “user manual”.  I mean, who is going to do the user manual?  Who -- who is responsible?
	MALE:  The vendor produces it.
	MALE:  (indiscernible) process was concluded.
	MALE:  Uh-huh.  (affirmative)
	MR. CHAIRMAN:  Yes, of course.  That’s part of documentation.
	FEMALE:  Want me to read you a (indiscernible)?
	MALE:  Yeah.
	MALE:  Do we want to have a --?  [laughter]  
	FEMALE:  Paul’s motion is “Vendor shall provide user manuals with the process to correctly install the system, to verify that the system has been correctly installed, and has not been modified using the NSRL” and I’ll add a few more words.  And to strike 3.1.1.1. 3.1.1.2, and 3.1.1.3.  
	MALE:  I thought it went further than that.  Was the (indiscernible)?
	MALE:  Yeah, it was -- it was through --
	MALE:  (indiscernible)
	MALE:  -- all the way through 4.3.1.2.4.
	FEMALE:  All the way through what, Paul?
	MALE:  All the way through 4.3.1.2.4.
	MALE:  4.3.1.2.4.
	MALE:  Line 35.
	FEMALE:  Okay, all right.
	MALE:  Through line 35, yes.
	MALE:  Yes.
	MALE:  So the motion’s been read.  Any questions about what it said?
	FEMALE:  (indiscernible)
	MALE:  You wanna ask any questions on?  If not, then why don’t we move for a vote.  I suggest a roll call vote.  
	MALE:  Roll call vote.  Williams?  Williams?  Williams is absent.  Berger?
	MALE:  Yes.
	MALE:  Berger votes yes.  Craft?
	MALE:  Yes.
	MALE:  Craft votes yes.  Davidson?
	FEMALE:  Yes.
	MALE:  Davidson votes yes.  Elekes?
	MALE:  Yes.
	MALE:  Elekes votes yes.  Gannon?
	MALE:  No.  
	MALE:  Gannon votes no.  Harding?
	MALE:  Yes.
	MALE:  That’s a yes?
	MALE:  Yes!
	MALE:  Harding votes yes.  Miller?
	FEMALE:  Yes.
	MALE:  Miller votes yes.  Purcell?
	FEMALE:  Yes.
	MALE:  Purcell votes yes.  Quesenbery?
	FEMALE:  No.
	MALE:  Quesenbery votes no.  Rivest?
	MALE:  No.
	MALE:  Rivest votes no.  Schutzer?
	MALE:  No.
	MALE:  Schutzer votes no.  Semerjian?
	MR. CHAIRMAN:  No.
	MALE:  Semerjian votes no.  We have 7 in favor.
	MALE:  Motion fails.
	MALE:  Motion fails.  The majority would’ve been -- would’ve been 8 votes; we only had 7.
	MALE:  Thank you, Mr. Greene (phonetic sp.).  So the motion failed, did not pass.  We still have before us, then, 6.0.4.3.1 as -- as given in the section here and --.
	MR. CHAIRMAN:  May I make a motion?
	MALE:  Yes.
	MR. CHAIRMAN:  That we modify 3.1.1.1 to read “The process used to verify software should require -- should not require execution.”  Basically, make that shall a should.
	MALE:  Is there a second?
	MALE:  I’ll second that.
	MALE:  Discussion?  Any discussion online?
	MALE:  No.
	MALE:  Shall we have a voice vote on this or?
	MALE:  Yeah.
	MALE:  Yeah.
	MALE:  Let’s do a voice vote.  Voice vote, all in favor?
	MALE:  Aye.
	MR. CHAIRMAN:  Aye.
	FEMALE:  Aye.
	MALE:  All against?  The motion passes.  So now we’re on to 6.0.4.3.2.  Maybe Nelson can lead us through that, then?
	MALE:  6.0.4.3.2?
	MALE:  6.0.4.3.2 at the bottom of page 668.  
	MALE:  Okay.  This is the setup validation method shall verify the registers and variables of the voting system and train the proper static and initial values.  The next req -- sub requirement underneath there basically states that a vendor shall supply a method to query the system to determine those values.  The next requirement underneath that says that the vendor shall document the initial starting values of all dynamic and registers and variables.  That needs to -- that’s gonna need to be expanded to include static variables and -- and -- and -- and registers as well.  Then the next requirement basically says prior to -- election officials shall query the voting system to determine that those values are -- are -- are the documented values.  And the next requirement says that any anomalies will be analyzed and resolved before the election.  
	MALE:  Okay, are y’all trying to say that you’re going to print a zero report before each election?
	MALE:  It’s -- it’s a little bit more than -- oh, go ahead.
	MALE:  No, go ahead.
	MALE:  Okay.  It’s a little bit more than a zero report.  If there’s other static variables that’s in there, in the system, such as a plus 1, you wanna make sure that it’s plus 1 and not plus 2 or 3.  That’s -- that’s the essence of this.  But it’s based on -- on the zero report concept.  
	MALE:  And you envision doing this both on the DRE machines and the central machines?  Crap.
	FEMALE:  (indiscernible)
	MALE:  I’m not -- I’m not sure that can be done by us six.
	FEMALE:  Is -- I was going to say, isn’t it -- are you intending that to be done by the judges before they open up the polling location?  Is that where you’re having it done?
	MALE:  The way it is written, that’s what we’re -- where it is.  
	MALE:  (indiscernible) polling location.
	MALE:  Wait.  It says --.
	MALE:  Polling place workers doing that.
	MALE:  It just says election official, so before the election, so it doesn’t specify at the polling place.  Could be at the warehouse, I guess.  
	FEMALE:  If that could be part of your public test or something like that, but I see some issues when you get to your judges at the polling place to even know what they’re doing.
	MALE:  But the way I -- I read it, it doesn’t -- doesn’t necessarily say at the polling place.  Says before the election.
	MR. CHAIRMAN:  So before the election could be a week before, could be three days before, or -- is that correct?  I mean, it doesn’t have to be that morning of the election.
	FEMALE:  No.  It can be several days before.
	MR. CHAIRMAN:  Right.
	FEMALE:  And the only thing is is I think that should be a should so that -- that it’s done by the 2008.
	MALE:  Yeah.
	FEMALE:  Instead of shall because I’m not sure that that can be accomplished by 2006.  
	MALE:  If I could comment.  I think there’s several places for shalls and shoulds here.  I think --
	FEMALE:  I think so.
	MALE:  -- one of the things that concerns me the most is -- is 6.0.4.3.2.3 --
	FEMALE:  Right.
	MALE:  -- prior to election, voting officials shall query the voting system.  If -- if there’s, you know, 100,000 static variables in the program, that’s quite a few to query --
	FEMALE:  [laughing]
	MALE:  -- and I think we should give the election officials some discretion to -- to skip that step in that case.  So I -- I would move that -- entertain a motion that at least 6.0.4.3.2.3 should be made a should.
	FEMALE:  Do you want to add to those some of the other places that should be shoulds instead?
	MALE:  As far as I understand the hierarchy, if we take Secretary Davidson’s recommendation and made 4.3.2 a should and everything underneath it becomes a should.
	FEMALE:  Right.
	MALE:  I’m personally not unhappy with others being shall, myself, so.
	FEMALE:  Are you -- do you really wanna make 3.2.2 which is “shall document initial starting values” a should?  I -- I -- I would assume that that’s actually being done already.
	FEMALE:  If you’re considering about our zero tape that we run --
	FEMALE:  No.  This is “vendors shall document”.  So, the question is shall we make this a blanket should and I wonder whether that ought to be a should.  We could -- if we leave the top -- if we leave the top level a shall and make sub point 1.3 and 4 shoulds and leave number 2 a shall, then we sort of left it in the realm of possibility while still preserving the text.
	MALE:  (indiscernible)
	FEMALE:  So 1, 3, and 4 become shoulds.
	MR. CHAIRMAN:  Mi -- microphone, please.
	MALE:  Okay.  1, 3, and 4 under 4.3.2.  Okay.
	MALE:  Do we have a motion on the floor to --?
	MR. CHAIRMAN:  Microphone.
	MALE:  Oh, sorry.  1, 3.  We -- believe -- do we have one motion?  Did you make a motion, Secretary Davidson?
	FEMALE:  No, I -- I.
	MALE:  That was a comment.
	FEMALE:  (indiscernible)
	MALE:  So, so.
	FEMALE:  I move that we modify sub -- section 6.0.4.3.2 sub sections 1, 3, and 4 to change them from shalls to shoulds.
	MALE:  So 1, 3, and 4 from shalls to shoulds.  Is there a second?
	MALE:  I’ll second.
	MALE:  Discussion?  Patrick?
	MALE:  Question:  Is it just the sub ones or should 6.0.4.3.2, will that still remain a shall or a should?
	FEMALE:  Let’s leave that a shall (indiscernible).
	MALE:  (indiscernible) shall and shoulds requires that that be a shall.  Further discussions?
	MALE:  Ron, J.R.  I think you outta make it clear and maybe break down into two motions or something just doing the 4.0.3.2 and then going into the .1, .2, .3 and 4.
	MALE:  There’s a specific proposal on the floor to leave 4.0.3.2 the same because it needs to be the same because the rest of the motion leaves one of the shalls standing.
	MALE:  Okay.
	MALE:  And then the specific motion, if I can repeat it is to change the shalls in 3.2.1, 3.2.3, and 3.2.4 to shoulds and not make any other changes.
	MALE:  All right.
	MALE:  It is a bundled motion, I understand, but they go together sort of.
	FEMALE:  See if we can do it.  [laughing]
	MALE:  Further discussion?  All in favor?
	MALE:  Aye.
	FEMALE:  Aye.
	MALE:  Aye.
	FEMALE:  Aye.
	MALE:  All against?  The ayes have it. 
	MR. CHAIRMAN:  Okay.
	MALE:  Motion passes.  And the final section of this part, then is 6.0.4.3.3.  
	MALE:  And basically, it just says that voting officials shall run the verification process before the election.  The last -- the sub bullet to that just says they shall document the results of that verification.  And then the next sub bullet after that just says that the anomalies should be analyzed and resolved before the election.  So.  And that concludes that section.
	MALE:  Comments on that?  That would be moved into the best practices section (indiscernible).
	MALE:  (indiscernible) going on there?  Any major changes?
	FEMALE:  Did we have -- I -- as I recall, we had a lot of discussion but not a lot of changes and in the interest of not having to come back while this is fresh in our mind, I wonder if we could handle the accepting of this discussion --
	MALE:  Yes.
	FEMALE:  -- while we’re right here.
	MALE:  So there’s a -- there’s a magic script which I can read here.  Which is right here.  Are there any more motions or requests for unanimous consent to change the content of the software distribution setup validation requirements for VVSG version 1 that we’ve just reviewed?
	There being no further motions to change the VVSG version 1, volume 1, section 6.0.4, I will now entertain a motion for the TGDC to adopt this draft of section 6.0.4 as part of the -- its first set of recommendations to the Executive Director of the EAC subject to changes expressed in any motions we have adopted today that expressly apply to section 6.0.4 which changes shall be made person to TGDC Resolution 3705.  
	MALE:  Hey, Ron, this is J.R.  
	MALE:  Yes.
	MALE:  If I heard you right, we’re about to take a vote on the whole section 1, correct?
	MALE:  On section 6.0.4.  That’s correct, yes.
	MALE:  Oh, no, just section 6.0.4.  Okay.  No, I’m fine.  Go ahead.
	MALE:  Yes, just -- just the part on the distribution of voting system software and setup validation.
	MALE:  Right.  That’s fine.  Go for it.
	MALE:  So.  Okay.  I need to think.  I need somebody to actually --
	FEMALE:  I’ll second.
	MALE:  -- second with the motion and second the motions.
	FEMALE:  I’ll make the motion.
	MALE:  Do we have a second?
	MR. CHAIRMAN:  I guess I can second that.
	FEMALE:  (indiscernible)
	MALE:  (indiscernible) all in favor?
	PARTICIPANTS:  Aye.
	MALE:  All opposed?  The rest of this by roll call?
	MALE:  Can I -- can I raise one point?  I just want to clarify.  Over the last couple of days in our minds, we understood what should and shall mean.  I’m a little concerned about 6.0.4.3.1.1.1.  Page 6-67.  It’s where we use it with a modify -- with the word “not” after it.  I wonder if that is going to mean something else to the rest of the world.  The process used to verify software should not require.  Is that?
	MALE:  Oh, I think you’re right there.
	MALE:  That concerns me that it’s not that should not and shall not maybe will be viewed as being the same thing whereas should and shall are two different things, at least in our minds the last two days.
	MALE:  Excuse me.  Shall not is -- is actually defined in our conformance clause as being prohibited.  So it’s -- it’s at least clear what shall not is.  
	MALE:  Should not might be prohibitive whereas --
	FEMALE:  Well, can I -- can I --
	MALE:  -- should means encouraged.
	FEMALE:  -- let me just suggest a re-wording that would be very quick.  The process used to verify software should make it possible to perform this verification without requiring the execution of software, et cetera.
	FEMALE:  (indiscernible)
	FEMALE:  Should make it possible to perform without requiring.
	MALE:  Yeah, I think putting the “not” later in the sentence --
	FEMALE:  Okay, so.
	MALE:  -- I think it makes it --.
	FEMALE:  Does someone -- does someone have that whatever I just said?  [laughing]
	MALE:  I think that’s -- okay.  
	MALE:  Should and not being next to each other.
	FEMALE:  Yeah, it (indiscernible) the way you want and it makes it clear that you should perform and that in performing, you should not -- yeah.
	MALE:  Can we table that as an editing change?
	MALE:  Yes.
	MR. CHAIRMAN:  Yeah.
	MALE:  Thank you, Mr. (indiscernible).
	MALE:  All right.  So we’ll take a roll call vote on 6.0.4.  Williams?  Absent.  Berger?
	MALE:  Yes.
	MALE:  Berger votes yes.  Craft?
	MALE:  Yes.
	MALE:  Craft votes yes.  Davidson?
	FEMALE:  Yes.
	MALE:  Davidson votes yes.  Elekes?
	MALE:  Elekes votes yes.  Gannon?
	MALE:  Yes.
	MALE:  Gannon votes yes.  Harding?
	MALE:  Yes.
	MALE:  Harding votes yes.  Miller?
	FEMALE:  Yes.
	MALE:  Miller votes yes.  Purcell?
	FEMALE:  Yes.
	MALE:  Purcell votes yes.  Quesenbery?
	FEMALE:  Yes.
	MALE:  Quesenbery votes yes.  Rivest?
	MALE:  Yes.
	MALE:  Rivest votes yes.  Schutzer?
	MALE:  (indiscernible) lost.
	MALE:  Absent at the moment.  Semerjian?
	MR. CHAIRMAN:  Yes.
	MALE:  Semerjian votes yes.  It’s 11 votes in favor; the motion passes.
	MALE:  Thank you.  The motion passes.  We should now take a short break.  Any announcements from?
	MALE:  Mr. Chairman, can I just ask some clarification for editing instructions for NIST?
	MALE:  Yes.
	MALE:  I brought up the question before about voting officials and best practices and -- and -- and reminded everyone that they were not mandatory in the best practices.  I spoke to Britt Williams and he said yes, we -- we want to keep them as best practices, so I -- I have a couple of questions.  Number 1, then, I want to make sure that all the voting official removals in the main body, we still want to keep as best practices.  Is that -- is that agreed upon when we do our editing?  Best practices for voting officials is a specific appendix.  That’s question 1.  Question 2 is what do we do about the main body?  Again, we have a little bit of an inconsistency that we remove voting officials sometimes from the main body.  We could remove voting officials throughout the main body, or we could say them differently.  We purposely put them in the main body so it -- to maintain the flow of the functionality of the standard.  We could, in fact, change all the references to voting officials to say something like in the main body, best practices, voting officials do this without a shall or a should.  That’s one suggestion.  Another suggestion is -- is being consistent about voting officials in the main body.  We could, for instance, change them to all shoulds or we could remove them.  Or we could follow the specific editing instructions, which I fear will leave us to be a little bit inconsistent in the main body in the sense that sometimes we leave them and sometimes we remove them.
	FEMALE:  Mr. Chair?
	MALE:  Will the committee --?
	FEMALE:  Did we actually take a vote to remove voting official references?  I don’t believe so.
	MALE:  In some cases, we did.
	FEMALE:  No.  In some cases, we specifically removed them from here, but I think those were often because no one wanted them anywhere.  
	MALE:  Well, Britt’s (indiscernible) was that he thought they ought -- they belonged in best practices even though we removed them (indiscernible).
	FEMALE:  But that’s not what we said and that’s not what we voted on.  I would like to speak in favor of leaving them somehow in the section.  I realize that leaving infor -- sort of semi-informational material in the body of the standards document poses some structural problems from the point of view of well-formed standards; however, I think that in this -- in the case of this type of standard, the standard for this material, and especially in 2.2.7 in the accessibility and usability sections, there are times when the actions of voting officials following the best practices that we’re prescribing whether with shoulds or shalls is really integral to the living up to not just the letter but the spirit of the standards that we’re creating.  I would be happy to vote on something that said we would somehow mark them, we would find a different semantic device to -- to identify them, or anything of the kind, but I really don’t want to see them removed from the main section.  
	MALE:  And although I would really like to see them removed, I have to agree with Whitney; we did not vote a resolution to remove them at all.
	MALE:  So do -- do I hear a sense that we want to re-word them in the main section to call them best practice and take out shalls and shoulds?
	FEMALE:  I -- I think it at -- at minimum, they should be clearly identified.
[End of Audiotape 8, Side A]
	FEMALE:  -- as they say, there was -- the voting officials are responsible for them -- I mean, I have -- I have talked to a number of you.  I have some information design issues with the entire document in general.  I know this is a draft, I know that it’s hard to format a document while you’re trying to write the document, but we in this committee have -- had some clarity issues with reading the nested levels, so I think there’s two issues that we’ve faced that could be addressed either through information design or through some clear wording.  One is the top-level shalls that are general statements which I understand their structural purpose and I understand their semantic purpose.  And the other are the best practices where, again, we’ve gotten -- it’s a slightly funny document and yet the oddity of that doc -- the oddity of -- of what you’ve done with regard to general standards practices actually meets the need for this context.  So I -- I don’t quite have the answer, but I do think that we need to address that somehow.
	MALE:  And again, the sec -- the second part of the question is, I think that we need to achieve consensus as well.  Britt’s sense was he told me when he specifically said take them out, he did not mean take them out from best practices.  He meant take them out from the main body, so we need guidance on when we were told to take them out from the main body whether they stay in the appendix as best practices.  
	FEMALE:  Britt may have told you to do that, but the committee didn’t.  
	[laughter]  
	MALE:  I don’t -- I don’t think the committee spoke to that issue.  They said take them out of the main body.
	FEMALE:  I -- we did address it.  We specifically looked at places where we felt that it was inappropriate to have a specific clause of any kind.  We removed many of them, we did not take any blanket thing.  In the case of 2.2.7, we would have to go back through that very carefully to look at that.  I think that might be true in some other cases as well.  
	MALE:  Secretary Davidson.	
	FEMALE:  What have we -- if it’s not removed, we do have to come up with a -- I think, give guidance to NIST on how we want it.  I mean, because as you said, we had the shalls; we had the shoulds, and then we maybe identify someway else and say this was left in but no decisions were made or something.  	FEMALE:  Actually -- actually, I do have a suggestion which is that we leave them in in the position where they are now, but we remove them from the numbering order.  I -- but I think this is probably like some of the editing things.  I’d be happy to work with you guys on this.  I think there’s some other information designers available to work on it, but I -- so one solution is to make them boxed call outs rather than numbered clauses.  
	FEMALE:  And then I think that definitely needs to be a footnote or a statement someplace of what those mean.  
	MALE:  One slight complication.  Sometimes we have more than one responsible entity, so we may have vendor and voting official.  So in that case if we take that out of the numbering scheme, we lose the requirement for the vendor.  
	FEMALE:  If they’re -- if they’re a requirement for the vendor, they stay there.  And as I understood the best practices section, that was an appendix that was a useful guide that saved people from having to go through and highlight things to find ven -- voting official sections.	
	MALE:  If I could make a comment to respond to your question.  I think that -- at this stage of the game, simplicity is important, so I would be happy with leaving, personally, with leaving them in the text as numbered even and maybe with square brackets, best practices and the reference to the appendix where they appear also and then some text up front sort of saying that we have left in the main body of the text some of the -- in -- in the position the committee considered them, some of the best practices that are collected together at the end of the document and -- and because they seem integral to the intent of that section as well for reference purposes.
	MALE:  Is that -- is that the sense of the committee?
	MALE:  The people want to comment.
	FEMALE:  Would -- would you actually like a motion on this?
	MALE:  That would be helpful. [laughing]
	MALE:  Would you like to make a motion?
	FEMALE:  Yeah, I’d like to offer a motion that where requirements that are -- that are -- where the only responsible party is a voting -- is a voting official have been left in -- are still part of the standard, that they be identified with some clear statement with like bracket, best practices, bracket or some other device that you come up with so that readers of this document, no matter where they begin in the document, can be very clear of the intent of the inclusion of those materials.
	MALE:  Does the motion have a second?
	MALE:  Second.
	FEMALE:  Sorry.  That was way more than anybody wanted me to say in one sentence.  [laughing]
	MALE:  Any other discussion?
	MALE:  So may I assume from that that if we have a responsible entity which is two things, a voting -- a vendor, for instance, and a voting official, we break them separately, take out the --?
	FEMALE:  If you have two things of voting -- a vendor and a --
	MALE:  We haven’t quite (indiscernible).
	FEMALE:  -- voting official, I would just leave it.  The voting official can be treated as informative in that case.  
	MALE:  Okay.  That’s many --.
	FEMALE:  Whether you pull that out into best practices as a du -- as a duplicate reference.
	MALE:  Well, yeah.  We’ll leave it as it is.  (indiscernible) read in place for the vendors as a requirement, can be with the square brackets, it can be read in place also as a best practices, is copied in the end as a best practices.  I think in that -- in that second location, the vendor part would be informative only, so.  
	Any further discussion?  All in favor?
	PARTICIPANTS:  Aye.
	MALE:  All against?  The ayes have it.  
	MALE:  Thank you.
	MALE:  So if there’s no further business, let’s adjoin for a short break.
	MR. CHAIRMAN:  Let’s come back quarter after and finish up.  Thank you.
	MALE:  (indiscernible) is that even though I double-checked it, Word went ahead and underlined a number of things that.
	FEMALE:  Oh.  (indiscernible) Word is evil.  They all know that.
	MALE:  Yeah so there are a lot of things there was no change.
	FEMALE:  Okay.
	MALE:  But.
	FEMALE:  I don’t think (indiscernible) simple.  I mean, for.  [laughing]
	MR. CHAIRMAN:  Let’s see.  I think we’re --.  
	MALE:  If anybody can hear me out in the hallway, we’d like to get started, please.
	MR. CHAIRMAN:  I think -- I think the members are here.  
	MALE:  Well, you got one on the phone.
	MR. CHAIRMAN:  I saw -- I saw Berger come in.  What happened?  Oh, here he is.  And Secretary Davidson.  So I think all the folks who are here and can we hear who -- who is on the phone?
	MALE:  J.R.
	FEMALE:  This is Alice (indiscernible).
	FEMALE:  (indiscernible) Rachelle.
	MR. CHAIRMAN:  Is Mr. Elekes with us?  Okay, we have -- we have 3, 7, and 309.  We have 10 so we continue to have a quorum.  
	Okay, so the first task at hand is approval of the VVPAT requirement section, section 6.0.1 -- 6.0.1, yes.  Security overview.  And you have a new document in front of you which has not only the changes from yesterday, but also changes from this morning, so this is the final document.  I had asked the -- the changes this morning were pretty simple editorials or take outs, so those are all done, and from yesterday, you had a chance to look them over, so I assume that you’ve had a chance to do that.  
	FEMALE:  Mr. Chair, I suggest that we take 2 ½ minutes to look them over quickly and then, perhaps, take a motion to vote on this section and see if we can and use any --.
	MR. CHAIRMAN:  Well, let me -- let me say, just go through my formal script.  Are there any motions at this point or -- or -- or request for unanimous consent to change the content of the gloss -- of the security standard, section 6.0.1?
	MALE:  Mr. Chairman, I think I’ll have a motion in a moment on two of these.  Let me get to it in the document.
	MR. CHAIRMAN:  Do you wanna take a few minutes?
	FEMALE:  Mr. Chairman, were the changes from this morning e-mailed to those of us who are on the phone?
	MALE:  We can do that (indiscernible).
	MALE:  (indiscernible) on that token (indiscernible).
	MR. CHAIRMAN:  We’re checking on it.  Just a minute.
	FEMALE:  Thank you.
	MALE:  (indiscernible) pull up it -- pull up those changes on the screen for me, would you, put up (indiscernible) this morning?
	MALE:  Alan!
	MALE:  Yeah.  6.0.1.  Put ‘em on my refreshable Purcell.  An e-mail comes in from Alan Eustis, pump it right to the Purcell system.
	FEMALE:  Would you like a mint?
	MR. CHAIRMAN:  No, thank you.
	FEMALE:  6.0.2.
	FEMALE:  The other guys are looking at the 6.0.2, okay?
	FEMALE:  That’s not what I just copied.  (indiscernible)
	FEMALE:  Huh?  Recycle bins.
	MALE:  At the request of the Chairman, I’d like to resume chairing, well, I hope Dr. Semerjian will be back with us in the near future to resume chairing, but I think we need to make progress here, so I’ve received a request to proceed as Chair.
	Do we still have a quorum?
	MALE:  How many do we have on the phone?
	MALE:  How many do we have on the phone?
	MALE:  Three of us, but the lady --.
	FEMALE:  Yep.  I’m still here.
	MALE:  And, James, are you still here?
	MALE:  That’s three, four, five, six, seven, eight, nine.
	FEMALE:  (indiscernible) nine.
	MALE:  Yep.  We’re fine, I think.
	FEMALE:  Mr. Chair, I noted an edit that didn’t make it into the current draft.
	MALE:  Yes, so let’s look at edits that didn’t make it in or edits that need to be made to the draft of 6.0 security standards.
	FEMALE:  Yep.  This is on page 6-12.  Thank you.  I’d like to thank Stephen Berger (phonetic sp.) for pointing this out.	
	The final line 19 of that page has a very short statement that says, “The privacy and anonymity of voters unable to mail or handle paper shall be maintained.”  The sense of that is still correct, but there was a longer, slightly more explanatory note which John will now read to you.  [laughing]
	MALE:  The requirement should read, “When the voter is responsible for depositing a paper record in a ballot box, the accessible voting station shall maintain the privacy and anonymity of voters unable to manually handle paper.”
	MALE:  That is -- that is clear, yes.  Shall we take that as an edit?  Any?
	FEMALE:  Uh-huh.  (affirmative)
	MALE:  Okay.  Next suggestion, comment, whatever.
	MALE:  Okay, 6.0.2.6.1 as written implies that all cryptographic -- actually, it’s says all cryptographic software in the voting station shall been approved by the U.S. government’s crypto module validation program.  We understand the intent of that is if the voting station makes use of one of the validation modules approved by the U.S. government crypto module program, the implementation chosen will be the specific one approved by the program.
	MALE:  There -- there may be more than one approved so it would be one of the a --
	MALE:  A one of these specific.
	MALE:  -- one of these (indiscernible).  So, if I can --.
	FEMALE:  Perhaps it should say any cryptographic software in the voting station.
	MALE:  No because there -- there are cryptographic softwares that are appropriate that are not in this program, but it would say this will have the Acme -- the Acme algorithm and there’s versions 1, 1.5, and 1.7 approved, but we don’t want ‘em using 1.2.  [laughing]
	FEMALE:  Is your -- is your point that it should be -- have been -- is it any cryptographic software used in the VVPAT?
	MALE:  No, no.  I think the intention was the original intent which is that if -- if the voting system uses cryptographic algorithms, that -- whose implementations are approved by the U.S. government’s crypto module validation program, then the vendor’s required to use one of the implementations approved by the CMVP.
	FEMALE:  So how would you change it?
	MALE:  Just what I said.
	MALE:  Can I -- just what he just said.
	MALE:  Yeah.
	FEMALE:  [laughing]
	MALE:  I’ll make what he said a motion.
	FEMALE:  I’ll second it.
	MALE:  So, did somebody write that down?
	FEMALE:  I think we can take that as an edit, actually.
	MALE:  Yeah.
	FEMALE:  And not as -- not have to take a motion on it.
	MALE:  I think it captures the intent we had originally --
	FEMALE:  Yeah.
	MALE:  -- as well there, so we’ll take that as an edit.  Okay.  Other changes, comments, suggestions, motions?  Anybody online, on the phone, have a comment on this section, 6.0, security standards?
	MALE:  Just finishing reading.
	FEMALE:  No.
	MALE:  Shall I give you a little more time?
	MALE:  I just need about -- about a minute.
	MALE:  Okay.
	MALE:  Takes a little bit longer to read the Braille copy.
	MALE:  I understand.  You’re doing remarkably well.  It’s a lot here.
	MALE:  Nope.  No comments or changes.
	MALE:  So I’m not sure what vote we need at this stage to clear this.  Turn to the parliamentarian for advice?
	FEMALE:  I think this is that long script.
	MALE:  Do I need to do that long script again, or?
	FEMALE:  Yes.
	MALE:  Yeah.
	FEMALE:  You need that script.
	FEMALE:  [laughing]
	MALE:  Thank you.
	FEMALE:  You can read the first one.  Just substitute VVPAT.
	MALE:  Are there any more motions or requests for unanimous consent to change the content of glossary -- sorry, the content of 6.0 security standards?
	FEMALE:  6.8.0.2.
	FEMALE:  6.8.0.2.  Requirements for verified voter paper audit trails.
	MALE:  I’m sorry.  Did I get the wrong one?
	FEMALE:  It’s the second page.  There you go.
	MALE:  6.8.0.2.  Yes, you’re right.  6.8.0.2 requirements for voter-verified paper audit trails for voting VVSG version 1 that we have just reviewed.  There being no further motions to change VVSG version 1, volume 1, section 6.0.2, I will now entertain a motion for the TGDC to adopt this draft.  6.0.2 requirements for voter-verified paper audit trails, as part of its first set of recommendations to the Executive Director of the EAC subject to the changes expressed -- do we need that part in?
	FEMALE:  Yep.
	MALE:  Subject to the changes expressed.  Any motions we’ve adopted today that expressly apply to this section, which changes shall be made person to TGDC Resolution number 3705.
	FEMALE:  So moved.
	MALE:  Second.
	MALE:  Do I have a second?  All in favor?
	PARTICIPANTS:  Aye.
	MALE:  Do we need a roll call voting?
	FEMALE:  Roll call.
	MALE:  Sorry.  Okay.  Roll call vote.
	MALE:  Roll call vote on 6.0.2.  Williams?  Absent.  Berger?
	MALE:  Yes.
	MALE:  Berger votes yes.  Craft?
	MALE:  Yes.
	MALE:  Craft votes yes.  Davidson?
	FEMALE:  Yes.
	MALE:  Davidson votes yes.  Elekes?
	MALE:  Yes.
	MALE:  Elekes votes yes.  Gannon?
	MALE:  Yes.
	MALE:  Gannon votes yes.  Harding?
	MALE:  Yes.
	MALE:  Harding votes yes.  Miller?
	FEMALE:  Yes.
	MALE:  Miller votes yes.  Purcell?  Purcell?  Purcell is not responding.  Quesenbery?
	FEMALE:  Yes.
	MALE:  Quesenbery votes yes.  Rivest?
	MALE:  Yes.  
	MALE:  Rivest votes yes.  Schutzer?  Schutzer’s not responding.  Semerjian?  Semerjian votes yes.
	MALE:  Mr. Parliamentarian, I just heard a beep.  I think we have someone else sign on in the process (indiscernible).
	MALE:  Did Purcell rejoin us?  
	MR. CHAIRMAN:  Did anyone join us?
	MALE:  Perhaps someone signed off.
	MALE:  At least we got their vote.
	FEMALE:  There’s somebody.
	MALE:  Is someone joining us?
	FEMALE:  Yes, Mr. Chairman, this is Helen Purcell.  I was momentarily offline.
	MALE:  We’re now voting on section 6.0.2.  Have you had a chance to review that?
	FEMALE:  Ye -- that’s a yes.  
	MALE:  You’re voting yes?
	FEMALE:  Yes.
	MALE:  Thank you.  Purcell votes yes.  That’s 11 votes in favor; the motion passes.
	MALE:  Motion passes so we’ve approved that section.  At this point, I’d like to return the chair back to Dr. Semerjian.  
	MR. CHAIRMAN:  Thank you, Dr. Rivest.  At this point, the remaining sections that we need to vote on are the glossary section -- the glossary which is Appendix A, the error-rate qualification testing which is part of Appendix C.  Are those the only sections that?
	FEMALE:  Uh-huh.  (affirmative)
	MR. CHAIRMAN:  So these are lengthy sections, but the changes are basically simple editorial changes.  I suggest that on this, somebody needs a clarification on these and I would entertain a motion to approve them.
	MALE:  Summative?  Well, got a problem.  [laughter]  
	MR. CHAIRMAN:  Mr. Craft.
	MALE:  The definition of absentee ballot really is inaccurate.  It provides an absentee ballot is a ballot prepared or cast by the voter prior to election day because the voter will be unable to vote in person or polling place on that day.  That is written includes advanced voting ballots.  And absentee ballot, legally, is different from a early voting ballot or a polling place ballot in that there’s a actual higher duty on the voter to go through a process and present his ballot, get it postmarked at a certain time.  And the real definition of a kind of varies from state-to-state.  So I think you might just let that be, “Absentee ballots are ballots designed for absentee voters as defined in individual states’ elections codes.”  I can’t think of any set of words that’s going to solve the problem.  
	MALE:  Is there a lot of variety in the definitions between the states?
	MALE:  Yeah.  Yeah, quite a bit.
	MALE:  So -- so a broad definition like that’s --
	MALE:  Yeah.
	MALE:  -- approp -- important.
	MALE:  Well, I -- Mr. Elekes -- just was wordsmithing.  Would it be more appropriate to say, “-- in the states’ respective codes” or “in state codes, respectively”?
	MALE:  That would be fine, yeah.
	MALE:  I’m just kind of wordsmithing here.
	MALE:  Yeah.  That’d be fine.  I -- I need wordsmithing.  [laughing]
	FEMALE:  Could we actually leave this entire thing and just add a comment following appropriate state guidelines or regulations?
	MALE:  Well, it’s -- it’s --.
	FEMALE:  I mean, this is -- this is right out of VSS.  
	MALE:  Well, things have changed since VSS, including HAVA.  I mean, a ballot prepared or cast by a voter prior to election day does not necessarily make an absentee ballot anymore.  So.
	FEMALE:  And I do agree with the -- the statement of “unable to vote in person”.  That’s not really always true.  They may choose not to vote and a lot of laws have been changed that has no reason to voting absentee.
	FEMALE:  If I may, it’s perfectly okay at this point if we delete this -- this -- if this is really contentious and a problem, to basically leave the term name in there and say “to be defined later” or something like that or just take it out?
	MR. CHAIRMAN:  Or how about -- how about “ballot prepared or cast by a absentee voter”.  Period.
	MALE:  Yeah.
	MR. CHAIRMAN:  Definition.
	FEMALE:  (indiscernible)
	MR. CHAIRMAN:  Yes, I understand.  But then I would say -- then I would say the definition of absentee ballot is jurisdiction-dependent.  Would that do it?
	MALE:  Excellent --
	FEMALE:  Absolutely!
	MALE:  -- excellent!
	MR. CHAIRMAN:  Because that’s --.  Other than that, any other comments on Appendix A?  Appendix C?  I guess we did not have any changes in Appendix B.  Is that correct?
	FEMALE:  (indiscernible) to Appendix C.  
	FEMALE:  Appendix B is simply a compilation of sections from elsewhere, so.
	MALE:  (indiscernible)
	FEMALE:  Well, perhaps since we’re looking at Appendix A, that we could -- and I’m sure we have to vote on these separately, that we could take a vote on accepting the glossary as it -- with the one modification?
	MALE:  I’ll second.
	MR. CHAIRMAN:  I believe I heard a motion to vote on Appendix A.  Any further discussion?
	There being no further motions to change VVSG version 1, volume 1, Appendix A, I’ll now entertain -- well, I guess we did this, but I will read that anyway for the record.  I will now entertain a motion for the TGDC to adopt this draft of Appendix A as part of its first set of recommendations to the Executive Director of the EAC subject to changes expressing any motions we have adopted today that expressly apply to Appendix A, which we did make one change.  Which changes shall be made pursuant to TGDC Resolution 37-05. 
	We have a motion and a second.  Any other discussion?  Not hearing any discussion, I will call for a roll call.
	MALE:  Roll call vote on App -- on Appendix A.  Berger?
	MALE:  Yes.
	MALE:  Berger votes yes.  Craft?
	MALE:  Yes.
	MALE:  Craft votes yes.  Davidson?
	FEMALE:  Yes.
	MALE:  Davidson votes yes.  Elekes?
	MALE:  Yes.
	MALE:  Elekes votes yes.  Gannon?
	MALE:  Yes.
	MALE:  Gannon votes yes.  Harding?
	MALE:  Yes.
	MALE:  Harding votes yes.  Miller?
	FEMALE:  Yes.
	MALE:  Miller votes yes.  Purcell?
	FEMALE:  Yes.
	MALE:  Purcell votes yes.  Quesenbery?
	FEMALE:  Yes.
	MALE:  Quesenbery votes yes.  Rivest?
	MALE:  Yes.
	MALE:  Rivest votes yes.  Schutzer?  Schutzer’s not responding.  And Semerjian.
	MALE:  Yes.
	MALE:  Semerjian votes yes.  
	MALE:  Mr. Chairman?
	MR. CHAIRMAN:  (indiscernible)
	MALE:  11 votes for.  Sorry.
	MALE:  I’ll let -- I’ll let him finish the votes.  
	MR. CHAIRMAN:  Okay.
	MALE:  11 votes in favor; the motion passes.
	MR. CHAIRMAN:  Thank you.  Yes, Mr. (indiscernible)?
	MALE:  Yes, on A-2 (phonetic sp.) for sources under Definitions and Glossary, I just noticed that on page 39 where it referenced section 5.0.8, we have that as amended section 5.0.8.  Might wanna put in 1998 and thereby it being consistent with like the ADA 1990 and so forth because as amended, it’s been amended a few times, 5.0.8 came in during ’98.  
	FEMALE:  Yeah, there’s actually (indiscernible) -- see if our citation that needs to be here.
	MALE:  Right.
	FEMALE:  Which we’ve got lots of other places.
	MR. CHAIRMAN:  Duly noted.  The change will be made.  Thank you.  
	Are there any motions or requests for unanimous consent to change the contents of Appendix -- volume 2, Appendix C?
	FEMALE:  (indiscernible)
	MALE:  I move for a request for unanimous consent.
	MALE:  So which section are we talking about?
	FEMALE:  Volume 1 or volume 2?
	FEMALE:  (indiscernible)
	MALE:  Wait a minute.
	MALE:  (indiscernible) voting officials?  (indiscernible)?
	FEMALE:  No.  Qualification test design criteria.  It’s the last (indiscernible).
	MR. CHAIRMAN:  The last 3 or 4 pages.  Qualification test design criteria.  We have a motion and second.  Any discussion?  Not hearing any, call for a roll call.
	MALE:  Roll call vote, volume 2, Appendix C.  Berger?  
Berger votes yes.  Craft?
	MALE:  Yes.
	MALE:  Craft votes yes.  Davidson?
	FEMALE:  Yes.
	MALE:  Davidson votes yes.  Elekes?
	MALE:  Yes.
	MALE:  Elekes votes yes.  Gannon?
	MALE:  Yes.
	MALE:  Gannon votes yes.  Harding?
	MALE:  Yes.
	MALE:  Harding votes yes.  Miller?
	FEMALE:  Yes.
	MALE:  Miller votes yes.  Purcell?
	FEMALE:  Yes.
	MALE:  Purcell votes yes.  Quesenbery?
	FEMALE:  Yes.
	MALE:  Quesenbery votes yes.  Rivest?
	MALE:  Yes.
	MALE:  Rivest votes yes.  And Semerjian.
	MR. CHAIRMAN:  Yes.
	MALE:  Semerjian votes yes.  
	MR. CHAIRMAN:  The motion is carried.  Appendix C, volume 2 has been adopted as modified.
	The final motion I will call for is a motion to adopt all of the sections that we individually approved.  I would like to make sure that we have a complete list of these.  Mark, will you please help me?
	We are talking -- we are talking about 2.2.7 --.
	MALE:  If I may, would it be more appropriate to have a motion to adopt the total document because it’s not just the sections we’ve --
	MR. CHAIRMAN:  Yes.
	MALE:  -- the flow of the total document.
	MR. CHAIRMAN:  Yes.  Very good point.  
	MALE:  VVSG 1 in its entirety.
	MR. CHAIRMAN:  We -- this -- this actually goes back to the point that I believe Dr. Williams made yesterday, that indeed, we’re not only approving the parts that were modified, but implicitly, we are approving the entire document, both the parts that were modified and the parts that were left intact.  So. 
	I now entertain a motion for the TGDC to adopt this draft of the VVSG version 1 in its entirety.  Do I have a motion?  Do I have a second?
	MALE:  Second.
	MR. CHAIRMAN:  Any further discussions?  
	MALE:  Yes, Mr. Chairman.  J.R.  
	MR. CHAIRMAN:  Yes.
	MALE:  When we deliver this document next week, will we have a transmittal letter or preamble to emphasize a few things like including persons with disabilities with the setup and the verification and training and those kinds of things?  
	MR. CHAIRMAN:  We will welcome any input the committee members would like to make on specific points that you would like to have included in the transmittal letter.  If you send an e-mail directly to me as well as copy Mark Scull (phonetic sp.) and Alan Eustis, my e-mail address is Hratch, h-r-a-t-c-h, @nist.gov.
	MALE:  Right.  I’ll get it there.  No problem.
	MR. CHAIRMAN:  I will be pleased to take your input into account in drafting of the transmittal letter.
	MALE:  Great!  Thank you.
	MR. CHAIRMAN:  Not hearing any further comments.
	MALE:  Question.
	MR. CHAIRMAN:  Yes.
	MALE:  Says we’re approving the entire documents.  I did have one note of something missing that I think should be added into the Appendix B which was Reference Information.  There were a couple of citations in the documents that referred to the (indiscernible) markup language specification?  And there’s not a reference in here that would allow (indiscernible) from this guidance documents is where I think it would be inserted.  We could ask to have that added -- that reference added in there?
	MR. CHAIRMAN:  If you could provide --
	MALE:  Yes.
	MR. CHAIRMAN:  -- that to us, we’ll be -- make the appropriate addition.  Any further comments?  If not, I call for a roll call to adopt the volume -- volumes 1 and 2 of the Voluntary Voting System Guidelines, version 1.
	MALE:  Roll call vote.  Berger?
	MALE:  Yes.
	MALE:  Craft?
	MALE:  Yes.
	MALE:  Davidson?
	FEMALE:  Yes.
	MALE:  I’m sorry.  Berger voted yes.  Craft voted yes.  Davidson voted yes.  Elekes?
	MALE:  Yes.
	MALE:  Elekes voted yes.  Gannon?
	MALE:  Yes.
	MALE:  Gannon votes yes.  Harding?
	MALE:  Yes.
	MALE:  Harding votes yes.  Miller?
	FEMALE:  Yes.
	MALE:  Miller votes yes.  Purcell?
	FEMALE:  Yes.
	MALE:  Purcell votes yes.  Quesenbery?
	FEMALE:  Yes.
	MALE:  Quesenbery votes yes.  Rivest?
	MALE:  Yes.
	MALE:  Rivest votes yes.  And Semerjian?
	MR. CHAIRMAN:  Yes.
	MALE:  Semerjian votes yes.  It’s 11 votes in favor; motion passes.
	MR. CHAIRMAN:  Well, with this motion, we have adopted the Voluntary Voting System Guidelines version 1, volumes 1 and 2.  I think this committee and the NIST staff that supported their activities ought to be congratulated for your outstanding work and dedication.  I thank everybody especially for still staying here at this hour.  Everybody deserves applause.
	We did not obviously have time to start the review of version 2, but as I stated at the very beginning, that the most important task at hand for this meeting was the approval of version 1.  And I think that’s a major undertaking and major accomplishment.  But that actually emphasize -- emphasizes the fact that the work of this committee is not finished, not complete and I would entertain a proposal that the work of the three subcommittees continue and they continue to work in the development -- on the development of VVSG version 2, and we have passed out a sheet to begin selection of suitable dates for the next meeting of TGDC in early September time frame.  And I open the floor for any further discussion of this topic at this time.
	MALE:  Yes, Mr. Chairman?
	MR. CHAIRMAN:  Yes, J.R.
	MALE:  Thank you.  I would move that the three (indiscernible) committees continue their labors on version 2.  I would also ask us and you, Chairman, to consider our next face-to-face meeting to be outside of the Washington, D.C. community in another state.
	MR. CHAIRMAN:  Do you have any particular suggestion at this time or is this something for us to deliberate on?
	MALE:  Well, I believe the Secretary from Colorado mentioned she’d welcome us in her state.  [laughter]  
	FEMALE:  We have a NIST --.
	MR. CHAIRMAN:  Yes, I have never been to Colorado [laughter], so I -- I would --.
	MALE:  I was kidding.
	FEMALE:  And we even -- we even have a NIST facility there, so.  [laughing]  I was surprised because we do have the NIST location there outside of Boulder, in between Boulder and Denver.
	MR. CHAIRMAN:  Certainly Boulder area, Colorado in general, is a very fine place to visit, and we appreciate the invitation from Secretary Davidson, and I’m sure NIST will be delighted to host such a meeting at our facility, so we -- we will take that under advisement and make appropriate arrangements.  Thank you for the suggestion, Mr. (indiscernible).  
	Any other comments?
	MALE:  Yes, Mr. Chairman.  It’s Jim Elekes.  
	MR. CHAIRMAN:  Yes.
	MALE:  So as not to conflict with Mr. Harding and our scheduled U.S. (indiscernible) is scheduled to meet in September on Monday, Tuesday, and Wednesday, the 12th, 13th, and 14th.  So if we -- if we could just ask consideration of the NIST staff that we don’t have to conflict with board business, it would be greatly appreciated.
	MR. CHAIRMAN:  Yes, we will certainly take that under consideration.  We actually have -- I know I have other commitments that particular week, so.  In fact, we -- you probably have not seen it, but a sheet was passed and two proposed weeks were September 5-9 or September 26-30th.  So that doesn’t mean that we’re ruling out other dates, but those were first offers, so to speak, so.
	MALE:  Mr. Chairman, just for those members of the committee who may be of the Jewish faith, to make sure that staff does not schedule in conflict with the Jewish holidays during the month.
	MR. CHAIRMAN:  We are quite aware of that.  Thank you.
	MALE:  I have a question of clarification on these dates.  Is this proposed for the next plenary meeting of the TGDC then?  There’d be nothing in between now and then.  Is that the proposal?
	MR. CHAIRMAN:  Well, do you have any -- that -- I think that is the proposal on the table, but I’m open, certainly, to other suggestions.
	MALE:  Well, if I could, Mr. Chairman, I would think that EAC would want us to move version 2 somewhat expeditiously so it was ready come January as opposed to next, say, summer, and perhaps maybe we could get together in June or July or August as opposed to September, you know.  I’m just thinking to keep this mojo moving.  [laughter]  
	FEMALE:  Well, I agree with you, J.R.  This is Whitney -- that we need to move on up, but perhaps the next time we meet in plenary, we should have completed a little more work on the -- at the subcommittee level.  I’m particularly aware that in the Human Factors and Privacy committee, we have a certain amount of research to do before we will be ready to draft our next version, so it would be nice to allow a little bit of time to get that work done.
	MR. CHAIRMAN:  My suggestion will be let’s pick a date in September, let’s see how much progress we have made.  If we think that we will have a fruitful meeting long before that, we can certainly poll the committee members and set another date and still use the September date as a second meeting, but let’s at least identify a date that we know we’re going to meet and then if we can arrange something earlier than that, we can think about that depending on how much how fast progress is made.  Is that acceptable to everyone?
	 MALE:  (indiscernible)
	MR. CHAIRMAN:  But I appreciate, certainly, your comments and I agree with you that we need to maintain the momentum of this work.  Are there any other issues?  Any other business?
	MALE:  Are we ready for new business?
	MALE:  (indiscernible) to enable the three subcommittees to begin work by telephone on their -- on the second version?
	MR. CHAIRMAN:  I couldn’t catch the first part of your question, J.R.
	MALE:  Well, Paul -- Paul asked if this was new business and I just thought we still needed to vote on the fact that the three subcommittees would continue their work on the second -- second version.
	MR. CHAIRMAN:  Well, we -- we -- I thought there was general agreement.  I mean, do we need to put a motion forward for that?  I assumed that was a given unless there’s an objection.
[End of Audiotape 8]
	MR. CHAIRMAN:  -- so then we will wait for a formal resolution, formal instructions from the EAC?  Is that?
	FEMALE:  Yes.
	MR. CHAIRMAN:  Okay.  All right.  
	Well, I -- I would say that our assumption should be that, you know, since it’s -- we’re only done with the first part of the job, that certainly, the expectations on the Hill is to continue this work.  But, certainly, it’s a formal understanding, a formal instruction from EAC would be useful.  
	Did you have some other new business, Mr. (indiscernible)?
	MALE:  Yes, sir, I have three new resolutions that I would like to -- and this is only one.  [laughing]  I got ‘em separate.
	MALE:  Was my -- was my understanding when we discussed that that was the only one you were going to bring up.
	MALE:  No, sir.  I’d like to bring up all three.  Can you put ‘em on the screen?
	MALE:  Yeah, we can do that.
	MALE:  Okay.
	MALE:  (indiscernible).
	MALE:  Please read them for us, Paul.
	MALE:  Pardon?
	MR. CHAIRMAN:  Yes, we -- will put it on the screen here and we’ll also read them.
	MALE:  Okay.  The first one entitled “Safe Harbor for Voting Systems Purchased Under HAVA” and actually, it’s got a typo on it so I’ll read off my screen.  “The Technical Guidelines Development Committee recommends that the EAC take steps to immediately publish a safe harbor list of voting systems qualified by NASAID or the EAC under the 1990 or 2002 voting systems standards which can be purchased in a configuration which will meet the requirements of HAVA for use after January 1, 2006.  And we recommend -- and the EAC should recommend that jurisdictions purchasing systems off the safe harbor list create purchasing contracts that include mandatory upgrades to their voting systems as new revisions of the Voluntary Voting System Guidelines become effective.  They remind election jurisdictions that the presence of the system on the safe harbor list only indicates compliance with HAVA but does not address compliance with individual state and local requirements and does not override any state or local requirements for voting systems.  And update the safe harbor list weekly or as new systems become qualified.”
	MR. CHAIRMAN:  Do I have a second?
	MALE:  Second for purpose of discussion.
	MR. CHAIRMAN:  I’d just like to add that according to the legal opinion from our general counsel is the last three items are outside the jurisdiction of authority, however you want to say it, of the TGDC.
	MALE:  Well, all four items, Mr. Chairman, are aimed at answering a question which we have brought up in discussions here several times in the last 2 days and which a number of people have been asking members of this committee, which is how do you transition to the new systems?  How do you transition to the new standards?  What are these jurisdictions out there waiting to buy equipment to do?  And, you know, basically, we are providing a suggestion to the EAC as to how they might do this.  And I don’t really find that it’s inappropriate for them -- us to give them a recommendation.
	MALE:  In short, Paul, would that be considered like a cheat sheet to help out those 600-some jurisdictions who need to buy new equipment?
	MALE:  Exactly, J.R.  It is -- I mean, there are -- I think we have discussed at length the fact that Congress intended that the current state of the art systems and current accessibility be available nation wide with an accessible device in each precinct by January 1.  There are systems out there that meet that now.  Unfortunately, there are jurisdictions out there that are waiting on the work of this committee to find out that they can really buy those systems or not.  They’re looking to the EAC for guidance and I think the EAC is looking to the committee here for guidance.
	FEMALE:  Paul, I just want to be clear about the intention.  I’m probably beating the dead horse a little bit.  
	MALE:  Okay.
	FEMALE:  But the idea is not to say that there are systems that were qualified under 1990 and 2002 VSS which are acceptable in their current form, but that there are systems that the EAC believes with it purchased in an appropriate configuration, would meet the spirit if not the letter of the VVSG 1.
	MALE:  Correct.  And that’s why I said purchased in a configuration. 
	MALE:  You said it appropriately, Whitney.  
	MALE:  Do we need to change the way it’s saying?  Stated?
	FEMALE:  I don’t think so.
	MALE:  Okay.  Okay.
	FEMALE:  I just wanted to double-check.
	MALE:  Yeah.  Yeah.  And then obviously, the second part since these --.
	FEMALE:  Actually, I guess I get -- well, let me just raise the question.  I’m not sure.  But we do say “meet the requirements of HAVA”.  Are we also saying “believe will meet the requirements of VVSG 1”?  So that’s -- that’s a question.  They are two slightly different things.
	MALE:  I’m saying HAVA.  Basically, the jurisdictions out there have a part of HAVA money that they -- they need to spend.  They’re looking for guidance on what they should spend it on.
	FEMALE:  Yeah.  And as much as I would like to say the second, I think that it’s probably impractical for any governmental body to do.
	MALE:  Yeah.
	MALE:  So I have two questions, clarifications.  What exactly are you expecting that would be published?  What’s on this list?
	MALE:  I’m expecting that a list would be -- include the system name, the NASAID or EAC qualification number, and be supplemented with any additional optional features such as an audio ballot station that would be required to meet the requirements of HAVA.
	MR. CHAIRMAN:  Now --.
	MALE:  It would be a very specific specification of what they could buy.
	MALE:  Are -- are these systems that have gone through a testing authority?
	MALE:  Yes.  These would be systems that are already either recently EAC or NASAID qualified, so what are commonly referred to as NASAID-certified systems.
	MALE:  So, you’re saying a list exists today?
	MALE:  No.  A list does not exist today.  I am suggesting that the EAC compile such a list and publish it.
	MALE:  You mean NASAID doesn’t have a list of qualified companies?
	FEMALE:  It isn’t -- it isn’t actually very hard to find the information.
	MALE:  NASAID -- NASAID has a list of qualified systems under the 2002 standards.  They have not, and neither has the EAC, published a list of which of those 2002 and 1990 systems will actually be acceptable under HAVA.  
	MALE:  And how would that determination be made?
	MALE:  The EAC will have to possibly huddle with their lawyers and make some decisions.  I would suggest that they consult with knowledgeable persons at NASAID such as a NASAID technical advisory board.  I am sure there will be issues of vendors wanting to be included that the EAC feels that they cannot include.  But this guidance is desperately needed by jurisdictions that are trying to make decisions with a very rapidly-eroding timeline. 
	MALE:  Okay, so by us recommending that they meet the requirements of HAVA, how does that, if at all, relate to any of the work this committee has done?
	MALE:  This, I think, gives the EAC a recommendation on transitioning to the work this committee has done.  Much of the work this committee has done, particularly in the areas of accessibility, there’s not going to be anything new before the ’06 election.  By the time this work can be completed and some sort of certification evaluation of these systems done against this, we’re -- we’re going to be in September and October, much too late for these jurisdictions to start making purchase decisions.  There are some very definite definitions of systems that are out there right now that will work and I think the EAC just needs to identify those to the people who are waiting on the information.
	MALE:  Okay, by -- by referencing meeting the requirements of HAVA, is there some implication that the -- the VVSG version 1 is then gets adopted by EAC and by the Election Assistance Commission and therefore once they adopt our recommendations on those guidelines, that then means that they’re part of HAVA?  That our guidelines then mean -- 
	FEMALE:  No.
	MALE:  -- if you meet those guidelines, you’re qualified under -- I’m trying to understand what the leakage is kind of behind the words here.  It’s not explicit in the words.
	MALE:  Basically a system that today meets the 2002 voting systems standards and has the accessible device, the audio ballot that you can put one of in each polling place, that meets the requirements of HAVA.
	FEMALE:  Paul, I feel -- I -- I hear how strong the need you’re expressing is and I suspect that this is a wonderful piece of work, but I wonder if it’s a piece of work for this committee and might not be something better suited for the EAC Standards Board or even for NASAID to make such a recommendation.  I just -- I don’t -- I just don’t quite understand how it fits with our work, and that’s -- that’s my only problem with it.  I mean, as a --
	MALE:  Okay.
	FEMALE:  -- as a piece of important advice and guidance, it sounds like it would be something very helpful and wonderful, but I -- I don’t even know that I’m qualified to vote on whether some -- on what would meet -- [laughing] sorry.  I just disintegrated there.
	MR. CHAIRMAN:  If I may, I would like to have the legal opinion experts by the -- by our attorneys, so.
	MALE:  It’s apropos what Whitney was just saying.  We were concerned that we were dictating to EAC in too specific or too detail a level of what they should then do toward industry.  And we did not have an objection with the spirit of -- of the proposal, the resolution.  The first two bullets are fine.  In general, you’re instructing, or you’re recommending -- excuse me -- the -- the concept of a safe harbor list.  We were concerned that the final three bullets went beyond that and went into great detail where we were telling the EAC what the -- the list would be and -- and the impact and -- and it just goes into greater detail.  And I think we were -- we believe that that was beyond the scope of HAVA which -- which is more bare bones, shall assist the Executive Director of the Commission that the TGDC shall assist the Executive Director of the Commission in development of voluntary voting system guidelines and that this goes beyond that, the final three bullets.  
	MALE:  Actually, well, probably the final two bullets.
	FEMALE:  Yeah, when you say three bullets, there’s actually a -- there’s a typo on this form.
	MALE:  Well, beginning with “recommend that jurisdictions purchase these systems off of the safe harbor list” and then on down from there.
	MALE:  Okay, I’ll -- I’ll amend the resolution if the second is in agreement to strike everything below “remind election jurisdictions”.  
	MALE:  Actually, the objection comes in one bullet above that.  And I apologize.  I was going off the pre-typo version, but “recommend that jurisdictions purchase these systems off the safe harbor list” that’s the beginning of -- of where we have concern.  If it ended at “January 1, 2006”, that would be -- that would not be objectionable.
	MALE:  Well, I think the second piece is -- it is not a requirement; it is a recommendation for the EAC to make a recommendation which they can then determine, but I think in the best interest of the voters and the people who are going to rely on this information, that would be very sound advice and I just -- I don’t see the problem with giving that advice. 
	FEMALE:  I’d love to hear from some of our election officials on this.
	FEMALE:  Well, I think I’m the only on here and I don’t know if there’s some on the telephone.
	FEMALE:  Actually, I’m here, Jeanetta (phonetic sp.).
	FEMALE:  I --.
	FEMALE:  And this is Caroline here, also.  
	FEMALE:  Okay, great!  My opinion is I see where I would love to have something like this.  Obviously.  But in my -- in my -- thinking it through, we are asking the EAC to put themselves in where maybe the Justice Department feels like a system doesn’t meet the requirements or somebody else and that they have it on the list or they don’t have it on the list, I think you’re setting the EAC up for possibly until the standards can be met and -- and everything is certified and they can print a list up that has been met to these new standards, I wonder if you’re setting the EAC up or -- for court battles.  And HAVA is very clear that you can’t spend any money that is federal underneath HAVA to fight any law -- court cases.  So I -- I definitely understand where you’re coming from; I love the idea, but I’m not sure we can do that.
	FEMALE:  I would agree with Secretary Davidson.  I feel that the EAC has not only appointed an advisory board but also a standards board and they will make recommendations to the EAC on things, and I believe things of this nature.  And I would -- if our legal counsel is saying -- if they feel it’s a little bit out of our purview, I’m not sure that I don’t also.
	FEMALE:  Yeah, let me just say for the record also, we do need to be cognizant of the fact that the Standards Board also has to get these recommendations before it goes any further so maybe, while I think, Paul, that’s an excellent idea for most jurisdictions out there that haven’t purchased, we may want to be a little bit careful with how we proceed to do that.  A list would be great.  It’s just a matter of who generates that list, where it comes from, and how it gets to where it needs to go.
	MALE:  Okay, well, Mr. Chairman, I think I can no longer count to eight, so [laughter] if there are no objections, I think I will withdraw the motion.  And the other two resolutions are supportive of the first, so.
	FEMALE:  But it sounds like a great letter to write.  [laughing]
	MALE:  Okay.  
	MALE:  Yeah, Whitney, on that -- on that point, Mr. Chairman, perhaps that could be included in your transmittal.  During our debate and our discussions of our draft guidelines, these are issues that should be considered by the EAC and their Advisory Boards, et cetera.  
	MR. CHAIRMAN:  Would that be a reasonable approach?  Do we agree with that?  A softer language that says this is something that we have discussed and most committee members feel that this would be a useful tool?
	FEMALE:  Certainly the whole issue --
	MR. CHAIRMAN:  Or something to that effect?
	FEMALE:  -- certainly, we’ve been extremely cognizant of the rapidly-moving calendar, you know, through no fault of anybody’s here, 2006 hasn’t changed when it’s going to happen.  And I think, you know, we have spent a certain amount of time trying -- trying to resolve that issue and I think if -- if this is a suggestion that people think is a great idea, it would be a shame not to do something with it.  
	FEMALE:  I -- I think that’s a great idea.  I like the suggestion of a letter and maybe we should do that.
	MALE:  Mr. Chairman, James Elekes.
	MR. CHAIRMAN:  Yes.
	MALE:  I understand that next week, you’ll be appearing before us at the Board of Advisors.  I would heartily recommend that you bring the sentiments from the TGDC in, specifically Mr. Craft, and perhaps we can then hold that into our agenda, and where the TGDC cannot make a recommendation, perhaps our chairman, Mr. Lewis, would entertain such action next week.
	MR. CHAIRMAN:  Is that consistent with the sense of the committee?
	MALE:  Yes.
	FEMALE:  Yes.
	MR. CHAIRMAN:  Okay, I will surely take that under advisement.  I may include it in my comments.
	MALE:  Thank you, sir.
	MR. CHAIRMAN:  So does this mean, Mr. Craft, that you’ve withdrawn the others?
	MALE:  Yes.
	MR. CHAIRMAN:  Motions?  [laughter]  
	Any other business?
	FEMALE:  Did we have an open resolution that we never cleared up?  I think there was one that we deferred voting on.  I hate to say this.
	FEMALE:  We came back.  We -- we got it already.
	MALE:  Yeah, we got it.
	FEMALE:  We got it.  Okay.
	MALE:  Yeah.
	MR. CHAIRMAN:  I believe we voted on all the items and we voted on the entirety of the document.  So, I thank all of you for your time, effort, dedication, and we look forward to continuing this effort.  And I declare this session adjourned.  Thank you.
[End of Audiotape 9]
	*		*		*		*		*

                        

	CERTIFICATE OF AGENCY

	I, Carol J. Schwartz, President of Carol J. Thomas Stenotype Reporting Services, Inc., do hereby certify we were authorized to transcribe the submitted cassette tapes, and that thereafter these proceedings were transcribed under our supervision, and I further certify that the forgoing transcription contains a full, true and correct transcription of the cassettes furnished, to the best of our ability.

					_____________________________
						  CAROL J. SCHWARTZ
							 PRESIDENT