DRAFT Test Assertions for VVSG 1.0 Section 3.1.7, October 2014

Requirement 3.1.7

VVSG 1.0 Requirement 3.1.7: The voting process shall preclude anyone else from determining the content of a voter's ballot, without the voter's cooperation.

Test Assertions

TA317–1: The voting process SHALL prevent anyone other than the voter from determining the content of his or her ballot unless the voter cooperates.

TA317-2: IF a specific receipt is capable of being used to prove how he/she voted, THEN the voting system SHALL NOT issue a receipt to the voter.

Requirement 3.1.7.1

VVSG 1.0 Requirement 3.1.7.1: When deployed according to the installation instructions provided by the vendor, the voting station shall prevent others from observing the contents of a voter's ballot.

Test Assertions

TA3171-1: IF the instructions provided by the vendor are followed THEN the voting station SHALL prevent any other person from observing the contents of his or her ballot.

Requirement 3.1.7.1.a

VVSG 1.0 Requirement 3.1.7.1a: The ballot and any input controls shall be visible only to the voter during the voting session and ballot submission.

Test Assertions

TA3171a-1: IF the voting session is performed using a visual interface THEN the voting system SHALL prevent any individual in the polling place (without the voter's consent) from perceiving any content or associated visual cues on the ballot presented to the voter during the voting session.

TA3171a-2: IF the voting session is performed using a visual interface THEN the voting system SHALL prevent any individual in the polling place (without the voters consent) from perceiving any input controls (and interaction with such input controls) on the visual voting machine used by the voter during the voting session.

TA3171a-3: IF ballot submission is performed using a visual interface THEN the voting system SHALL prevent any individual in the polling place (without the voter's consent) from perceiving any content on the ballot submitted by the voter during the voting session.

TA3171a-4: IF ballot submission is performed using a visual interface THEN the voting system SHALL prevent any individual in the polling place (without the voter's consent) from perceiving any input controls (and interaction with such input controls) on the visual voting machine used by the voter during the ballot submission process.

Requirement 3.1.7.1b

VVSG 1.0 Requirement 3.1.7.1b: The audio interface shall be audible only to the voter.

Test Assertions

TA3171b-1: IF the voting session is performed using an aural interface THEN the auditory content and associated aural cues SHALL NOT be discernible to any other individual in the polling place without the voter's consent.

TA3171b-2: IF headphones are used with an aural interface THEN the headphones SHALL have low sound leakage such that the auditory content and associated aural cues are not discernible to any other individual in the polling place without the voter's consent.

TA3171b-3:  IF ballot submission is performed using an aural interface THEN the voting system SHALL prevent any individual in the polling place (without the voter's consent) from perceiving any content on the ballot submitted by the voter during the voting session.

TA3171b-4: IF ballot submission is performed using an aural interface THEN the voting system SHALL prevent any individual in the polling place (without the voter's consent) from perceiving any input controls (and interaction with such input controls) on the visual voting machine used by the voter during the ballot submission process.

Requirement 3.1.7.1c

VVSG 1.0 Requirement 3.1.7.1c: As mandated by HAVA 301(a)(1)(C), the voting system shall notify the voter of an attempted over vote in a way that preserves the privacy of the voter and the confidentiality of the ballot.

Test Assertions

TA3171c-1: IF the voting system is notifying the voter of an attempted overvote and the voting session is performed using a visual interface THEN the visual content and associated visual cues SHALL NOT be discernible to any other individual in the polling place without the voter's consent.

TA3171c-2: IF the voting system is notifying the voter of an attempted overvote and the voting session is performed using an aural interface THEN the auditory content and associated aural cues SHALL NOT be discernible to any other individual in the polling place without the voter's consent.

Requirement 3.1.7.2

VVSG 1.0 Requirement 3.1.7.2: Voter anonymity shall be maintained for alternative format ballot presentation.

Test Assertions

TA3172-1: IF voters use non- typical ballot interfaces THEN only the logical contents of the ballot SHALL be recorded.

TA3172-2: IF voters use non- typical ballot interfaces THEN the special formats in which they were rendered SHALL NOT be recorded.

TA3172-3: The logical contents of a cast vote record SHALL be invariant across all interfaces.

Requirement 3.1.7.2a

VVSG 1.0 Requirement 3.1.7.2a: NO information shall be kept within an electronic cast vote record that identifies any alternative language feature(s) used by a voter.

Test Assertions

TA3172a-1: The electronic cast vote record SHALL NOT record any information that identifies any alternative language feature used by the voter.

Requirement 3.1.7.2b

VVSG 1.0 Requirement 3.1.7.2b: NO information shall be kept within an electronic cast vote record that identifies any accessibility feature(s) used by a voter.

Test Assertions

TA3172b-1: The electronic cast vote record SHALL NOT record any information that identifies any accessibility feature used by the voter.