Test Assertions for VVSG 1.1, Volume 1, Section 7.8.3, September 23, 2016

VVSG 1.1, Vol 1, Requirement 7.8.3: Electronic and Paper Record Structure

a.  Electronic ballot images shall be recorded in a randomized order by the voting system for the election. NIST Special Publication 800-90: Recommendation for Random Number Generation Using Deterministic Random Bit Generators specifies techniques for the generation of random numbers that can be used to randomize the order of ballot images in a cryptographically sound way. For each voted ballot, this includes:

1. Ballot style and reporting context such as precinct or election district;
2. For each contest:
   • The choice recorded, including undervotes and write-ins; and
   • Any information collected by the vote-capture device electronically about each write-in;
3. Information specifying whether the ballot is provisional, early voting or election day voting. Types of provisional ballots (such as “regular provisional”, “extended hours provisional”, and “regular extended hours”) are jurisdiction-dependent.
4. Information linking the electronic ballot image to a paper record, if such functionality is enabled in the voting system.

b.  The voting system shall provide the capability to export the collection of electronic ballot images in a publicly documented format, such as XML, or include a utility to export the records into a publicly documented format for offline viewing.

c.  Electronic ballot images shall be digitally signed by the voting system. The digital signature shall be generated using a NIST-approved digital signature algorithm with a security strength of at least 112 bits implemented within a FIPS 140-2 validated cryptographic module operating in FIPS mode.

d.  The human-readable contents of the paper record should be created in a manner that is machine-readable by optical character recognition.

e.  Paper-roll VVPAT voting systems shall mark paper rolls with the following:

1. Machine ID;
2. Reporting context, such as precinct or election district;
3. Date of election or date record printed;
4. If multiple paper rolls were produced during this election on this device, the number of the paper roll (e.g., Roll #2); and

g.  Paper-roll VVPAT voting systems shall include the following on each paper record:

1. Ballot style;
2. Type of voting (e.g., provisional, early, etc.);
3. Complete summary of voter’s choices;
4. For each ballot contest:
   • Contest name (e.g., “Governor”);
   • Any additional information needed for unambiguous interpretation of the paper record;
   • An indication, if the contest was undervoted; and
   • An indication, if the choice is a write-in vote.
5. An indication of whether the paper record has been accepted or rejected by the voter.

g.  Paper-roll VVPAT voting systems shall not split paper records across rolls; each paper record must be contained in its entirety by the paper roll.

h.  Cut-sheet VVPAT voting systems shall include the following on each paper record:

1. Machine ID;
2. Reporting context, such as precinct or election district;
3. Date of election or date record printed;
4. Ballot style
5. Type of voting (e.g., provisional, early, etc.);
6. Complete summary of voter’s choices;
7. For each ballot contest:
   • Contest name (e.g., “Governor”);
   • Any additional information needed for unambiguous interpretation of the paper record;
   • An indication, if the contest was undervoted; and
   • An indication, if the choice is a write-in vote.
8. An indication of whether each sheet has been accepted or rejected by the voter.

i.  If a cut-sheet VVPAT voting system splits paper records across multiple sheets of paper, each sheet shall include:

1. Page number of this sheet and total number of sheets (e.g., page 1 of 4);
2. Ballot style
3. Reporting context, such as precinct or election district
4. An indication that the sheet’s contents have been accepted or rejected by the voter; and
5. Any correspondence information included to link the paper record to its corresponding electronic ballot image record.

j.  If a cut-sheet VVPAT voting system splits paper record across multiple sheets of paper, it shall not split ballot contests across sheets.

k.  If a cut-sheet VVPAT voting system splits paper records across multiple sheets of paper, the ballot choices on each sheet shall be submitted to the voter for verification separately according to the following:

1. The voter shall be presented a verification screen for the contents of each sheet separately at the same time as the voter is able to verify the contents of the part of the paper record on the sheet;
2. When a voter accepts or rejects the contents of a sheet, the votes contained on that sheet and verification screen shall be committed to memory, regardless of the verification of any other sheet by the same voter;
3. Configurable limits on rejected paper records per voter shall count each rejected sheet as a rejected paper record;
4. Configurable limits on rejected paper records per machine shall not count more than one rejected paper record per voter; and
5. When a rejected paper record requires election official intervention, the VVPAT voting system shall indicate which sheets have been accepted and which rejected.

l.  The VVPAT voting system shall provide a capability to print information on each paper record sufficient for auditors to identify from an electronic ballot image record its corresponding paper record and from a paper records its corresponding electronic ballot image. This capability shall be possible for election officials to enable or disable.

m.  Any information on the paper record that identifies the corresponding electronic ballot image should not be practical for the voter to read or copy by hand.

n.  The VVPAT voting system manufacturer shall include a capability for auditors to verify the correspondence between the electronic ballot image and paper record pairs, if the correspondence information is printed on the paper record.

Test Assertions

TA783a-1: The voting system SHALL record electronic ballot images in a randomized order by for the election.

TA783a-1-1: The voting system MAY use the techniques for the generation of random numbers specified in “NIST Special Publication 800-90: Recommendation for Random Number Generation Using Deterministic Random Bit Generators” to randomize the order of ballot images in a cryptographically sound way.

TA783ai-1: For each voted ballot, ballot images recorded in a randomized order include, but are not limited to, ballot style and reporting context, such as precinct or election district.

TA783aii-1: For each contest, ballot images recorded in a randomized order include, but are not limited to, the choice recorded, including undervotes and write-ins.

TA783aii-2: For each contest, ballot images recorded in a randomized order include, but are not limited to, any information collected by the vote-capture device electronically about each write-in.

TA783aiii-1: For each voted ballot, ballot images recorded in a randomized order include, but are not limited to, ballot Information specifying whether the ballot is either a) provisional, OR b) early voting OR c) election day voting.

TA783aiv-1: IF functionality to link information in the electronic ballot image to a paper record is enabled in the voting system THEN, for each voted ballot, ballot images recorded in a randomized order include, but are not limited to, information linking the electronic ballot image to a paper record.

TA783b-1: The voting system SHALL EITHER a) provide the capability to export the collection of electronic ballot images in a publicly documented format or b) include a utility to export the records into a publicly documented format for offline viewing.

TA783b-1-1: The publicly available format MAY be XML.

TA783c-1: Electronic ballot images SHALL be digitally signed by the voting system.

TA783c-1-1: The digital signature SHALL be generated using a NIST-approved digital signature algorithm.

TA783c-1-2: The NIST-approved digital signature algorithm SHALL have a security strength of at least 112 bits implemented within a FIPS 140-2 (or current release) validated cryptographic module operating in FIPS mode.

TA783d-1: The human-readable contents of the paper record SHOULD be created in a manner that is machine-readable by optical character recognition.

TA783ei-1: IF the VVPAT system consists of paper-rolls THEN that system SHALL mark paper rolls with a machine ID.

TA783eii-1: IF the VVPAT system consists of paper-rolls THEN that system SHALL mark paper rolls with reporting context.

TA783eii-1-1: The reporting context MAY be the precinct district.

TA783eii-1-2: The reporting context MAY be the election district.

TA783eiii-1: IF the VVPAT system consists of paper-rolls THEN that system SHALL mark paper rolls with either a) date of election or b) date record printed.

TA783eiv-1: IF the VVPAT system consists of paper-rolls AND IF multiple paper rolls were produced during this election on this device THEN that system SHALL mark the number of the paper roll (e.g., Roll #2).

TA783fi-1: IF the VVPAT system consists of paper-rolls THEN that system SHALL include, on each paper record, the ballot style.

TA783fii-1: IF the VVPAT system consists of paper-rolls THEN that system SHALL include, on each paper record, the type of voting (e.g., provisional, early, etc.).

TA783fiii-1: IF the VVPAT system consists of paper-rolls THEN that system SHALL include, on each paper record, the complete summary of voter’s choices.

TA783fiv-1: IF the VVPAT system consists of paper-rolls THEN that system SHALL include, on each paper record, for each ballot contest:

• Contest name (e.g., “Governor”);
• Any additional information needed for unambiguous interpretation of the paper record;
• An indication, if the contest was undervoted; and
• An indication, if the choice is a write-in vote.

TA783fv-1: IF the VVPAT system consists of paper-rolls THEN that system SHALL include, on each paper record, an indication of whether the paper record has been accepted or rejected by the voter.

TA783g-1: IF the VVPAT system consists of paper-rolls THEN the VVPAT voting systems SHALL NOT split paper records across rolls.

TA783g-2: IF the VVPAT system consists of paper-rolls THEN each paper record must be contained in its entirety by the paper roll.

TA783hi-1: IF the VVPAT system consists of cut sheets THEN that system SHALL include, on each paper record, the machine id.

TA783hii-1: IF the VVPAT system consists of cut sheets THEN that system SHALL include, on each paper record, reporting context.

TA783hii-1-1: The reporting context MAY be the precinct.          

TA783hii-1-2: The reporting context MAY be the election district.

TA783hiii-1: IF the VVPAT system consists of cut sheets THEN that system SHALL include, on each paper record, either a) date of election or b) date record printed.

TA783hiv-1: IF the VVPAT system consists of cut sheets THEN that system SHALL include, on each paper record, ballot style.

TA783hv-1: IF the VVPAT system consists of cut sheets THEN that system SHALL include, on each paper record, type of voting (e.g., provisional, early, etc.).

TA783hvi-1: IF the VVPAT system consists of cut sheets THEN that system SHALL include, on each paper record, complete summary of voter’s choices.

TA783hvii-1: IF the VVPAT system consists of cut sheets THEN that system SHALL include, on each paper record, for each ballot contest:

• Contest name (e.g., “Governor”);
• Any additional information needed for unambiguous interpretation of the paper record;
• An indication, if the contest was undervoted; and
• An indication, if the choice is a write-in vote.

TA783hviii-1: IF the VVPAT system consists of cut sheets THEN that system SHALL include, on each paper record, an indication of whether each sheet has been accepted or rejected by the voter.

TA783i-i-1: IF the VVPAT system consists of cut sheets AND IF a cut-sheet VVPAT voting system splits paper records across multiple sheets of paper, THEN each sheet SHALL include the page number of this sheet and total number of sheets (e.g., page 1 of 4).

TA783i-ii-1: IF the VVPAT system consists of cut sheets AND IF a cut-sheet VVPAT voting system splits paper records across multiple sheets of paper, THEN each sheet SHALL include the ballot style.

TA783i-iii-1: IF the VVPAT system consists of cut sheets AND IF a cut-sheet VVPAT voting system splits paper records across multiple sheets of paper, THEN each sheet SHALL include the reporting context.

TA783i-iii-1-1: The reporting context MAY be the precinct district.

TA783i-iii-1-2: The reporting context MAY be the election district.

TA783i-iv-1: IF the VVPAT system consists of cut sheets AND IF a cut-sheet VVPAT voting system splits paper records across multiple sheets of paper, THEN each sheet SHALL include an indication that the sheet’s contents have been accepted or rejected by the voter.

TA783i-v-1: IF the VVPAT system consists of cut sheets AND IF a cut-sheet VVPAT voting system splits paper records across multiple sheets of paper, THEN each sheet SHALL include any correspondence information included to link the paper record to its corresponding electronic ballot image record.

TA783j-1: IF the VVPAT system consists of cut sheets AND IF a cut-sheet VVPAT voting system splits paper records across multiple sheets of paper, THEN the VVPAT system SHALL NOT split ballot contests across sheets.

TA783ki-1: IF the VVPAT system consists of cut sheets AND IF a cut-sheet VVPAT voting system splits paper records across multiple sheets of paper, THEN the ballot choices on each sheet SHALL be submitted to the voter for verification separately according to the following criterion: The voter SHALL be presented a verification screen for the contents of each sheet separately at the same time as the voter is able to verify the contents of the part of the paper record on the sheet.

TA783kii-1: IF the VVPAT system consists of cut sheets AND IF a cut-sheet VVPAT voting system splits paper records across multiple sheets of paper, THEN the ballot choices on each sheet SHALL be submitted to the voter for verification separately according to the following criterion: IF a voter accepts OR IF a voter rejects the contents of a sheet, THEN the votes contained on that sheet SHALL be stored in memory, regardless of the verification of any other sheet by the same voter.

TA783kii-2: IF the VVPAT system consists of cut sheets AND IF a cut-sheet VVPAT voting system splits paper records across multiple sheets of paper, THEN the ballot choices on each sheet SHALL be submitted to the voter for verification separately according to the following criterion: IF a voter accepts OR IF a voter rejects the contents of a sheet, THEN the votes contained on the verification screen SHALL be stored in memory, regardless of the verification of any other sheet by the same voter.

TA783kiii-1: IF the VVPAT system consists of cut sheets AND IF a cut-sheet VVPAT voting system splits paper records across multiple sheets of paper, THEN the ballot choices on each sheet SHALL be submitted to the voter for verification separately according to the following criterion: Configurable limits on rejected paper records per voter SHALL count each rejected sheet as a rejected paper record.

TA783kiv-1: IF the VVPAT system consists of cut sheets AND IF a cut-sheet VVPAT voting system splits paper records across multiple sheets of paper, THEN the ballot choices on each sheet SHALL be submitted to the voter for verification separately according to the following criterion: Configurable limits on rejected paper records per machine SHALL NOT count more than one rejected paper record per voter.

TA783kv-1: IF the VVPAT system consists of cut sheets AND IF a cut-sheet VVPAT voting system splits paper records across multiple sheets of paper, THEN the ballot choices on each sheet SHALL be submitted to the voter for verification separately according to the following criterion: IF a rejected paper record requires election official intervention, THEN the VVPAT voting system SHALL indicate which sheets have been accepted.

TA783kv-2: IF the VVPAT system consists of cut sheets AND IF a cut-sheet VVPAT voting system splits paper records across multiple sheets of paper, THEN the ballot choices on each sheet SHALL be submitted to the voter for verification separately according to the following criterion: IF a rejected paper record requires election official intervention, THEN the VVPAT voting system SHALL indicate which sheets have been rejected.

TA783l-1: The VVPAT voting system SHALL provide a capability to print information on each paper record that meets the following two conditions: 1) The information printed SHALL be sufficient for auditors to identify, from an electronic ballot image record, its corresponding paper record and 2) The information printed SHALL be sufficient for auditors to identify, from a paper record, its corresponding electronic ballot image.

TA783l-1-1: The above capability SHALL be configurable to allow it to be enabled by election officials.                    

TA783l-1-2: The above capability SHALL be configurable to allow it to be disabled by election officials.                                                                                                                                                                                                                                                                                                                                                                                                                                             

TA783m-1: IF any information on the paper record identifies the corresponding electronic ballot image THEN it SHOULD NOT be practical for the voter to read or copy by hand.

TA783n-1: IF the correspondence information is printed on the paper record THEN the VVPAT voting system manufacturer SHALL include a capability for auditors to verify the correspondence between the electronic ballot image and paper record pairs.