Test Assertions for VVSG 1.1, Volume 1, Section 7.8.4, September 23, 2016

VVSG 1.1, Vol 1, Requirement 7.8.4: Equipment Security and Reliability

1. The VVPAT printer shall be physically connected via a standard, publicly documented printer port using a standard communications protocol.
2. Tamper-evident seals or physical security measures shall protect the connection between the printer and the voting machine.
3. If the connection between the voting machine and the printer has been broken, the voting machine shall detect this event and record it in the system event log.
4. The VVPAT voting system shall detect printer errors that may prevent paper records from being correctly displayed, printed or stored, such as lack of consumables such as paper, ink, or toner, paper jams/misfeeds, and memory errors.
5. If a printer error or malfunction is detected, the VVPAT voting system shall:
   1. Present a clear indication to the voter and election officials of the malfunction. This must indicate clearly whether the current voter’s vote has been cast, discarded, or is waiting to be completed;
   2. Suspend voting operations until the problem is resolved;
   3. Allow canceling of the current voter’s electronic ballot image by election officials in the case of an unrecoverable error; and
   4. Protect the privacy of the voter while the error is being resolved.

6. Procedures for recovery from printer errors on paper-roll VVPAT voting systems shall not expose the contents of previously cast paper records.

7. Paper-roll VVPAT voting systems shall be designed so that when the rolls are removed from the voting device according to the following:
   1. All paper records are contained inside the secure container;
   2. The container supports being tamper-sealed and locked; and
   3. The container supports being labeled with the device serial number, precinct, and other identifying information to support audits and recounts.

8. If a continuous paper spool is used to store paper records, the manufacturer shall provide a mechanism for an auditor to unspool the paper, view each paper record in its entirety, and then respool the paper, without modifying the paper in any way.
9. The printer shall not be permitted to communicate with any system or machine other than the voting machine to which it is connected.
10. The printer shall only be able to function as a printer; it shall not contain any other services (e.g., provide copier or fax functions) or network capability.
11. Protective coverings intended to be transparent on voting equipment shall be maintainable via a predefined cleaning process. If the coverings become damaged such that they obscure the paper record, they shall be replaceable.

12. The paper record shall be of sufficient durability to remain unchanged for minimally 22 months to be used for verifications, reconciliations, and recounts conducted manually or by automated processing.

Test Assertions

TA784a-1:  The VVPAT printer SHALL be physically connected via a standard port.

TA784a-2:  The VVPAT printer SHALL be physically connected via a publicly documented port.

TA784a-3:  The VVPAT printer SHALL use a standard communication protocol.

TA784b-1: The connection between the printer and the VVPAT voting machine SHALL be protected by using EITHER 1) Tamper-evident seals OR 2) tamper-resistant measures.

TA784c-1: IF the connection between the VVPAT voting machine and the printer has been broken, THEN the VVPAT voting machine SHALL detect this break in the connection.

TA784c-2: IF the connection between the VVPAT voting machine and the printer has been broken, THEN the VVPAT voting machine SHALL record this break in the system event log.

TA784d-1: The VVPAT voting machine SHALL detect errors/malfunctions including, but not limited to, paper jams/misfeeds, memory errors, or lack of consumables such as paper, ink, or toner, that may prevent paper records from being correctly displayed.

TA784d-2: The VVPAT voting machine SHALL detect errors/malfunctions including, but not limited to, paper jams/misfeeds, memory errors, or lack of consumables such as paper, ink, or toner, that may prevent paper records from being correctly printed.

TA784d-3: The VVPAT voting machine SHALL detect errors/malfunctions including, but not limited to, paper jams/misfeeds, memory errors, or lack of consumables such as paper, ink, or toner, that may prevent paper records from being correctly stored.

TA784ei-1:  IF a printer error/malfunction is detected, THEN the VVPAT voting system SHALL present a clear indication to the voter of the error/malfunction.

TA784ei-2:  IF a printer error/malfunction is detected, THEN the VVPAT voting system SHALL present a clear indication to the election officials of the error/malfunction.

TA784ei-3: This indication SHALL indicate clearly whether the current voter’s vote has been EITHER cast, discarded, OR is waiting to be completed.

TA784eii-1: IF a printer error/malfunction is detected, THEN the VVPAT voting machine SHALL suspend voting operations until the problem is resolved.

TA784eiii: IF an unrecoverable error/malfunction is detected THEN the VVPAT voting machine SHALL allow the current voter’s electronic ballot image to be cancelled by election officials.

TA784eiv: IF a printer error/malfunction is detected, THEN the VVPAT voting system SHALL protect the privacy of the voter while the error is being resolved.

TA784f-1: IF the VVPAT voting machine is a paper-roll VVPAT AND IF a printer error or malfunction is detected, THEN procedures for recovery from these errors SHALL NOT expose the contents of previously cast paper records.

TA784gi-1:  IF the VVPAT voting machine is a paper-roll VVPAT AND IF rolls are removed from the voting device THEN all paper records SHALL be contained inside the secure container.

TA784gii-1:  IF the VVPAT voting machine is a paper-roll VVPAT AND IF rolls are removed from the voting device THEN the container SHALL be capable of being tamper-sealed.

TA784gii-2:  IF the VVPAT voting machine is a paper-roll VVPAT AND IF rolls are removed from the voting device THEN The container SHALL be capable of being locked.

TA784giii-1:  IF the VVPAT voting machine is a paper-roll VVPAT AND IF rolls are removed from the voting device THEN the container SHALL be capable of being labeled with the device serial number.

TA784giii-2:  IF the VVPAT voting machine is a paper-roll VVPAT AND IF rolls are removed from the voting device THEN the container SHALL be capable of being labeled with the device precinct number.

TA784giii-3:  IF the VVPAT voting machine is a paper-roll VVPAT AND IF rolls are removed from the voting device THEN the container SHALL be capable of being labeled with other identifying information needed to support audits and recounts.

TA784h-1:  IF a continuous paper spool is used to store paper records, THEN the manufacturer SHALL provide a mechanism for an auditor to a) unspool the paper, AND b) view each paper record in its entirety, AND then c) respool the paper.

TA784h-1-1:  During the above process the paper SHALL NOT be modified.

TA784i-1: The printer SHALL ONLY have the capability to communicate with the VVPAT voting machine to which it is connected.

TA784j-1:  The printer SHALL ONLY have the capability of functioning as a printer.

TA784j-2:  The printer SHALL NOT contain any other services besides printer services, including, but not limited to, providing copier functions, or providing fax functions.

TA784j-3: The printer SHALL NOT contain any network capability.

TA784k-1: IF a protective covering is intended to be transparent on voting equipment THEN it SHALL be maintainable via a predefined cleaning process.

TA784k-1-1: The covering SHALL be replaceable in the event the covering becomes damaged such that it obscures the paper record.

TA784l-1: The paper record SHALL be of sufficient durability, to remain unchanged for minimally 22 months, to be used for verifications, reconciliations, and recounts conducted manually or by automated processing.