Test Assertions for VVSG 1.1, Volume 1, Section 7.8.5, September 23, 2016

VVSG 1.1, Vol 1, Requirement 7.8.5: Preserving Voter Privacy

VVPAT records can be printed and stored by two different methods:

• Printed and stored on a continuous spool-to-spool paper roll where the voter views the paper record in a window
• Printed on separate pieces of paper, which are deposited in a secure receptacle.

If a requirement applies to only one method, that will be specified. Otherwise, the requirement applies to both.

a.  Voter privacy shall be preserved during the process of recording, verifying and auditing his or her ballot selections.

• DISCUSSION:  The privacy requirements from Section 3 also apply to voting equipment with VVPAT.

b.  When a VVPAT with a spool-to-spool continuous paper record is used, a means shall be provided to preserve the secrecy of the paper record of voter selections.

c.  When a VVPAT with a spool-to-spool continuous paper record is used, no record shall be maintained of which voters used which voting machine or the order in which they voted.

d.  The electronic and paper records shall be created and stored in ways that preserve the privacy of the voter.

• DISCUSSION:  For VVPAT systems that use separate pieces of paper for the record, this can be accomplished in various ways including shuffling the order of the records or other methods to separate the order of stored records.

e.  The privacy of voters whose paper records contain an alternative language shall be maintained.

f.  Unique identifiers shall not be displayed in a way that is easily memorable by the voter.

• DISCUSSION:  Unique identifiers on the paper record are displayed or formatted in such a way that they are not memorable to voters, such as by obscuring them in other characters

g.  Both paper rolls and paper record secure receptacles shall be controlled, protected, and preserved with the same security as a ballot box.

Test Assertions

TA785a-1: Voter privacy SHALL be preserved during the process of recording his or her ballot selections.

TA785a-2: Voter privacy SHALL be preserved during the process of verifying his or her ballot selections.

TA785a-3: Voter privacy SHALL be preserved during the process of auditing his or her ballot selections.

TA785a-4: For any implementation of the VVPAT, the VVPAT SHALL conform to the usability requirements of 3.2.3.

TA785a-4-1: For any implementation of the VVPAT, the VVPAT SHALL conform to the usability requirements of 3.2.3 that reference the ballot interface.

TA785a-4-2: For any implementation of the VVPAT, the VVPAT SHALL conform to the usability requirements of 3.2.3 that reference the cast vote record.

TA785a-5: For any implementation of the VVPAT, the VVPAT SHALL conform to the test assertions of 3.2.3.

TA785a-5-1: For any implementation of the VVPAT, the VVPAT SHALL conform to the test assertions of 3.2.3 that reference the ballot interface.

TA785a-5-2: For any implementation of the VVPAT, the VVPAT SHALL conform to the test assertions of 3.2.3 that reference the cast vote record.

TA785a-6: IF the voting system produces a paper record, THEN that record SHALL be protected from physical removal by the voter.

TA785b-1: IF a VVPAT with a spool-to-spool continuous paper record is used AND IF a voter makes ballot selections during a voting session, THEN at the beginning of the next voting session, ballot selections SHALL have original default values, including but not limited to, empty ballot selections.

TA785c-1: None (requirement is operational).

TA785d-1: When the electronic records are created the privacy of the voter SHALL be preserved.

TA785d-2: When the paper records are created the privacy of the voter SHALL be preserved.

TA785d-3: When the electronic records are stored the privacy of the voter SHALL be preserved.

TA785d-4: When the paper records are stored the privacy of the voter SHALL be preserved.

TA785d-5: IF the VVPAT system uses separate pieces of paper for the record THEN privacy MAY be accomplished by shuffling the order of the records.

TA785d-6: IF the VVPAT system uses separate pieces of paper for the record THEN privacy MAY be accomplished by various methods that separate the order of stored records.

TA785e-1: No test assertion.  This is an operational requirement.

TA785f-1: Unique identifiers SHALL be displayed in a representation that is NOT easily memorable by the voter.

TA785f-2: Unique identifiers MAY be obscured in other characters in order to make them NOT easily memorable to the voter. (from Discussion).

TA785g-1: Secure receptacles SHALL be provided for both paper rolls and paper records.