NIST Delivers Updated Draft Standards for Electronic Voting Machines

The National Institute of Standards and Technology (NIST) has delivered to the Election Assistance Commission (EAC) a draft revision to the 2005 federal Voluntary Voting System Guidelines (VVSG) Version 1.0, specifying how electronic voting machines are built and tested. The EAC made the draft revision available for public comment June 1st, with a final version expected by the end of 2009.

"The guidelines are designed to further improve the quality and efficiency of the testing conducted on voting systems," says John Wack, NIST's voting team manager. "This enables improvements to be made sooner rather than later when the next full set of standards is finalized."

The draft revision, titled "Voluntary Voting System Guidelines, Version 1.1," provides improved requirements for electronic voting machine accuracy, reliability, usability, accessibility, and security. The strengthened requirements have been taken from the August 2007 VVSG recommendations delivered to the EAC by NIST and the Technical Guidelines Development Committee. Because the EAC wants the draft revision to be achievable by voting system manufacturers in the near term, the revision requires no changes to voting system hardware and no significant changes to system software.

NIST has developed associated tests to go along with the revised standards, which will be available to the public and to federally accredited testing labs. Revisions include:

• Accuracy and reliability testing. Testing would be expanded to ensure comprehensive coverage of the entire voting system. Testers will evaluate all errors that could potentially impact voting tallies, such as problems with voting machine printers.
• Paper audit trails. Requirements for those systems that produce paper audit trails have been improved, including additional information on the paper trails making them easier to read and handle.
• Cryptographic defenses to protect systems from malicious software. Election software and any updates must be digitally "signed", and voting systems must verify these signatures before accepting or running any software. Electronic records produced by voting systems must also be digitally signed.
• New reporting requirements for system manufacturers. Manufacturers will now be required to provide details of their voting systems' security architecture and usability testing results.
• Improved usability for poll workers. Clear operating instructions for poll workers are required, including details on how to set up, start, and close down the voting system as well as easily enable and configure accessibility features for disabled voters.

EAC will review the NIST-developed revisions and public comments before the new standards are adopted. For more information on voting standards and NIST's role, visit http://vote.nist.gov