(A) These standards govern the use of the
voter verified paper audit trail system in direct recording electronic (DRE)
voting machines in all elections governed by the Ohio Revised Code. These
standards shall only apply to DRE systems for which an electronic record of the
vote is created by the DRE. The standards in this document constitute a minimum
standard of performance.
(B) "Direct recording electronic
voting machine" means a voting machine that records votes by means of a
ballot display provided with mechanical or electro-optical components that can
be actuated by the voter, that processes the data by means of a computer
program, and that records voting data and ballot images in internal or external
memory components. Only for the purpose of complying with the accessibility
requirements of section 3506.19 of the Revised Code, optical scan marking
devices determined by the secretary of state to provide the same or
substantially similar levels of accessibility, including non-visual
accessibility, shall be considered direct recording electronic voting devices.
A direct recording electronic voting machine produces a tabulation of the
voting data stored in a removable memory component and a printed
copy.
(C) "Voter verified paper audit
trail" means a physical paper printout on which the voter's ballot
choices, as registered by a direct recording electronic voting machine, are
recorded. The voter shall be permitted to visually or audibly inspect the
contents of the physical paper printout. The physical paper printout shall be
securely retained at the polling place until the close of the polls on the day
of the election. After the physical paper printout is produced, but before the
voter's ballot is recorded, the voter shall have an opportunity to accept
or reject the contents of the printout as matching the voter's ballot
choices. If a voter rejects the contents of the physical paper printout, the
system that produces the voter verified paper audit trail shall invalidate the
printout and permit the voter to recast the voter's ballot.
(D) General description
(1) Components: the voter
verified paper audit trail (VVPAT) system shall minimally consist
of:
(a) A voter verified paper audit trail writer (VVPAT-W) device
that is attached, built into, or used in conjunction with a direct recording
electronic (DRE) unit and includes:
(i) A printer that will
duplicate a voter's selections on the DRE onto a paper record
copy.
(ii) A paper record
display unit that allows a voter to view his or her paper record copy while
preventing the voter from directly handling the paper record copy.
(iii) Paper to produce
the voter verified paper audit trail that is sturdy, clean, and resistant to
degradation.
(b) A voter verified paper audit trail record storage unit
(VVPAT-S) device that stores cast and spoiled paper record copies.
(c) A VVPAT-W and VVPAT-S may be integrated as appropriate to
their operation.
(d) A VVPAT may not be used with any voting equipment
beyond the physical confines of the polling place, except when used outside a
polling place in a self-contained manner to allow for curbside or functionally
similar voting.
(2) Operation:
(a) VVPAT systems may be designed in various configurations. In
all such devices, prior to casting the ballot, the voter shall have the ability
to verify his or her selections on a paper record copy. Before final
verification, the voter shall either accept or reject the choices represented
on the paper record copy. Upon the completion of verification and casting the
ballot, both the electronic record and the paper record copy shall be stored
and retained.
(b) Any system that produces a voter verified paper audit trail
shall be accessible to disabled voters, including visually impaired voters, in
the same manner as the direct recording electronic voting machine that produces
it.
(3) Maintenance: VVPAT
system design shall permit routine maintenance in a manner that prevents the
risk of undetected tampering or unauthorized altering of certified system
components during routine system maintenance.
(E) Design requirements
(1) General
(a) Use of electronic and paper ballot records
(i) Every electronic
record must have a corresponding paper ballot record copy.
(a) The paper ballot
record copy must be printed and the voter must have the opportunity to verify
that record prior to the final electronic record being recorded.
(b) A unique DRE
identifier must appear on each individual paper ballot record produced, without
revealing the identity of the voter who cast the ballot.
(ii) For any recount of
an election in which ballots are cast using a DRE voting machine with a VVPAT,
the voter verified paper audit trail shall serve as the official ballot to be
recounted.
(iii) In the case of a
difference between the electronic record and the paper record copy, the paper
record copy shall govern, unless there is clear evidence that the paper record
copy is inaccurate, incomplete or unreadable as defined in the system
procedures.
(iv) The voter verified
paper audit trail shall be preserved in the same manner and for the same time
period as paper ballots are preserved under section 3505.31 of the Revised
Code.
(b) Privacy: The VVPAT system shall be designed to allow every
voter to review, accept or reject his/her paper record copy privately and
independently and shall comply with federal and state privacy
requirements.
(c) Secrecy: The VVPAT system shall be designed to ensure secrecy
of votes so that it is not possible to determine which voter cast which paper
record copy and shall comply with federal and state secrecy
requirements.
(d) Readability:
(i) The VVPAT system
shall be designed to maximize the ease in which the voter may review, accept or
reject his/her paper record copy and shall comply with federal and state
readability requirements.
(a) The headline should
be printed in no smaller than twenty-five point font, however, if the vendor
cannot print the headline in at least twenty-five point font then they have the
option of using a typeface of not less than nine point font and the VVPAT
machine must include magnification capability to read the font as if it were
thirty point font.
(b) The ballot language,
explanation and arguments must be printed in no smaller than nine point font
and no larger than eighteen point font and the machine must include a
magnification capability read the font as if it were thirty point
font.
(c) The ballot typeface
must be times new roman, arial, myriad, or its equivalent.
(ii) The voter verified
paper audit trail shall be readable in a manner that makes the voter's
ballot choices obvious to the voter without the use of computer or electronic
codes.
(e) Accessibility: The VVPAT system shall be designed to allow
access for disabled and limited literacy voters to privately and independently
use the VVPAT and shall comply with federal and state accessibility
requirements.
(f) Language accessibility: The VVPAT system shall be designed to
allow each voter to verify their vote on a paper record copy in the same
language they voted in on the DRE and shall comply with federal and state
requirements.
(g) Security: The VVPAT system shall be designed to prevent
tampering with either the VVPAT system or the paper record copy, and shall
comply with federal and state security requirements.
(h) Capacity: The VVPAT system shall be designed with a combined
capacity to ensure that an adequate amount of all the paper record, ink, toner,
ribbon or other like supply units in a precinct will accommodate all voters
using the DRE's with VVPAT-W within the precinct.
The VVPAT system shall be designed to ensure
that poll workers will not be required to add paper record, ink, toner, ribbon
or other like supply units to the VVPAT-W, more than once, during the polling
hours.
(i) Integrity:
(i) The VVPAT system must
be designed to prohibit the production by any direct recording electronic
voting machine of anything that legally could be removed by the voter from the
polling place, such as a receipt or voter confirmation.
(ii) The VVPAT system
must provide a low supply warning to provide a poll worker the opportunity to
add paper, ink, toner, ribbon or other like supply before the supply item runs
out.
(a) In the event a supply
warning occurs as a voter is casting a ballot, the VVPAT must safeguard the
secrecy of the ballot by preventing the poll worker from reading the VVPAT
ballot.
(b) After the poll worker
has filled the supply, the system shall allow the voter to review their VVPAT
ballot without having to recast their ballot.
(j) Capability: The VVPAT device should draw its power from the
DRE or the same electrical circuit the DRE draws its power from.
(i) When not plugged into
an AC power source, the battery used to power the DRE must also power the
VVPAT. However, a separate battery can be used to power the VVPAT as long as
the voting process cannot continue if the VVPAT is not
operational.
(ii) The battery must
provide sufficient power to supply both the DRE and VVPAT device for at least
two hours, or federal and state standards, which ever is more
stringent.
(2) Paper record
copy
(a) Security: Security protections shall be built into the paper
record copy and/or VVPAT-S to prevent tampering. This provision shall apply to
paper record copies before, during and after printing.
(b) Readability: The paper shall be designed so as to make the
paper record copy readable by voters and election officials and shall comply
with state readability requirements.
(c) Retention: The voter verified paper record copy shall be
retained by the elections official for the same period of time as mandated by
state law for the retention of paper ballots for that election.
(3) Printer
(a) Security: The printer shall be physically secure from
tampering. The paper record copy and the image created by the VVPAT-W on the
paper record copy shall be designed to withstand storage requirements as
outlined in these standards and state requirements.
(b) Readability: The image created by the printer shall be
designed to allow a voter to review his or her paper record copy privately and
independently.
(i) The headline should
be printed in no smaller than twenty-five point font, however, if the vendor
cannot print the headline in at least twenty-five point font then they have the
option of using a typeface of not less then nine point font and the VVPAT
machine must include magnification capability to read the font as if it were
thirty point font.
(ii) The ballot language,
explanation and arguments must be printed in no smaller than nine point type
and the machine must include a magnification capability read the font as if it
were thirty point.
(iii) The VVPAT must be
printed using black ink, toner, or chemical agent on white paper.
(iv) The VVPAT must be
printed using typeface/font of times new roman, arial, myriad, or its
equivalent.
(v) The VVPAT must be
printed using a paper weight of no less than fifteen pounds.
(c) Printed information
(i) Offices/issues: The
image created by the VVPAT-W shall include every contest that is displayed to
the voter on the DRE review screen including write-ins and
undervotes.
(ii) Provisional ballot:
The image created by the VVPAT-W shall be clearly identifiable in the case of a
provisional ballot.
(iii) Spoiled
ballot
(a) The image created by
the VVPAT-W shall be clearly identifiable in the case of a spoiled paper record
copy. The clearly identifiable spoiled paper record copy shall be shown in the
paper record display unit to allow the voter to acknowledge the paper record
copy has been spoiled. The VVPAT system shall be designed to prevent a paper
record copy from being spoiled after the voter has verified that paper record
copy and has cast his/her ballot.
(b) The voter shall have
the opportunity to affirmatively spoil their paper record copy no more than two
times. An error in recording or printing a paper record copy not caused by the
voter shall not be counted as a spoiled paper record copy.
(c) Upon spoiling their
paper record copy the voter shall be able to modify and verify selections on
the DRE without having to reselect all of their choices.
(d) Before the voter
causes a third and final paper record copy to be printed, the voter shall be
presented with a warning notice that the selections made on screen will be
final and the voter will see and verify a printout of their vote, but will not
be given additional opportunities to change their vote.
(d) Language accessibility
(i) The VVPAT-W shall be
capable of producing an image in all alternative languages for which the DRE is
certified.
(ii) The paper record
copy shall be printed in English and in the alternative language when used by a
voter to cast their vote on the DRE.
(4) Paper record display
unit
(a) Security: The paper record display unit shall allow the voter
to inspect the paper record copy without physically handling the paper record
copy and shall be physically secure from tampering.
(b) Readability: The paper record display unit shall provide
adequate visual space to allow the voter to privately and independently inspect
the paper record copy. A paper record copy shall be readable from the same
position and posture used for voting on the DRE. The voter shall have the
ability to view both the review screen on the DRE and the paper record copy in
the display unit simultaneously. If the paper record copy cannot be viewed in
its entirety in the paper record display unit at one time, then the voter shall
have the opportunity to verify the entire paper record copy prior to either the
electronic record or the paper record copy being stored and
recorded.
(c) Covering: Any protective covering intended to be transparent
shall be in such condition that it can be made transparent by ordinary cleaning
of its exposed surface.
(d) Accessibility: The VVPAT components must conform to federal
and state accessibility requirements.
This shall include, but is not limited to, an
audio component.
The audio component must accurately relay the
information printed on the paper record copy to the voter.
(5) Paper record storage
unit
(a) Security: The paper record storage unit shall be designed to
prevent tampering.
(b) Secrecy: The VVPAT system shall be designed and proper
procedures put in place to ensure the printed ballot audit trail is stored in a
manner to ensure secrecy of votes so that it is not possible to determine which
voter cast which paper record copy.
(c) Capacity: The combined capacity of all the paper record
storage units in a precinct must be enough to accommodate all voters using the
DREs within the precinct.
(F) Procedure requirements
(1) Update: Testing and
certification, pre-election, election and post-election procedures for each DRE
voting system shall be updated to reflect the use of the VVPAT. These updates
include, but are not limited to:
(a) Testing and certification
(i) Testing: The VVPAT
system shall conform to federal and state testing requirements. Required
testing shall include, but not be limited to, functionality, security,
durability, longevity and accessibility testing.
(ii) Certification: The
VVPAT system must be certified for use by the state of Ohio in conjunction with
the rest of the voting system with which it is intended to be
used.
(iii) Configuration: The
VVPAT system shall not, at any time, contain or use undisclosed hardware or
software. The only components that may be used in the system are components
that have been tested and certified for use in the state of Ohio.
(b) Pre-election procedures: The VVPAT system components must be
integrated into existing local logic and accuracy testing
requirements.
(c) Election procedures
(i) Malfunctions
(a) The vendor shall
provide written recommendations for how to investigate and resolve malfunctions
including, but not limited to, misreporting votes, unreadable paper records,
paper or ribbon jams, low-ink, low paper, misfeeds and power
failures.
(b) The vendor shall
include written recommendations for how to recover votes in the case of
malfunction to assure a ballot is properly recorded and stored.
(ii) The vendor shall
include written recommendations for if the voter does not complete the
verification process for their paper record copy.
(iii) The system shall
prevent any further attempt to cast a ballot until an election judge has reset
the VVPAT/DRE after correcting a malfunction.
(d) Post election procedures
(i) Written procedures
shall reflect the use of the paper record copies in the required full manual
recount as defined under state requirements.
(ii) The vendor shall
include written recommendations for how the secrecy of votes will be
ensured.
(iii) The vendor shall
include written recommendations for how a discrepancy between an electronic
record and its corresponding paper record copy shall be identified,
investigated and resolved.
The vendor shall include written
recommendations for determining what constitutes clear evidence that a paper
record copy is inaccurate, incomplete or unreadable.
(G) In order to provide the secretary
information pertinent to the implementation of the voting machines and the
security of the voting machines, the individual voting machine vendors must
meet the following requirements:
(1) Vendors shall produce
all documentation describing materials, equipment, programs, and procedures,
including source codes, scripts, and data files, required to develop, install
or operate any software, firmware or hardware used in the voting
system.
(2) Vendor shall produce
the following documents submitted to or resulting from the federal testing and
qualification or re-qualification process regarding voting
systems:
(a) The technical data package as defined in voting systems
standards 2002 (VSS-2002), Volume II, Section 2, or the current voting systems
standards.
(b) Vendor shall furnish secretary with all test reports in the
vendor's possession, both published final and intermediate statue reports
showing discovered deficiencies and resolution steps.
(3) Vendor shall produce
the following documents relating to each hardware, software and firmware
version for any component of the voting system: detailed change logs, hardware
change records or logs, test records relating to the changed components, and
documents describing the effects of the changes.
(4) Vendor shall execute
and deliver to the secretary of state an authorization in a format reasonably
acceptable to vendor and independent testing authorities, to enable the
secretary of state to obtain information about the status of federal testing
and qualifications of vendors voting systems proposed to be used in
Ohio.
(5) Vendor shall notify,
within two business days, the secretary of state of problems encountered in
Ohio and other jurisdictions, whether upon completion of testing or in an
actual election, which vendor concludes would reasonably create an impediment
to obtaining certification.
(6) Vendor shall maintain
in good working order, provided the following are subjected only to normal wear
and tear and proper usage, one working version of vendor's voting system,
a server containing election management system and peripherals proposed to be
used in any Ohio election.
(7) Vendor shall provide
the secretary a statement identifying the voting system supplied and affirming
that each voting system is state certified at the time of vendor's
statement.
(8) Vendors shall
implement the following security measures:
Replace hard-coded supervisor passwords with dynamic passwords,
and provide directions and training to enable election officials to change
these passwords. There shall not be vendor-controlled security keys, and the
encryption code shall be programmable by election officials.
(9) Vendor shall notify
secretary of state and the counties, where the vendors system is in use, of any
security patches or other software upgrades that vendor recommends to be
installed on the server. Vendor shall notify the secretary of any security
patches which vendor recommends not be used.
