Voluntary Voting System Guidelines VVSG 2.0 Requirements for the Voluntary Voting System Guidelines 2.0 February 10, 2021 Prepared for the Election Assistance Commission At the direction of the Technical Guidelines Development Committee 1 Acknowledgements Chair of the TGDC: Dr. Walter G. Copan Director of the National Institute of Standards and Technology (NIST) Gaithersburg, MD Representing the EAC Standards Board: Robert Giles Paul Lux Director Supervisor of Elections New Jersey Division of Elections Okaloosa County Trenton, NJ Crestview, FL Representing the EAC Board of Advisors: Neal Kelley Linda Lamone Registrar of Voters Administrator of Elections Orange County Maryland State Board of Elections Orange County, CA Annapolis, MD Representing the Architectural and Transportation Barrier, and Compliance Board (Access Board): Marc Guthrie Sachin Pavithran Public Board Member Public Board Member Newark, OH Logan, UT Representing the American National Standards Institute (ANSI): Mary Saunders Vice President, Government Relations & Public Policy American National Standards Institute Washington, DC Representing the Institute of Electrical and Electronics Engineers: Dan Wallach Professor, Electrical & Engineering Computer Science Rice University Houston, TX Representing the National Association of State Election Directors (NASED): Lori Augino Judd Choate Washington State Director of Elections State Elections Director Washington Secretary of State Colorado Secretary of State Olympia, WA Denver, CO 2 Requirements for VVSG 2.0 February 10, 2021 Individuals with technical and scientific expertise relating to voting systems and equipment: McDermot Coutts Geoff Hale Chief Architect/Director of Technical Computer Security Expert Development Washington, DC Unisyn Voting Solutions Vista, CA Diane Golden David Wagner Accessibility Expert Professor, Electrical & Engineering Grain Valley, MO Computer Science University of California-Berkeley Berkeley, CA 3 Public Working Groups discussed and developed guidance to inform the development of requirements for the VVSG. • The Election Process Working Groups: Pre-Election, Election, and Post-Election Process Working Groups performed a great deal of up-front work to collect locale-specific election process information and, from that, to create coherent process models. • The Interoperability Working Group handled voting system interoperability including common data format (CDF) modeling and schema development. • The Human Factors Working Group handled human factors-related issues including accessibility and usability. • The Cybersecurity Working Group handled voting system cybersecurity-related issues include various aspect of security control and auditing capabilities. • The Testing Working Group handled voting system testing-related issues including what portions of the new VVSG need to be tested and how to test them. 4 Requirements for VVSG 2.0 February 10, 2021 Executive Summary The United States Congress passed the Help America Vote Act of 2002 (HAVA) [HAVA02] to modernize the administration of federal elections and to establish the U.S. Election Assistance Commission (EAC) to provide guidance to the states in their efforts to comply with the HAVA administrative requirements. Section 202 of HAVA directs the EAC to adopt voluntary voting system guidelines, and to provide for the testing, certification, decertification, and recertification of voting system hardware and software. The purpose of the guidelines is to provide a set of specifications and requirements against which voting systems can be tested to determine if they provide all the basic functionality, accessibility, and security capabilities required of voting systems. This document, the Voluntary Voting System Guidelines Version 2.0 (referred to herein as the Guidelines or VVSG 2.0), is the fifth iteration of national level voting system standards. The Federal Election Commission published the first two sets of federal standards in 1990 [VSS1990] and 2002 [VSS2000]. The EAC then adopted Version 1.0 of the VVSG (VVSG 1.0) [VVSG2005] on December 13, 2005. In an effort to update and improve Version 1.0 of the VVSG, on March 31, 2015, the EAC commissioners unanimously approved VVSG 1.1 [VVSG2015]. The VVSG 2.0 is a departure from past versions in that a set of principles and associated guidelines were first developed to describe how, at a high-level, voting systems should be designed, developed, and how they should operate. The VVSG 2.0 requirements were then derived from those principles and guidelines. The VVSG 2.0 requirements fit within a framework of documents under the EAC Voting System Certification Program that include: • VVSG 2.0 Principles and Guidelines • VVSG 2.0 Requirements • VVSG 2.0 Testing and Certification Program Manual The Guidelines were designed to meet the challenges ahead, to replace decade’s old voting machines, to improve the voter experience, and provide necessary safeguards to protect the integrity of the voting process. All sections of the prior VVSG versions have been reviewed, re- evaluated, and updated to meet modern expectations, which address how voters should interact with the voting system and how voting systems should be designed and developed. The VVSG 2.0 requirements represent the latest in both industry and technology best practices, requiring significant updates in many aspects of voting systems. The Guidelines allow for an improved and consistent voter experience, enabling all voters to vote privately and independently, ensuring votes are marked, verified and cast as intended, and that the final count represents the true will of the voters. Section 508 Information and Communication Technology (ICT) Final Standards and Guidelines [USAB18], and Web Content Accessibility Guidelines (WCAG) [W3C10] are referenced and highlighted. Voter interface requirements have been updated to incorporate recent usability research and interactions that result from modern devices and now fully support accessibility throughout the voting process. 5 Requirements for VVSG 2.0 February 10, 2021 The cybersecurity of voting systems has never been more important. Indeed, attacks from nation state actors on our elections infrastructure in 2016 led to a critical infrastructure designation. To limit the attack surface on voting systems, the Guidelines require that any election system, such as an e-pollbook or election reporting system, be air-gapped from the voting system. To ensure the integrity of the voting process, methods have been implemented to detect errors through the combined use of an evidence trail and regular audits, including risk-limiting audits (RLAs), compliance audits, and ballot-level audits. There is a dedicated section on ballot secrecy, preventing voter information from being carried through to the voting system, and two-factor authentication is now mandated for critical voting operations. Cryptographic protection of data and new system integrity requirements ensure that security protections developed by industry over the past decade are built into the voting system. These include risk assessment and supply chain risk management, secure configurations and system hardening, exploit mitigation, sandboxing and runtime integrity. The VVSG 2.0 requires the voting system to include the capability of using common data formats defined by the National Institute of Standards and Technology (NIST) and public working groups. The common data formats were created to make election data more transparent and interoperable. These formats can be used in addition to any native formats used by the manufacturer. Defensive coding practices, reliability and electrical requirements were reviewed, updated, and streamlined. Finally, guidance relevant to testing and certification has been moved to the EAC’s testing and certification manual. This document was produced by the EAC’s Technical Guidelines Development Committee (TGDC) working in conjunction with NIST to aid in developing guidelines for voting equipment and technologies for making accessible, accurate and secure elections possible. EAC staff must annually review the VVSG for proposed revisions. Determinations must be sent to the EAC’s Executive Director (or a person operating in that capacity) to begin the review process required by HAVA (review by the TGDC, Board of Advisors, Standards Board, and public comment review) to ensure timely adoption of revisions. Under the direction of the Executive Director, EAC staff in consultation with NIST staff may make minor technical changes to the requirements in a timely manner. This process may include, but is not limited to, the development of an appeals process for such minor technical changes. EAC staff is responsible for updating the test assertions and issuing requests for interpretation or notices of clarification, as needed, to ensure efficiency in the process. 6 Requirements for VVSG 2.0 February 10, 2021 Table of Contents Acknowledgements ............................................................................................................. 2 Executive Summary ............................................................................................................. 5 Introduction ........................................................................................................................ 9 How the VVSG is to be Used ............................................................................................... 9 Scope ................................................................................................................................