Voluntary Voting System Guidelines 2 0 Principles and Guidelines Principle 1 HIGH QUALITY DESIGN The voting system is designed to accurately completely and robustly carry out election processes 1 1 - The voting system is designed using commonly-accepted election process specifications 1 2 - The voting system is designed to function correctly under real-world operating conditions 1 3 - Voting system design supports evaluation methods enabling testers to clearly distinguish systems that correctly implement specified properties from those that do not Principle 2 HIGH QUALITY IMPLEMENTATION The voting system is implemented using high quality best practices 2 1 - The voting system and its software are implemented using trustworthy materials and best practices in software development 2 2 - The voting system is implemented using best practice user-centered design methods for a wide range of representative voters including those with and without disabilities and election workers 2 3 - Voting system logic is clear meaningful and well-structured 2 4 - Voting system structure is modular scalable and robust 2 5 - The voting system supports system processes and data with integrity 2 6 - The voting system handles errors robustly and gracefully recovers from failure 2 7 - The voting system performs reliably in anticipated physical environments Principle 3 TRANSPARENT The voting system and voting processes are designed to provide transparency 09 12 2017 1 3 1 - The documentation describing the voting system design operation accessibility features security measures and other aspects of the voting system can be read and understood 3 2 - The processes and transactions both physical and digital associated with the voting system are readily available for inspection 3 3 - The public can understand and verify the operations of the voting system throughout the entirety of the election Principle 4 INTEROPERABLE The voting system is designed to support interoperability in its interfaces to external systems its interfaces to internal components its data and its peripherals 4 1 - Voting system data that is imported exported or otherwise reported is in an interoperable format 4 2 - Standard publicly-available formats for other types of data are used where available 4 3 - Widely-used hardware interfaces and communications protocols are used 4 4 - Commercial-off-the-shelf COTS devices can be used if they meet applicable VVSG requirements Principle 5 EQUIVALENT AND CONSISTENT VOTER ACCESS All voters can access and use the voting system regardless of their abilities without discrimination 5 1 - Voters have a consistent experience throughout the voting process in all modes of voting 5 2 - Voters receive equivalent information and options in all modes of voting Principle 6 VOTER PRIVACY Voters can mark verify and cast their ballot privately and independently 6 1 - The voting process preserves the privacy of the voter's interaction with the ballot modes of voting and vote selections 6 2 - Voters can mark verify and cast their ballot or other associated cast vote record without assistance from others 09 12 2017 2 Principle 7 MARKED VERIFIED AND CAST AS INTENDED Ballots and vote selections are presented in a perceivable operable and understandable way and can be marked verified and cast by all voters 7 1 - The default voting system settings for displaying the ballot work for the widest range of voters and voters can adjust settings and preferences to meet their needs 7 2 - Voters and election workers can use all controls accurately and voters have direct control of all ballot changes 7 3 - Voters can understand all information as it is presented including instructions messages from the system and error messages Principle 8 ROBUST SAFE USABLE AND ACCESSIBLE The voting system and voting processes provide a robust safe usable and accessible experience 8 1 - The voting system's hardware and accessories protect users from harmful conditions 8 2 - The voting system meets currently accepted federal standards for accessibility 8 3 - The voting system is measured with a wide range of representative voters including those with and without disabilities for effectiveness efficiency and satisfaction 8 4 The voting system is evaluated for usability by election workers Principle 9 AUDITABLE The voting system is auditable and enables evidence-based elections 9 1 - An error or fault in the voting system software or hardware cannot cause an undetectable change in election results 9 2 - The voting system produces readily available records that provide the ability to check whether the election outcome is correct and to the extent possible identify the root cause of any irregularities 9 3 - Voting system records are resilient in the presence of intentional forms of tampering and accidental errors 9 4 - The voting system supports efficient audits 09 12 2017 3 Principle 10 BALLOT SECRECY The voting system protects the secrecy of voters' ballot selections 10 1 - Ballot secrecy is maintained throughout the voting process 10 2 - The voting system does not contain nor produce records notifications information about the voter or other election artifacts that can be used to associate the voter's identity with the voter's intent choices or selections Principle 11 ACCESS CONTROL The voting system authenticates administrators users devices and services before granting access to sensitive functions 11 1 - Access privileges accounts activities and authorizations are logged monitored and reviewed periodically and modified as needed 11 2 - The voting system limits the access of users roles and processes to the specific functions and data to which each entity holds authorized access 11 3 - The voting system supports strong configurable authentication mechanisms to verify the identities of authorized users and includes multi-factor authentication mechanisms for critical operations 11 4 - Default access control policies enforce the principles of least privilege and separation of duties 11 5 - Logical access to voting system assets are revoked when no longer required Principle 12 PHYSICAL SECURITY The voting system prevents or detects attempts to tamper with voting system hardware 12 1 - The voting system supports mechanisms to detect unauthorized physical access 12 2 - The voting system only exposes physical ports and access points that are essential to voting operations Principle 13 DATA PROTECTION The voting system protects sensitive data from unauthorized access modification or deletion 09 12 2017 4 13 1 -The voting system prevents unauthorized access to or manipulation of configuration data cast vote records transmitted data or audit records 13 2 - The source and integrity of electronic tabulation reports are verifiable 13 3 - All cryptographic algorithms are public well-vetted and standardized 13 4 - The voting system protects the integrity authenticity and confidentiality of sensitive data transmitted over all networks Principle 14 SYSTEM INTEGRITY The voting system performs its intended function in an unimpaired manner free from unauthorized manipulation of the system whether intentional or accidental 14 1 - The voting system uses multiple layers of controls to provide redundancy against security failures or vulnerabilities 14 2 - The voting system limits its attack surface by reducing unnecessary code data paths physical ports and by using other technical controls 14 3 - The voting system maintains and verifies the integrity of software firmware and other critical components 14 4 - Software updates are authorized by an administrator prior to installation Principle 15 DETECTION AND MONITORING The voting system provides mechanisms to detect anomalous or malicious behavior 15 1 - Voting system equipment records important activities through event logging mechanisms which are stored in a format suitable for automated processing 15 2 - The voting system generates stores and reports all error messages as they occur 15 3 - The voting system employs mechanisms to protect against malware 15 4 - A voting system with networking capabilities employs appropriate well-vetted modern defenses against network-based attacks commensurate with current best practice 09 12 2017 5 This document is from the holdings of The National Security Archive Suite 701 Gelman Library The George Washington University 2130 H Street NW Washington D C 20037 Phone 202 994-7000 Fax 202 994-7005 nsarchiv@gwu edu