VVSG Tutorial

VVSG Security Requirements Part 6[^1]

*\[Slide 1\]*

\[NARRATOR:\] This is Part 6 of the Security Training Modules for the
next Voluntary Voting System Guideline document. This training module is
presented by Dr. Nelson Hastings of NIST's Information Technology
Laboratory. The module continues an overview of Chapter 5, General
Security Requirements, for the next VVSG. The presentation includes
question and answer sessions with the Election Assistance Commission's
Board of Advisors and Standards Board.

*\[Slide 2\]*

\[MR. HASTINGS:\] System integrity management: basically it is a
catchall for other security requirements that didn't fit in the other
parts of the guidelines. It talks to protection of the boot load and
execute process, removable media interface protection, backup and
recovery capabilities, and protection from malicious software.

*\[Slide 3\]*

The boot process protection: this process is when a system is powered
on. The first components of the system need to be loaded into memory so
that the system can execute. The integrity of the software
initialization components needs to be verified using the digital
signatures associated with those pieces of software. So again,
cryptography comes in.

*\[Slide 4\]*

The load and execute process is the process of loading software into
memory before its being executed. Again, the verification of the
software needs to be checked before it's loaded into memory again using
cryptography and digital signatures.

*\[Slide 5\]*

Removal of media protection: the requirements here are other than the
physical security mechanisms that are talked about, I think, in Section
5.8: the ability to disable the interfaces where removable media is
inserted and removed from the voting system. An example that's given
here is you may only need to use a CD interface to be enabled when
software is being installed on the system but during the election you
are not using that CD drive, so you need to be able to disable that so
somebody just can't walk in and drop a CD into that.

*\[Slide 6\]*

Backup and recovery mechanisms are limited to election management
systems. It's permitted only when capturing votes, which is really not
the right term here because election management systems actually just
aggregate votes at that point. So we need to go back and look at that.

The integrity verification information needs to be created when
information is backed up so that you can make sure that the information
hasn't been modified. And then before you can restore that information,
you need to verify the authentication and integrity of that information
before you reinstall that or recover that information.

*\[Slide 7\]*

Malicious software protection: again this is limited to election
management systems. Used to detect malicious software, and there is a
requirement that you need to be able to update that software so that it
is aware of new threats as they appear over time. The idea here is like
if you run a virus scanner on your system, you are told to go out once a
week, every two weeks, every month, to go out and download the new data
files from your virus scanner vendor so that you are up to date-

\[QUESTIONER:\] Does this mean if you have a system that's never
connected to the Internet, then you would never want the malware, you
don't want to be going out there.

\[MR. HASTINGS:\] The requirement says it has to have the capability to
update it. It doesn't say that you have to, that you do it by connecting
it to the Internet. The idea here is that you can download the data
files, put the CD into your system, and copy those files over. Yes.

\[QUESTIONER:\] If you have the ability to update that detection
software that's loaded on your EMS, wouldn't that modification to your
certified EMS software, because it's an update, would that have to go
through recertification?\
\[MR. HASTINGS:\] That's a good question\
\[QUESTIONER:\] You are saying here that I have to be able to update
that software that is on my system.

\[MR. HASTINGS:\] Right.

\[QUESTIONER:\] So I'm modifying my system, I'm modifying my system that
received certification.

\[MR. SKALL:\] That's a question for the EAC.

\[QUESTIONER:\] Well that's why I was looking back at Brian wondering if
the VVSG is requiring this, are we going to have to recertify that?

\[MR. HANCOCK:\] Well, I mean I don't know right now but it is, as with
anything that you download, any time you change anything would that
change the signature, I mean-

\[MS. GUTTMAN:\] You would expect that it would change signature codes
and-

\[MR. HANCOCK:\] Yeah, I think so, but you would need to quantify that.

\[MR. SKALL:\] The answer is maybe.

\[MR. HASTINGS:\] So this software protection needs to be executed once
every twenty-four hours and before loading and executing of software on
the voting system.

\[QUESTIONER:\] If that stays like this- leading to our presentation up
to this-

\[MR. HASTINGS:\] Oh, is this the bullet where you are saying that this
is?

\[QUESTIONER:\] I'm saying you know if X comes every 24 hours before
there is any opportunity to stop it.

\[MR. HASTINGS:\] When I'm talking here, this is an automated process.
You can configure your virus software to check software before it's
loaded into memory to be executed. That's what that second part of that
and you can configure your software to, your virus protection software
to look at three in the morning- . Yes, that's where that's coming from.
It needs to be executed against removable media.\
*\[Slide 8\]*

Again the technical data package requirements are a list of all software
to be executed.\
*\[Slide 9\]*

So The next set of requirements relate to communications- protection
security. And it's really about the protection of information that's
being transmitted and defenses against communications-based threats or
networks-based threats.\
The first requirement which was in the VVSG 2005 was the use of no
wireless technology except for infrared technology when the path of that
infrared signal is protected.*\
\[Slide 10\]*

No remote to voting devices during Election Day: There are two
exceptions to this requirement. It's for devices used to transmit
end-of-day results and e-pollbooks when they communicate to voter
registration databases. However, when those types of devices are used,
they cannot be connected to other polling place devices.\
*\[Slide 11\]*

So, what I did to make this a little clearer is we drew a little picture
of a polling place and remote locations that one might want to
communicate with. So we have some voting devices in a polling place and
maybe an electronic pollbook as well. The voting devices can be
connected together, and maybe there is a remote registration database
that one would want, the pollbook may want to connect to. If the
e-pollbook connects to the voting devices, it cannot connect to the
registration databases. However, if it's not connected to the voting
devices in the polling place, that electronic pollbook can go out and
connect to the registration database. And this type of buffer is called
an air gap and that's the requirement that talks about air gaps between
these different devices. So at the end of the day, you might want to
select one of the voting devices and turn it into an accumulator to
upload end-of-the-day results. While it's connected to the other devices
in the polling place, it cannot connect out to the central count. So
what you have to do is disconnect the accumulator from the polling place
devices, and if it hasn't already accumulated the results through the
network, you bring those memory cards or whatever that have those totals
on it, put them on the accumulator. Then it goes out.

\[QUESTIONER:\] So are you saying that if there is a precinct count
optical scan, it is the accumulator, and it's not connected to anything
else so it can connect to the central count remote location?

> \[MR. HASTINGS:\] Say it one more time and then I'll-

\[QUESTIONER:\] Precinct count optical scan; So it is the accumulator
itself. It's not connected to anything else in the polling place. Are
you saying that the precinct count optical scan unit can transmit to the
central count?

\[MR. HASTINGS:\] At the end of the day, yes- so the question is if you
have a precinct count optical scan that's not connected to any other
devices in the polling place because it's a precinct count optical scan,
that based on the discussion we've had here, because it's an
accumulator, can it go and connect out and upload at the end of the day?
The way the guidelines are written right now, that would be acceptable.

\[QUESTIONER:\] What you are basically saying here is that if your
electronic poll book connects to the voting devices it can connect to a
central database.

\[MR. HASTINGS:\] Right.

\[QUESTIONER:\] On Election Day.

\[MR. HASTINGS:\] Right, on Election Day.

\[QUESTIONER:\] How do you propose to run early voting or even indicate-
particularly early voting or same day registration voting in states that
have to know whether or not somebody shows up at more than one polling
place or not?

\[MR. HASTINGS:\] State your question one more time so I'm clear. Okay?

\[QUESTIONER:\] An electronic pollbook needs not only to know who the
voters are, but it can tell you whether or not voters have voted in
other locations. In order to do that, the electronic pollbook of
necessity will have to connect to the voting devices also to record
whether or not that person (a) was eligible, (b) voted, and now (c) is
registered on the central database. So if you can't do that, you've
eliminated a security feature that election officials need.

\[MR. HASTINGS:\] But you have also introduced, if the electronic
pollbook is connected both to the voting devices at the same time that
it's connected to the Internet or has been connected to the Internet,
that introduces a vulnerability.

You can do one or the other. You can do one or the other. You can use an
electronic pollbook to connect to the central database.

\[QUESTIONER:\] But you can't have it happen all at once.

\[MR. HASTINGS:\] Absolutely.

\[MR. EUSTIS:\] We don't want it to happen all at once.

\[QUESTIONER:\] Got it- What it has done is it has prohibited it all in
one sentence.*\
\[Slide 12\]*

\[QUESTIONER:\] You made the comment. You said on Election Day. Does
this not apply during early voting? Election Day is a capitalized noun.

\[MR. HASTINGS:\] The way the guidelines are written as of right now, it
is specific on Election Day and--

\[QUESTIONER:\] My point is, what Doug said is true, at least the way we
do it now. We discussed this with the card activators. A card activator,
by your definition, I think, is a voting device. If it's not a voting
device, I don't care, but we use what you would call a pollbook to
activate the card and to simultaneously record in a database,
centralized database that that voter has voted and that is a much more
accurate way to do it because it takes out the human typing in that
ballot code.

I just want to be sure of that, and I think there are other preventions
that could be put in to be sure that a card that is stuck into a machine
to activate it is secure , I mean, is not going to corrupt the machine.

\[MR. HASTINGS:\] How do--

\[QUESTIONER:\] It's not connected so it would be okay, right? You don't
have both of them connect-

\[QUESTIONER:\] That's what I'm saying. It's a two-step process instead
of one and I guess we can live with that.

\[MR. HASTINGS:\] Okay. Matt.

\[MR. MASTERSON:\] Maybe I'm confused by exactly what the requirement
says but I'm looking at 5.6.1-B2. It says "electronic devices that
connect to voter registration databases outside a polling place on
Election Day shall never be connected to other polling place electronic
devices." Is that what you are describing here because "shall never"
does not apply to one and then, you know, both at the same time?

\[MR. HASTINGS:\] The way the requirement is written as I think was the
intent of the STS subcommittee: So if you ever connect out to the remote
registration database during the day, you should not ever be able to
connect back into the voting devices.

\[QUESTIONER:\] Is the issue here whether- are we defining the voting
device to include the ballot activation encoder? I know it's the wrong
terminology. I think what the issue is here, like in Larry's situation,
he's using the encoder directly connected to his voter registration
database to encode the ballot activator, the voter card to then be
carried to the voting device, the DRE. Is that the air gap that's
necessary or is it the actual encoder that cannot be connected to the--

\[MR. HASTINGS:\] I'm going to look at John Wack here because this is
somewhat related to--

\[MR. WACK:\] Well, I've been trying to follow things, and I'm not sure
I followed them correctly but I think in general the philosophy here is
that, as Doug was saying earlier, or Barbara, one or the other. So you
know, whether it be- Larry, you were talking about a handheld encoder or
you are talking about a--

\[QUESTIONER:\] I'm talking about a laptop that's connected to our
centralized voter database that when a voter comes in, we pull up his
signature to verify him and then we're basically hitting the key that
transmits back to the voter database that this voter has voted at this
place and this time and simultaneously transmits a signal to the card
activator saying pull up this ballot style.

\[MR. WACK:\] So restating for the record, Larry's layout, he's
basically got an encoder connected up to an external database. So
according to the requirements, while he is connected up to the external
database, he cannot also be connected up to his VVPATs if the VVPATs,
well, yeah, he can't be --

\[QUESTIONER:\] It's not the VVPAT. This is a card activator that
activates the card that the voter then carries over to the--

\[MR. WACK:\] Right. Right, and basically I understand. I guess
basically the card encoder itself. This is really aimed at card encoders
that, well, actually activation devices that are not card encoders that
may send some sort of a signal to a network set of DREs and in that way
activate the ballot.

It's really not aimed at all really to in any way prohibit kind of a
stand-alone, you know, ballot activation device connected up at the same
time to a voter registration database.

\[QUESTIONER:\] Is Election Day, does that include early voting?

\[MR. HASTINGS:\] I think that's the discussion, some of the discussion
that we are having right now.

\[QUESTIONER:\] I think you are going to have to allow for early voting,
whether you interpret it as Election Day or not. You are going to have
to have the ability to do it.

\[MR. HASTINGS:\] I think the focus when that requirement was being
written was specifically for Election Day and if we get comments back
that say we need to take a look at that in terms of early voting, we
definitely can do that.

\[QUESTIONER:\] A couple of years ago, we had an election contest that
involved early absentee voting. As a result of that it changed our state
protocol of a couple of years ago that specifically says that when a
voter comes in and does early voting, that is their Election Day. So
let's be real clear that Election Day is not the second Tuesday of
November for everybody. Whenever they vote in person is Election Day.

\[QUESTIONER:\] There's one problem with that. It's that then lawsuits
are filed against you that the election violated the law because
Election Day is a pre-set date particularly where all of this problem
came is central elections. So if you are considering Election Day by
state law, it's not correct.

\[QUESTIONER:\] Well, first of all, I'm not qualified to talk on the
issue of Election Day, but in terms of what I understand the requirement
to be and this issue was discussed in the TGDC, is that the encoder is
not, would not be defined as one of those voting devices, and therefore
there is an air gap because you are producing a card that you then take
out of your electronic pollbook, and you take it over to your voting
device, and you have your air gap there.

The question that you are trying to deal with is if there is a wire
connection between the pollbook and the voting device, then the pollbook
cannot be connected to the voter registration database, and if there is,
or some connectivity between the pollbook and the central computer, it
cannot be wirelessly connected to the voting device, wirelessly or any
other way. You can use activation cards carried from one location to the
other location, and that is the air gap that is provided for.

\[MR. HASTINGS:\] We'll you go first and then--

\[QUESTIONER:\] You cannot transfer a corruption code via that card?
You've got an air gap in there, the file comes from the server back to
the encoder, corrupts the card, then you put the card in the voting
device--

\[MR. WACK:\] May I? So the question was couldn't you still transmit
something via the memory card, let's say, or smart card from the
activation device to one of the DREs?

The answer is you could. So yesterday when I was going over some of
those requirements, number one, there was a 'should' requirement that
basically said the amount of memory on the card itself ought to be just
what you need and no more so you can reduce that threat.

The other thing was that the DRE or the vote capture device, I'm trying
to remember by acronyms, vote capture device also has to check the
integrity of the information. So it has to look at the integrity of the
information on the card and check that it came from an authorized ballot
activation device.

Those things, again, it's an example of defense in depth, and they don't
completely mitigate that threat but they would go a long way towards it.

\[MR. HASTINGS:\] Larry, again.

\[QUESTIONER:\] One minor comment. You might want to rewrite the
definition of voting device because the definition of the voting device
in your appendix says to include systems such as smart cards, which I
assume is what we are talking about.

\[MR. HASTINGS:\] Okay. Thanks, Larry. Larry's comment was that we
should revisit our definition of voting device and maybe rewrite it.\
*\[Slide 13\]*

The next requirements deal with network interface protection: the
ability again to disable network interfaces when they are not required
for use so that somebody just can't plug in a device there, a network
device.

The other thing is to prohibit traffic flow from one network interface
to another network interface on devices that have multiple interfaces.
You don't want to have that to be a route to contaminate one network
from the other.

The other requirement is that the network interfaces need to have
physical identifiers, unique physical identifiers for each interface.\
*\[Slide 14\]*

Other requirements limit the communications to only devices that need
communication between each other. In addition, information that's
transmitted over these network communications need to have integrity
information to make sure that the data sent hasn't been corrupted.\
*\[Slide 15\]*

In addition to that, there needs to be mutual authentication between the
devices that are communicating over the network. It's part of the
connection establishment. It uses unique identifiers for the devices so
you can tell what device I'm talking to and limit the amount of
information needed to do authentication so you are not otherwise leaking
information.

Limit devices to only required network ports, active share such as
network hard drives and services. So you want to disable all those, be
able to disable all those unnecessary processes that use a network.\
*\[Slide 16\]*

Then there is a requirement to monitor network interfaces for evidence
of attack. And if an attack via the interface is detected, to take some
action to defend against that such as shutting down that network
interface.\
*\[Slide 17\]*

Documentation requirements list all network communications required by
the process and applications and list of all required network port share
services that are used by the voting system.\
*\[Slide 18\]*

This next section is system event logging requirements. It provides
accountability and supports the ability to reconstruct events and detect
intrusions.

This is an electronic audit trail, and it's really about information to
be generated, how to protect that information after it's been generated,
and the management of system event logs as the logs get bigger and
accumulate information.\
*\[Slide 19\]*

Log information must maintain voter privacy and ballot secrecy. In
general, no cast ballot records are recorded in the system event log. It
might say a ballot was cast at x time but the actual cast ballot record
is not part of the system event log.

Basic log entry information: the system identifier, event identifier, a
time stamp, the result of the event, and, when applicable, the user that
triggered that event to occur.\
*\[Slide 20\]*

Time stamp: the first requirement deals with the accuracy of the clock
and drift related to that. So, one minute within a fifteen-hour period;
the format of the time stamps to be based on ISO 8601 representations of
time. So the date would be day, month, year with a four-digit year.

Time is in hours, minutes, seconds as well as an indication of a time
zone. And the administrator role is required to do any adjustments on
the clock. Wendy.

\[QUESTIONER:\] In what round do you include things like daylight
savings time, central time zone, and different zones?

\[MR. EUSTIS:\] The question is about daylight savings time and the
requirement for that.

\[MR. HASTINGS:\] I'm going to defer since Dave Flater has written--

\[MR. FLATER:\] ISO 8601 specifies that the time zone is specified as an
offset from universal coordinated time. You know the number of hours are
different, so it's not a question of, you are not going to say Eastern
Daylight Time or Eastern Savings Time; you are going to say it's an
offset of minus 4 hours. So it's not ambiguous.

\[QUESTIONER:\] Here's a scenario. I just burned part of the testing
machines last week and between now and election time, daylight savings
time is going to come in. The machines will not adjust for it.

\[MR. HASTINGS:\] Right.

\[QUESTIONER:\] So if you go back in and change those cards and actually
reburn them and theoretically then they should be retested.

\[MR. HASTINGS:\] I think what David said is that time in this standard
is based on offset, from universal time. So, it's plus 4 hours or
whatever, regardless of whether it's daylight savings time or not.

\[QUESTIONER:\] The problem is that you've got people who don't know
what that means in the criteria. They know they're in central daylight
savings time. That's great but like he said, people will be running into
issues whether it's daylight savings time clock between the time you
burned your election and the election comes up. Then you run into a new
problem. They've changed daylight savings time last spring and so if the
machines were set to automatically generate, you have to stop them from
automatically doing it for those of us who have an April election. We've
got some issues there that you need to get some testing in as to what's
going on with time. It's a never ending day.

\[MR. HASTINGS:\] Larry.

\[QUESTIONER:\] My question is, because I think this is an explanation;
the offset of minus 4, are we talking what we in the military used to
call Zulu time?

\[MR. HASTINGS:\] I believe so. I believe that is correct.

\[QUESTIONER:\] What is zulu time?

\[MR. EUSTIS:\] Greenwich Mean Time.

\[QUESTIONER:\] In other words, it never changes. It doesn't matter if
it's daylight savings--

\[MR. EUSTIS:\] Zero degree meridian, always the same-

\[MR. HASTINGS:\] Thanks, Larry, for that clarification.

\[QUESTIONER:\] The offset is from zulu time. The offset changes by your
time zone.\
*\[Slide 21\]*

\[MR. HASTINGS:\]The system event logging in that section has a big
table that contains all the events to be logged. If there are events
that we've missed, please provide feedback on it. They are broken out
into, I think, five different categories: so general system functions
such as starting up the device, shutting down the device, adding files
to the device, that kind of thing.

Access control: events that occur, attempts to log in, attempts to log
out.\
*\[Slide 22\]*

System software events: installation of software, upgrades and patches,
attempts to connect to databases, cryptographic events such as changing
cryptographic keys in the voting device, and voting-related events such
as opening and closing of polls, casting of a ballot and ballot
definition, and modification to those configuration files.\
*\[Slide 23\]*

The management of system events logs: there should be a way to have a
default setting of the system event log. The storage of that log
information needs to be in a publicly documented format such as XML.

Event logs: events should be able to be distinguished based on elections
as well as based on the device itself, the different devices.

And then in some cases, retention of event log data from previous
elections. Some locales require that the voting device contain all the
event logs for all the elections that have been processed on that
system.\
*\[Slide 24\]*

Export of the system event log information with a digital signature,
again, for integrity.

Management of log capacity requirements: requirements to alert as the
capacity of the log increases and reaches certain intervals and
suspension of vote capturing when log capacity is reached.\
*\[Slide 25\]*

\[QUESTIONER:\] Okay. Now, all this logging, you know logging is fine
but it implies somebody is going to review all the logs, which falls
back on us. There needs to be some understanding. There's no staffing to
do this in most of these locations. We are building all of this
information. It's just out there. No election official has the
resources, well; very few have the resources to do anything with these
logs. Do you understand that?

\[MR. HASTINGS:\] I feel for your-

\[QUESTIONER:\] I mean the counties, they don't even do the elections,
the vendor does the election.

\[MR. HASTINGS:\] I'm going to defer to Barbara on this.

\[MS. GUTTMAN:\] Audit trails are used for several different purposes.
Some get reviewed on an hourly basis if you want or some at the end of
the election. However, some of them are just used in case you have a
problem, in which case, you know, a county might not have the expertise
to handle it. Specifically, they might have to call on resources from or
jurisdiction from the county or from the state depending on sizes. So,
some audit log data is only there in case you have a problem so you can
reconstruct events. It's not used, not all of it has to be used as part
of an ongoing review of logs. So these audit logs address that, not just
things an election official would be expected to check at the end of,
you know, at election closeout.\
*\[Slide 26\]*

\[MR. HASTINGS:\] There is a requirement to have tools, that the vendor
supply tools to view and analyze and search system event logs while the
logs reside on a voting system, to halt vote capturing when the system
event log malfunctions or is disabled, and it requires the administrator
role to do operations related to configuring and clearing log entries.\
*\[Slide 27\]*

The protection of log information: unauthorized access, limiting access
to those logs, read-only for administrator roles, writer-append only for
processes that generate event entries.

Unauthorized modification through the use of cryptography, append only
media kinds of things.

Unauthorized deletion to prevent unauthorized deletion and integrity and
availability protection of archived log files.\
*\[Slide 28\]*

Physical security: the goal of this is really to ensure that sufficient
controls are in place to prevent undetected and unauthorized physical
access. One must be able to distinguish between authorized and
unauthorized access. In general, the requirements say that unauthorized
access needs to leave some type of physical evidence that the
unauthorized access has occurred.\
The requirements recognize the use of both procedural and physical
countermeasures but try not to prescribe either.\
*\[Slide 29\]*

Unauthorized physical access in general basically must, like I said,
leave some physical evidence that that occurred.

Physical ports on the system: this physical port and lease
functionality; that's really about limiting the number of ports on the
system to only those that are needed to do the functions required by the
voting system. So you don't want to have an extra USB port that's never
used on the system.

Voting device boundary protection: if a connection between different
components on the voting system is broken, the voting device must
automatically disable the port that has gotten disconnected and set off
an indication for that and create an event log as well as it can only be
re-enabled with appropriate authorization before it can be used again.*\
\[Slide 30\]*

\[QUESTIONER:\] On 5.8.3 and I'm sorry, you just scrolled down through
there, but is that where it says if a physical connection between voting
device components is broken during activated or suspended state, the
affected voting machine port shall be automatically disabled? Should
that say the device should be disabled rather than the voting machine
port or do I not understand this?

\[MR. HASTINGS:\] Could you repeat the requirement number again?

\[QUESTIONER:\] Okay, 5.8.3-A.

\[MR. HASTINGS:\] 5.8.3-A. The affected voting machine port-\
\[QUESTIONER:\] "Shall be automatically disabled". Should that be the
device should be disabled rather than the voting machine port? What's
the definition of a port?

\[MR. HASTINGS:\] The port- so if you have unplugged something from a
USB port and that's during the time of activated or suspended state,
that port needs to be deactivated. Not the device itself but that port
can be done. Wendy?

\[QUESTIONER:\] Do you mean like okay so there's a printer that's
connected to a specific port, it becomes disconnected, so if it disables
the port but the person can continue voting and it would not continue to
create a paper trail.

\[MR. HASTINGS:\] Yeah, I guess that's, looking at the requirement that
seems to be-- so?

\[QUESTIONER:\] And If that paper trail is the initial ballot, then
you've got a problem. Yeah, I think she finds that-

\[MR. HASTINGS:\] It needs to be the device itself that goes down.
Okay.\
*\[Slide 31\]*

\[MR. HASTINGS:\] The next requirements relate to information flow and
access to ports with removable media needs to be restricted, maybe have
a panel over it that could have a tamper-evidence tape. Door covers and
panels, again, must be designed so that access to that can be monitored,
either through the use of some automated mechanism or some physical
tamper-evidence type of mechanism. Secure ballot box: ballot boxes must
be tamper-evident.\
*\[Slide 32\]*

The next requirements relate to the keys used by voting systems. There
is a lot of debate on the physical keys. So we are talking about
physical keys here, not cryptographic keys. So, physical keys that are
used as a security mechanism need to meet UL standards and be
tamper-evident. In addition to that, they must be able to be keyed based
on the owner's preference. So a vendor can't just buy a box of one type
of lock that can't be rekeyed for anything, and everybody in the nation
has that.

Now that's only for keys or for locks that are used as a security
mechanism. If a lock isn't used then these requirements do not apply.
However, the next requirement basically says that if a lock is not used
as a security mechanism, if that lock gets bypassed, it should not
result in a breach of the security of the system.

\[QUESTIONER:\] In 5.8.7-B, I think this is all nice but what physical
evidence can distinguish something being, like something maybe just got
scraped along a port or a lock, you know, how do you distinguish between
that and unauthorized attempts. I'm not sure if I understand.

\[MR. HASTINGS:\] That question has come up in the last few days about
how do I know that this isn't just something that bumped up against it?
So we will look. That's something that, add that to your list of
questions.

\[QUESTIONER:\] I will.

\[MR. HASTINGS:\] And then the final requirement in the physical
security is that if power fails, the physical countermeasure should not
fail itself, or if it fails, it should fail in the safe mode.
Essentially it's just saying physical security mechanisms shouldn't
depend on electricity being supplied to them.\
*\[Slide 33\]*

\[NARRATOR:\] Additional explanatory presentations on the Voluntary
Voting System Guidelines can be accessed from the Web site:
vote.nist.gov.

[^1]: ^\*^ Certain commercial entities, equipment, or materials may be
    identified in this presentation in order to describe an experimental
    procedure or concept adequately. Such identification is not intended
    to imply recommendation or endorsement by the National Institute of
    Standards and Technology, nor is it intended to imply that the
    entities, materials, or equipment are necessarily the best available
    for the purpose.