# **Volume I, Appendix C**

**Best Practices for Voting Officials**

The VSS-2002 contained requirements only for voting systems and for
testing entities. However, requirements for the new sections of the
VVSG, including human factors, wireless communications, VVPAT, software
distribution and setup validation, depend not only on voting systems
providing specific capabilities but on voting officials developing and
carrying out appropriate procedures. Consequently, the VVSG Version 1
contains Best Practices for voting officials. Voting officials can use
this to develop and incorporate appropriate procedures to help ensure
that their voting systems are reliable, accessible, usable, and secure.
Furthermore, this guidance may be used in training and incorporated into
written procedures for properly conducting the election and operating
voting systems.

This section is not a complete list of best practices for voting
officials. It only reflects items specifically called out in the VVSG.
Future versions will be more comprehensive and will better reflect the
key role that voting officials have in operating, maintaining, setting
up, validating, storing, and otherwise managing voting systems to
achieve successful elections.

**2.2.7.1.1.1** When the provision of accessibility involves an
alternative format for ballot presentation, then all the other
information presented to voters in the case of non-disabled
English-literate voters (including instructions, warnings, messages, and
ballot choices) shall also be presented in that alternative format.

> Responsible Entity: voting system vendor, voting officials
>
> Process: voting
>
> Discussion: This is a general principle to be followed for any
> alternative format presentation. Two particular cases, 1) audio
> formats and 2) non-English formats, are the subject of specific
> requirements in later sections.

**2.2.7.1.1.3** When the primary means of voter identification or
authentication uses biometric measures that require a voter to possess
particular biological characteristics, the voting process shall provide
a secondary means that does not depend on those characteristics.

> Responsible Entity: voting system vendor, voting official
>
> Process: voting
>
> Discussion: For example, if fingerprints were used for identification,
> there would have to be another mechanism for voters without usable
> fingerprints.

**2.2.7.1.1.4** Polling places shall conform to the appropriate
guidelines of the Americans with Disabilities Act (ADA) of 1990 and of
the Architectural Barriers Act (ABA) of 1968.

> Responsible Entity: voting officials
>
> Process: pre-voting/voting
>
> Discussion: This requirement does not stem from HAVA, but rather is a
> reminder of other legal obligations. For more details, see
> http://www.access-board.gov/ada-aba.htm and
> http://www.usdoj.gov/crt/ada/votingck.htm.

**2.2.7.1.2.2.3.4** A sanitized headphone or handset shall be made
available to each voter.

> Responsible Entity: voting system vendor, voting officials
>
> Process: voting
>
> Discussion: This requirement can be achieved in various ways,
> including the use of \"throwaway\" headphones, or of sanitary
> coverings.

**2.2.7.1.2.2.5** If the normal procedure is for voters to submit their
own ballots, then the voting process should provide features that enable
voters who are blind to perform this submission.

> Responsible Entity: voting system vendor, voting officials
>
> Process: voting
>
> Discussion: For example, if voters normally feed their own optiscan
> ballots into a reader, blind voters should also be able to do so.

**2.2.7.1.4.1.1** The AVS shall provide a clear floor space of 30 inches
(762 mm) minimum by 48 inches (1219 mm) minimum for a stationary
mobility aid. The clear floor space shall be level with no slope
exceeding 1:48 and positioned for a forward approach or a parallel
approach.

> Responsible Entity: voting system vendor, voting officials
>
> Process: pre-voting/voting

**2.2.7.1.4.2** All controls, keys, audio jacks and any other part of
the AVS necessary for the voter to operate the voting system shall be
within the reach regions as specified under the following
sub-requirements.

> Responsible Entity: voting system vendor, voting officials
>
> Process: pre-voting/voting
>
> Discussion: All dimensions are given in inches. To convert to
> centimeters, multiply by 2.54. Note that these sub-requirements have
> meaningful application mainly to controls in a fixed location. A
> hand-held tethered control panel is another acceptable way of
> providing reachable controls. All the sub-requirements inherit the
> \"responsible entity\" and \"process\" properties.

**2.2.7.1.4.2.4.1** The side obstruction shall be no greater than 24
inches in depth and its top no higher than 34 inches.

> Responsible Entity: voting system vendor, voting officials

**2.2.7.1.4.2.5** All labels, displays, controls, keys, audio jacks and
any other part of the AVS necessary for the voter to operate the voting
system shall be easily legible and visible to a voter in a wheelchair
with normal eyesight (no worse than 20/40, corrected) who is in an
appropriate position and orientation with respect to the AVS.

> Responsible Entity: voting system vendor, voting officials
>
> Process: pre-voting/voting
>
> Discussion: There are a number of factors that could make relevant
> parts of the AVS difficult to see: small lettering, controls and
> labels tilted at an awkward angle from the voter\'s viewpoint, glare
> from overhead lighting, etc.

**2.2.7.1.5.1.1** The AVS shall incorporate the features listed under
requirement #2.2.7.1.2.2.3 (audio presentation) to provide accessibility
to voters with hearing disabilities.

> Responsible Entity: voting system vendor, voting officials
>
> Process: voting
>
> Discussion: Note especially the requirements for volume initialization
> and control.

**2.2.7.1.7** The voting process shall be accessible to voters with
cognitive disabilities.

> Responsible Entity: voting system vendors, voting officials
>
> Process: voting
>
> Discussion: At present there are no design features specifically aimed
> at helping those with cognitive disabilities. Clause 1.2.1.9, the
> synchronization of audio with the screen in a DRE is helpful for some
> cognitive disabilities such as dyslexia.

**2.2.7.2.2** Regardless of the language, candidate names shall be
displayed or pronounced in English on all ballots. For written languages
that do not use Roman characters (e.g. Chinese, Japanese, Korean,
Arabic), the ballot shall include transliteration of candidate names
into the relevant language.

> Responsible Entity: voting system vendor, voting officials
>
> Process: voting

**2.2.7.3.2.**1 As mandated by HAVA 301 (a)(1)(A), the voting process
shall allow the voter to review his or her completed ballot before final
submission in order to verify that it correctly represents the intended
vote. Further, the process shall provide a means by which the voter can
correct the ballot if mistakes are detected.

> Responsible Entity: voting system vendor, voting officials
>
> Process: voting
>
> Discussion: Note that this review and correction may be achieved by
> procedural means (e.g. in the case of paper ballots), as well as
> technical. This requirement is a brief paraphrase of the HAVA language
> but of course the statutory language is determinative.

**2.2.7.3.2.2** As mandated by HAVA 301 (a)(1)(A), the voting process
shall notify the voter if he or she has attempted to vote for more
candidates than the maximum permitted in a given race and shall provide
the voter with the opportunity to correct the ballot before final
submission.

> Responsible Entity: voting system vendor, voting officials
>
> Process: voting
>
> Discussion: Note that this notification and correction may be achieved
> by procedural means (e.g. in the case of paper ballots), as well as
> technical. This requirement is a brief paraphrase of the HAVA language
> but of course the statutory language is determinative.

**2.2.7.3.2.4** The voting process shall notify the voter if he or she
has attempted to vote for fewer candidates than the maximum permitted in
a given race and provide the voter with the opportunity to change the
ballot before final submission. The process shall also notify the voter
that such an \"undervote\" is permitted and shall accept a ballot if the
voter so chooses.

> Responsible Entity: voting system vendor, voting officials
>
> Process: voting
>
> Discussion: Note that this notification and correction may be achieved
> by procedural means (e.g. in the case of paper ballots), as well as
> technical.

**2.2.7.3.3.1** Consistent with election law, the voting process shall
not introduce any bias for or against any of the choices to be made by
the voter. In both visual and aural formats, candidates and choices
shall be presented in an equivalent manner.

> Responsible Entity: voting system vendor, voting officials
>
> Process: voting
>
> Discussion: Certain differences in presentation are unavoidable, such
> as the order in which candidates are listed, and write-in candidates
> are inherently more difficult to vote for. But comparable
> characteristics such as font size or voice volume and speed must be
> the same for all choices.

**2.2.7.3.3.2.1** Voters should have access to sample ballots and all
relevant instructions before the voting session.

> Responsible Entity: voting officials
>
> Process: pre-voting

**2.2.7.3.3.2.2** Voters should have an opportunity to practice voting
before the actual voting session, especially for DRE systems.

> Responsible Entity: voting officials
>
> Process: pre-voting
>
> Discussion: For example, web-based support can provide access to
> ballot information and instructions for operating the voting station.
> Practice material and equipment may also be provided at the polling
> place.

**2.2.7.3.3.3.2** The voting process shall provide human assistance if
requested by the voter.

> Responsible Entity: voting officials
>
> Process: voting
>
> Discussion: The voter should always be able to get help from a poll
> worker if desired.

**2.2.7.3.3.4.1** The voting station should not visually present a
single race spread over two pages or two columns.

> Responsible Entity: voting system vendor, voting officials
>
> Process: voting
>
> Discussion: Such a visual separation poses the risk that the voter
> will perceive the race as two races. Of course, if a race has a very
> large number of candidates, it may be infeasible to observe this
> guideline.

**2.2.7.4.1.1** The ballot and any input controls shall be visible only
to the voter during the voting session and ballot submission.

> Responsible Entity: voting system vendor, voting officials
>
> Process: voting
>
> Discussion: Voting officials should take into account such factors as
> visual barriers, windows, permitted waiting areas for other voters,
> and procedures for ballot submission when not performed at the voting
> station, e.g. submission of optiscan ballots to a central reader.

**2.2.7.4.1.2** The audio interface shall be audible only to the voter.

> Responsible Entity: voting system vendor, voting officials
>
> Process: voting
>
> Discussion: Voters who are hard of hearing but need to use an audio
> interface may also need to increase the volume of the audio. Such
> situations require headphones with low sound leakage.

**2.2.7.4.1.3** As mandated by HAVA 301 (a)(1)(C), the voting system
shall notify the voter of an attempted overvote in a way that preserves
the privacy of the voter and the confidentiality of the ballot.

> Responsible Entity: voting system vendor, voting officials
>
> Process: voting
>
> Discussion: This requirement is a brief paraphrase of the HAVA
> language but of course the statutory language is determinative.

**2.2.7.4.3** The procedures for absentee balloting shall enable the
voter to preserve privacy.

> Responsible Entity: voting officials
>
> Process: voting
>
> Discussion: There is no practical means to prevent a voter from
> revealing an absentee paper ballot to others. But the procedures
> should ensure that if a voter chooses to maintain privacy, it is not
> violated at a later stage, in particular when the ballot is received
> by voting officials.

**6.0.2.4.3** In case of conditions that prevent voter review of the
paper record, there shall be a means for the voter to notify an election
official.

> Responsible Entity: voting Official
>
> Process: voting

**6.0.2.4.4** Procedures by which election officials can be notified and
prescribed actions that can be taken to address discrepancies if a voter
indicates that the electronic and paper records do not match shall be
documented.

> Responsible Entity: voting system vendor, voting official
>
> Process: voting

Discussion: If the records do not match, a potentially serious error has
occurred. Election officials must first verify that the records do not
match and then take appropriate actions such as removing the voting
station from service and quarantining its records for later analysis.

**6.0.2.5.3** The privacy and anonymity of voters whose paper records
contain any of the alternative languages chosen for making ballot
selections shall be maintained.

> Responsible Entity: voting system vendor, voting official
>
> Process: voting
>
> Discussion: One method for accomplishing this is to ensure that no
> less than five voters use any of the alternative languages for their
> ballot selections.

**6.0.2.5.4** The voter shall not be able to leave the voting area with
the paper record if the information on the paper record can reveal the
voter's choices.

> Responsible Entity: voting system, Voting Official
>
> Process: voting

**6.0.2.7.1** The voting station shall be physically secure from
tampering, including intentional damage.

> Responsible Entity: voting system vendor, voting official
>
> Process: voting

**6.0.2.7.2.5** There shall be adequate supplies of consumable items
such as paper and printer ink on hand to operate from opening to closing
of polls.

> Responsible Entity: voting officials
>
> Process: voting

**6.0.3.2.4.1** The voting official shall ensure that the wireless
capabilities are active only when needed.

> Responsible Entity: voting official
>
> Process: pre-voting, voting, post-voting

**6.0.3.2.6.1** To reduce the potential for unintended interference, the
wireless communications (radio frequencies) chosen for use in a voting
system should not use radio frequencies that are widely used for
non-voting systems devices that may be present in or near the expected
place (e.g., polling place) of wireless usage.

> Responsible Entity: voting official
>
> Process: pre-voting, voting, post-voting.

**6.0.3.2.6.3** A radio emissions site test should be conducted at any
location (e.g., polling place) where the wireless voting system is to be
used to determine the current level of interference, as well as to
determine the projected level of the voting system(s) wireless
emissions.

> Responsible Entity: voting official
>
> Process: pre-voting, voting, post-voting
>
> Discussion: The test would need to occur at times near each planned
> wireless usage, since the availability and usage of wireless
> communications in non-voting systems change quickly. This radio
> emissions site test may be used to determine other nearby wireless
> non-voting systems that could potentially interfere with the voting
> system.

**6.0.3.4.1** All information transmitted via wireless communications
shall be encrypted, with the exception of wireless coupling, to protect
against eavesdropping and data manipulation including modification,
insertion, and deletion.

> Responsible Entity: voting system vender, voting official
>
> Process: pre-voting, voting, post-voting

**6.0.3.4.1.1** The encryption shall be as defined in Federal
Information Processing Standards (FIPS) 197, "Advanced Encryption
Standard (AES)".

> Responsible Entity: voting system vender, voting official
>
> Process: pre-voting, voting, post-voting

**6.0.3.4.1.1.1** The cryptographic modules used shall comply with FIPS
140-2, Security requirements for Cryptographic Modules.

> Responsible Entity: voting system vender, voting official, testing
> entity
>
> Process: pre-voting

**6.0.3.5.4** The wireless (audible) path shall be protected or
shielded.

> Responsible Entity: voting system vender, voting official
>
> Process: voting
>
> Discussion: Protecting the audible path is a trade off between the
> high volume level from a speaker necessary for an individual to hear
> with the low volume level necessary to keep others from hearing, as
> well as protecting from interference (i.e., noise) from the polling
> place, voting station, or voting environment. The same is true for the
> audible path if a voter's speech is to be captured by the voting
> device. This wireless communication's path protection is necessary to
> protect privacy. Some audio head sets may already satisfy this
> requirement for the hearing part, while a sound proof voting booth may
> be necessary in some other cases (e.g., voice recordings).

**6.0.3.6.4** All wireless communications actions shall be logged.

> Responsible Entity: voting system vender, voting official
>
> Process: pre-voting, voting, post-voting
>
> Discussion: As a way of monitoring the wireless communications a log
> of important information is maintained. This is to ensure that the
> wireless communications is only used by authorized users with
> authorized devices to authorized access to authorized services, or at
> least see when it was not. This relates to the system audit
> requirements (See. Volume I, section 2.2.5) and integrity (See Volume
> I, section 2.2.4), if wireless is used.

**6.0.3.6.4.1** The log shall contain at least the following entries. --
times wireless activated and deactivated, services accessed,
identification of device to which data was transmitted to or received
from, identification of authorized user, successful and unsuccessful
attempts to access wireless communications or service.

> Responsible Entity: voting system vender, voting official
>
> Process: pre-voting, voting, post-voting
>
> Discussion: Other information like the number of frames or packets
> transmitted or received at various logical layers may be useful, but
> is dependent on the wireless technology used.

**6.0.4.1.4.1** All software used to install voting systems shall be
received from the voting system vendor, an EAC-accredited test
authority, or voting officials.

> Responsible Entity: voting officials
>
> Process: pre-voting

**6.0.4.2.2** Jurisdictions may use the NSRL or other EAC-named
repository for jurisdiction-specific voting software that is not part of
a qualified voting system.

> Responsible Entity: voting officials
>
> Process: pre-voting

**6.0.4.2.3.1** All write once Reference Information media that do not
have a digital signature covering its contents shall be stored in a
secure container (such as a safe) when not being used.

> Responsible Entity: voting officials
>
> Process: pre-voting

**6.0.4.3.2.1.3** Prior to an election voting officials shall query the
voting system to determine the values for all the static registers and
variables; shall compare these to the vendor documented initial starting
values and shall document their findings.

> Responsible Entity: voting officials
>
> Process: pre-voting

**6.0.4.3.2.1.4** Any anomalies shall be analyzed and resolved before
the election.

> Responsible Entity: voting officials
>
> Process: pre-voting

**6.0.4.3.3.1.1** Voting officials shall document the results of the
software verification performed on the voting system including at a
minimum: a unique identifier (such as a serial number) for the
documentation, the date, time, results, location of verification, time,
the list of software verified, name of the people that preformed the
verification, verification technique used, source of reference
information, identifying information of media with reference information
(if appropriate), and unique identifiers of the voting systems
inspected.

> Responsible Entity: voting officials
>
> Process: pre-voting

**6.0.4.3.3.1.2** Any anomalies shall be analyzed and resolved before
the election.

> Responsible Entity: voting officials
>
> Process: pre-voting