**BACKGROUND**

The United States Election Assistance Commission (EAC) is a bipartisan
Commission created and authorized by the Help America Vote Act of 2002
(HAVA). The Commission consists of four members who are appointed by the
President of the United States and confirmed by the United States
Senate. The Commissioners are [Donetta
Davidson](http://www.eac.gov/davidson.asp?format=none), [Rosemary
Rodriguez](http://www.eac.gov/rodriguez.asp?format=none), [Caroline
Hunter](http://www.eac.gov/hunter.asp?format=none) and [Gracia
Hillman](http://www.eac.gov/hillman.asp?format=none).

HAVA charged EAC with assisting states in the implementation of certain
election administration reforms. HAVA funded these election reforms and
directed EAC to distribute and monitor the use of that funding. Congress
has appropriated \$3.1 billion, all of which has been distributed to the
states according to the requirements of the law. In addition, HAVA
directed EAC to establish new guidelines for testing voting equipment, a
means to test and certify voting systems against those guidelines, and a
national clearinghouse for election administration information.

**THE BUDGET IN SUMMARY**

The requested appropriation for the EAC would provide salaries and
related operating expenses necessary for the EAC to carry out the
following functions and activities:

-   Distribution and management of HAVA funding;

-   Aiding in the improvement of election systems;

-   Serving as a national clearinghouse on matters concerning the
    administration of elections for Federal office; and

-   Providing guidance and assistance to State and local election
    officials on implementing HAVA's election reforms.

A complete description of the activities and programs in place at EAC as
well as the intended use of funds and personnel in those programs is
provided below.

In FY 2009, EAC requests a total of \$16,679,000. This amount represents
a continuation of the FY 2008 program with adjustments for inflation,
increased program needs for the testing and certification program and
National Voter Registration Act (NVRA) activities, and an increase of
\$750,000 in the funding for National Institute of Standards and
Techonology (NIST). The following chart summarizes EAC's FY 2009 request
in comparison to its FY 2008 request.

BUDGET AUTHORITY

\$(Thousands)

**EAC ACTIVITIES AND PROGRAMS**

Since its creation in 2004, EAC's role in assisting states with the
implementation of HAVA has shifted. The first objective that EAC had in
2004 was to quickly and efficiently distribute the funding that Congress
made available for election reforms to the states. In December 2005, EAC
distributed the last requirements payments, under Section 251 of HAVA,
to the states. Similarly, during this time, EAC sought to help states by
providing advisories and guidance interpreting HAVA. In 2004 and 2005,
EAC issued resolutions, advisories, and guidance on provisional voting,
voting systems, and voter registration databases. EAC also issued
various opinions on the appropriate uses of HAVA funds in 2004, 2005,
and 2006.

Now that the funding has been fully distributed, EAC's role has changed
to monitoring the appropriate uses of HAVA funds, through reports filed
by the states as well as regular and special audits of the states. In
addition to audit activities, EAC has shifted its focus to the ongoing
programs that will improve the administration of elections for Federal
office, including developing and updating voting system standards,
accrediting testing laboratories, certifying voting systems, providing a
clearinghouse of information for states, and administering HAVA and the
National Voter Registration Act (NVRA). As such, EAC has adopted the
following strategic objectives to accomplish its mission and goals:

-   Distribution and management of HAVA funding;

-   Aiding in the improvement of election systems;

-   Serving as a national clearinghouse on matters concerning the
    administration of elections for Federal office; and

-   Providing guidance and assistance to State and local election
    officials on implementing HAVA's election reforms.

    [DISTRIBUTION AND MANGEMENT OF HAVA FUNDS]{.underline}

Congress appropriated \$3.1 billion to help states meet the requirements
of HAVA and improve the administration of Federal elections. All HAVA
sections 101, 102 and 251 funds appropriated have been distributed. Now
that the election reform funding has been distributed, EAC is working to
ensure that states are good stewards of these Federal funds. To monitor
the use of these funds, EAC issues guidance and answers questions on the
appropriate use of HAVA funds, reviews reports submitted by the states
and territories on expenditure of the funds, and conducts assessments
and audits of the states. States have spent 60 percent of HAVA funds
received.

Appropriate Uses of HAVA Funds

HAVA specifically limits the use of funds distributed under the various
funding programs. These uses include purchasing voting equipment to
replace punch card or lever voting systems, implementing provisional
voting, purchasing equipment and software to build statewide voter
registration databases, as well as various activities aimed at improving
the administration of Federal elections. To clarify the appropriate uses
of HAVA funds, EAC and the General Services Administration (GSA) applied
OMB Circulars A-87, A-102, and A-133. In addition, EAC provided guidance
and information on the appropriate use of HAVA funds in response to
questions from the states. Even with these resources, EAC must answer
questions daily from the fifty states, four territories and the District
of Columbia about allowable expenses under HAVA.

EAC requires that states, territories and the District of Columbia
report their uses of HAVA funds. In the second quarter of each year,
states report on their use of both Title I and Title II funds. The Title
II report includes: (a) a list of expenditures for each category of
activities described in Title III; (b) the number and types of voting
equipment obtained with the funds; and (c) an analysis and description
of the activities funded to meet HAVA requirements and how such
activities conform to the state plan. The Title I report requires states
to (1) disclose, in separate reports for Section 101 and 102 funds, the
financial activity for the previous calendar year on a Standard Form
269; and (2) provide the same detail on the expenditures that is
required for the reports on Title II requirements payments. EAC conducts
a detailed review of each report to validate that the expenditure of
funds met the requirements of HAVA and was in accordance with plans
filed by the state or territory. The states' Title I and Title II
reports are available to the public upon request.

In Fiscal Year 2007 Congress extended the deadline for the use and
expenditure of HAVA Section 102 funds. These funds were limited to the
replacement of punch card and lever voting systems that were in use
during the 2000 Federal General Election. The states that obtained a
waiver now have until the first Federal Election following March 1, 2008
to use remaining Section 102 funding.

Auditing

Section 902 of HAVA gives EAC and other HAVA granting agencies the
authority to conduct regular audits of HAVA funds. EAC's audit activity
is conducted through EAC's Office of the Inspector General (OIG), which
has previously consisted of two types of reviews to determine if the
states are exercising sufficient controls and using the funds
distributed under HAVA for appropriate purposes. is the first was an
assessment of procedures each state uses to administer and monitor HAVA
funds, as well as a review of certain critical elements such as whether
the state has maintained sufficient matching funds. In addition, OIG has
commissioned audits of approximately 10 states each year to more fully
review the state's internal controls, processes, procedures, and
transactions to ensure compliance with Government Auditing Standards.

In addition to EAC's regular audits, HAVA also provides for two other
means of extraordinary audit authority -- (a) funds are subject at least
once during the term of the program to an audit by the Comptroller
General; and (b) Section 902(b)(6) of HAVA allows EAC to conduct a
"special audit" or "special examination" of the funds that are subject
to regular audit under Section 902(b)(1). This special audit authority
covers every HAVA program, including funds distributed under Title I,
Title II, and programs administered by the Department of Health and
Human Services. If EAC determines that a special audit is warranted, by
vote of the Commission, EAC will refer the matter to the OIG for review.

Following the issuance of an audit report by the OIG, EAC management is
required to resolve any audit findings, including recommendations for
changes to policies and procedures and any findings that HAVA funds were
misspent. This process requires EAC management to review the audit
findings, develop monitoring programs for changes to policy or
procedure, and quantify amounts of funding that are to be returned to
the state's election fund or to the U.S. Treasury. Once an initial
decision is made by the Executive Director, the determination is sent to
the audited state. The state then has the option of appealing the
decision to the Commission. Appeal can entail a paper review of the
record of the audit or a combination of paper review and a hearing on
the record. The decision of the Commission is final and binding on the
state.

The OIG has issued 13 final reports on States that reported some of the
largest expenditures of HAVA funds. The audited States reported more
than 59 percent of total reported expenditures of Section 101, 102, and
251 funds through December 31, 2006. These 11 audits could result in the
repayment of up to \$3.2 million to either the State's HAVA funds or to
the U.S. Treasury. There are three additional state audits that are in
progress.

Investigations

When allegations are made concerning the misappropriation of HAVA funds,
EAC is responsible for investigating those allegations through the OIG.
The OIG does not currently employ an investigator, thus, when issues for
investigation arise, EAC has contracted with other government agencies
for the services of an investigator.

Internal Audits and Investigations

The OIG is also responsible for conducting reviews, audits and
investigations of EAC's internal policies, procedures and actions. OIG
is currently reviewing EAC's internal controls and policies as well as
conducting a review of two contracts at the request of the agency.

[AIDING IN THE IMPROVEMENT OF VOTING SYSTEMS]{.underline}

One of the most enduring effects of HAVA will be the change in voting
systems used throughout the country. All major HAVA funding programs can
be used by states to replace outdated voting equipment. HAVA also
provides for the development and maintenance of testable standards
against which voting systems can be evaluated. It also provides, for the
first time, Federal certification according to these standards. EAC is
responsible for and committed to improving voting systems through these
vital programs.

Voluntary Voting System Guidelines

One of EAC's most important mandates is the testing, certification,
decertification and recertification of voting system hardware and
software. Fundamental to implementing this key function is the
development of updated voting system guidelines, which prescribe the
technical requirements for voting system performance and identify
testing protocols to determine how well systems meet these requirements.
EAC along with its Federal advisory committee, the Technical Guidelines
Development Committee (TGDC), and the National Institute of Standards
and Technology (NIST), work together to research and develop voluntary
testing standards.

On December 13, 2005, EAC adopted the first iteration of the [Voluntary
Voting System Standards (VVSG)](http://www.eac.gov/vvsg_intro.htm). This
document was an initial update to the 2002 Voting System Standards
focusing primarily on improving the standards for accessibility,
usability and security. These testing guidelines also incorporated
standards for reviewing voting systems equipped with voter verifiable
paper audit trails (VVPAT) in recognition of the many states that now
require this technology. VVSG also establishes the testing methods for
assessing whether a voting system meets the guidelines.

Significant work remains to be done to fully develop a comprehensive set
of guidelines and testing methods for assessing voting systems and to
ensure that they keep pace with technological advances. On September 4,
2007, EAC received a draft of a new iteration of Voluntary Voting System
Guidelines from the TGDC and NIST. This draft represents a comprehensive
rewrite of the Voting System Standards developed by the FEC in 2002. The
document sets standards or guidelines for the next generation of voting
equipment to be used in U.S. elections. Throughout FY 2008, EAC will
conduct an extensive review of this draft document and solicit public
comment on its provisions as well as any changes that are made by EAC
based upon those comments. This work will extend through FY 2009, with
the goal of issuing a final product in the third or fourth quarter of
the 2009 fiscal year. Because of the expected length of this document,
EAC will incur substantial expenses in FY 2008 and FY 2009 publishing
the VVSG for two public comment periods and as a final product.
Contemporaneously, EAC and NIST will continue their work on developing a
set of test suites or methods that can be used by testing laboratories
to review any piece of voting equipment on the market. These test suites
will make uniform the testing protocols used by the various laboratories
accredited under EAC's laboratory accreditation program.

Accreditation of Voting System Testing Laboratories

HAVA Section 231 requires EAC and NIST to develop a national program to
accredit voting system testing laboratories. The National Voluntary
Laboratory Accreditation Program (NVLAP) of NIST provides for the
initial screening and evaluation of testing laboratories and will
perform periodic re-evaluation to verify that the labs continue to meet
the accreditation criteria. When NIST has determined that a lab is
competent to test systems, the NIST director recommends to EAC that a
lab be accredited. EAC then makes the determination to accredit the lab.
EAC issues an accreditation certificate to approved labs, maintains a
register of accredited labs and posts this information on its website.

In July 2005, NVLAP advertised for the first class of testing
laboratories to be reviewed under the NVLAP program and accredited by
EAC. The first set of NIST recommended laboratories were not received by
the EAC until January 18, 2007. Three laboratories have now been
accredited by EAC:

-   [iBeta Quality
    Assurance](http://www.eac.gov/docs/iBeta certificate 07.pdf)

-   [SysTest Labs,
    L.L.C.](http://www.eac.gov/docs/SysTest certificate 07.pdf)

-   [InfoGard Laboratories,
    Inc.](http://www.eac.gov/docs/InfoGard accreditation cert.pdf)

Four other labs have applied for accreditation and are currently being
reviewed by NVLAP:

-   Wyle Laboratories

-   Aspect Labs

-   CIBER Labs

-   Atsec Information Security Corporation

Laboratories that are accredited by EAC through the NVLAP program will
be reviewed on a regular basis to maintain their accreditations. In FY
2009, EAC anticipates that NVLAP will begin the first periodic reviews
of accredited labs.

Voting System Certification

In 2006, EAC is assumed the responsibility of certifying voting systems
according to national testing guidelines. Previously, NASED qualified
voting systems to both the 1990 and 2002 Voting System Standards. EAC's
certification process constitutes the Federal government's first efforts
to standardize the voting system industry. In July 2006, EAC implemented
its pre-election certification program, which only focused on reviewing
changes or modifications that were necessary for modifications to
systems that would be used during the November 2006 elections. Three
modifications were reviewed and approved under the pre-election program.
In October 2006, EAC published for public comment its post-election
certification program. This program encompasses an expanded and detailed
review of voting systems. It utilizes accredited testing laboratories
and EAC technical reviewers. The program also includes assessments of
quality control, field monitoring, vendor registrations, and enhanced
public access to certification information. EAC adopted its Voting
System Certification Program on December 7, 2006. Since that time, ten
voting system manufacturers have registered with EAC's certification
program and nine systems have been submitted for testing.

In FY 2009, EAC will conduct its quality control program, which includes
site visits to manufacturing facilities to assure the products that are
being produced by the manufacturers are the same as those that are
tested by EAC. As a part of the testing and certification program, the
manufacturer agrees to submit all modifications to the EAC for review
and appropriate testing. Furthermore, the manufacturer is only allowed
to display an EAC certification on systems that have been tested and
received certification from EAC. This process will be integral to
ensuring that state and local election officials are getting the same
quality product that EAC saw during its certification process. This type
of work requires technical knowledge of the voting systems that are
tested and competence to assess whether the produced system is the same.
To facilitate this program, EAC will employ technical experts to conduct
the reviews and will incur associated travel and logistical costs to
support their reviews.

[NATIONAL CLEARINGHOUSE OF ELECTION INFORMATION]{.underline}

HAVA establishes EAC as a national clearinghouse of election
information, which means EAC makes research available on a range of
issues including best practices in election administration, hours and
places for voting, and election data. EAC has conducted extensive
research on a variety of topics related to election administration, has
begun an ongoing process of collecting election related data, and has
compiled election-related resources such as statutes and regulations.
This information is presented to the election community and to the
public through the EAC's website as well as through formal reports on
studies and data collections. Through this clearinghouse, EAC positions
itself as a primary source of information about Federal elections.

Research and Study

HAVA requires EAC to conduct a number of studies and provides
considerable discretion to research other election administration issues
to assist states in their efforts to make election administration
improvements. EAC uses its Federal advisory committees to assist in
prioritizing research topics that are important to and that will assist
election officials. EAC has embarked on research projects that have or
will produce guidance, best practices and reports on recruiting,
training and retaining poll workers; redesigning ballots and information
provided to voters; procedures for counting and recounting ballots;
provisional voting; voter identification; voter fraud and intimidation;
as well as launching a legal resources database that will provide
election officials and the public with access to election laws and
regulations from each of the 50 states. Four Quick Start Guides were
distributed to election officials prior to the 2006 election, and
another three Quick Start Guides were produced in FY 2007 and three more
are anticipated to be ready in early FY 2008. These guides are summaries
of more extensive Chapters of the Management Guidelines that some of
which were released this year and covered topics such as introducing a
new voting system, ballot preparation, voting system security, and poll
worker training. In FY 2008 and FY 2009, work will continue to produce a
comprehensive document that will accompany the voting system guidelines
and assist state and local governments with implementing voting systems
and administering Federal elections.

In June, 2007 EAC delivered to Congress its second report on the
implementation of the National Voter Registration Act (NVRA). The
content of that report was based largely on the results of the 2006
Election Administration and Voting Survey. In addition to this report,
EAC will also analyze and synthesize data from the survey to form two
additional reports. The first is related to voting by military members
and overseas citizens. The second involves more generic election data
and will form EAC's second Election Survey Report. Both of these reports
should be completed by fall of 2007.

In FY 2009, EAC will need to collect and analyze data on the 2008
Presidential election, including reporting to Congress on the
implementation of the NVRA, the number of military and overseas citizens
that voted in the election, and general statistical data concerning the
election. In addition, EAC will continue to work on research efforts
listed in Section 241 of HAVA, including:

-   Methods of voter registration and maintaining a secure and accurate
    list of registered voters;

-   Methods of ensuring accessibility of voting, registration and
    polling places to all voters;

-   Methods of educating voters about the process of registering to vote
    and voting;

-   Federal and state laws governing the eligibility to vote;

-   Methods of voter registration for members of the uniformed services
    and overseas voters;

-   Broadcasting practices that may result in the broadcast of false
    information regarding polling place operation;

-   Feasibility of providing voting materials in eight or more foreign
    languages; and

-   Other matters the Commission deems appropriate.

    EAC's Website as a Clearinghouse

Using EAC's website as its primary means of transmitting information to
the public is a useful, accessible and cost effective tool. As studies,
guidance and best practices are completed, EAC has an increasing amount
of information to store and display through its website. EAC uses the
website to provide information to the public about the voting system
standards and certification program. Furthermore, EAC anticipates
providing more interactive services through its clearinghouse function.
EAC currently contracts for the hosting and maintenance of its website.
To accommodate the expanding clearinghouse, EAC will need to expand its
IT capabilities by either enhancing its contracts for web services and
IT support or by considering bringing those services in house.

[GUIDANCE AND INFORMATION TO THE STATES]{.underline}

HAVA established EAC to provide guidance and assistance to the states on
implementation of the law and transferred to EAC the responsibility of
implementing the National Voter Registration Act (NVRA). EAC has
provided valuable guidance to the states on what HAVA means,
implementing the law, and appropriate use of HAVA funds. In FY 2008 and
FY 2009, EAC will continue that work by developing election management
guidance, expanding on its voter registration data base guidance, and by
updating and revising the NVRA regulations and national voter
registration form. The election management guidance is a comprehensive
companion document to the VVSG that will assist states in managing an
election from receipt of voting equipment to the reporting of results to
the canvass or recount that follows. EAC's continued work on voter
registration databases will focus on studying the appropriate use of
security measures, verification of voter information using appropriate
matching protocols, and sharing information with other state agencies
and, ultimately, with other states. EAC will address issues involving
voter registration using the Federal form by reviewing and revising the
NVRA regulations and the Federal registration form. The NVRA regulations
have not been updated since 1994. Thus, this project will be a
significant undertaking for EAC and will involve the need for additional
human and financial resources to review the current regulations, propose
changes to the regulations and conduct a robust program of collecting
and considering public comments. In addition, EAC will update the FEC's
implementation manual to reflect the changes in the regulations and the
additional complexities added by the passage of HAVA.

[ADMINISTRATION]{.underline}

These costs include rent, equipment, supplies, human resources
functions, finance and budget, computers, telephones, publication, and
printing. This objective includes maintaining the leadership and support
staff for the agency. Charges for salaries and benefits for the
Commissioners and non-programmatic support staff are included in this
category. In addition, the administrative objective includes supporting
the efforts of EAC's two Federal advisory committees, the Board of
Advisors and Standards Board. Between these two boards there are 147
members who meet at least once in each fiscal year to fulfill their
responsibilities under HAVA. The leadership of these Boards meets more
frequently, approximately once each quarter.

**EXPLANATION OF DISTRIBUTION BY OBJECT CLASS**

[11.1 Personnel Compensation -- \$4,202,000.]{.underline} Provides for
37 full-time equivalent (FTE) EAC staff salaries. The 37 FTE include 29
full-time permanent employees and eight experts, consultants, contract
employees, students and other part-time employees.

[12.1 Personnel Benefits - \$1,149,000.]{.underline} Calculated at 30%
of EAC full-time permanent staff salaries and 15.3% of experts,
consultants and other part-time employee salaries. For full-time
permanent employees this includes life insurance, health insurance,
employee retirement, work injury disabilities or death and professional
liability insurance.

[21.0 Travel and transportation of persons - \$900,000.]{.underline} To
reimburse the 110-member Standards Board and the 37-member Board of
Advisors for travel and expenses related to conducting a 3-day meeting
for each board twice each year; to reimburse speakers and participants
at EAC public meetings and hearings; to reimburse EAC Commissioners and
staff for travel expenses.

[23.1 Rental Payments to GSA - \$700,000.]{.underline} Provides for
payments to the Federal Buildings Fund for rent.

[23.3 Communications, utilities, and miscellaneous charges -
\$150,000.]{.underline} Provides for local and intercity telephone
services; for postage and fees; and for other administrative expenses.

[24.0 Printing and Reproduction - \$950,000.]{.underline} Provides for
the printing of State Plans, voluntary guidance, and Voluntary Voting
Systems Guidelines in the Federal Register, and other printing of
reports, studies, transcripts, etc.

[25.0 Other services - \$2,394,000.]{.underline} Provides for contracts
associated with HAVA-required administration and audit of requirements
payments and other HAVA funds; program support for the laboratory
accreditation and voting system certification programs; human resources,
financial and IT support services by GSA; and web site management
contracts.

[25.5 Research and development contracts - \$5,500,000.]{.underline}
Provides for transfer of \$4,000,000 to NIST for activities required
under Sections 221, 231 and 245 of HAVA; to conduct research under
Sections 241 and 244(b) of HAVA; and to maintain and supplement ongoing
clearinghouse activities.

[26.0 Supplies and materials - \$115,000.]{.underline} Provides for the
purchase of administrative supplies and materials.

[31.0 Equipment - \$600,000.]{.underline} Provides for the replacement
of PC and LAN equipment

to support the increased requirements of the clearinghouse data storage
and to assure that aging equipment is repaired, replaced, and upgraded,
as needed.

  --------------- ----------------------------------- -------------- ----------- -------------- -- ----------- --
                                                                                                               

  OBLIGATIONS BY                                                                                               
  OBJECT CLASS                                                                                                 

  \$(Thousands)                                                                                                

                                                      FY 2007                    FY 2008           FY 2009     

                                                      Appropriated               Appropriated      Requested   

                  Personal Compensation and Benefits                                                           

  11.1            Full-time permanent                 2,918                      3,308             3,402       

  11.3            Other than full-time permanent      270                        854               800         

  11.5            Other personnel compensation        0                          0                 0           

  11.9            Total personal compensation         3,188          []{.mark}   4,162             4,202       

  12.1            Civilian personnel benefits         725            []{.mark}   1,057             1,149       

                                                                                                               

                  Contractual Services and Supplies                                                            

  21.0            Travel and transportation of        710                        880               900         
                  persons                                                                                      

  23.1            Rental payments to GSA              618                        638               700         

  23.3            Communications, utilities, and      64                         125               150         
                  miscellaneous charges                                                                        

  24.0            Printing and reproduction           734                        950               950         

  25.0            Other services                      4,495          []{.mark}   2,313             2,413       

  25.5            Research and development            5,634          []{.mark}   4,750             5,500       

  26.0            Supplies and materials              37                         92                115         

                                                                                                               

                  Acquisition of Assets                                                                        

  31.0            Equipment                           58                         500               600         

                                                                                                               

  41.0            Grants, subsidies and contributions 0                          1,063             0           

  99.9            Total Program                       16,263                     16,530            16,679      
  --------------- ----------------------------------- -------------- ----------- -------------- -- ----------- --

> **EXPLANATION OF CHANGES FOR FY 2009**

-   Funding to NIST increased from \$3.25 million to \$4.00 million per
    the request provided to EAC (See Appendix "1")

+-------------------------------------------------------+------+------+
| EXPLANATION OF BUDGET CHANGES IN PRIORITY ORDER       |      |      |
|                                                       |      |      |
| APPROPRIATION                                         |      |      |
|                                                       |      |      |
| \$(Thousands)                                         |      |      |
+-------------------------------------------------------+------+------+
|                                                       | FTE  | \$   |
+-------------------------------------------------------+------+------+
| FY 2008 Request                                       | 37   | \$15 |
|                                                       |      | ,448 |
+-------------------------------------------------------+------+------+
|                                                       |      |      |
+-------------------------------------------------------+------+------+
| Changes:                                              |      |      |
+-------------------------------------------------------+------+------+
| > Increase in funding to NIST per their               |      | 750  |
| > request.....................\....                   |      |      |
+-------------------------------------------------------+------+------+
| > Increased funding for inflation, and program        |      | 481  |
| > modifications.............                          |      |      |
| ..................................................... |      |      |
+-------------------------------------------------------+------+------+
|                                                       |      |      |
+-------------------------------------------------------+------+------+
| FY 2009 OMB Request                                   | 37   | \$16 |
|                                                       |      | ,679 |
+-------------------------------------------------------+------+------+

Appendix 1

Proposed 2009 NIST Technical Program on Voting Systems:

**Total Funding Request - \$4,000K**

The major areas of NIST's 2008 program and funding levels are:

**1. Standards Management -- 2007 Voluntary Voting System Guidelines
(VVSG 2007**) **(\$1000K)**

> The new VVSG was approved by the TGDC and will be delivered to the EAC
> in September, 2007. The EAC will then begin a very comprehensive
> public review that will last approximately two years. Many thousands
> of comments are expected. NIST will help the EAC review comments and
> suggest revised wording in the VVSG.
>
> NIST will continue to provide technical input and guidance to the EAC
> on document management issues, including updating of requirements.
>
> Tasks include:

-   *Research and analysis of voting systems technology and equipment*

> NIST will conduct research in order to respond to public review
> comments. NIST will provide technical input to the EAC with respect to
> these comments.

-   *Draft updates to the VVSG*

> NIST will serve as primary author and editor of updates to the VVSG,
> based on public review comments, working closely with the EAC.

-   *Transparency*

> NIST in association with the EAC, as appropriate, will conduct or
> participate in interactions with vendors, researchers, and the public.
> Based on the results of these comment periods, NIST will revise or
> create new material, as appropriate.

**2. Test Method and Test Suite Development and Maintenance (\$1,750K)**

> Test methods and test suites will be developed and maintained for
> three areas of the VVSG: Core Functionality, Cyber Security, and Human
> Factors. For each of these areas, NIST will determine applicable
> measurement techniques, testing approaches and testing protocols as
> well as develop test suites and testing tools to help ensure that VVSG
> requirements are met by voting systems.
>
> Different techniques, approaches, protocols and test suites are needed
> to address the unique characteristics of each of these areas in order
> to ensure that all requirements in the VVSG are correctly implemented
> in voting systems. The development of public test suites and tools for
> use by all accredited test laboratories will reduce the cost of
> testing, ensure consistency of testing among laboratories, and promote
> transparency of the testing process.
>
> The testing funding is divided evenly among the following three areas.
>
> **Core Functionality**
>
> Core functionality addresses all general aspects and requirements of
> the VVSG that are not explicitly related to security or human factors.
> NIST will continue development of a set of conformance test suites for
> the core, functional capabilities of voting systems.
>
> Tasks include:

-   *Update taxonomy of test methods*

> NIST will update its in-depth analysis and classification of test
> methods, including their applicability and cost effectiveness to
> voting systems to reflect changes to the VVSG and/or changes in
> requirements.

-   *Conformance test suites*

> NIST will continue in-depth analysis of each requirement, deriving
> objective means to measure and/or determine that the requirement is
> met. Based on this analysis, NIST will continue to apply the relevant
> test methods and continue development of test protocols and test
> suites. New test cases will be developed and previously developed test
> protocols and test suites will be reviewed, updated, and/or modified
> to reflect any changes in the VVSG requirements.

-   *Testing tools*

> To facilitate the development, usability, and reporting of test
> suites, NIST will develop and maintain, as necessary, test frameworks
> to automatically generate tests, setup (e.g., initialize) the testing
> environment, execute tests, and/or report test results.

-   *Traceability matrix*

> NIST will update the traceability matrix that shows the linkage from
> each test back to specific requirements in the VVSG.

-   *Documentation*

> NIST will produce documentation so that an independent test laboratory
> can reproduce the testing. The documentation will include the purpose
> and description of each test, level of expertise required to conduct
> the test and interpret the results, facilities and environmental
> conditions, instructions for initiating and executing the tests, and
> verdict criteria (i.e., how to evaluate the results).

-   *VVSG Feedback*

> In order to develop and maintain test suites, the tester must examine
> each requirement in the standard/guideline to develop test
> specifications and ultimately test cases. This scrutiny often results
> in the discovery of ambiguous, unclear or un-testable requirements.
> The development and maintenance of the test suite thus results in a
> feedback process to the standards developers, which often results in
> dramatic improvements to the standard/guideline. NIST will provide
> feedback regarding any errors, inconsistencies, ambiguities, etc. that
> are found in the VVSG as a result of NIST's thorough review of the
> detailed requirements of the VVSG.
>
> **Cyber Security**
>
> Cyber security addresses all aspects and requirements for the security
> of voting systems, including methods to protect and prevent fraud,
> integrity of voting information and votes, requirements to facilitate
> audits, and secure operation of the voting process and systems. NIST
> will continue development of security testing approaches and test
> suites to address issues such as the ability of voting systems to
> prevent tampering and detect fraud, and to allow for efficient audits.
> Various test methods will be applied to security testing to ensure
> cost effective testing commensurate with the risk to the voting
> process and/or system. NIST work in this effort will build upon and/or
> contribute to tasks and deliverables produced under the Core
> Functionality area.
>
> Tasks include:

-   *Test method analysis for security requirements*

> NIST will update its in-depth analysis of each security requirement,
> determining the most effective test methods, including consideration
> of costs and risks. This work will augment the taxonomy of test
> methods produced under the Core Functionality area.

-   *Conformance test suites*:

> NIST will continue the development of test suites for security
> requirements that can be tested without access or knowledge of the
> internals of the voting system. New test cases will be developed and
> previously developed test suites will be reviewed, updated, and/or
> modified to reflect any changes in the VVSG requirements. NIST will
> produce necessary documentation and a traceability matrix.

-   *Open-ended testing*

> NIST will develop and update a set of test protocols for open-ended
> testing.

-   *Testing of commercial-of-the-shelf products (COTS)*

> NIST will conduct research and implement a strategy for testing of
> COTS.

-   *Documentation*

> NIST will produce documentation so that an independent test laboratory
> can reproduce the testing. The documentation will include the purpose
> and description of each test, level of expertise required to conduct
> the test and interpret the results, facilities and environmental
> conditions, instructions for initiating and executing the tests, and
> verdict criteria (i.e., how to evaluate the results).

-   *Innovation Class*

> NIST will work with the EAC to develop the mechanism for evaluating
> proposals for the innovation class. NIST will also work with a panel
> of technical experts to determine applicability, and conformance, of
> these proposals.

-   *Feedback to VVSG*

> NIST will provide feedback regarding any errors, inconsistencies,
> ambiguities, etc. that are found in the VVSG as a result of NIST's
> thorough review of security requirements in the VVSG.

-   *Methods to detect fraud*

> NIST will continue to update and maintain its National Software
> Reference Library (NSRL) for voting systems. The NSRL will help enable
> state and local election officials to discover if certified voting
> systems have been modified prior to delivery. NIST will continue to
> work with state and local election officials in obtaining data for the
> NSRL and developing procedures for election officials on its use and
> deployment.
>
> **Human Factors**
>
> Human factors address all aspects and requirements of accessibility
> and usability of voting systems. Testing for accessibility or
> usability of a voting system must take into account the 'human' during
> all aspects of the voting process and in using the voting system. NIST
> will create and update performance benchmarks for a range of voter
> interactions with a voting system and continue to develop tests to
> determine compliance with the benchmarks. NIST work in this effort
> will build upon and/or contribute to tasks and deliverables produced
> under the Core Functionality area.
>
> Tasks include:

-   *Conformance tests for performance requirements*

> NIST will continue in-depth analysis of each requirement, deriving
> objective means to measure and/or determine that the requirement is
> met. Based on this analysis, NIST will continue to apply the relevant
> test methods and continue development of conformance test suites and
> performance metrics as necessary. Previously developed test suites and
> metrics will be reviewed, updated, and/or modified to reflect any
> changes in the VVSG requirements.

-   *Test protocols*

> NIST will update and maintain the protocols and procedures for
> conducting accessibility and usability testing programs, including the
> selection of test participants, directions on setting up, executing,
> and monitoring the testing, and interpreting results.

-   *Validation and refinement of test suites*

> NIST will continue to conduct a series of pilot programs to test the
> test suites.

-   *Test protocol and benchmarks documentation*

> NIST will produce documentation for the test protocols and benchmarks
> so that an independent test laboratory can reproduce the testing. The
> documentation will include the purpose and description of each test,
> level of expertise required to conduct the test, ability of the person
> executing the test, facilities and environmental conditions,
> instructions for initiating and executing the tests, and verdict
> criteria (i.e., how to evaluate the results).

-   *Feedback to VVSG*

> NIST will provide feedback regarding any errors, inconsistencies,
> ambiguities, etc. that are found in the VVSG as a result of NIST's
> thorough review of human factors requirements in the VVSG.

**3. Research in Voting Systems Technology (\$500K)**

The TGDC determined a need for a research program to address emerging
technology and methods to further improve the voting process and voting
systems. NIST will conduct research and produce white papers to advance
the state-of-the-art of voting systems and to improve the voting process
through the use of information technology. These white papers will
provide the groundwork for future voting systems and the evolution of
the voting process.

Tasks include:

-   *Research and white papers*

> NIST will conduct research and write white papers on relevant issues,
> such as cryptographic voting protocols, application of new technology
> to accessible voting systems, additional usability and accessibility
> performance benchmarks, and election official and poll worker
> usability.

-   *Workshops and meetings*

> NIST will conduct and participate in workshops and meetings to solicit
> and gather input to research topics.

**4. Technical Support to EAC - Voting System Certification Process
(\$250K)**

As required by Section 231 of the Help America Vote Act, the EAC is
required to provide for the testing, certification, decertification, and
recertification of voting systems. To accomplish this goal, the
Commission developed a program for accrediting independent, non-Federal
testing laboratories in conjunction with NIST's National Voluntary
Laboratory Accreditation Program (NVLAP). These accredited laboratories
test voting systems in accordance with applicable EAC standards. To
assist the EAC in operating and maintaining its certification process,
NIST will provide technical support, as appropriate.

Tasks include:

*Technical Guidance*

> NIST will provide technical guidance to the EAC as requested for
> interpretations of the VVSG standards as well as review of technical
> data packages, test plans, and test reports forwarded by EAC
> accredited voting system testing laboratories.

**5. NVLAP On-Going Accreditation of Laboratories (\$250K)**

In accordance with HAVA, the National Voluntary Laboratory Accreditation
Program (NVLAP) for Voting Systems Testing will continue to assess
non-Federal laboratories for testing voting systems that meet
international testing and calibration standards (ISO 17025, "General
Requirements for the Competence of Testing and Calibration
Laboratories"). In addition, NVLAP will coordinate with the EAC to
monitor and review on an ongoing basis, the performance of voting system
testing laboratories (VSTLs)

Tasks include:

*Assessment of Non-federal Testing Laboratories*

> NVLAP will continue to conduct assessments of laboratories that apply
> for accreditation to test voting systems. Once NVLAP assessment is
> successfully completed, the Director of NIST will forward to the EAC
> recommendations for laboratories to be accredited to test voting
> systems as appropriate.

*Program for recertification and decertification of VSTLs*

> NVLAP will coordinate with the EAC to develop a program for the
> recertification and decertification of voting system testing
> laboratories (VSTLs). NVLAP will implement the program in FY 2008.

**6. Innovation Class Research and Development (\$250K)**

The purpose of the Innovation Class is to provide a means of evaluating
new, innovative voting system technologies. These innovative designs
could improve security, accessibility or other aspects of a voting
system. The TGDC recommended that the EAC work with NIST to develop the
Innovation Class program.

Tasks include:

-   *Innovation class framework*

> NIST will work with the EAC on developing the overall framework for
> the Innovation Class and help develop detailed plans and operational
> procedures including operational procedures and steps, formal review
> procedures and dispute resolution.

-   *Innovation class reviews and workshops*

> NIST will assist in forming panels for reviewing innovation class
> submissions including whether the designs meets the requirement to be
> software independent. .

-   *VVSG maintenance*

> NIST will recommend necessary changes to requirements and language in
> the VVSG as necessary to support the conformance of innovations.

-   *Innovative design test procedure development*

> Some innovative submissions may require new test procedures or
> modifications to existing tests. NIST will evaluate whether changes in
> test protocol and test suites need to be made, and recommend the
> additions or modifications.

Revised 2/11/08