**[BOARD OF ADVISORS & STANDARDS BOARD]{.underline}**

**[VVSG TRAINING WORKSHOP]{.underline}**

**[Nelson Hastings Part 2 Security, OCTOBER 16, 2007]{.underline}**

**[NIST BOULDER]{.underline}**

\[NARRATOR\]: This is Part 2 of the Security Training Modules for the
next VVSG document currently under public review. This training module
will be presented by Nelson Hastings of NIST's Information Technology
Laboratory

The module is an overview of basic cryptography principles in the VVSG.

\[NELSON HASTINGS:\] We will look at cryptography basics. It comes from
the Greek word cryptos, hidden and "grephin" to write or "graphen" to
write. So its hidden to write is kind of where the word comes from.

Cryptography usually is used in three ways in security. Basically to
protect the confidentiality of information, limiting who can actually
see and access that information.

Integrity protection of information: being able to detect if information
has been modified in any way. And authentication of information, where
did this information come from or the source of that information ?

So, we are going to start off looking at some metric key cryptography.
So what I might want to do is I have a message here that's readable by
anybody, so here's a message to encrypt. And we call that plain text- a
plain text message. What we do with that message is we have an
encryption function that that plain text information in inputted to.

In addition to the plain text we have some type of key put into that
encryption function and then what comes out is information that looks
like gobblygook, for lack of a better term. What we call that is
actually cipher text. So, its been translated from plain text into
cipher text using a key.

So the reverse of that operation, of this encryption operation, is
called decryption. And so what we do is we will take cipher text
information, feed that into the decryption operation, use the same key
that was used to encrypt that information will be used to decrypt that
information. That's why this is called symmetric key or secret key
because the same key is used both for encryption and in decryption.

From that comes the outputted plain text.

The next thing we are going to look at is public key or asymmetric
encryption which has the same structure as symmetric key except for the
fact that the key that's used to encrypt is different than the key that
is used to decrypt. There is a mathematical relationship between those
keys so that when you use the one key to encrypt, that the other key
that's used to decrypt it, everything works out.

And we usually call one of the keys as a private key. It should only be
used by one person. The other key is called the public key that
everybody else can know. If you have that structure what happens is, if
I have my private key and I sign something, you will know that
information came from me. And everybody can use that same public key to
do the decryption on that. And that's why its called asymmetric because
a different key is used for the encryption operation and the decryption
operation.

The next thing we will talk about is digital signatures. And what it
does is it uses public key cryptography and hashes. I'll talk about what
a hash is when I get to talking about this a little bit more. What it
does is with the use of digital signatures you can provide, like I said
is authentication of where the information came from and the integrity
on that information. You know that that information hasn't been altered.

The basic operations are digital signature generation and digital
signature verification. So for digital signature generation , what I can
do is I can take a plain text document that I want to digitally sign. I
can put that into a hash function which reduces that information, that
document information into a fixed length hash value. Then that hash
value is fed into the encryption operation and the private key is also
used to perform this encryption Then out comes the digital signature. Ok
so that's generating the digital signature.

The next operation we are going to talk about is digital signature
verification. So in this case I have a signed document with its digital
signature attached. So the first thing I do is I run that plain text
document again through the hash function and come out with the hash
value. Then I take the digital signature and actually run that through
the decryption operation and use the public key to do the decryption and
then I get a value out of that operation. And then I compare the two,
the hash value that was generated with the document with the value that
came out of the decryption. If those match, then your digital signature
is verified. If they don't match, then something is wrong. Either you
used the wrong public key or the document had been altered. So, that's
digital signature verification. Is there any questions on that? Yes,
Jim.

\[JIM DICKSON:\] Can you just back up. Where are we going with this?

\[NELSON HASTINGS:\] This is background information because we use the
term digital signature and digital signature verification, digital
signature generation in the VVSG itself. And it's used as a security
mechanism. So, I just wanted to present this information so that people
would come from a common background when we talked about this. Does that
answer your question, Jim?

\[JIM DICKSON:\] The security method for? We are talking about ballots
that produce?

\[NELSON HASTINGS:\] We are talking about electronic information that's
produced by the voting system, whether its log information or electronic
cast vote record, that kind of thing.

So the question is, what is the difference between asymmetric key and a
hash function? Well, the hash function takes a chunk of information, a
chunk of data and reduces it down to a fixed length piece of
information, or a fingerprint. And the keys are actually used as input
to the encryption and decryption functions. So, in a sense, the hash
function is kind of an independent thing. Its not related in a sense, to
asymmetric cryptography per se. It's used here to enable digital
signature generation to occur.

To achieve the security properties that cryptography provides, key
management is a critical aspect of that to get the type of effect. There
are different stages in a cryptographic key's life. It's generated, it's
distributed to people, it's stored when its not being used, it can be
limited, its usage can be limited and then at the end of its life its
destroyed.

I'm going to talk about is public key distribution and the mechanisms
that is used to do that. So for security properties of public key
cryptography it depends on private keys remaining private and secret.

The other thing is the integrity and validity of a public key has to be
maintained. And that is done through the use of things called digital
certificates that provides the integrity and then the validity. Validity
meaning has this key been revoked or compromised due to some release
that was unexpected and that is done through the use of certificate
revocation lists or certificate status servers. I'm only going to talk
in terms of certificate status servers because they are a little bit
less complex to talk about.

So a digital certificate is really a data structure or certificate that
contains a subject's public key. Nelson Hastings' public key could be in
this certificate. It has other information such as identifying who that
subject is through various different naming schemes. It also has
validity time frames for these.

Then what is done is a digital signature is put on that digital
certificate to bind all that information together with that public key.
And these certificates are generated by things called certificate
authorities who check out and make sure, is this public key really
associated with Nelson Hastings or is it not and does those kinds of
things.

So, I thought how do I \-- like a real world example of what a digital
certificate is. And so I went to Amazon and went to their https site,
their secure site to log into my account. And if you look down in the
bottom right hand corner there is a lock there.

And if you double click on that lock, you get this information page. And
if you click on the bottom called "view" it says view the security
certificates that verify the web site security. So if you click on that,
you look at that, and here is some of the information of the certificate
that was issued to Amazon.com and it was issued by RSA Data Security.

There is other information in here like the validity date, the date it
was issued, and an expiration date. It also has a serial number
associated with it. If you click on the details tab, it shows this
viewer that's broken into a hierarchical certificate hierarchy window,
certificate fields window and a fields value window.

We'll talk about the certificate hierarchical field a little bit later.
What I've highlighted right now is the certificate associated with
Amazon.com. And I've clicked and highlighted on the certificate
signature itself. And so you have this hexadecimal blob of data there
that goes 63BC on that certificate itself. That's the raw digital
signature on that certificate.

Now if I open up the certificate attributes and look at what's in
there - a version field, a serial number and I've clicked on the
certificate signature algorithm. What this shows is it shows that this
certificate was signed using RSA cryptography, public key cryptography
mechanism using SHA1 which is a hash value. It's the hash algorithm. So
I can go down and I can click on subject public key information and
actually look at the public key that's contained in this digital
certificate. And again, in the value field it's a bunch of hexadecimal
numbers, 30, 81, 89, 02. So that's kind of, just to give you a feel,
that this stuff is in , is used in a common, everyday thing that most
people use that go on the web.

A certificate status server basically tells you the status of a
certificate. Has it been revoked? Is it the digital signatures that I'm
verifying with this? So what I do is I can take a digital certificate
and basically just ask the status server is this certificate valid? And
then it comes back and says yes or no. There is a lot of back end
processing on this certificate status server that's being done but
essentially I can ask the server is it valid? It goes out and checks
information and says yes or no this certificate is still valid.

This slide is titled "Building A Path of Assurance." So let's say I have
a document that I want to look at and validate its digital signature. It
was signed by subject Z. So Z takes his private key, does a digital
signature generation and places that signature with the document. What I
can do is I can go out and I can find subject Z's digital certificate or
he could give it to me, his digital certificate that, if you notice has
been signed by CAB, ok?

And I can use that public key certificate or the public key in that
certificate to do a digital signature verification on that. And if I
trust CAB, then everything is good and we are happy. But if I don't
trust CAB but I trust a different CA. Say I trust TCA, my trusted CA and
I have to make the connection between subject Z's digital certificate
and the CA that I trust.

What I can do is I can go out and find a digital certificate containing
CAB's public key and verify the digital signature of subject Z's public
key and then go look at the trusted server, the certificate status
server to make sure that it hasn't been revoked, and then verify the
digital signature of CAB's public key in its certificate that has been
signed by the certificate authority that I trust, TCA. I then go out and
look at the certificate status server to make sure that my CA hasn't
revoked that certificate.

MALE SPEAKER 18: A server is just a computer.

\[NELSON HASTINGS:\] Yeah, the server is just a computer that goes and
asks. These objects, now you can see, I can build a chain of trust from
the CA that I trust to that subject indirectly.

MALE SPEAKER 19: How did you come to trust that one?

\[NELSON HASTINGS:\] That's a good question. That's a very good
question. It could be that its an organization that I'm familiar with,
that I trust. In your web browsers these are pre-populated. Those keys
are pre-populated in your web browser so some people are making
decisions for you. It could be that say, NIST, maybe this is NIST's CA
key and I trust that. There has to be, you will have to somehow get this
trust relationship that you have with the CA.

DONNA DODSON: This is Donna Dodson. A root trust example cannot be
looking at topography. Its sort of like the Federal Reserve Bank. That's
how you get some of that (undecipherable). If you look at some of this
sort of like following a check in the banking industry,
(undecipherable).

\[NELSON HASTINGS:\] Where's the microphone? Could you hand that to
Donna so she could say that again. I'll go to Wendy next and then I'll
come back.

DONNA DODSON: This is Donna Dodson from NIST. The question was why do
you trust this CA in the diagram. I think it always helps if you look at
it from a banking perspective. If you look at the Federal Reserve a lot
of banks tie back to the Federal Reserve and that provides sort of the
trusted blanket for the banks. If you look at this its sort of the way a
check flows and why you have confidence you are going to get the money
when you accept a check from someone.

\[NELSON HASTINGS:\] Wendy.

WENDY NOREN: This being elections there is not going to be any trusted
authority that everybody agrees on. Consequently, I am assuming that we
have a future slide that has multiple trusted authority to take upon who
you trust.

\[NELSON HASTINGS:\] I think you will be disappointed because I don't
have a slide that says that. That's an open ended question. Where is
this trust root going to lie. It could lie many places. It could lie in
the jurisdiction. It could lie at the Federal level. I don't know.

DON MERRIMAN: Don Merriman from Salina County, Kansas. In the election
world related to other than banks and so forth we use the same sort of
a, we call it PKI key. We use --

\[NELSON HASTINGS:\] We try to stay away from that word.

DON MERRIMAN: I won't use it again then. We use that in our election
voter information system. Each one of us who has access to that voter
file has got our own key and passwords and all of that. It's a very,
very secure system. In our system anyway, this is exactly what we use
and the trusted authority of course is the Secretary of State and they
trust us to put in the people that we trust to be in that system, in
relation to elections anyway.

\[NELSON HASTINGS:\] That's a very good explanation. You brought up a
term, he used the term PKI, standing for public key infrastructure which
is really what this whole thing is of the CA issuing certificates, using
a certificate status server to check and see if the certificate has been
revoked. All that infrastructure is call public key infrastructure.

MATT MASTERSON: Why would I ever go to TAB. If I already have a trusted
authority, why wouldn't I always go to the trusted authority?

\[NELSON HASTINGS:\] Okay. Matt's question is why would I go to CAB if I
always trusted TCA. What if subject Z does not have a certificate that
has been signed by the same CA that you trust? It bridges that gap.
That's what happens there.

FEMALE SPEAKER 15: Would you say that again?

\[NELSON HASTINGS:\] Okay. So, the question was, why don't I just go and
get subject Z's certificate that has been issued by the certificate
authority that I trust? What if subject Z doesn't register or get a
certificate issued by the certificate authority that I trust. He has his
own realm of trust, if you will, that he plays in which is rooted with
CAB.

MALE SPEAKER 20: Just a follow up. So that means you sort of, you build
a trust with CAB by doing your passive returns? When the situation
arises that your CTA doesn't have that certificate, you can trust on
CAB. Is that the point of doing a passive return?

\[NELSON HASTINGS:\] Yes, it is. Okay. So that was a lively discussion.
See, it wasn't that painful.

Going back to our Amazon example, if you notice that the Amazon
certificate was issued by VERISIGN/RSA secure server. If you click on
that you notice that this is a certificate issued by RSA to RSA and
that's called a self-sign certificate. It's a self-sign certificate. It
is also sometimes called the root of trust. The distribution of
self-sign certificates has to be done very carefully so that you don't
inadvertently put somebody, a root of trust in there that you really
shouldn't have in there. Web browser come pre-populated with a set of
self-sign certificates in the browser.

I can look at in more detail the certificate signature. I can open up
the certificate and look at the certificate signature algorithm. Again,
this one uses RSA public key cryptography but in this case it actually
uses a different hash algorithm, MD2 which I won't comment on.

Again, I can then go and look at the subject's public key and look at
that information as well. that's kind of a quick tutorial on symmetric
key, public key cryptography in the use of certificates because we use
the term in the guidelines, digital certificates or certificates. We use
the term digital signature generation, digital signature verification.
We don't really use a lot of symmetric key cryptography in the
guidelines.

The next topic we'll talk about is audit trail basics. Audit trail
basics really consists of two parts. The generation of audit information
and then the actual auditing itself. The use of that generated
information which is really procedural. The guidelines really focus on
the generation of audit information to support auditing procedures.

Audit information can be used for accountability to determine who did
what, when. It can be used to reconstruct events. How did we get into
this situation? You can look up what events led to that. It could be
used to detect intrusions. Do I have unexpected information in my audit
trail? Is something missing that should be in the audit trail
information? As well as problem analysis.

When you secure audit trail information, what you really want to do is
to prevent or detect tampering with that information. Additional
creation of log entries, modification of a log entry that exists,
deletion of a log entry. There are different techniques that can be used
to secure logs and I've given two here: cryptographic techniques can be
used and write once media can be used.

This actually is the end of the computer security basics. If there is
any questions on that, I'd be happy to answer those. If not, I'm going
to turn the second half of the presentation over to --

BARBARA GUTTMAN: So as you gathered the format is, first we are going to
give you a little bit of the background, these terms. Now we are going
to do our part to walk through what's in the VVSG and explain the
security concepts in there.

I'm going to start again with the disclaimers. You may not we are
actually taking some advantage of some real world examples so we will be
using real product names for example purposes.

There are two security chapters. Chapter 4 which covers the audit
architecture and Chapter 5 which are the general security requirements.

The first point I want to make is that with the security parts they all
need to work together. Nelson explained to you that security has to work
together both from a technical and a procedural and a management point
of view but also, these components work together.

That's actually why we spent so much time on cryptography is that it
ends up as the basis of so many other controls. You might find that when
you are looking through the sections some of them are a bit hard to
understand out of context with the other.

That actually says the same thing that crypto is -- I tend to get ahead
of myself on this one -- crypto is used to support a lot of other
things. The same thing holds true in the relationship between the other
controls. You have to kind of look at the big picture. That's also part
of the defense in depth strategy that it is, from a security
practitioner's point of view, you always presume at least one of these
will be bypassed. You need to have them multi-layers going through your
system.

One of the pieces that we actually thought was especially confusing is
that the documentation requirements are elsewhere. They are not in with
the security requirements because, of course, these security things they
are a little bit complicated to set up. They are pretty much worthless
if the election official cannot set them up correctly.

Let me point out there are two kinds of documentation requirements.
There is one which addresses, which is in the technical data package
which explains sort of overall approach to security so that when a lab
looks at the system they know what to test, especially when we talk
about this open ended vulnerability testing. It explains the whole
context of the system. So, its more from a security architecture point
of view.

You also have user documentation. Well, how do I actually set up this
feature so that I can use it correctly? These are both very important
pieces of documentation and you really have to think of these security
pieces together that you need documentation people can really use to set
this stuff up correctly.

That's a little, sort of background overview to the whole of security
Chapters 4 and 5. With that I'm going to get into section 4, which is
security and architecture. I have some advantage here which is that
you've already gotten several introductions to this because this was a
particularly difficult issue that the TGDC wrestled with about how to
address the security and audit architecture.

It's divided into two basic parts. One is sort of overall approach to
audit and then there is sort of two basic components. What requirements
are put on electronic records the system keeps and what does it put on
this concept that has been introduced before, the IVVR records, the
independent voter verifiable records.

So, I'm going to give you a third take on a background because, I don't
know, I guess you can't have enough. If you are really bored with it,
just say go on Barbara, go on.

What does this mean. There was a resolution. The SI resolutions that
systems, that changes must be detectible. What does that mean in reality
land? Some of us dwell in reality land, some in fantasy land. Election
officials tend to live in reality land. In practice this means
auditable. If we are talking about whether it's a detectible, well, how
do you detect things. You detect things through an audit. So, SI in
practice, means auditable.

Why does the TGDC, why do they want SI and some of the concepts Dave had
talked about earlier is that software -- . The first concept is with the
computer its actually kind of easy to make the screen say one thing and
being doing something else underneath. This is pretty common to do, it
has been done in computer systems. People they lie, all the time.

The hard part is election officials will point out that making changes
that are plausible. The first question people ask is, okay computers
often don't show you exactly what they are doing inside. Wouldn't a test
lab catch this? I think Dave explained part of when he was talking about
testing.

Testing is very difficult for software. One of the things he mentioned
is you know, in voting systems you have your core logic, your counting
logic, which is actually much more straightforward than your user
interface code.

User interface in voting systems, I mean, that's one of the beauties of
having computerized systems. You are capable of having a very rich user
interface capable of support all kinds of different ways of interacting
with the voter. Well, you know what, this adds a lot of lines of code
and a lot of complexity. It's a good thing, but I just wanted to point
out, its very hard to test.

I want to give you some examples that I'm hoping will help you
understand the concerns computer scientists have. I am going to give you
three examples of famous software that wasn't doing what we thought it
was doing.

The first one I thought would be one you are pretty familiar with. In
North Carolina you had the system. There was a configuration set up. It
looked like it was recording votes. It did everything right. The voters
pressed the submit vote button. It submitted the vote and it went into
the black hole of doom because there was a memory configuration error.
It just simply wasn't recording those votes. That's one example, it was
a error, it was not malicious, of the voting system looking like it was
doing one thing when it was actually doing something else.

The second example I'm going to give is something that's very old. It is
deep in the heart of what computer scientists learn about systems. This
is an example, its from the 70\'s.

It was a radiation machine. It was used to actually deliver radiation to
cancer patients. This is the kind of machine that people actually spent
a lot of time designing, doing it right and the machine, it's a very sad
story because the machine killed people. It burned people. It killed
them because the user interface, if you were actually really good at
doing the user interface, if you type really, really fast, you are a
really good technician and you typed it in, you ended up bypassing,
getting into a place in the system where you should never be, where the
machine it looked like it was delivering dose X, it was really
delivering ten times that dose.

Everything looked right. The technicians were doing what they were
supposed to be doing. Everything on the screen looked right but the
machine was actually doing something else. I bring this example up
because, one, it was a user interface example which is the most
complicated part of voting systems, but also just to give you a flavor
for were computer scientists are kind of coming from when the talk about
their concern about software quality.

I thought I should give you another example that a malicious. It's the
Therac (sic) 25 was not malicious. It was just a mistake.

By the way, it took them a long time to catch it because it was a very
odd error. It was very hard to recreate, to actually get to this point
because, of course, when people were trying to recreate the error, they
would make sure they typed things very carefully, but you couldn't make
the error happen when you typed if very carefully. You had to type fast.

My next example is something most people are familiar with which is
fishing attacks. You get a nice e-mail. It says you need to go change
your password. The report says it comes from E-Bay. I think if I click
it, it will say that it says you are going to that web site, that nice
piece of blue.

Where's our willow wiggly stick? Did some one take our wiggly stick?
Thank you. We need our wiggly stick.

It says you are going here to E-Bay but really what's behind that is
this arbitrary address. You are going there and then they are going to
steal your information and do bad things to you. That's an example on
the web, but just an example to show you that there are plenty of
malicious attacks where something looks like its one thing, but its
really something else.

The question is how does the VVSG address the issue of auditability? The
first thing, one thing that came up a couple of times which is this is
an equipment spec. it defines capabilities of the equipment. What
election officials do with it is actually their business or the business
of their jurisdiction, their state, whatever they are. This requires
equipment that can be audited. I feel that's something we can't say too
many times.

The VVSG itself lists four different kinds of audits that the equipment
needs to support. There is a fifth type that the TDGC considering
putting in their parallel testing which is yet another kind of audit.
However, this one had absolutely zero requirements on the equipment
itself. Basically whatever equipment you have now, you can do parallel
testing with it. They actually did consider putting some requirements in
but the TDGC considered those too Draconian and dropped them.

Wendy, you had asked a great question, like observational testing, like
how many actual requirements does this levy on the equipment? The
answer, is one. I wrote it down. Its probably in my notes. Its one, its
very minor, the actual requirement that it levies is there can't be a
way for a poll worker to signal to the machine that its being tested.
It's a very minimal set of requirements because observational testing is
primarily using the system the way it is.

There are these other three types of audits to be supported which are
sort of, kind of, these should basically be familiar to you. Poll book
audit, the right number. I had so many voters come through. Do I have so
many votes coming out the other end? Are my counts correct? Can I
compare, now this is a new one, can you compare your electronic and your
IVVR records and get the same numbers?

Also addressing not only just totals but are your totals in the right
bins? So, you could, if someone were maliciously trying to attack the
voting system, they might not change the number of voters, but move
voters from one, basically from one precinct to another so they are
voting in the wrong contest. You need to be able to keep track of rather
a lot of things, if you want to do a rather complete set of audits. So,
those are required when we get to the electronic and the paper records,
that they provide enough data so that you could actually do a meaningful
audit depending on which attribute you need to audit.

As I said, there are two types of -- I mean the essence of auditing is
you compare two things or sometimes more than two to see if they are the
same.

I am going to address the electronic records first. Let me make sure I
am going to address everything. There are some general requirements on
electronic records which is that they must be in an open format. That
is, whatever format it is, it has to be published so that it is possible
for your to read them without just using equipment that came from that
vendor. They must be printable. They don't have to be printed all the
time but they must be capable of being printed if you need them. They
must be digitally signed for both integrity and authenticity.

That provides you rather a rich set of security features because when
you accumulating votes, you can, if you have equipment that will support
this, you can know that the subtotal votes you are bringing in. They can
be signed so you know what exact piece of equipment they came from which
means you can check, did you get totals from all the machines you are
supposed to get them from or are you missing some. You can know that
they came from that machine and they came from that machine unchanged.
As you are looking at your accumulation function this is a really nice
thing to be able to do.

In general the electronic records focus on making sure all the relevant
data is in there. One of the things, Dave pointed this out and I'm going
to reinforce it because it tends to be confusing because there is a
difference between ballot style and ballot configuration. Ballot
configuration being just the choices that you have and ballot style
addressing the specific user interface like whether it was an
alternative language. In this section is addresses ballot configuration
choices. So, when you look through make sure we got all of the
information that needs to be included in electronic record. It addresses
configuration, not ballot style which is the more common term that
people are used to using.

It includes things you might think it would include like, what are the
totals? The totals for each ballot choice that was available to the
voters. How many ballots were read? How many were counted? How many were
rejected? How many over votes or under votes or write ins? It also,
Brit, includes your ballot counter total which is 435. So, I looked that
up for you. It addresses it and this is another important point that
Dave brought up, remember that a DRE is also a tabulator. Remember we
don't distinguish necessarily. Some of the address things that are done
by tabulators and EMS which would be a tabulator that has tabulators
that report to it. So, as you accumulate you have some additional
requirements for keeping all of these records straight.

Now we get to the slightly harder concept because you all are sort of
used to working with these electronic records already, which is the
independent voter verifiable record. What is an independent voter
verifiable record and where did we come up with such a long name?

The issue is it has to support direct verification by the voter. It must
provide support for hand auditing. We also have various security and
operational properties that I'll walk through.

My first issue is, well doesn't this mean paper? This was brought up
before and the answer is no. One of the specific things we looked for
was just because paper is all we know today, why would we limit
ourselves? Let's put some flexibility in here and hopefully having
flexibility in our standard will encourage the marketplace to come up
with better solutions. That was the impetus that drove this is not a
paper requirement, it is truly an independent voter verifiable record.

(**END OF AUDIOTAPE 3, SIDE A)**

\* \* \* \* \*

**(START OF AUDIOTAPE 3, SIDE B)**

BARBARA GUTTMAN: It has to be capable of direct review and that's by
both the voter and the election official. It must be capable of
supporting a hand audit. It must be able to support a recount. However,
you might note that that does not say a hand recount.

There is an assumption that recounts would likely use automated means to
help them along. The capability is just for a hand audit but recount can
be automated. It has to be able to support a recount. It has to have
some durability. It has to provide some tamper evidence. It has to
provide some support for privacy. It has to be in a public format.

It has to have sufficient information on each physical media you have
so, for instance, it must have what ballot configuration this is so that
when you are left at the end of the day with a pile of these things, if
you can imagine you had a pile of these cut sheet things, you actually
know what they go with. Each record must have sufficient information on
it.

No code book is required. That is the IVVR cannot just say "president
43." It has to say who choice number 43 is. It must be readable
independently without resorting to a code book because there are, of
course, some approaches out there that use a code book and these are not
allowed.

On support for multiple physical media. That addresses this cut sheet
issue or like on your paper roll you may need more than one paper roll
during an election. So, what information has to be available on each
piece of separate physical piece of media. Yes.

FEMALE SPEAKER 16: On particular information you said ballot can be
(undecipherable) so that means that each voter's complete ballot is
recorded?

BARBARA GUTTMAN: It probably -- oh, the question is: How much
information you really have to put on there in terms of the ballot
configuration, not just the selection. So, President Smith, you don't
have to list all the choices they didn't make, but enough so \--. In a
race you could have, you know, the same names show up more than once.
You have to have enough information that it stands alone as a record.

FEMALE SPEAKER 16: I know that some records show all selections for
president. Its not necessarily each voter's cast ballot. Its not the
complete ballot.

BARBARA GUTTMAN: It doesn't have to be the complete ballot, the complete
cast vote record. Jim also had a question.

JIM DICKSON: My question is, is this standard mandating individual cut
ballots?

BARBARA GUTTMAN: No, no it does not. The question is does it mandate
individual cut sheet ballots. No, it does not. It allows for paper
rolls.

JIM DICKSON: But you just said, it had to be an individual cut ballot.

BARBARA GUTTMAN: I think she was asking if it was. Oh, I shouldn't speak
for you, you speak for yourself.

FEMALE SPEAKER 16: (Undecipherable).

JIM DICKSON: I'm talking about what you said how it presented. I thought
I heard you say when you were reading off the --

BARBARA GUTTMAN: Oh, on the slide it says sufficient information (ballot
configuration, not just selections). She was asking about that specific
bullet on the slide. Does that answer your question Jim?

MALE SPEAKER 21: No. Jim thought you said cut paper ballots because you
were referring to cut paper ballots.

BARBARA GUTTMAN: I'm sorry I was unclear. The standard allows for both
paper rolls and cut sheet ballots. In either case, each individual piece
of physical media, which could be the end of a paper roll or the end of
sheet one of a multi-sheet ballot, has to have sufficient information on
it that it can stand on its own.

If you have a cut sheet system, the voter has to be able to accept or
reject each sheet individually. The standard also does allow for there
to be non-human readable information on the IVVR for instance if you had
a digital signature or a bar code to support automated recounts. It does
allow for that, but whatever non-human readable information on there
must be in a public format. Oh, question, good.

SHELLY GROWDEN: Shelly Growden from Alaska. On the multiple, physical
media where the IVVR has to support each individual piece of that media
to be accepted or rejected, one of the issues I was concerned about
there is that if you have an entire ballot that say, includes five
individual sheets, there needs to be somewhere in the VVSG or something
that, if you are going to allow that voter to cast their ballot, you
need at least five accepted to complete your ballot set.

If you could accept or reject individually, you could have a cast vote
record that wouldn't be a complete set of those ballots if one of them
would have been rejected. You want the full set. At some point you might
individual sheets in there that are rejected, but by the time they cast
their ballot, you need that full five.

BARBARA GUTTMAN: You need the full five or you have a voting session
that is not completed.

SHELLY GROWDEN: That's correct.

BARBARA GUTTMAN: Make a note of that Nelson.

DONETTA DAVIDSON: Does that include absentee?

BARBARA GUTTMAN: Well, your absentee ballot, I mean, you only have the
one paper ballot that's sent in. So, yes, I think it would cover. That's
a good question Donetta. I have to think about that one because that's
not an equipment stack so I'm not sure it does. However, it would
probably be in keeping with best practice. Its not specifically an
equipment spec so it would probably be out of scope. There's another one
for you, Nelson.

In addition, after we have this section, so any IVVR system must conform
to all of those IVVR requirements. Of course we happen to know that
there are two IVVR type systems out there and there are some additional
requirements specifically on VVPAT systems and very few on Op-Scan
because they don't have as many issues beyond what was already covered
in IVVR.

In VVPAT, Sharon had already addressed VVPAT and accessibility and I
don't think we need to go into that anymore here. We have already talked
about the observational testing there and that there are many
operational requirements which I'm going to get into. Here I did put
specifically in that paper rolls are allowed because I knew that would
be an important question. Matt.

MATT MASTERSON: Matt Masterson from the EAC. I guess my question is that
okay, we have IVVR and how you are creating requirements for the two
existing IVVR. If we are trying to encourage innovation, how is the EAC
going to handle these possible other forms of IVVR if --

BARBARA GUTTMAN: If it complies, if it meets IVVR and its neither a
VVPAT nor an Op-Scan \-\-- if Mark over here, when he retires from NIST
and invents some wonderful new voting system, which I think he's working
on even as speak \-\-- if it meets IVVR, it meets the standard.

MATT MASTERSON: Then why have these additional --

BARBARA GUTTMAN: Because we know that there were some problems with
VVPAT, so we wrote standards to preclude these problems from happening
in the future. You will see most of them are operation requirements to
make VVPAT better systems. If they meet IVVR, they meet the basic
security requirements for auditability.

Let me show you an example of some of the VVPAT ones. For instance, we
require -- let me flip over my page because I wrote some happy little
notes. Let me think of an example that would be best for you, like
printer, computer interaction that that should be a public format
between the two. If its not, you haven't really broken the whole
security thing, but from an operational point of view this is a huge
advantage.

Let me talk through some of them and you'll see these are ways to make
VVPAT systems better because we have some experience with VVPAT. You all
know what can go wrong with some of them.. John Wack was the original
author of these. He spent a long time studying what went wrong for
people and what requirements they want so these things will be better.
Wendy did you have a question on that?

WENDY NOREN: When you said that printer computer interaction has to be
public --

BARBARA GUTTMAN: The printer port. You have to use a USB or -- that's
what it means. You use a USB, don't use a proprietary printer port that
nobody can --

So, there's this section the components and definitions defines what a
VVPAT is. The other things I pointed out before, is for error handling
so that if you have a printer error, you want to know the status of the
vote in question so that election officials have some clarity of what
they are supposed to do with this error. The protocol of operations at
the machine.

Some of these actually just sort of clarify what's in IVVR but make it
specific for VVPAT. You must display the vote choices so that the voter
can compare them, can accept or reject it and then also what happens if
you have multiple rejections. At what point you need a parameter that
election officials can set for after the voter has rejected the 29th
attempt to vote, and this is state specific. What is requires in there
is that there be a parameter that is state setable for when it is than
an election official needs to be called in.

FEMALE SPEAKER 17: If the purpose is to provide the systems with better
(undecipherable), it seems to me that the voter, the first thing the
voter says, is the VVPAT doesn't match their cast ballot.

BARBARA GUTTMAN: Well, no because people make mistakes. When you get
your display screen, now if you have a DRE, you already get a summary
screen that says these are the choices you make. People go back and
change them because they made mistakes.

FEMALE SPEAKER 17: Right.

BARBARA GUTTMAN: So, if you are at your display screen, if the voter saw
that the display screen and the printed screen were not the same, they
might want to call the poll worker over and say, something is really
wrong here. They might just change their mind.

FEMALE SPEAKER 17: The thing that is so confusing is what a VVPAT is for
because if the VVPAT leaves an audit and confirms that (undecipherable),
you have the summary, you wind up changing. If you are going to allow
voters to continually make changes on the VVPAT, (undecipherable).

BARBARA GUTTMAN: This addresses for systems. I'm sorry, the question
was, you have the summary screen to address when the voter recognizes
that they made an error and want to change their choices versus you have
the VVPAT record which is supposed to be an audit record. However, these
can happen at the same time. Therefore there is a tuneable parameter
which you might want to use in your jurisdiction.

This would be procedural but I think an election official would be hard
pressed to explain if they actually saw a difference in the VVPAT record
and the summary screen. You've got a problem, you need to pull that
piece of equipment off and you need to wonder is this an endemic
problem. Is this a systematic problem or is this a lone case of a
malfunctioning machine? Hopefully, this won't happen to you. Does that
answer your question?

The human readable contents is that the VVPAT record itself must be --
the print on it must be machine readable back in. This supports both
accessibility and it supports later if you are going to need to do a
recount and need to do some automated processing. This really might be
quite handy for you if the human readable version is also machine
readable.

There is another parameter for potentially linking the electronic and
the paper record. There is some very nice kind of auditing you can do if
you can pull specific records. However, this also might violate state
law. So, what we have in there is the requirement for the ability to
have this that can be turned on and off locally, depending on what the
jurisdiction needs because it does give you some auditing advantages
however it also has some problems. So, we left that as a capability to
use or not use.

There is also something to address paper roll privacy, you know, seals
and things like that for the machine. Also if there is an error that
occurs during printing the paper roll that what the voter already has
selected should be inside the machine, inside the roll in case of an
error. Also, there is a requirement for vendors to provide a spooler if
there is a paper roll.

If PCOS did not have many additional requirements beyond what's already
in all of the rest of the VVSG, mostly there was a specific allowance of
non-human readable mark, either record identifiers, batch information,
integrity checkmarks, but these are allowed to be on there.

That is the end of Audit and SI. I'm happy to answer any questions now
or later. Otherwise you get to learn more about how cryptography is
actually used in voting systems. Yes.

LYNN BAILEY: Lynn Bailey from Georgia. I would just like to make a
comment really. The audits that you referred to earlier, the poll book
audit trail, those audits are not mandated, they are optional.

BARBARA GUTTMAN: They are provided in -- the question is, are like the
poll book audit and the hand audit and the vote count audit required?
The answer is no. It is required that the machine be able to support
such audits but you in your state might, you might just call them
something different. You might call them five separate audits versus the
three we called them. Each state is allowed to use its own terms. We had
to provide a context for what the goals of what these records were
doing.

LYNN BAILEY: As a follow up, so we may simply choose not just to call
them something different but not to do them at all.

BARBARA GUTTMAN: Not to do them. No, no, your state may require you not
to do them which is the beauty of our Federal system. One more, over
here. Oh, we've two more.

FEMALE SPEAKER 18: The continuous paper roll. Our state has concerns
about the secrecy of that . So, the guidelines talk about procedure,
what kind of procedures are envisioned to deal with the secrecy of the
ballot on continuous --

BARBARA GUTTMAN: I'd actually just probably have you ask Larry because
he has more experience with them. The question was how do you handle
secrecy of paper rolls.

From an equipment point of view, we put in a requirement that they have
to be able to have seals on them. I'd ask Larry if I were you.

LARRY LOMAX: In our state its very simple. All of the voting machines in
a polling place are electronic voting machines. We don't record the
order in which voters come in to vote. We have no way of knowing. They
are allowed to take the liberty to select the machine they use when they
vote and whether there is a record of what they seen. There is no way to
go back afterwards and (undecipherable).

BARBARA GUTTMAN: Which also is an issue, if you go to electronic poll
books, you are going to want to make sure your electronic poll books is
not also keeping track of the order of votes which is something to keep
in mind.

MALE SPEAKER 22: Can you summarize Larry's answer?

BARBARA GUTTMAN: Larry's answer was that they don't record the order the
voters came in and they let voters select which machines to use. So you
get some randomization.

Brit would also like to speak to that.

BRIT WILLIAMS: There is a contradiction in the guidelines. You just read
a standard that allowed (undecipherable). There is another standard that
says that the vote has got to be cast in such a way that no person can
identify another person's ballot without their assistance.

Those two are conflicting because when you vote on a VVPAT, if you
record - if I see you vote -- when you leave I walk over and I record
the serial number of that machine and the public counter on that
machine, those two numbers uniquely identify your ballot.

BARBARA GUTTMAN: As Brit well knows this was something that the TGDC
spent quite some time arguing about. In fact at one point, had decided
to go the other way, but it being not a perfect world, they decided that
it was better to allow paper rolls given that election officials were
developing procedures to address them.

Yes, its --

BRIT WILLIAMS: And in another place you say that the system has got to
prevent that and the system cannot prevent that. As long as those two
numbers uniquely identify --

JOHN WACK: Well, Brit, I know we talked about this earlier,

BARBARA GUTTMAN: This is John Wack now.

JOHN WACK: Can you hear me now? We talked about this earlier. Does the
public counter have to be printed on the paper roll or could it just be
displayed on the screen or something?

BRIT WILLIAMS: Its just displayed on the screen. Its not printed on the
paper roll, but if I know, if on this serial numbered machine you were
the fifteenth voter, I'd go down that roll to the fifteenth counted
ballot and that's yours.

JOHN WACK: Oh, okay. That's unavoidable, I think.

BRIT WILLIAMS: I'm not arguing for or against either one of those two
requirements. I'm saying that they are conflicting and one or the other
needs to be taken out.

JOHN WACK: Another thing I will add is, I can't remember which
particular requirement but there is a requirement also to ensure that
the paper roll gets stored in a well strengthened cannister which would
make it more difficult for someone at the polling site to look at the
paper roll.

BRIT WILLIAMS: There's no questions about it and Larry does a really
good job with it, but still the point is that no matter how
(undecipherable) it is, somebody has access to those rolls and whoever
that somebody is, given those two pieces of information, may
(undecipherable) the ballots.

BARBARA GUTTMAN: So it definitely places a procedural burden. Nelson.
Wendy, did you have a question too or anybody else.

WENDY NOREN: (Undecipherable). I think over in Chapter 7 sometimes there
may be some things -- there were a couple of things in there that said
the activation device shall not keep certain information but I think
maybe requires --

BARBARA GUTTMAN: Okay. We tried to make sure we were consistent between
7, 6 and 4. We might have missed a few spots. So if you send us an
e-mail, that would be good or put it in the public comment record
because it is certainly possible that we missed a few. Nelson.

\[NELSON HASTINGS:\] Can I just speak to that real quickly. In 7, what
we basically said was the electronic poll book records cannot be
combined with a DRE's records to clearly show how people voted. I think
they are consistent, I mean what Barbara said to Larry earlier was that,
when he said he doesn't keep track of the order in which people use the
VVPAT, she mentioned something about he may need to make sure his
electronic poll book doesn't also keep the same order which then would
keep things in sync there.

WENDY NOREN: Yes, that's one of the issues I had with 7 yesterday was
(undecipherable) assuming you had electronic poll books but you
(undecipherable) the activation device which gave you something
different in a different system. I think again both of those functions
need to be (undecipherable) together to make sure.

In 7 a lot of the requirements were for an activation device for what
was it -- assuming it was a poll book when its not only (undecipherable)
\-\--

\[NELSON HASTINGS:\] Okay, is there any more questions on that? If not,
I'll go ahead and start taking about the general security requirements.
There are eight different sections there. We'll start off with
cryptography.

As we've talked about, it's a powerful security control, provide
information integrity and authentication. Requirements were developed to
reduce the maintenance and ease of use for this.

We were sensitive about the burden that this would put on election
officials so we tried to simplify the key management aspect of it.
Specifically, the burden that that would put on people. It also uses the
strength of existing Federal standards that have been developed in the
area of cryptography.

The cryptography requirements are really about the implementation of
cryptography, specifically public key and secret key cryptography and
not cryptographic voting protocols, sometimes known as end-to-end voting
protocols. Like has been said before, many of the sections of the
guidelines leverage the security capabilities that cryptography
provides.

The first requirement on cryptography is that it needs to be done in a
FIPS140-2 validated cryptographic module. FIPS stands for Federal
Information Processing Standards. 140-2 refers to requirements for
cryptographic modules I believe it what it is. In addition, there is a
testing regime to test cryptographic modules to make sure that they
validate to that FIPS140 standard.

What is really a cryptographic module? A cryptographic module is a piece
of hardware, software or firmware that implements cryptographic
functions whether that's encryption, decryption, key generation, digital
signature verification, digital signature validation.

Another requirement is the minimum strength of cryptography is specified
in the guidelines so that you are not using inferior cryptography. Over
time cryptography sometimes becomes weaker, different algorithms become
broken, compromised and that kind of thing and fall to technological
changes.

Another requirement is to have this thing called a signature module
which is a hardware cryptographic module that's validated to FIPS level
2. In the FIPS program there are four different levels of validation
that you could go through, 1 being the lowest, 4 being the highest. This
talks to have a level 2 type of cryptographic module with a physical
security of that module being at level 3.

The signature module is used to generate digital signatures. It
generates and stores private keys inside of that module and is
permanently attached to the piece of voting equipment. We don't have
them out.

So to kind of bring this home of what we are looking at in terms of
cryptographic module on a piece of voting equipment, we went out and we
looked at what pieces of equipment right now that you could buy
commercially off the shelf contained such types of devices. There was
concern that we are asking for devices that aren't in equipment today
that you can buy, the reliability of them were questioned. So we looked
to see if there were manufacturers actually putting these modules on
pieces of equipment, you know, computer equipment. If you look at the
diagram on the board, that little piece of silicon, that computer chip
right there, that is a cryptographic module that does digital signature
general, digital signature verification and the commercial name for that
piece, that chip is called the TRUSIC Platform Module. We've actually
brought in the boards themselves, so we are passing those around so you
can look and see what that might look like.

The signature module has two types of signature keys, a device signature
key which is associated with a device for its complete lifetime. What
this allows, it allows digital signatures to be traceable back to a
specific piece of equipment.

In addition, there is another signature key called an election signature
key that is generated and used during just one election cycle. I don't
know if that's the correct terminology, but what it is really saying is
that you would use that as you conducted one election.

WENDY NOREN: What is we have multiple elections during (undecipherable).

\[NELSON HASTINGS:\] This is why I don't know if I have the actual right
terminology. What it is, when you put it and deploy that system out for
that election or multiple contests or whatever, then its good for, its
used for that one specific deployment. I guess maybe that's the better
terminology here, Not election cycle but really about the deployment of
that equipment to the polling place. Britt, you had a --

BRIT WILLIAMS: This subject is something that the election officials are
controlling?

\[NELSON HASTINGS:\] Yes, it would be --

BRIT WILLIAMS: (undecipherable) to the election and all the associated
runoffs --

WENDY NOREN: I've got February, March, April election. So I've got
different names but the same pieces of equipment for --

\[NELSON HASTINGS:\] I guess my question to that is, how many times do
you configure that piece of equipment for those different elections? The
idea here is that that key would be generated each time you configure it
for a different election or a different deployment.

WENDY NOREN: CANNOT UNDERSTAND WHAT IS BEING SAID.

Anyway, I'll think about it. If it's only one (undecipherable).

\[NELSON HASTINGS:\] Okay. So, the effect that we are trying to get here
on this election key is that you can tie the digital signatures on the
electronic records to that given election or that were generated by that
given election, the cast vote records, the system logs and all that
information can be tied to that deployment or that cycle of use.

The device signature key is generated using a random number generator,
the (undecipherable) is a very mathematical term. The requirements for
it is that it can be exported from the, the public key can be exported
from the module in a public key certificate, either as a self signed
certificate or it could be exported and then signed by a certificate
authority.

The other requirement is that a unique identifier on the surface, like a
placard or a serial number on the outside of voting equipment, that
number needs to be one of the objects or pieces of information in the
digital certificate that contains that public key for the digital
signature or the device signature key.

The device signature key is used only to sign election signature keys,
election key closeout records and if it does a self-sign certificate it
can do a device signature key certificate signature. Jim.

JIM DICKSON: I don't know if this is a broader question. So if this is
not the right time, it can wait.

\[NELSON HASTINGS:\] Okay. What's the question?

JIM DICKSON: My question is, what is the cost of this kind of encrypted
requirement going to do to the cost of DRE?

\[NELSON HASTINGS:\] I can give you some generalities on this. The
question was what is the cost of this encryption technology being
integrated into voting devices? I can only give --

JIM DICKSON: Specifically into DREs.

\[NELSON HASTINGS:\] Specifically into DREs. The only thing that I can
give you is something that I saw in terms of the cost of placing a
trusted platform module on a motherboard that Intel cited that it cost
them \$5.00. It raised the price of their motherboards by \$5.00.

That being said, you have to understand the scales of economies, right.
Intel produces a lot of motherboards, so the cost is really laying out
the board and putting that chip in the board to do that. They do that
once and they sell millions of motherboards. So, that's the best I can
give you on that.

JIM DICKSON: But isn't there also, its n to just cost for the storage.
Isn't there a cost for the software that's going to generate the keys
and the hashes and the signatures and all that?

\[NELSON HASTINGS:\] There would be a cost in addition to integrating
that onto a DRE's motherboard, there would be a cost to modifying the
code in order to access the capabilities supplied by that chip or by
that cryptographic module.

BARBARA GUTTMAN: Let me give a sort of general answer to that which is
that crypto, the hardware has become, as Nelson pointed out, dirt cheap.
The software has become very readably available. Lots of people make
software that vendors can incorporate into their products. Its pretty
standard kind of applications here.

So, the cost is likely to be not terribly high. There is some cost to
making sure you are doing it right but there are commercial pieces that
can be purchased to add into these. Generally, cryptography is your best
return on investment in security these days. That's my humble opinion.

\[NELSON HASTINGS:\] So, the next key is the election signature key. Its
generated in the same fashion as the device signature key. Its main
purpose is to digitally sign the electronic records generated by a
deployment. I'm going to use the term deployment instead of election
cycle.

Its destroyed as part of the election closeout process. Its envisioned
that this would be done as part of, it would be created as part of the
election set up process, just another command that you would do and then
as part of the election closeout process, it would destroy that private
key that's in the module..

There are a couple of other things that are associated with the election
signature key. Counters to keep track of the number of election
signature keys that were generated by that voting device as well as a
counter that counts how many signatures were generated by a specific
election signature key. One of these counters is monotonically
increasing over time and one of these gets reset to zero at the end of
each election. This figure is really to show that the election signature
key certificates are signed by the device signature key. The election
signature key's public key would be in the certificate and it would be
signed by the device signature key.

As part of the election key closeout record, this is an electronic
record that's generated by the system. It would include the public key
of the election signature key so it could just be the digital
certificate itself. It could be placed into the record. The number of
signatures generated by that key is recorded and the election signature
key number for that device is recorded. All that electronic information
is digitally signed using the device signature key.

SANDY (?): After all of this information what does it tell me?

\[NELSON HASTINGS:\] It tells you, it's the foundation for the integrity
of your electronic information.

SANDY (?): So will it tell me if somebody has accessed by system without
my permission or will it tell me how many people voted or how many
people \--

\[NELSON HASTINGS:\] So the question is -- Sandy's question is a good
one. What does this buy me? This is a piece of the puzzle. This is the
first piece of the puzzle.

You asked is this going to tell me who accessed my system? Well, this
cryptography is used to digitally sign system event logs. One of the
things that's logged is access to the system. So, yeah, it does, but
like we have said before, these are kind of building blocks on each
other. You have to view them all together. Does that answer your
question a little bit?

SANDY (?): I'm not sure. Let me ask one more question and then maybe it
will help.

So, if every time something is done to the voting system there is a
little signature marking that event. Does it have a date and time stamp
so that I know that somebody was playing with it at 4:30 in the morning
and it wasn't me?

\[NELSON HASTINGS:\] I mean, that information is, a lot of the question
that you are asking is about the types of information that's logged as
part of the system event log and specifically the types of events that
are associated with access control.

The short answer to your question, I believe, is yes. Its in several
different places in the document. You have your access control that says
\--. Barbara go ahead.

BARBARA GUTTMAN: It's the entire foundation of knowing the integrity of
your system. What records your system has, you can know are correct or
unchanged and where the records came from in case you have to move
records between machines. Its going to do the same thing for your
software which Nelson hasn't got to yet because you are going to sign
your software too. So, the entire foundation for the integrity of your
system is going to rest on this.

SANDY (?): So, why do I need this?

BARBARA GUTTMAN: Because it tells you that your system is entirely right
as it came to you, not that it was right before it was shipped to you.

SANDY (?): That's your job.

\[NELSON HASTINGS:\] Okay, so some documentation requirements that you
will find in the TDP that are associated with cryptography really are
the fields or objects or information in the device signature key
certificate as well as the election signature key certificate. The
specific cryptographic algorithms used by the device and the closeout
record format. Jim, go ahead.

JIM(?): I just want to rephrase Sandy's question. We do all of this
encryption and the system will still need a VPAT? Yes or no.

\[NELSON HASTINGS:\] The way the guidelines are right now, I believe the
answer is yes.

MALE SPEAKER 23: The question Jim is asking is not the way the
guidelines are explained right now. His question is, is it really
necessary to have the VPAT, if all this --

\[NELSON HASTINGS:\] Okay. I think, I need the question repeated. So,
the question is, because we are doing all this cryptography and this is
the foundation of assurance that we are getting, why do we need VPAT?

My answer to that is that basically going back to the idea that you
can't prove that software is operating correctly, you know, that's why
you have the VPAT. This structure here tells you the software that you
load on your system hasn't been altered. It doesn't say anything about
the correctness, if you will, of the operation of that software. John
Cugini.

JOHN CUGINI: With this method if the North Carolina example, that
software could have been signed, sealed as authentic and yet it still
lost well over 7,000 votes.

FEMALE SPEAKER 19: My understanding was the poll workers ignored several
thousand errors --

JOHN CUGINI: Oh, okay.

JIM DICKSON: The North Carolina error would not have happened if it was
a modern, acceptable device because the screen would have said this
machine will accept no more votes.

WENDY NOREN: (Undecipherable) if a situation like that occurred,
(undecipherable).

FEMALE SPEAKER 20: That wasn't a machine problem to the extent that poll
workers knew there was something wrong, they just didn't
(undecipherable).

MALE SPEAKER 24: After all this talk about cryptography is
(undecipherable), its almost laughable that we are saying that you've
got to verify the software is working with a VPAT, a piece of paper that
is probably the most single unreliable piece of equipment ever used in
elections.

I've got pictures right here on my laptop if you really want to see a
VPAT audit out of Cuyahoga County a year ago. These things are a
disaster. I just thought is was laughable and in the face of what you
are presenting here that we are talking about verifying it with a VPAT.

JOHN WACK: This is John Wack. I'm trying to respond. I think some of the
issues that perhaps you are responding to, for example, the problems in
Cuyahoga County, were the result of poorly engineered VPAT systems and
that's somewhat been taken care of in the new requirements.

With those improvements, I don't think it would be the case that audits
would be a bloody or murderous as they seemed to be in that county. I
feel in some respects that the VPAT and paper gets maligned unfairly
because the truth of the matter is, a number of these systems were
poorly implemented.

They were implemented before requirements were in any of the voting
systems standards. The usability for election officials and for auditing
paper rolls was not there at all. I think vast improvements have been
made upon them in the requirements we have. I felt it necessary to just
point that out.

MALE SPEAKER 25: Let me just add this to that. My background prior to
the election was twenty years of commercial (undecipherable). I'd been
putting a lot of papers in a lot of machines and I could be sure that
the paper goes in and it goes through the machine.

I just find it totally fascinating that after all of the presentation of
this that we are still talking about verifying ---

MALE SPEAKER 26: That's \$150.00 maybe \$200.00.

JOHN WACK: This is really an interesting discussion but I think we are
getting off the subject. The purpose was just to get everyone familiar
and we will obviously have this debate. So, why don't you move on now.

\[NELSON HASTINGS:\] Okay.

**(END OF AUDIOTAPE 3, SIDE B)**

\* \* \* \* \*

**(START OF AUDIOTAPE 4, SIDE A)**

**\-\--** these will automatically be generated and destroyed as part of
the election setup process and closeout process and this allows us to
get some very strong security in a reasonable amount ease and of
administration.

So, yes, Wendy.

WENDY NOREN: (Undecipherable) at what point does that prevent, for
example, if you have a recount, you either have to regenerate a new ESK
for a recount or do you reuse the ESK? Where the (undecipherable) how
broad is it?

\[NELSON HASTINGS:\] Okay. The question is if you need to do recount of
some kind, do you need to regenerate an ESK and kind of try to get a
feel for how the ESK would be used, I think.

Once the ESK is destroyed, records for that election have frozen. The
electronic records for that election have frozen. You still have the
public key to verify those electronic records and you should have those
electronic record around still. It doesn't destroy the electronic
records associated with that election, but you can't create new records
or information or log entries that would be tied to that election.

WENDY NOREN: So, in order to do a recount then you generate a new
election?

\[NELSON HASTINGS:\] No, because, Paul.

PAUL MILLER: I think you have two questions here with the very same
answer. A question we don't know the answer. We can't know the answer
(undecipherable) and how the election management process has occurred.

What you are simply saying is that at some point there is a need to
destroy the key so that so no new transactions for that election can be
created but (undecipherable).

\[NELSON HASTINGS:\] That's correct.

PAUL MILLER: What would be needed to be done in the event of a recount,
the management process (undecipherable).

\[NELSON HASTINGS:\] Yeah, I think you are right on that. Paul's
response was he thinks that we are trying to answer a question that is
highly dependent on election management and that the destruction of the
election signature key basically just makes it so that you can't create
new records associated with that election after its been destroyed and
how one resolves say a recount in using those electronic records is an
election management question. Its dependent on how the vendor implements
their equipment.

Are there any more questions on cryptography or are we all cryptographed
out?

Setup inspection. These are requirements related to capabilities to
inspect properties of a voting system or voting devices specifically.
The requirements reflect the new focus in light of software
independence.

These inspections generate system log events which include time and
date, information related to a specific inspection such as the
calibration of a component, the location where software is installed,
the result of the inspection. These are just a few.

I should have probably said this before I started, I'm really just going
through the guidelines, kind of in a linear fashion. You should be able
to just follow along in the guideline itself. It will also have the
voting device's unique identifier and the individual or role that
actually performed a given inspection.

There are two inspections related to software. One is software
identification and verification. Basically that's the ability to query
and inspect the voting device to determine what software is installed on
that system. So, does this system have the right files that should be
there, the right executables, the right configuration files. Those types
of things.

The second part is a software integrity verification using digital
signatures and hashes. What that's really doing is saying, is answering
a question, has somebody come in and changed the software on my system?

In light of SI, this approach allows for internal verification meaning
that there does not need to be an external device connected to the
system to do the verification of the software on that system. This is
different than what was in the VVSG2005 because the VVSG2005 didn't have
this notion of software independence. Okay, Wendy.

WENDY NOREN: I may have this but one of the things we aren't able to
verify (undecipherable).

\[NELSON HASTINGS:\] The way this is written it is written in a fashion
that it includes firmware. A lot of times what you will see is that file
needs to be on the system. It has to be a device that you can query and
find is a given file there. The way this is written, it actually says
that you can do it by a file system path name or by memory address
location which is probably what would happen in the case of a firmware
situation.

WENDY NOREN: Okay, so I have an individual (undecipherable) optical scan
device. They've verified the version I have matches the person that
certified. Will I be able to do that?

\[NELSON HASTINGS:\] That is the goal of this requirement is to make
sure that you can tell what software is on that system, wherever it is
stored, whether its on a storage device that uses a file system or if
its on a prom that doesn't have a file system whatsoever.

The next requirements relate to looking at election information,
specifically election information that changes over time. Basically the
number of ballots cast, the totals for a given contest. This is where
there was a generalization done where it was very specific in previous
guidelines that talked in terms of registers and variables which are
very specific to technologies. Usually registers are associated with
hardware devices and variables are associated with software type
devices.

This really just says, election information wherever its stored,
whatever type of technology that's used to store it, you need to be able
to query it and find out what those are. This is where the zero total
inspections could be done.

There are other properties that the guidelines have that should be able
to be inspected. The backup power supply level, is it fully charged, is
it halfway charged, cabling connectivity indicator.

Is my cord plugged into the wall? There should be some kind of external
indicator like a little LED like probably on most of your power
supplies. Communications and operational status and on/off indicators
for communication devices inside of the voting device.

The consumables remaining indicator. How much ink do I have left? How
much paper do I have left? How much, just other consumable of the
system. Yes.

FEMALE SPEAKER 21: Issues that we experience and I don't know if wasn't
thought about in the first set of standards (undecipherable). They were
too short, meaning we had a difficult time setting up equipment in
certain places at our polling places, but maybe that should be an issue
that you would address for some of the equipment that needed to be
plugged in. It has really caused a lot of (undecipherable).

\[NELSON HASTINGS:\] Like minimum length?

FEMALE SPEAKER 21: (Undecipherable) things like that.

\[NELSON HASTINGS:\] I don't think we've looked at that. Just to probe
this a little bit more. Are you looking at like some minimum length of
cords that are supplied with the equipment, like a 25 foot cord, or a 10
foot cord, kind of thing?

FEMALE SPEAKER 21: Yes.

\[NELSON HASTINGS:\] Okay. I don't believe that's in the requirements
but --

FEMALE SPEAKER 21: We were looking for extension cords and then we had
issues with the equipment. They said its because you used an extension
cord.

\[NELSON HASTINGS:\] Ah, that's --

WENDY NOREN: The power strips you used (undecipherable). In a lot of
these places you don't have the luxury --

\[NELSON HASTINGS:\] Interesting, interesting. Can we make a note of
that?

FEMALE SPEAKER 22: I already made a note of it.

\[NELSON HASTINGS:\] Okay, because that's something we --

Finally, some items that need to be calibrated such as catch screens and
things like that you should be able to determine a calibration of those
things and be able to adjust those back into calibration.

The user documentation requirements require that the manufacturers
supply a model setup inspection process that includes minimally the
items that have been mentioned, software inspection, verification,
register totals information, storage location totals, that kind of
thing. They are also to provide a model inspection checklist of other
properties that they may deem that they want you to be able to inspect
on the system. That's kind of an open ended requirement that if they do
provide other properties to be inspected on that system outside of the
ones that are enumerated in the guidelines, they need to provide you
documentation of that. Also, in that documentation the manufacturers are
to provide the risks related to not performing a given inspection.

So, what are your risks if you don't check the integrity of the
software? So you guys can make a decision on whether you want to use the
process that they have modeled out or put something in place so that you
know what the risks are that need to be mitigated by any procedures that
you create.

Software installation requirements. These requirements relate to
installing software on voting devices. It also covers access and
modification to configuration files. It uses digital signatures to
provide the ability to authenticate and verify the integrity of the
software. It specifically calls for looking at using signatures
generated by NSRL or designated repositories that the EAC may see fit to
designate.

SHELLY GROWDEN: Shelly from Alaska. Just a point of clarification, maybe
in terminology. The first bullet talks about the installation of the
software on voting devices which, unless I missed something, what about
the voting system versus the voting device? You have your software that
runs your whole system and in that system you have the individual
devices. So, I keep hearing you entertain the terminology voting system,
voting device. So, does this apply to any part of your voting system?

\[NELSON HASTINGS:\] Yes.

SHELLY GROWDEN: \-- but your main programming --

\[NELSON HASTINGS:\] Right and actually I believe the "Applies to" field
calls that this is to be applied to programmed devices. So, any device
in the voting system that is programmed or that uses software.

SHELLY GROWDEN: Maybe if that had been (undecipherable) saying voting
devices.

\[NELSON HASTINGS:\] The software installation shall only be done in the
pre-voting state. I got a comment on this that pre-voting state if very
specific to a vote capture device. In the model part of the VVSG they
talk about a vote capture device having these states: pre-voting state;
active state; suspended state; post-voting state. That was put in there
to support early voting.

It was brought to our attention that that was very specific to a vote
capture device but what about, say scanners or tally devices that don't
actually capture votes but use a scanner and we are looking into that to
maybe expanding that state requirement for tabulators that are used
during early voting type situations.

Only individuals with administrator or central election official roles
can install software and central election officials roles are limited to
election specific software. The administrator and central election
official roles, those roles are defined in the access control. I'll talk
a little bit more about that when we get there and we'd like your
feedback on those roles if those roles are appropriate. So, I'll talk
about that when we get to access control.

Lets see. Digital signature verification of the software has to be done
before the software is installed. An external, visible alert if software
installation fails, that installation function fails, there needs to be
an alert. Software should only be able to be installed using the
procedures, the documented procedures. So, if there is another way to
install software on the system, that the vendor has some secret work
around to do that, they better document that.

Software installation generates system event log entry. Again, time and
date, software, the version of the software that's installed, the
location of the software, where its installed, the result of the digital
signature verification and whose signature was verified is also part of
that? Go ahead Wendy.

WENDY NOREN: When you are talking about software, does this apply to
initial installation or upgrades, or would this be the load of the
election specific data?

\[NELSON HASTINGS:\] This is for everything. This is from the ground up.

WENDY NOREN: So, there would need to be (undecipherable) the software
reference library. How often would that be done?

\[NELSON HASTINGS:\] Where it says the digital signature verification
before installation. That would be before the software, that's where
that would be done.

WENDY NOREN: So, each election it would be done?

\[NELSON HASTINGS:\] For the pieces of software that you are putting on.
So, let's say you have a baseline system and you only change the
configuration files. You probably would just install the configuration
files over the old ones and you could do the digital signature
verifications.

WENDY NOREN: Again, this is involving the area the election officials
(undecipherable) that we are doing these standards, correct or is this
just what has to go into the manual (undecipherable).

\[NELSON HASTINGS:\] These requirements would be and the way this
specific requirement is stated in the document I believe says something
to the effect that software installation programs have to check the
digital signature of software before it is installed on the system. It's
the application that you are using to install that software that's going
to check the digital signature.

MALE SPEAKER 27: Wendy (undecipherable) definition files?

WENDY NOREN: Yeah, I mean, that's why I asked. When I (undecipherable)
the ballots for a specific election, does that generate another incident
that requires verification?

\[NELSON HASTINGS:\] I'm going to have to take a break because we are
running low on the DVD. I'm sorry. We will pick this up when we get
back. Thanks.

MALE SPEAKER 28: Hector would like to take a picture of the group out
front during the break.

\[NELSON HASTINGS:\] John Wack has asked to have a minute of time here
before we start this back up. Go ahead.

JOHN WACK: I just wanted a minute or two mainly to address a couple of
questions. I'm going to end up being one of the primary authors of this
companion guide. One of the tragedies, I guess, in my mind, is that we
were so busy and I mean literally so busy at NIST working on this that
it would have been nice to have been able to have this companion
document out now because sometimes it gets lost, you know, what are you
actually getting out of all these requirements? What is the encryption
really buying you?

There was a question about, I can't remember who asked it, Keith, where
he said, with all this encryption you mean we still have to have VVPAT?
Maybe I said that wrong, but I just wanted to make it clear that the
encryption doesn't buy you anything at all in terms of accuracy of what
the DRE records. VVPAT is really designed to essentially ensure that you
have some recourse in case the DRE doesn't record your vote correctly,
you know, that you can look at the paper.

Encryption won't do a thing for you there. Encryption will do things
like help you make sure that the software you are running on the voting
system is indeed the software that's been certified, or it will help you
to ensure that the electronic records you have down the road did indeed
come from that voting system and they have not been changed like, you
know, the memory cards that are collected at the end of the day, if they
are all digitally signed you know, hey, it hasn't been changed. You may
not have to have a Democrat and a Republican both walking into the
office, but that won't do anything as regards giving you an independent
audit capability of the electronic record itself.

I just wanted to make that clear. I'm not arguing for VVPAT but they are
two different things.

FEMALE SPEAKER 23: My question is this. Cryptography tells me that
nobody's been adding or subtracting things from the software
(undecipherable) it will add (undecipherable). What's the missing part
there? Nobody's compromising the voting system (undecipherable) to work
properly. What am I missing here?

JOHN WACK: Well, VVPAT and again, I'm not arguing for it and I really
should not say VVPAT but software independence, IVVR in this particular
case. IVVR in some ways addresses the issue of the difficulty of
exhaustively testing software for errors. If the software does have
errors then, you know, the IVVR gives you some recourse in terms of
auditing and independent audit. So, that's exactly.

MALE SPEAKER 29: Just because its been tested it does not show that it
works correctly because its been tested. It shows that we haven't found
it to work incorrectly. It may be a subtle difference but its really a
huge difference. We could test forever and you still probably going to
find errors somewhere down the line. That happens to be true of all
software. That's where we are.

JOHN WACK: The only other thing I wanted to mentioned very quickly is
that again, getting back to the usability of VVPAT, its unfortunate that
a number of the systems out there cause so many problems, you know, with
usability of the paper records and so on and so forth. The requirements
that we worked on really did hammer on those issues and we tried hard to
address a number of those usability issues. I hope that you are looking
at them and you can, in fact, I think -- . That was it. Thank you.

\[NELSON HASTINGS:\] The first thing I guess, is it was pointed out that
I have a misconstruction of my sentence here. The last bullet should say
software only to be installed using documented procedures. We'll fix
that.

Picking up with Wendy's question about configuration files and digital
signatures associated with those, I believe the guidelines currently do
say that those files need to have digital signatures with them.

The question is how to enable election officials to generate those
digital signatures. It may be there is a need for a requirement that
says software use to create configuration files for a given election
must generate a digital signature for those configuration files. That's
something that, this is just kind of over the break kind of thinking
about the question that Wendy asked.

Back to what gets logged as a result of software installation, name,
version, location, digital signature. As part of the technical data
package vendors, manufacturers need to supply the list of all software
to be put on the voting system including name and version, type of
software, any associated software documentation that's available with
it, contact information for the manufacturer of that software including
system voting device and the functionality provided by the software and
dependencies and interactions between the different pieces of software
on that voting device.

As far as user documentation, again, a list of all software to be
installed on the voting system including software files or configuration
files specific to elections and the hardware and software required to
install the software. In addition the manufacturer needs to provide
procedures to perform software installation and as a result of those
procedures, no compiler should be installed on the voting system. It
should talk about how COTS can be procured through other mechanisms on
the open market, not just through the voting system vendor itself. How
to create a baseline binary image in order to do replication across the
voting systems.

Preparation of erasable media. How software on unalterable media such as
CD's is used to do software installation and the types of information
that should be recorded as a result of the software installation
process.

The next set of requirements relates to access control and, like I said,
these really relate to the management of three basic elements: the
management of identification; authentication; and, authorization on the
voting system.

Access control supports the ability to have users be accountable for
their actions as well as to allow for limitations on uses of resources.
These access controls apply not only to individuals but to applications
and processes on the system. On this computer there are probably, this
is not a single process computer. There are probably at least twenty
applications going on at the same time. That's why we talk about
applications and processes. You want to control their ability to do
certain things.

Management of identification information. You want to be able to create
and disable identities or roles that are created. The guidelines require
that after a certain number of failed attempts which is a configurable
number, a lock out for that account would occur. In addition, there is a
requirement for the length of lock out. It could be indefinite. It could
be a lock out for ten minutes. Those are two configurable aspects of
locking out given identities or roles.

Role identification is required for voting devices as well as election
management systems. The roles specified in the access control section
include the voter, election judge, poll worker, central election
official and administrator. When we talk about administrator here, we
are talking about an administrator of the voting device, kind of like a
root. The administrator of the device and not administrator in terms of
administering of an election type situation. Role identification is
required by a voting device in election management systems and
individual identification, identifying that Nelson Hastings is on this
system is required by election management systems.

Notice. One is for voting devices and election management systems and
one is only for election management systems. The reason roles apply to
both systems is, well, I guess I should say, the reason identity,
individual identification only applies to election management systems is
acknowledgment that some voting devices may not have the capability to
support identity based authentication.

Authentication information management, setting and changing
authentication information, protecting the authentication data by the
system, and password management. Password management includes reuses of
passwords, the expiration of passwords after a given amount of time and
the strength of the passwords, you know, you don't want to use a
dictionary word or that kind of thing.

Authentication requirements by roles. This part of the guidelines talks
about the minimum required authentication that's required for a specific
role. Voters are actually handled in section 7.5.1 where the issuance of
voting credential and ballot activation. John talked about that
previously.

Poll workers. There is no minimum in the guidelines at this point.
Basically we couldn't figure out what type of action that the poll
worker would be doing to the voting system that would require them to be
logged onto the system.

Election judge and central election officials do authentication by
something you know such as a user name or password. Administrators need
to do multi factor authentication. An example I gave was smart card and
biometric. It could be smart card and pin number or pass phrase as well.

Applications or processes need to use cryptographic techniques because
they are in the digital world in its form of digital signatures.

Authorization management. You can limit authorization based on the
voting state, like in pre-voting, the time interval or a specific time
action can take place. The requirements also require support for being
able to have two person control, require two people to authenticate
before a given action is done.

Being able to separate duties. You don't want to have only one role that
does everything on that voting system.

Limitation of resources based on function and type of data. To
explicitly indicate that a person or process is allowed or disallowed to
do an action or access a given piece of data.

The technical data package requirements are a basic description and
specifications of the access control mechanisms used by the voting
device, descriptions and specifications of what voting system mechanisms
rely on those access controls.

The first one is what kind of access control mechanism am I using? Am I
using user name and password? Am I using smart cards?

The next requirement basically says, so, given that I'm using these
types of access control mechanisms, where are those applied to perform
voting functions?

Mapping of voting system operations to default roles with the
permissions to perform those. There should be some default, a way to set
it up, its not everybody automatically gets all access to everything
just because their account is created or their identity is created on
the system.

The user documentation for access control includes instructions for
implementing, configuring and managing the access control mechanisms
that are supported by the voting device.

Model access control policies. The manufacturer should supply how he
envisions his voting system access controls to be used on the system and
templates or instructions for how to customize the access control
policies on that system and disclosure of all default privileged roles.

System integrity management. Basically it is a catchall for other
security requirements that didn't fit in the other parts of the
guidelines. It talks to protection of the boot load and execute process,
removable media interface protection, back up and recovery capabilities
and protection from malicious software.

The boot process protection. This process is when a system is powered
on. The first components of the system needs to be loaded into memory so
that they system can execute. The integrity of the software
initialization components need to be verified using the digital
signatures associated with those pieces of software. Again, cryptography
comes in.

The load and execute process is the process of loading software into
memory before its being executed. Again, the verification of the
software needs to be checked before its loaded into memory using
cryptography and digital signatures.

Removal of media protection. The requirements here are other than the
physical security mechanisms that are talked about, I think, in 5.8,
section 5.8. The ability to disable, remove the interfaces where
removable media is inserted and removed from the voting system. An
example that's given here is you may only need to use a CD interface to
be enabled when software is being installed on the system but during the
election you are not using that CD drive so you need to be able to
disable that so somebody just can't walk in and drop a CD into that.

Back up and recover mechanisms are limited to election management
systems. Its permitted only when capturing votes which is really not the
right term here because election management systems actually just
aggravates votes at that point. So, we need to go back and look at that.

The integrity verification information needs to be created when a back
up, when information is backed up so that you can make sure that the
information hasn't been modified. Before you can restore that
information you need to verify the authentication and integrity of that
information before you reinstalled that or recover that information.

Malicious software protection. Again this is limited to election
management systems. Used to detect malicious software and there is a
requirement that you need to be able to update that software so that it
is aware of new threats as they appear over time. The idea here is like
if you run a virus scanner on your system you are told to go out once a
week, every two weeks, every month, to go out and download the new data
files from your software, your virus scanner vendor so that you are up
to date as new --

WENDY NOREN: If you have a system that's never connected to the internet
than you would never -- you don't want to be going out (undecipherable).

\[NELSON HASTINGS:\] The requirement says it has to have the capability
to update it. It doesn't say that you have to, that you do it by
connecting it to the internet, it just says, the idea here is that you
can download the data files, put the CD into your system and copy those
files over.

SHELLY GROWDEN: Shelly from Alaska. If you have the ability to update
that protection software that's loaded on your EMM, wouldn't that
modification to your certified EMS software, because its an update,
would that have to go through re-certification?

\[NELSON HASTINGS:\] That the data files -- that's a good question. So,
you are asking if the data files --

SHELLY GROWDEN: You are saying here that I have to be able to update
that software that is on my system.

\[NELSON HASTINGS:\] Right.

SHELLY GROWDEN: So, I'm modifying my system, I'm modifying my system
that received certification. That's why I was looking back at
(undecipherable) wondering if the VVSG is requiring this, are going to
have to re-certify that?

MALE SPEAKER 30: Well, I don't know right now but it is, anything that
you download, any time you change and that change to your system ---

BRIT WILLIAMS: The answer is maybe.

\[NELSON HASTINGS:\] Okay. So this \--. We'll think about that because
\--. So this software protection needs to be executed once every
twenty-four hours and before loading and executing of software on the
voting system.

Is this the bullet where you are saying that this is --

WENDY NOREN: I'm saying (undecipherable) every twenty-four hours,
(undecipherable)

\[NELSON HASTINGS:\] When I'm talking here, this is automated process.
You can configure your virus software to check software before its
loaded into memory to be executed. That's what that second part of that
and you can configure your software, your virus protection software to
look at three in the morning \--. Yes, that's where that's coming from.
It needs to be executed against removable media. Again the technical
data package requirements are a list of all software to be executed.

The next set of requirements relate to communications protection
security. Its really about the protection of information that's being
transmitted

**(END OF AUDIOTAPE 4, SIDE A)**

\* \* \* \* \*

**(START OF AUDIOTAPE 4, SIDE B)**

\[NELSON HASTINGS:\] **- - -** 2005 was the use of no wireless
technology except for infrared technology when the path of that infrared
signal is protected.

There are two exceptions to this requirement. Its for devices used to
transmit end of day results and e-poll books when they communicate to
voter registration data bases. When those types of devices are used,
they cannot be connected to other polling place devices.

What I did to make this a little clearer is we drew a little picture of
a polling place and remote locations that one might want to communicate
with. We have some voting devices in a polling place and maybe
electronic poll book as well.

The voting devices can be connected together and maybe there is a remote
registration data base that one would want, the poll book may want to
connect to. If the e-poll book connects to the voting devices it cannot
connect to the registration data bases.

However, if its not connected to the voting devices in the polling place
that electronic poll book can go out and connect to the registration
data base. This type of buffer is called the AIR-GAP and that's the
requirements that talk about AIR-GAPS between these different devices.

At the end of the day you might want to select one of the voting devices
and turn it into an accumulator to upload end of the day results. While
its connected to the other devices in the polling place, it cannot
connect out to the central count. What you have to do is disconnect the
accumulator from the polling place devices and if it hasn't already
accumulated the results through the network, you bring those memory
cards or whatever that have those totals on it, put them on the
accumulator and then it goes out.

GARY POSER: Gary Poser from Minnesota. Are you saying (undecipherable)
optical scan, you use the accumulator and its not connected to anything
else until it scans connected to the central (undecipherable)?

\[NELSON HASTINGS:\] Say it one more time and then I'll --

GARY POSER: Optical scan. So, it is the accumulator itself. Its not
connected to anything else in the polling place. Are you saying that
(undecipherable) an optical scan unit can transmit to the central
(undecipherable)?

\[NELSON HASTINGS:\] At the end of the day, yes. The question is, if you
have a precinct count optical scan, that's not connected to any other
devices in the polling place because it's a precinct count optical scan,
that based on the discussion we've had here, because its an accumulator,
can it go and connect out and upload end of the day. The way the
guidelines are written right now, that would be acceptable. I've got two
guys who have been quiet most of the day --

GARY POSER: Well, I'm just (undecipherable).

MALE SPEAKER 30: I have a question on --

\[NELSON HASTINGS:\] The one before this one?

MALE SPEAKER 30: Your pictures of what it can connect to. What it
basically saying here is if your electronic poll book connects to the
voting devices, it cannot connect to the central data base.

\[NELSON HASTINGS:\] Right.

MALE SPEAKER 30: On election day.

\[NELSON HASTINGS:\] Right, on election day.

MALE SPEAKER 30: How do you propose to run (undecipherable) (CANNOT
UNDERSTAND WHAT IS BEING SAID) whether or not someone shows...

\[NELSON HASTINGS:\] State your question one more time so I'm clear.

MALE SPEAKER 30: An electronic poll book is not only to know who the
voters are, but is to tell you whether or not voters have voted in other
locations. In order to do that the electronic poll book of necessity
will have to connect to the voting devices also to record whether or not
that person (a) was eligible, (b) voted, and now (c) is registered on
the central data base. So, if you can't do that, you've eliminated a
security feature that election officials need.

\[NELSON HASTINGS:\] But you have also introduced, if the electronic
poll book is connected both to the voting devices at the same time that
its connected to the internet or has been connected to the internet,
that introduces a vulnerability.

You can do one or the other. You can do one or the other. You can use an
electronic poll book to connect to the central data base.

MALE SPEAKER 30: (Undecipherable) once.

\[NELSON HASTINGS:\] Absolutely.

MALE SPEAKER 31: We don't want it to happen all at once.

MALE SPEAKER 30: What it has done is it has prohibited you all in one
sentence.

MALE SPEAKER 32: You said on election day. This does not apply during
early voting? Election day is a capitalized noun.

\[NELSON HASTINGS:\] The way the guidelines are written as of right now,
it is specific on election day --

MALE SPEAKER 33: My point is, what Doug said is true at least the way we
do it now. We discussed this with the card activators. A card activator
by your definition, I think, is a voting device. If its not a voting
device, I don't care, but we use what you would call a poll book to
activate the card and to simultaneously record in a data base,
centralized data base that that voter has voted and that is a much more
accurate way to do it because it takes out the human typing in that
ballot code.

I just want to be sure that, and I think there is other preventions that
could be put in to be sure that a card gets stuck into a machine to
activate it is, I mean is not going to corrupt the machine.

\[NELSON HASTINGS:\] How do --

WENDY NOREN: (Undecipherable) You don't have both of them connected.

BRIT WILLIAMS: It's a two step process.

\[NELSON HASTINGS:\] Matt.

MATT MASTERSON: Maybe I'm confused by exactly what the requirement says
but I'm looking at 561-b2. It says "electronic devices that connect to
voter registration data bases outside a polling place on election day
shall never be connected to other polling place electronic devices." Is
that what you are describing here because "shall never" does not apply
one and then, you know, both at the same time.

\[NELSON HASTINGS:\] I think the way the requirement is written -- the
way the requirement is written is, I think it was the intent of the STS
subcommittee. So, if you ever connect out to the remote registration
data base during the day, you should not ever be able to connect back
into the voting devices.

RUSS RAGSDALE: Russ Ragsdale from Colorado. Is the issue here whether,
are we defining the voting device to include the ballot activation
encoder? I know it's the wrong terminology. I think what the issue is
here, is like in Larry's situation, he's using the encoder directly
connected to his voter registration data base to encode the ballot
activator, the voter card to then be carried to the voting device, the
VRE. Is that that AIR-GAP that's necessary or is it the actual encoder
that cannot be connected to the --

\[NELSON HASTINGS:\] I'm going to look at John Wack here because this is
somewhat related to --

JOHN WACK: Well, I've been trying to follow things and I'm not sure I
followed them correctly but I think in general the philosophy here is
that, as Doug was saying earlier, or Barbara, one or the other. So, you
know, whether it be \--. Larry you were talking about a handheld encoder
or you are talking about a --

LARRY LOMAX: I'm talking about a laptop that's connected to our
centralized voter data base that when a voter comes in we pull up his
signature to verify him and then (undecipherable) that transmits back to
the voter data base that this voter has voted at this place and this
time and simultaneously transmits a signal to the card activator saying
pull up this ballot.

JOHN WACK: So, restating for the record. Larry's layout, he's basically
got an encoder connected up to an external data base. So according to
the requirements, while he is connected up to the external data base, he
cannot also be connected up to his VVPATs if the VVPATs, well, yeah, he
can't --

LARRY LOMAX: Its not the VVPAT. This is a card activator that activates
the card that the voter then carries over to the --

JOHN WACK: Right. Right and basically I understand. I guess basically
the card encoder itself. This is really aimed at card encoders that,
well actually activation devices that are not card encoders, that may
send some sort of a signal to a network work set of DREs and in that way
activate the ballot.

Its really not aimed at all really to in any way prohibit kind of a
stand alone, you know, ballot activation device connected up at the same
time to a voter registration data base.

\[NELSON HASTINGS:\] Paul wanted to say something I think.

PAUL MILLER: If we are agreed we've got it, I don't have any comments on
it.

\[NELSON HASTINGS:\] I see Jim.

JIM DICKSON: Is election day, does that include early voting?

\[NELSON HASTINGS:\] I think that's the discussion, some of the
discussion that we are having right now.

MALE SPEAKER 33: I think (undecipherable) for early voting. You
interpret it as election day results (undecipherable).

\[NELSON HASTINGS:\] I think the focus when that requirement was being
written was specifically for election day and if we get comments back
that say need to take a look at that in terms of early voting we
definitely can do that.

DAN ENGLISH: Dan English from Idaho. A couple of years ago we had an
election (undecipherable) that involved early absentee voting. As a
result of that (undecipherable) but specifically says that when a voter
comes in and does early voting that is their election day. So, let's be
real clear that election day is not the second Tuesday of November for
everybody. Whenever they vote (undecipherable).

MALE SPEAKER 34: There's one problem with that. When lawsuits are filed
that the election violated the law for elections because election day is
a pre-set date. If you are considering election day by state law, its
not correct and official.

\[NELSON HASTINGS:\] Okay. This is for the record. A discussion of what
is election day. Paul, I'll get you next, okay.

MALE SPEAKER 35: Well, first of all I'm not qualified to talk
(undecipherable) election day but in terms of what I understand the
requirement to be and this issue was discussed in the TGDC, is that the
encoder is not, would not be defined as one of those voting devices and
therefore there is an AIR-GAP because you are producing a card that you
then take out of your electronic poll book and you take it over to your
voting device and you have your AIR-GAP there.

The question that you are trying to deal with is if there is a wire
connection between the poll book and the voting device then the poll
book cannot be connected to the voter registration data base and if
there is, or some connectivity between the poll book and the central
computer, it cannot be wirelessly connected to the voting device,
wirelessly or any other way. You can use activation cards, carried from
one location to the other location and that is the AIR-GAP that is
provided.

\[NELSON HASTINGS:\] We'll go you first and then --

MALE SPEAKER 35: You cannot transfer a corruption code via that card?

MALE SPEAKER 36: If you've got an AIR-GAP in there the file comes from
the server back to the encoder, corrupts the card, then you put the card
in the voting device --

JOHN WACK: May I, \--. The question was couldn't you still transmit
something via the memory card let's say or smart card from the
activation device to one of the DREs?

The answer is you could. So, yesterday when I was going over some of
those requirements number one there was a should requirement that
basically said the amount of memory on the card itself ought to be just
what you need and no more so you can reduce that threat.

The other thing was that the DRE or the vote capture device, I'm trying
to remember by acronyms, vote capture device also has to check the
integrity of the information. So, it has to look at the integrity of the
information on the card and check that it came from an authorized ballot
activation device.

Those things, again, its an example of defense in depth and they don't
complete mitigate that threat but they would go a long way towards it.

\[NELSON HASTINGS:\] Matt? You're good. Larry again.

LARRY LOMAX: One minor comment. You might want to rewrite the definition
of voting device because the definition of the voting device in your
appendix says to include systems such as smart cards which I assume is
what we are talking about.

\[NELSON HASTINGS:\] Okay. Thanks Larry. Larry's comment was that we
should revisit our definition of voting device and maybe rewrite it.

So we went through this. The next requirement to deal with network
interface protection. The ability again to disable network interfaces
when they are not required for use so that somebody just can't plug in a
device, a network device.

The other thing is to prohibit traffic flow from one network interface
to another network interface on devices that have multiple interfaces.
You don't want to have that to be a route to contaminate one network
from the other.

The other requirement is that the network interfaces need to have
physical identifier, unique physical identifiers for each interface.

Other requirements limit the communications to only devices that need
communication between each other. In addition information that's
transmitted over these network communications need to have integrity
information to make sure that the data sent hasn't been corrupted.

In addition to that there needs to be mutual authentication between the
devices that are communicating over the network. Its part of the
connection establishment process. It uses unique identifiers for the
devices so you can tell what device I'm talking to and limit the amount
of information needed to do authentication so you are not leaking
information.

Limit devices to only required network ports, active share such as
network hard drives and services. You want to disable all those, be able
to disable all those unnecessary processes that use a network.

There is a requirement to monitor network interfaces for evidence of
attack. If an attack via the interface is detected to take some action
to defend against that such as shutting down that network interface.

Documentation requirements list all network communications required by
the process and application and list of all required network port share
services that are used by the voting system.

We are getting close. We have 5.7 and 5.8 to go. This next section is
system event logging requirements. It provides accountability and
supports the ability to reconstruct events and detect intrusions.

This is an electronic audit trail and its really about information to be
generated, how to protect that information after its been generated and
the management of system event logs as the logs get bigger and
accumulate information.

Log information must maintain voter privacy and ballot secrecy. No cast
ballot records are recorded in the system event log. It might say a
ballot was cast at x time but the actual cast ballot record is not part
of the system event log.

Basic log entry information. The system identifier, event identifier, a
time stamp, the result of the event and when applicable, the user that
triggered that event to occur.

Time stamp. The first requirement deals with the accuracy of the clock
and drift related to that. So, one minute within fifteen hour period.
The format of the time stamp to be based on ISO8601, representations of
time. The date would be day, month, year with a four year digit, four
digit year, four year digit number. Its getting late.

Time is in hours, minutes, seconds as well as an indication of a time
zone. The administrator role is required to do any adjustments on the
clock. Wendy.

WENDY NOREN: (Undecipherable) things like daylight savings time, central
time (undecipherable) different zones.

MALE SPEAKER 37: The question is about daylight savings time and the
requirement for that.

\[NELSON HASTINGS:\] I'm going to defer since Dave Flater has --

DAVE FLATER: So, 8601 specifies that the time zone is specified as an
offset from universal coordinated time. You know the number of hours
different so its not a question of, you are not going to say Eastern
Daylight Time or Eastern Savings Time, you are going to say its an
offset of -4 hours. Its not ambiguous.

\[NELSON HASTINGS:\] Go ahead.

MALE SPEAKER 38: So --

\[NELSON HASTINGS:\] Say again?

MALE SPEAKER 38: Here's a scenario. I just burned part of the testing
machines last week and between now and election time, daylight savings
time is going to come in. The machines will not adjust for it.

\[NELSON HASTINGS:\] Right. What Dave --

MALE SPEAKER 38: So, we need to go back in and change those cards and
actually reburn them and theoretically then they should be retested.

\[NELSON HASTINGS:\] I think what David said is that time in this
standard is based on offset, from universal time. So, its +4 hours or
whatever, regardless of whether its daylight savings time or not, is
that correct David?

WENDY NOREN: But like you said, people will be running (undecipherable)
issues whether its daylight savings time clock between the time you
burned your election and the election comes up. Then you run into a new
problem. They've changed daylight savings time last spring and so if the
machines were set to automatically generate, you have to stop them from
automatically doing it, you know, if you have an April election. We've
got some issues there that you need to get some testing in as to what's
going on with time.

\[NELSON HASTINGS:\] Larry.

LARRY LOMAX: My question is the offset of -4, are we talking what we in
the military used to call Zulu time?

\[NELSON HASTINGS:\] I believe so. I believe that is correct.

MALE SPEAKER 39: What is Zulu time?

MALE SPEAKER 40: Greenwich Mean Time.

MALE SPEAKER 41: In other words it never changes. It doesn't matter if
its daylight savings --

MALE SPEAKER 42: Zero degree Meridian, always the same.

\[NELSON HASTINGS:\] Thanks Larry for that clarification. Okay, I think
we've figured that out a little bit.

The system event logging in that section has a big table that contains
all the events to be logged. If there is events that we've missed,
please provide feedback on it. They are broken out into, I think five
different categories.

General system functions such as starting up the device, shutting down
the device, adding files to the device, that kind of thing.

Access control. Events that occur, attempts to log in, attempts to log
out.

System software events. Installation of software, upgrades and patches,
attempts to connect to data bases, cryptographic events such as changing
cryptographic keys in the voting device and voting related events such
as opening and closing of polls, casting of a ballot and ballot
definition and modification to those configuration files.

The management of system events logs. There should be a way to have a
default setting of the system event log. The storage of that log
information needs to be in a publicly documented format such as XML.

Event logs. Events should be able to be distinguished based on elections
as well as based on the device itself, the different devices.

In some cases retention of event log data from previous elections. Some
locales require that the voting device contain all the event logs for
all the elections that have been processed on that system.

Export of the system event log information with a digital signature,
again, for integrity.

Management of log capacity requirements, requirements to alert as the
capacity of the log increases and reaches certain intervals and
suspension of vote capturing when log capacity is reached.

That didn't frighten too many people. Oh, except for Wendy.

WENDY NOREN: Okay. All this logging, logging is fine but it implies
somebody is going to review all the logs which falls back on us. There
needs to be some understanding. There's no staffing to do this in most
of these locations. We are building all of this information. Its just
out there. No election official has the resources, well, very few, have
the resources to do anything with these logs. Do you understand that?

\[NELSON HASTINGS:\] I feel for your.

WENDY NOREN: (Undecipherable) they don't even do the elections, the
vendor does the election.

\[NELSON HASTINGS:\] I'm going to defer to Barbara on this.

BARBARA GUTTMAN: So, audit trails. I'm going back to our slides from
computer security basic serve different purposes.

Audit trails are used for several different purposes. Some get reviewed
on a hourly basis if you want or some at the end of the election.
However, some of them are just used in case you have a problem in which
case, you know, a county might not have the expertise to handle it. They
might have to call on resources from or jurisdiction from the county or
from the state depending on sizes.

Some audit log data is only there in case you have a problem so you can
reconstruct event. Its not used, not all of it has to be used as part of
an on going review of logs. These audit logs address that not just
things an election official would be expected to check at the end of,
you know, at election close out.

MALE SPEAKER 43: It could be requested as public records.

BARBARA GUTTMAN: Its part of the public record so people can make sure
everything is working right.

\[NELSON HASTINGS:\] I'm going to go on from here. There is requirements
to have tools, that the vendor supply you tools to view and analyze and
search system event logs while the logs reside on a voting system, to
halt vote capturing when the system event log malfunctions or is
disabled and it requires the administrator role to do operations related
to configuring and clearing log entries.

The protection of log information. Unauthorized access, limiting access
to those logs, read only for administrator roles, writer append only for
process that generate event entries.

Unauthorized modification through the use of cryptography append only
media kinds of things.

Unauthorized deletion to prevent unauthorized deletion and integrity and
availability protection of archived log files.

Okay, we are down to physical security. Physical security. The goal of
this is really to ensure that sufficient controls are in place to
prevent undetected and unauthorized physical access. One must be able to
distinguish between authorized and unauthorized access.

In general, the requirements say that unauthorized access needs to leave
some type of physical evidence that the unauthorized access has
occurred. The requirements recognize the use of both procedural and
physical countermeasures but tries not to proscribe either.

Unauthorized physical access in general basically must, like I said,
leave some physical evidence that that occurred.

Physical ports on the system. Physical port and lease functionality
that's really about limiting the number of ports on the system to only
those that are needed to do the functions required by the voting system.
You don't want to have an extra USB port that's never used on the
system.

Voting device boundary protection. If a connection between different
components on the voting system is broken, the voting device must
automatically disable the port that has gotten disconnected and set off
an indication for that and create an event log as well as it can only be
re-enabled with appropriate authorization before it can be used again.

PEGGY NIGHSWONGER: I'm Peggy Nighswonger from Wyoming. On 5.8.3 and I'm
sorry you just scrolled down through there but is that where it says if
a physical connection between voting device components is broken during
activated or suspended state, the effected voting machine port shall be
automatically disabled. Should that say the device should be disabled
rather than the voting machine port or do I not understand this?

\[NELSON HASTINGS:\] Could you repeat the requirement number again?

PEGGY NIGHSWONGER: Okay, 5.8.3(a)

\[NELSON HASTINGS:\] 5.8.3-(a). The affecting voting machine port --

PEGGY NIGHSWONGER: \-- shall be automatically disabled. Should that be
the device should be disabled rather than the voting machine port?
What's the definition of a port?

\[NELSON HASTINGS:\] The port. So, if you have unplugged from a USB port
and that's during the time of activated or suspended state, that port
needs to be deactivated. Not the device itself but that port. Wendy.

WENDY NOREN: When there's a printer that's connected to a specific port,
it becomes disconnected, so if it disables the port but the person can
continue voting and it would not continue to create a paper trail.

\[NELSON HASTINGS:\] I guess that's, looking at the requirement that
seems to be --

WENDY NOREN: If that (undecipherable) the initial ballot then we've got
problems.

\[NELSON HASTINGS:\] It needs to be the device itself that goes down.
Okay. I'm not \--.

Let's see. The next requirements relate to information flow and access
to ports with removable media needs to be restricted, maybe have a panel
over it that could have a tamper evidence tape. Door covers and panels,
again, must be designed so that access to that can be monitored, either
through the use of some automated mechanism or some physical tamper
evidence type of mechanism.

Secure ballot box. Ballot boxes must be tamper evident.

The next requirements are for actually relate to the keys used by voting
systems. There is a lot of debate on the physical keys. So, we are
talking about physical keys here, not cryptographic keys.

Physical keys that are used as a security mechanism need to meet UL
standards and be tamper evidence. In addition, to that they must be able
to be keyed based on the owner's preference. So, a vendor can't just buy
a box of one type of lock that can't be re-keyed for anything and
everybody in the nation has that.

That's only for keys or locks that are used as a security mechanism. If
a lock isn't used for a security mechanism, these requirements do not
apply. However, the next requirement basically says that if a lock is
not used as a security mechanism, if that lock gets bypassed, it should
not result in a breach of the security of the system.

PEGGY NIGHSWONGER: I can talk off line with you about this if I need to
but -- . Peg Nighswonger, Wyoming.

In 5.8.7-b I think this is all nice but, what physical evidence can
distinguish something being, like something maybe just got scrapped
along a port or a lock, you know, how do you distinguish between that
and unauthorized attempts. I'm not sure if I understand.

\[NELSON HASTINGS:\] I think you would have to look at, how do you say
this? The evidence that's left behind from the physical, actually, I've
got to think about that a little bit because that question has come up
in the last few days about how do I know that this isn't just something
that bumped up against it. So we will look. That's something that, add
that to your list of questions.

PEGGY NIGHSWONGER: I will.

\[NELSON HASTINGS:\] Then the final requirement in the physical security
is that if power fails the physical countermeasures should not fail
itself, or if it fails it should fail in the safe mode. Essentially its
just saying, physical security mechanism shouldn't depend on electricity
being supplied to them.

Now, that's the last slide I have for today or for this presentation.
The question is should we dismiss for the day? Okay. I could go ahead. I
still have a half hour or so but --

John, I'm going to step away from the mike and let John --

JOHN WACK: I'll be very quick. Its just a request that, as I see you all
I'm interested in your opinions as to the usability of the printed
document. So, if you could think a little bit about how easy is it to
find information and things of that sort. I'm very interested in that.

The other things I should mention probably are to make sure you take you
badges and same sort of thing, take your laptops. On quick question back
there.

MALE SPEAKER 44: (Undecipherable) about an ad hoc committee
(undecipherable) I know that my group has looked at several types of
what we thought (undecipherable). It would be helpful to have them
addressed in the plain language. Can we just give you a list of those
(undecipherable)

JOHN WACK: Sure, we could do that. I'm interested in that but also the
usability specifically of the document itself as well as the plain
language things you are talking about too. So, yeah, that would be fine.
Okay. Thank you.

**(END OF AUDIOTAPE 4, SIDE B)**

\* \* \* \* \*

[CERTIFICATE OF AGENCY]{.underline}

I, Carol J. Schwartz, President of Carol J. Thomas Stenotype Reporting
Services, Inc., do hereby certify we were authorized to transcribe the
submitted cassette tapes, and that thereafter these proceedings were
transcribed under our supervision, and I further certify that the
forgoing transcription contains a full, true and correct transcription
of the cassettes furnished, to the best of our ability.

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

CAROL J. SCHWARTZ

PRESIDENT

ON THIS DATE OF:

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_