Rev. 2005-03-01

[THE RECOMMENDATIONS IN THIS DOCUMENT ARE ALL TENTATIVE, PRE-DECISIONAL
DRAFTS THAT DO NOT REPRESENT THE CONSENSUS OF NIST OR OF THE
SUBCOMMITTEE.]{.mark}

# Changelog

2005-03-01: Noted issue on reporting levels. Replaced "claim of
conformance" with "implementation statement." Cleaned out
non-value-added commentary about testability. Revised value-added
commentary and turned into Word comments. Added IEEE disclaimer.
Expanded a few compliance points that needed sub-points.

2005-02-23: Re-synced with Process Model rev. 20050223. Cleaned up
formatting slightly. Moved testing requirements into CRT Testing Pieces.
Added references to logic model to make accuracy well-defined.

2005-02-15: Moved To-Do list to the top. Numbered compliance points and
requirements as FR4.x.y.z (per JC's proposal). Added general
requirements. Made note to move error rate during testing language to
testing document. Created section for requirements punted to S&T.
Improved some requirements and testing hints.

2005-02-14: Reorganized according to process model. Added missing
compliance points from I.3.2.1 (accuracy requirements). Multiplied the
voting variations compliance points for A1.1.1/A1.1.6 and A1.4. Made
minor changes to other compliance points, added missing references.

**TO DO:**

> Clarify reporting levels.
>
> General review of old requirements w.r.t. new organization needs to be
> done. Requirements that aren't here but possibly should be: L&A
> testing. Requirements that are here but perhaps belong elsewhere:
> everything to do with election management.
>
> Define and use roles (e.g., designated election officials).
>
> For each compliance point of the form "the system shall support X," we
> should elaborate by specifying detailed requirements for what it means
> to support X, to enable a tester to determine more objectively whether
> X is supported. *Cannot complete by April.*

**Draft Requirements for Organizing Principle #4: The voting process
shall accurately accumulate, count and report legitimate votes**

The following requirements have been extracted from the 2002 VSS and (in
one case) IEEE DRAFT P1583/D5.3.2b, 2005-01-04.

Most requirements have been refactored from the structured text of the
2002 VSS to make them self-contained compliance points. Some have
undergone additional rewording to improve their precision and clarify
them. This work is still ongoing.

The compliance points are organized according to the process model rev.
2005-02-23.

General requirements

1.  All systems shall support all voting variations indicated in the
    Implementation Statement. {Extrapolated from VSS I.2.2.8.2}

2.  All systems shall achieve an error rate of no more than one in
    10,000,000 ballot positions. {Extrapolated from VSS I.3.2.1}

3.  All systems shall be capable of generating the required reports.
    {Generalized from many VSS requirements}

4.  All systems shall be auditable by election officials. {Generalized
    from many VSS requirements}

5.  All systems shall maintain the integrity of voting and audit data,
    including Cast Vote Records, during an election and for a period of
    at least 22 months afterward. {Reworded from VSS I.2.11}

A1.1 Prepare for election

There are significant variations among the election laws of the 50
states with respect to permissible ballot contents, voting options, and
the associated ballot counting logic. {VSS 2.2.8.2}

1.  The Election Management System shall support all voting variations
    indicated in the Implementation Statement. {Extrapolated from VSS
    I.2.2.8.2}

A1.1.1 Define precincts

1.  In systems claiming conformance to the *Split precincts* profile,
    the Election Management System shall support split precincts.
    {Extrapolated from VSS I.2.2.8.2}

A1.1.6 Program election

2.  In systems claiming conformance to the *Closed primaries* profile,
    the Election Management System shall support closed primaries.
    {Extrapolated from VSS I.2.2.8.2}

3.  In systems claiming conformance to the *Open primaries* profile, the
    Election Management System shall support open primaries.
    {Extrapolated from VSS I.2.2.8.2}

4.  In systems claiming conformance to the *Partisan offices* profile,
    the Election Management System shall support partisan offices.
    {Extrapolated from VSS I.2.2.8.2}

5.  In systems claiming conformance to the *Non-partisan offices*
    profile, the Election Management System shall support non-partisan
    offices. {Extrapolated from VSS I.2.2.8.2}

6.  In systems claiming conformance to the *Write-ins* profile, the
    Election Management System shall support write-in voting.
    {Extrapolated from VSS I.2.2.8.2}

7.  In systems claiming conformance to the *Primary presidential
    delegation nominations* profile, the Election Management System
    shall support primary presidential delegation nominations.
    {Extrapolated from VSS I.2.2.8.2}

8.  In systems claiming conformance to the *Ballot rotation* profile,
    the Election Management System shall support ballot rotation.
    {Extrapolated from VSS I.2.2.8.2}

9.  In systems claiming conformance to the *Straight party voting*
    profile, the Election Management System shall support straight party
    voting. {Extrapolated from VSS I.2.2.8.2}

10. In systems claiming conformance to the *Cross-party endorsement*
    profile, the Election Management System shall support cross-party
    endorsement. {Extrapolated from VSS I.2.2.8.2}

11. In systems claiming conformance to the *N of M voting* profile, the
    Election Management System shall support N of M voting.
    {Extrapolated from VSS I.2.2.8.2}

12. In systems claiming conformance to the *Recall issues with options*
    profile, the Election Management System shall support recall issues,
    with options. {Extrapolated from VSS I.2.2.8.2}

13. In systems claiming conformance to the *Cumulative voting* profile,
    the Election Management System shall support cumulative voting.
    {Extrapolated from VSS I.2.2.8.2}

14. In systems claiming conformance to the *Ranked order voting*
    profile, the Election Management System shall support ranked order
    voting. {Extrapolated from VSS I.2.2.8.2}

15. In systems claiming conformance to the *Provisional / challenged
    ballots* profile, the Election Management System shall support
    provisional/challenged ballots. {Extrapolated from VSS I.2.2.8.2}

A1.2 Prepare for voting (precinct)

A1.2.4 Test precinct equipment (precinct)

FR4.3.1 As a pre-voting function, all systems at the polling place shall
provide a record of the following, in any media, upon verification of
the authenticity of the command source: a. The election\'s
identification data; b. The identification of all equipment units; c.
The identification of the polling place; d. The identification of all
ballot formats; e. The contents of each active candidate register by
office and of each active measure register at all storage locations
(showing that they contain only zeros); f. A list of all ballot fields
that can be used to invoke special voting options; and g. Other
information needed to confirm the readiness of the equipment, and to
accommodate administrative reporting requirements. {Reworded from VSS
I.2.3.5}

A1.3 Prepare for voting (central)

A1.3.3 Test central equipment (central)

FR4.3.2 As a pre-voting function, all systems at the central location
shall provide a record of the following, in printed form, upon
verification of the authenticity of the command source: a. The
election\'s identification data; b. The contents of each active
candidate register by office and of each active measure register at all
storage locations (showing that they contain all zeros); and c. Other
information needed to ensure the readiness of the equipment and to
accommodate administrative reporting requirements. (Reworded from VSS
I.2.3.5}

A1.5 Gather in-person vote

2.  In systems claiming conformance to the *DRE* profile, the
    vote-gathering functionality of each DRE shall support all voting
    variations indicated in the Implementation Statement. {Extrapolated
    from VSS I.2.2.8.2}

    1.  In systems claiming conformance to the *Closed primaries* and
        *DRE* profiles, the ballot presentation, voting, and recording
        functionality of each DRE shall support closed primaries.
        {Extrapolated from VSS I.2.2.8.2}

    2.  In systems claiming conformance to the *Open primaries* and
        *DRE* profiles, the ballot presentation, voting, and recording
        functionality of each DRE shall support open primaries.
        {Extrapolated from VSS I.2.2.8.2}

    3.  In systems claiming conformance to the *Partisan offices* and
        *DRE* profiles, the ballot presentation, voting, and recording
        functionality of each DRE shall support partisan offices.
        {Extrapolated from VSS I.2.2.8.2}

    4.  In systems claiming conformance to the *Non-partisan offices*
        and *DRE* profiles, the ballot presentation, voting, and
        recording functionality of each DRE shall support non-partisan
        offices. {Extrapolated from VSS I.2.2.8.2}

    5.  In systems claiming conformance to the *Write-ins* and *DRE*
        profiles, the ballot presentation, voting, and recording
        functionality of each DRE shall support write-in voting.
        {Extrapolated from VSS I.2.2.8.2}

    6.  In systems claiming conformance to the *Primary presidential
        delegation nominations* and *DRE* profiles, the ballot
        presentation, voting, and recording functionality of each DRE
        shall support primary presidential delegation nominations.
        {Extrapolated from VSS I.2.2.8.2}

    7.  In systems claiming conformance to the *Ballot rotation* and
        *DRE* profiles, the ballot presentation, voting, and recording
        functionality of each DRE shall support ballot rotation.
        {Extrapolated from VSS I.2.2.8.2}

    8.  In systems claiming conformance to the *Straight party voting*
        and *DRE* profiles, the ballot presentation, voting, and
        recording functionality of each DRE shall support straight party
        voting. {Extrapolated from VSS I.2.2.8.2}

    9.  In systems claiming conformance to the *Cross-party endorsement*
        and *DRE* profiles, the ballot presentation, voting, and
        recording functionality of each DRE shall support cross-party
        endorsement. {Extrapolated from VSS I.2.2.8.2}

    10. In systems claiming conformance to the *Split precincts* and
        *DRE* profiles, the ballot presentation, voting, and recording
        functionality of each DRE shall support split precincts.
        {Extrapolated from VSS I.2.2.8.2}

    11. In systems claiming conformance to the *N of M voting* and *DRE*
        profiles, the ballot presentation, voting, and recording
        functionality of each DRE shall support N of M voting.
        {Extrapolated from VSS I.2.2.8.2}

    12. In systems claiming conformance to the *Recall issues with
        options* and *DRE* profiles, the ballot presentation, voting,
        and recording functionality of each DRE shall support recall
        issues, with options. {Extrapolated from VSS I.2.2.8.2}

    13. In systems claiming conformance to the *Cumulative voting* and
        *DRE* profiles, the ballot presentation, voting, and recording
        functionality of each DRE shall support cumulative voting.
        {Extrapolated from VSS I.2.2.8.2}

    14. In systems claiming conformance to the *Ranked order voting* and
        *DRE* profiles, the ballot presentation, voting, and recording
        functionality of each DRE shall support ranked order voting.
        {Extrapolated from VSS I.2.2.8.2}

    15. In systems claiming conformance to the *Provisional / challenged
        ballots* and *DRE* profiles, the ballot presentation, voting,
        and recording functionality of each DRE shall support
        provisional/challenged ballots. {Extrapolated from VSS
        I.2.2.8.2}

A1.5.12 Accept ballot

FR4.2.1 For systems claiming conformance to the *DRE* profile, the
acceptable voting system error rate (no more than one in 10,000,000
ballot positions) applies to recording the voter selections of
candidates and contests into voting data storage. (From VSS I.3.2.1.b.1)

FR4.2.2 For systems claiming conformance to the *DRE* profile, the
acceptable voting system error rate (no more than one in 10,000,000
ballot positions) applies to recording voter selections of candidates
and contests into ballot image storage independently of voting data
storage. (From VSS I.3.2.1.b.2)

A1.6 Count (precinct count) + A1.8.1 Count (central)

The following requirements apply equally to counting that occurs in the
precinct and in the central location.

3.  All tabulators shall support all voting variations indicated in the
    Implementation Statement. {VSS I.2.2.8.1 plus I.2.2.8.2}

    1.  In systems claiming conformance to the *Closed primaries*
        profile, the vote tabulating functionality of each voting
        device, vote count server, or other devices shall support closed
        primaries. {VSS I.2.2.8.1 plus I.2.2.8.2}

    2.  In systems claiming conformance to the *Open primaries* profile,
        the vote tabulating functionality of each voting device, vote
        count server, or other devices shall support open primaries.
        {VSS I.2.2.8.1 plus I.2.2.8.2}

    3.  In systems claiming conformance to the *Partisan offices*
        profile, the vote tabulating functionality of each voting
        device, vote count server, or other devices shall support
        partisan offices. {VSS I.2.2.8.1 plus I.2.2.8.2}

    4.  In systems claiming conformance to the *Non-partisan offices*
        profile, the vote tabulating functionality of each voting
        device, vote count server, or other devices shall support
        non-partisan offices. {VSS I.2.2.8.1 plus I.2.2.8.2}

    5.  In systems claiming conformance to the *Write-ins* profile, the
        vote tabulating functionality of each voting device, vote count
        server, or other devices shall support write-in voting. {VSS
        I.2.2.8.1 plus I.2.2.8.2}

    6.  In systems claiming conformance to the *Primary presidential
        delegation nominations* profile, the vote tabulating
        functionality of each voting device, vote count server, or other
        devices shall support primary presidential delegation
        nominations. {VSS I.2.2.8.1 plus I.2.2.8.2}

    7.  In systems claiming conformance to the *Ballot rotation*
        profile, the vote tabulating functionality of each voting
        device, vote count server, or other devices shall support ballot
        rotation. {VSS I.2.2.8.1 plus I.2.2.8.2}

    8.  In systems claiming conformance to the *Straight party voting*
        profile, the vote tabulating functionality of each voting
        device, vote count server, or other devices shall support
        straight party voting. {VSS I.2.2.8.1 plus I.2.2.8.2}

    9.  In systems claiming conformance to the *Cross-party endorsement*
        profile, the vote tabulating functionality of each voting
        device, vote count server, or other devices shall support
        cross-party endorsement. {VSS I.2.2.8.1 plus I.2.2.8.2}

    10. In systems claiming conformance to the *Split precincts*
        profile, the vote tabulating functionality of each voting
        device, vote count server, or other devices shall support split
        precincts. {VSS I.2.2.8.1 plus I.2.2.8.2}

    11. In systems claiming conformance to the *N of M voting* profile,
        the vote tabulating functionality of each voting device, vote
        count server, or other devices shall support N of M voting. {VSS
        I.2.2.8.1 plus I.2.2.8.2}

    12. In systems claiming conformance to the *Recall issues with
        options* profile, the vote tabulating functionality of each
        voting device, vote count server, or other devices shall support
        recall issues, with options. {VSS I.2.2.8.1 plus I.2.2.8.2}

    13. In systems claiming conformance to the *Cumulative voting*
        profile, the vote tabulating functionality of each voting
        device, vote count server, or other devices shall support
        cumulative voting. {VSS I.2.2.8.1 plus I.2.2.8.2}

    14. In systems claiming conformance to the *Ranked order voting*
        profile, the vote tabulating functionality of each voting
        device, vote count server, or other devices shall support ranked
        order voting. {VSS I.2.2.8.1 plus I.2.2.8.2}

    15. In systems claiming conformance to the *Provisional / challenged
        ballots* profile, the vote tabulating functionality of each
        voting device, vote count server, or other devices shall support
        provisional/challenged ballots. {VSS I.2.2.8.1 plus I.2.2.8.2}

FR4.2.3 For systems claiming conformance to the *Marksense* or
*Punchcard* profile, the acceptable voting system error rate (no more
than one in 10,000,000 ballot positions) applies to scanning ballot
positions on paper ballots to detect selections for individual
candidates and contests. (From VSS I.3.2.1.a.1)

FR4.2.4 For systems claiming conformance to the *Marksense* or
*Punchcard* profile, the acceptable voting system error rate (no more
than one in 10,000,000 ballot positions) applies to conversion of
selections detected on paper ballots into digital data. (From VSS
I.3.2.1.a.2)

A1.6 Count (precinct count)

FR4.2.5 For systems claiming conformance to the *Precinct count*
profile, the acceptable voting system error rate (no more than one in
10,000,000 ballot positions) applies to consolidation of vote selection
data from multiple precinct-based systems to generate jurisdiction-wide
vote counts, including storage and reporting of the consolidated vote
data. {Reworded from VSS I.3.2.1}

A1.7 Wrap up voting (precinct)

A1.7.1 Close polls

FR4.3.3 Systems claiming conformance to the *Precinct count* profile
shall provide designated functions for generating post-election reports.
{Reworded from VSS I.2.5}

FR4.3.4 Systems claiming conformance to the *Precinct count* profile
shall consolidate the data contained in each unit into a single report
for the polling place when more than one voting machine or precinct
tabulator is used. {Reworded from VSS I.2.5.3.2}

FR4.3.5 Systems claiming conformance to the *DRE* profile shall, if the
consolidation of polling place data is done locally, perform this
consolidation in a time not to exceed 5 minutes for each device in the
polling place. {Reworded from VSS I.3.2.6.2.1}

6.  Systems claiming conformance to the *Precinct count* profile shall
    provide designated functions for closing the polling place.
    {Reworded from VSS I.2.5}

Note: For reporting requirements see A1.8.4.

A1.7.3 Diagnose and correct problem (precinct)

7.  Any discrepancy in reports, regardless of source, shall be
    resolvable to a procedural error, to the failure of a non-memory
    device, or to an external cause. {Reworded from VSS I.3.2.6.2.2}

A1.7.4 Deliver / transmit ballots, ballot images and/or precinct totals
to central

FR4.5.1 All systems shall ensure that extracted or duplicated
information, including Cast Vote Records extracted from DRE machines, is
identical to that on the original storage medium. {Reworded from Section
5.6.9.2, Paragraph k of IEEE DRAFT P1583/D5.3.2b, 2005-01-04.}[^1]

FR4.5.1.1 All electronic systems shall verify that information extracted
or duplicated to machine-readable media is identical to that on the
original storage medium.

FR4.5.2 All systems shall prevent data from being altered or destroyed
by the transmission of results over telecommunications lines, including
data in transportable memory. {Reworded from VSS I.2.5.3.1 and
I2.5.3.2d}

FR4.5.2.1 Transmitting results over telecommunications lines shall not
result in modifications to any vote data in the sending system.

FR4.5.2.2 All electronic systems shall ensure that information received
by transmission over telecommunications lines is identical to what was
sent.

A1.8.1 Count (central)

FR4.2.6 For systems claiming conformance to the *Central count* profile,
the acceptable voting system error rate (no more than one in 10,000,000
ballot positions) applies to consolidation of vote selection data from
multiple counting devices to generate jurisdiction-wide vote counts,
including storage and reporting of the consolidated vote data. {Reworded
from VSS I.3.2.1}

FR4.3.6 All election management systems shall be capable of accumulating
vote totals at the precinct, election district, and jurisdiction
reporting levels. {Reworded from VSS I.2.2.6}

FR4.3.7 Sytems claiming conformance to the *In-person voting* profile
shall provide a means to consolidate vote data from all polling places
at the jurisdiction reporting level and include this data in the
accumulated vote totals. (Reworded from VSS I.2.5.2 and I.2.5.3)

FR4.3.8 Systems claiming conformance to the *Absentee voting* profile
shall provide a means to consolidate vote data from absentee ballots at
the jurisdiction reporting level and include this data in the
accumulated vote totals. (Reworded from VSS I.2.5.2 and I.2.5.3)

FR4.3.9 Systems claiming conformance to the *Provisional / challenged
ballots* profile shall provide a means to consolidate vote data from
provisional ballots at the jurisdiction reporting level and include this
data in the accumulated vote totals. (Reworded from VSS I.2.5.2 and
I.2.5.3)

FR4.3.10 Systems claiming conformance to the *Review-required ballots*
profile shall provide a means to consolidate vote data from voted
ballots requiring human review at the jurisdiction reporting level and
include this data in the accumulated vote totals. (Reworded from VSS
I.2.5.2 and I.2.5.3)

A1.8.3 Diagnose and correct problem (central)

See A1.6.3 (same requirements apply here).

A1.8.4 Report

Note: see A1.2.4 and A1.3.3 for pre-voting reports

FR4.3.11 All devices that tabulate ballots shall record and report the
number of ballots cast during a particular test cycle or election. {DWF,
phrasing the functional requirement that was implied by design
requirements in I.2.2.9}

FR4.3.12 All systems shall be capable of producing a printed report of
the number of ballots counted by each tabulator. {From VSS I.2.2.6.h and
I.2.5.3.1.b}

FR4.3.13 Systems claiming conformance to the *DRE* profile shall produce
reports that account for all votes on all accepted ballots with no
discrepancy among reports of voting device data at any level. {Reworded
from VSS I.3.2.6.2.2}

FR4.3.14 All systems shall produce an accurate report of all votes cast.
{Reworded from VSS I.2.2.2.1}

FR4.3.14.1 All systems shall report the vote totals for each contest, at
each reporting level, per the definition of T(*c*,*r*,*t*~E~) in
[\[xref\]]{.mark}.

FR4.3.14.2 All systems shall report the number of cast ballots for each
contest, at each reporting level, per the definition of K(*r*,*t*~E~) in
[\[xref\]]{.mark}.

FR4.3.14.3 All systems shall report the number of overvotes for each
contest, at each reporting level, per the definition of O(*r*,*t*~E~) in
[\[xref\]]{.mark}.

FR4.3.14.4 All systems shall report the number of undervotes for each
contest, at each reporting level, per the definition of U(*r*,*t*~E~) in
[\[xref\]]{.mark}.

FR4.3.15 All systems shall support geographic reporting, which requires
the reporting of all results for each contest at the precinct, election
district, and jurisdiction levels. {From VSS I.2.2.6.h and I.2.5.3.1.a}

FR4.3.16 All systems shall be capable of producing a printed report for
each tabulator of the results of each contest that includes the votes
cast for each selection, the count of undervotes, and the count of
overvotes. {From VSS I.2.2.6.h and I.2.5.3.1.c}

FR4.3.17 All systems shall be capable of producing a consolidated
printed report of the results for each contest of all votes cast
(including in-person ballots, absentee ballots, provisional / challenged
ballots, and review-required ballots, as applicable, according to the
claimed profiles) that includes the votes cast for each selection, the
count of undervotes, and the count of overvotes. {From VSS I.2.2.6.h and
I.2.5.3.1.d}

FR4.3.18 All systems shall be capable of producing a consolidated
printed report of the combination of overvotes for any contest that is
selected by an authorized official (e.g.; the number of overvotes in a
given contest combining candidate A and candidate B, combining candidate
A and candidate C, etc.). {From VSS I.2.2.6.h and I.2.5.3.1.e}

FR4.3.19 All systems shall be capable of producing all of the
pre-election audit records, system readiness audit records, in-process
audit records and vote tally data defined below in the form of printed
reports, or in electronic memory for printing centrally. {From VSS
I.2.2.6.h and I.2.5.3.1.f}

\* PASTE 2002VSS VOL I SECTION 4.4 HERE \*

FR4.3.20 All systems shall provide the capabilities to obtain status and
data reports from each set of equipment. {Reworded from VSS I.2.3.4.1}

FR4.3.21 All systems shall provide the capabilities to generate
consolidated data reports at the precinct and jurisdiction levels.
{Reworded from VSS I.2.3.4.1}

FR4.3.22 Systems claiming conformance to the *Unofficial results
generation* profile shall provide only aggregated results, and not data
from individual ballots. {Reworded from VSS I.2.5.4a}

FR4.3.23 Systems claiming conformance to the *Unofficial results
generation* profile shall clearly indicate on each report or file that
the results it contains are unofficial. {Reworded from VSS I.2.5.4c}

FR4.5.3 All systems shall prevent data from being altered or destroyed
by report generation, including data in transportable memory. {From VSS
I.2.2.6.h, I.2.5.3.1.g, and I2.5.3.2d}

A2.2 Conduct official audits

FR4.4.1 All devices that tabulate ballots shall enable election
officials to determine the number of ballots cast so far during a
particular test cycle or election at any time during the test cycle or
election without disrupting any operations in progress. {DWF, phrasing
the functional requirement that was implied by design requirements in
I.2.2.9}

FR4.4.2 Systems claiming conformance to the *DRE* profile shall maintain
an accurate Cast Vote Record of each ballot cast. {Reworded from VSS
I.2.2.4.2}

**Procedural requirement**

All printed copy records produced by the election database and ballot
processing systems shall be labeled and archived for a period of at
least 22 months after the election. {Reworded from VSS I.2.2.11}

**Design requirements**

> The following requirements constrain the design rather than specify
> the function. There may be good reasons to constrain the design.
> However, in the absence of rationale for constraining the design, they
> will be deleted.

-   Systems claiming conformance to the DRE profile shall maintain Cast
    Vote Records using a process and storage location that differs from
    the main vote detection, interpretation, processing, and reporting
    path. {Reworded from VSS I.2.2.4.2} \<Testable\> \<Design\>

-   The vote tabulating program software resident in each voting device,
    vote count server, or other devices shall include all software
    modules required to accumulate votes. {Reworded from VSS I.2.2.8.1}
    \<Verifiable by inspection\> \<Design\>

-   Systems claiming conformance to the Precinct count profile shall
    provide a means to extract information from a transportable
    programmable memory device or data storage medium for vote
    consolidation. {Reworded from VSS I.2.5.3.2} \<Testable\> \<Design\>

-   All devices that tabulate ballots shall provide a counter that must
    be set to zero before any ballots are submitted for tally or DRE
    units are activated for voting. {Reworded from VSS I.2.2.9}
    \<Testable\> \<Design\>

-   All devices that tabulate ballots shall provide a counter that
    records the number of ballots cast during a particular test cycle or
    election. {Reworded from VSS I.2.2.9} \<Testable\> \<Design\>

-   All devices that tabulate ballots shall provide a counter that
    increases the count only by the acceptance of a cast ballot record.
    {Reworded from VSS I.2.2.9} \<Testable\> \<Design\>

-   All devices that tabulate ballots shall provide a counter that
    prevents or disables the resetting of the counter by any person
    other than authorized persons at authorized points in the election
    cycle. {Reworded from VSS I.2.2.9} \<Testable\> \<Design\>

-   All devices that tabulate ballots shall provide a counter that is
    visible to designated election officials. {Reworded from VSS
    I.2.2.9} \<Testable\> \<Design\>

-   All election management systems shall generate and maintain a
    database, or one or more interactive databases, that enables
    election officials or their designees to generate the required
    post-voting reports. {Reworded from VSS I.2.2.6.h, which references
    I.2.5.3.1} \<Testable\> \<Design\>

-   All election management systems shall generate and maintain a
    database, or one or more interactive databases, that enables
    election officials or their designees to process and produce audit
    reports of the audit record data required by \[# above\]. {Reworded
    from VSS I.2.2.6.i, which references I.4.5 but means I.4.4}
    \<Testable\> \<Design\>

**Requirements to be dealt with by Security & Transparency
Subcommittee**

-   Systems claiming conformance to the *Unofficial results generation*
    profile shall provide no access path from unofficial electronic
    reports or files to the storage devices for official data. {Reworded
    from VSS I.2.5.4b} \<Semi Testable\> Punt to STS. (Access paths
    might not be obvious.)

-   Systems claiming conformance to the *Precinct count* profile shall
    prevent the printing of reports and the unauthorized extraction of
    data prior to the official close of the polling place. {Reworded
    from VSS I.2.5.3.2} \<Testable\> Test by trying to do it / punt to
    STS.

-   For systems claiming conformance to the *Central count* profile, the
    Voting Equipment User Documentation shall detail the measures to be
    taken related to the physical and procedural controls for handling
    of ballot boxes. {Reworded from VSS I.6.3.2} \<Verifiable by
    inspection\>

-   For systems claiming conformance to the *Central count* profile, the
    Voting Equipment User Documentaton shall detail the measures to be
    taken related to the physical and procedural controls for preparing
    of ballots for counting. {Reworded from VSS I.6.3.2} \<Verifiable by
    inspection\>

-   For systems claiming conformance to the *Central count* profile, the
    Voting Equipment User Documentation shall detail the measures to be
    taken related to the physical and procedural controls for counting
    operations. {Reworded from VSS I.6.3.2} \<Verifiable by inspection\>

-   For systems claiming conformance to the *Central count* profile, the
    Voting Equipment User Documentation shall detail the measures to be
    taken related to the physical and procedural controls for reporting
    data. {Reworded from VSS I.6.3.2} \<Verifiable by inspection\>

**Deleted compliance points**

> The following was deleted because it was completely redundant with
> other compliance points that separately and more clearly required (1)
> all kinds of reports and (2) error-freeness. The separation of mere
> "reports" from "consolidated reports" in 2002VSS I.3.2.6.2.2 seems
> gratuitous.

-   DRE voting systems shall produce consolidated reports containing
    absentee, provisional, or other voting data that are error-free.
    {Reworded from VSS I.3.2.6.2.2}

[^1]: This material is from an unapproved draft of a proposed IEEE
    Standard, P1583. As such, the material is subject to change in the
    final standard. Because this material is from an unapproved draft,
    the IEEE recommends that it not be utilized for any
    conformance/compliance purposes. It is used at your own risk.