# Presentation: 512063

## NIST Roles: Help America Vote Act Past, Present and Future

- Dr. Susan Zevin, Acting Director
- NIST Information Technology Lab
- National Association of Secretaries of State
-  Winter Meeting February 16, 2004

## Agenda

**Agenda**

- Historic NIST Strengths in Standards Setting.
- Decision to Support HAVA
- Near-term Benefits to the Election Community
- Near term Benefits to all Voters
- Potential Timeline for future NIST HAVA Implementation

## 1901: National Bureau of Standards (NBS)  Begins to Assist States with Standards 

- Industrialization & Urbanization Brought A Search for Order
- NBS: A Federal Partner to State regulatory Agencies
-  Ohio Machine Parts needed to fit with New York Machine Parts
- 1 gallon in Maine=1 gallon in Georgia (?)
- Commercial transactions depended on accurate weights & measures

## Today, NIST Still  Works Closely with      Customers and Stakeholders

**Today, NIST Still  Works Closely with ****     Customers and Stakeholders**

- NIST Laboratory work emphasizes partnerships:
- Voluntary consensus standards and guidelines
- Driven by user community
- Cooperative research agreements with other agencies, universities, and industry
- Laboratory accreditation
- Expert advice to government agencies and others
- Contracts, grants, collaborative research
- Consortia and standards development organizations

**Notes:**
Partnerships bring all interested parties to the table

Voluntary Standards development efforts are driven by user and industry participants

Cooperative Agreements and Collaborations enable focused efforts by a variety of organizations

NIST experts bring needed expertise as needed

Laboratory Accreditation
 - Process used in many testing arenas (mechanical, software, materials, security...)
 - Establishes high level of laboratory performance
 - Enables the Accreditation Authority to grant accreditation with confidence
 - Most Accreditation Authorities are not NIST

## Why NIST and HAVA ?

- An Opportunity to advance measurement science applied to Information Technology
- An Opportunity to Assist State & Local Governments in securing their computer systems
- A Role as a  Neutral Objective 3rd Party for Vendors
- An Opportunity to Apply NIST tools in:
- Laboratory Accreditation
- Software Quality and testing
- Computer forensics

## NIST: Pre- HAVA Implementation

- Research and Write Human Factors Report
- Interactions with Election Community
- Initial review of Computer Security Issues Relevant to Voting Systems
- Advance Work Prior to Initiation of an ISO 17025 Accreditation Process for Independent Testing Authorities

## December Symposium Consensus Issues

- Need Good Procedures & Best Practices -Physical & Cyber Security - Usability and Accessibility
- Raise the Bar on Testing & Certification
- Keep it Simple for Voter, Poll Worker, and Election Officials

## December Symposium Consensus Issues

- NIST has a potential to assist states assure practical, secure elections, with every vote being important.
- It is important to look at the system end-to-end.
- We need to separately address both short-term and long-term challenges.
- We (the election community) need to work together.

## Moving to the Next Level  ?

- “America cannot afford another election in which there is widespread mistrust of the result. There should be bipartisan support for fully financing the Help America Vote Act, and for picking up the pace of reform.”New York Times Editorial 2/9/2004

## Significant Challenges

- Moving forward with Human Factors Report recommendations
- Applying FIPS standards to state voting Systems
- Secure Protocols for Wireless transmissions
- Improving Software Quality
- Implementing TGDC and  Accreditation Program

## What Could Be Done in the Next Six Months

- Spin Up New ISO 17025 Accreditation Process for Independent Testing Authorities
- Begin Development of Conformance Tests for Voter verifiable Audit Trail
- Review of 1990/2002 Voting System Standards :	-Identify Priorities
- Spin Up TGDC- Hold Public Meetings

## What Could Be Done in the Next Six Months

- Perform Risk Analysis of Voting System

**Notes:**

Areas of applicable NIST expertise include: 
 -Usability             -Laboratory Accreditation
 -Accessibility       -Statistics
 -Security              -Mechanical system testing
 -Communication

The Help America Vote Act directs many activities and names NIST with certain roles.
( “Guidelines” in the Act means Voluntary Standards)

We recognize the work NASED has done in establishing the testing program now in place, and will bring our experience and ability in testing and accreditation as we all build on that effort.

Funding for all activities not yet established.
The timeline for establishment of the Commission and Guidelines Committee means that some activates will be in preparation before that happens.

## What Could Be Done in the Next Six Months

- Recommend cyber security guidelines from adaptation of existing guidelines

| Security Control | E-Voting Risks | NIST Documents and Standards |
| --- | --- | --- |
| Access Control | - Unauthorized Modifications to Voting System
- Preventing Access by Authorized Individuals
- Unauthorized Access to Vote Data
- Unauthorized access to security-relevant data | FIPS 190, FIPS 196,  |
| Assurance | - Unauthorized Modifications to Voting System
- Modifying the recording of a vote 
-  Preventing the recording of a vote 
- Denial of Service During or After Election | FIPS 140-2, Common Criteria, SP 800-37,
SP 800-53,
SP 800-53A |
| Integrity | - Adding data for a vote not cast by a registered user
- Adding duplicate votes
-  Modifying  calculated vote totals
-  Modifying vote tallies in transit | FIPS 180-2, FIPS 186-2, FIPS 198 |
| Auditing | - Altering e-voting system audit trails
-  Modifying the recording of a vote
-  Preventing the recording of a vote | SP 800-12, SP 800-14 |
| Confidentiality | -  Unauthorized disclosure of voting data, e-voting system configuration information, audit data etc. | FIPS 46-3,FIPS 197,
SP 800-17,
SP 800-20,
SP 800-38A |

## What Could Be Done in the Next Six Months

- Develop a viable tested security standards baseline to be incorporated into the VSS
- Recommend best practices for Securing Voting Systems to State and Local Officials
- Develop Computer Forensics Tool of known file signatures of commercial voting system software

## What Could Be Done in the Next Six Months

**What Could Be Done in the Next Six Months**

- Obtain initial usability data
- Run a Pilot Test to determine usability testing procedures
- Assist State Election Directors & Vendors to implement Human Factors Report Recommendations
- Begin to Develop Ballot Design Guidelines

## What Could Be Done in the Next Six Months

- Recommend to State & Local Officials:	- Usability Testing requirements from vendors in standard Common Industry Format	-Evaluation by Usability professional of voting system with actual ballots, voters and poll workers	- Interpretation of Vendors Usability Test Reports by  A Usability Professional

## - What Could Be Done in the Next Six Months

- Recommend to Vendors:	- Implementation of User-Centered Design Approach in their System Engineering Processto prepare for Usability testing     - Documentation of Usability Evaluation & Usability testing 	- Usability testing reports in Common Industry 	Format

**Notes:**
Irregularities: Counting crossed-out ovals on mark-sense ballots were done opposite in two precincts

One recount procedure took nearly two weeks

The Hanging Chad problem caused lots of trouble. Here is one fellow trying to decide the voters intent:

## Potential Future NIST Contributions to              HAVA Implementation

-   - Partnerships			- Accuracy
-   - Technical excellence		- Reliability
-   - Objectivity			- Improved Performance

- Potential Future NIST Contributions to              HAVA Implementation

**Public Benefit**
-  Improved Voter Experience
-  Improved Election Process

**Election Community**
-  IT Systems: development, testing
-  Security
-  Measurements and Data
-  Usability/ Accessibility
-  Information Assurance

**Notes:**
For the benefits of improved voting systems to become a reality across the Country, we must all work together to meet the challenges before us.

Through leadership and technology in a variety of cooperative efforts, we hope to make significant progress.

NIST is looking forward to contributing in both traditional and new ways to help improve voting in the United States.

## Status Updates

- NIST Symposium CDs sent to Attendees
- Future NIST HAVA Activity Updates Available on the Web Site:_[http://vote.nist.gov](http://vote.nist.gov/)_
- Questions?