**`NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY`**

**`TGDC - MEETING`**

**(START OF AUDIOTAPE 1)**

MALE: Who else is on for teleconference? Can you hear us?

MALE: Yes, James Elekes. Alan, I\'m \-- you\'re coming through loud and
clear.

FEMALE: And this is Helen Purcell. I\'m also here.

MALE: Very good. Thanks.

We\'re going high-tech with a nice description here of our emergency
exits. It\'s very easy. If something would happen, you just walk right
out the door and you can see the exits on the left and the right when
you \-- when you head out. There are also emergency directions posted on
the left and on the right aisle. And \--.

FEMALE: (indiscernible)

MALE: Oh, I\'m sorry. Yes. You can go out either side of the front here.
I was little \-- right over here.

FEMALE: Okay.

MALE: Yes, you can, yeah. \[laughter\] That\'s right. Think we\'re
high-tech here and show it to you. Here we go. Exit. Exit. It\'s back
over here and then back in there, so you\'re set there. Now.

Okay. Turn off our cell phones and pagers. We don\'t allow food in the
auditorium, but we have a nice cafeteria right down the hallway and
we\'ll break for lunch right around 12:30. Please wear your name badges
at all times. I apologize for the fact that some people were not cleared
through security. We had a \-- a glitch there, but we\'ll take care of
that. Your badge that you have today will get you in tomorrow through
the gate. You do not need to go through security, so good reason to keep
it. Anyone who needs to take advantage of signing, our signer is over
here stage left and you may feel free to sit over on this left side as
close as you need to to take advantage. We have him lit, so we hope
he\'s \-- if you have any problems, just let us know. But we do have a
special light on him.

With that, I would welcome you all to the home of the Washington
Nationals and I think they\'re still in first place barely in their
division. We have a little warmer weather for you today than we\'ve had
for our last meetings. Look forward to your participation. Thank you for
attending. Also, hello to all people on the webcast. Our last webcast
was viewed by over 600 people. I\'d like to also welcome the members of
the Election Assistance Commission (phonetic sp.) who are here today and
the commissioners who will be \-- Commissioner, Vice-Chair DiGregorio
(phonetic sp.) will be addressing us shortly, and with that, I\'ll turn
over the po \-- podium and the microphone to the Chair of the Technical
Guidelines Development Committee, Dr. Hratch Semerjian.

MR. CHAIRMAN: Thank you, Alan. Good morning.

PARTICIPANTS: Good morning.

MR. CHAIRMAN: Can you hear me?

MALE: You\'re coming through loud and clear, Doc.

MR. CHAIRMAN: Okay.

FEMALE: \[laughing\]

MR. CHAIRMAN: I\'m Hratch Semerjian; I\'m the Acting Director of the
National Institute of Science and Technology and Chairman of the
Technical Guidelines Development Committee. I hereby call to order the
4^th^ meeting of this committee today, Wednesday, April 20, 2005. Let us
now stand and pledge allegiance.

PARTICIPANTS: I pledge allegiance to the flag of the United States of
America and to the Republic for which it stands, one nation, under God,
indivisible, with liberty and justice for all.

MR. CHAIRMAN: As Alan pointed out, we have, I believe, two members of
the Election Assistance Commission: Commissioner DiGregorio, the
Vice-Chair, and Commissioner Martinez (phonetic sp.). We\'re very
pleased to have them with us today.

At this time, I recognize Mr. Craig Burkhardt as the TGDC
parliamentarian and request that he determine if a form of the committee
is present. Mr. Burkhardt.

MALE: Thank you. Roll call for attendance. Mr. Williams.

MALE: Here.

MALE: Berger. (phonetic sp.)

MALE: Here.

MALE: Caldez. (phonetic sp.) Caldez not present. Craft. (phonetic sp.)

MR. CHAIRMAN: Caldez. He is no longer on the committee.

FEMALE: Here, for Davidson. (phonetic sp.)

MALE: Davidson. Elekes.

MALE: Here.

MALE: Gannon. Harding.

MALE: Here.

MALE: Miller.

FEMALE: Here.

MALE: Purcell. Quesenbery.

FEMALE: Here.

MALE: Rivest.

MALE: Here.

MALE: Schutzer.

MALE: Here.

MALE: Turnerbuoy. (phonetic sp.) And Semerjian. MR. CHAIRMAN: Here.

MALE: Calling once again for those who did not respond. Caldez did not
respond? Is Gannon present? Is Purcell present?

FEMALE: Here.

MALE: Okay. Twelve persons being present, a quorum exists. Members
recalling that eight are required to pass a \-- a motion. Thank you.

MR. CHAIRMAN: Thank you, Mr. Burkhardt. I can express my appreciation to
the members of TGDC for arranging your busy schedules to participate in
a most important TGDC meeting today. The new voting team has benefitted
from your willingness to volunteer significant time in assisting them to
complete drafts of the voluntary voting system guidelines we will review
today and tomorrow, and I\'m sure that the American voters will benefit
from your civic commitment.

TGDC members and I were distressed to hear of the recent illness of Mrs.
\-- Miss Sharon Turner Bouvier (phonetic sp.), one of our committee
members. However, I recently learned that she is recovering from
successful surgery and we wish her a speedy recovery. The committee will
miss her presence at this meeting.

Due to new job responsibilities, Ms. Anne Caldest (phonetic sp.), the
committee representative of the American National Standards Institute
recently submitted her resignation from the TGDC. She will be placed by
Mr. David Carmel (phonetic sp.), Vice President of Public Policy and
Government Affairs for ANC (phonetic sp.). The formal approval process
for Mr. Carmel is not yet complete; however we appreciate his attendance
at the meeting today and look forward to his active participation in
future TGDC activities. Thank you, David, for being here.

At this time, I will entertain a motion to adopt the April 20 and 21,
2005 meeting agenda for the Technical Guidelines Development Committee.
It is in under the first tab in your book. Do I hear a motion?

MALE: (indiscernible)

MR. CHAIRMAN: Thank you. Do I have a second? Any?

MALE: Second.

MR. CHAIRMAN: Thank you. Any comments? All in favor, please say \"aye.\"

PARTICIPANTS: Aye.

MR. CHAIRMAN: Anyone against? Thank you. The meeting agenda has been
approved.

At this time I will entertain a motion to accept the minutes of the
March 9, 2005 meeting of the Technical Guidelines Development Committee.
That is in your third tab in the book. The minutes of the March 9
meeting.

MALE: (indiscernible)

MALE: Second.

MR. CHAIRMAN: Okay, we heard motion and a second. Any comments,
corrections? Hearing none. All those in favor?

PARTICIPANTS: Aye.

MR. CHAIRMAN: Anyone against? Thank you.

Since our March TGDC meeting, NIST scientists have written a complete
final draft of the voluntary voting systems guidelines. This is
version 1. The document VBSG, version 1 represents a best effort to
incorporate this committee\'s guidance and constructive criticism of the
preliminary technical reports presented at the March 2005 meeting. TGDC
members, today, will have an opportunity \-- today and tomorrow \-- to
review this material and to provide detailed editing instructions to new
staff. I will ask Mr. Burkhardt to review the parliamentary logistics of
this meeting shortly. In addition, this voting team completed a
preliminary draft of the voluntary voting systems guidelines version 2.
This document, VVSG version 2 proposes a framework for a complete voting
standard that would succeed VVSG version 1. We will receive
presentations from this staff on both documents at this meeting.
However, the focus of our work today and Thursday will center on a final
review of VVSG version 1. When formally approved by the committee, VVSG
version 1 will become the initial TGDC recommendations forwarded to the
Election Assistance Commission as required by the Help America Vote Act.

The agenda for the committee\'s preliminary review of VVSG version 2 on
Thursday will depend on the time needed to cover all the sections of
VVSG version 1. Tomorrow, we will also discuss next steps relevant to
the future work of this committee in support of the Election Assistance
Commission. Copies of VVSG version 1 and VVSG version 2 as well as
necessary meeting materials were electronically transmitted to you on
April 13, 2005 in accord with the advanced notice required in TGDC
Resolution Number 1-05. In addition, these documents have been posted on
the public website vote.nist.gov (phonetic sp.).

As a brief review for the public in attendance and viewing the webcast,
Public Law 107-252, the Help America Vote Act established the Technical
Guidelines Development Committee. (indiscernible) charters the members
of this committee to assist the Election Assistance Commission with the
development of voluntary voting system guidelines. In the interim, the
2002 voting system standards adopted by the Federal Election Commission
serve as the first set of voluntary voting system guidelines under HAVA
(phonetic sp.).

Beginning in July of 2004, this committee met in plenary (phonetic sp.)
session on three occasions and conducted 36 subcommittee
teleconferences. The proceedings of each of these meetings including
archived webcasts and audio recordings are available on the voting
website, vote.NIST.gov.

At this 4^th^ plenary session, I\'m optimistic this committee will
thoroughly review and adopt with possible editing instructions to NIST,
the VVSG version 1, the culmination of sustained efforts by NIST
scientists and this committee to meet a non-negotiable Congressional
deadline. I will note here that most standards development processes
take at least 2 to 3 years.

This committee\'s initial set of recommendations for voluntary voting
system guidelines are due to the Executive Director of the Election
Assistance Commission 9 months after TGDC members were appointed and
approved. At this time, I note that the latest revised version of
Roberts\' Rules of Order (phonetic sp.) was adopted on July 9, 2004 to
govern Technical Guidelines Development Committee and sub-committee
proceedings. I call on Mr. Burkhardt to review the logistics of this
4^th^ meeting of the TGDC. Mr. Burkhardt.

MALE: Thank you, Dr. Semerjian. And welcome, everybody, again to NIST on
behalf of Secretary of Commerce Gutierrez and President Bush. I want to
compliment everybody, the members of the TGDC, the NIST staff of
scientists and other professionals as well as the hopeful guidance
that\'s been received from the members and staff of the EAC which has
gotten us here to date. Surely a wonderful accomplishment given that
most of this work has been done within the last 6 months.

I\'ll very briefly go through the business aspects of what we\'re going
to be doing today. As the TGD members know, the goal today and tomorrow
is to adopt as your own work product to be delivered to the EAC, the
various initial set of recommendations. And in order to do that, we\'ll
be following a very similar process that we followed before; that being
that each section will be discussed by a NIST \-- NIST professional
staff person, it will then be opened up again to questions and answers
from you. After that, then, of course, you will have your opportunity to
make motions to make changes. And one the changes that are generally
thought to be acceptable, these would be done on the unanimous consent
basis, meaning that it can be stated and if there are no objections, we
don\'t need to take a formal vote. Of course, if there\'s a contested
situation, then we would actually move and take a recorded roll call
vote, as you know.

Now, the only difference between what we\'ve done before and what we\'ll
be done \-- doing as well is that at the end of each section, we will
then be taking another vote, and that vote will be the vote that you
take embracing that section with all of the changes you might have made
just before that as your work product that you wish to deliver to the
Election Assistance Commission.

So we\'ll be following that same process, but we\'ll be taking that
extra vote at the end, adopting that as your work product and
authorizing NIST under the Director to make whatever technical changes
that you\'ve instructed to be made to that and deliver that to the EAC,
which would be taking place in the not-too-distant future.

Now, of course, mention has been made of VVSG version 2. These are the
longer view issues which were not prioritized for immediate release in
the initial set of recommendations and these are expected to come out
sometime over the upcoming months. So for those of you in the audience
or on the Internet, know that we may or may not get to all provisions
which are embraced in VVSG version 2, just depending on whether or not
we accomplish our fundamental work on version 1. To the extent we do get
through sections of version 2, that procedure will be the same procedure
we followed at the last meeting, meaning that we will be \-- NIST staff
is asking for you to provide directions as to how they may change that,
and those will be done, generally speaking, on a unanimous consent basis
or when appropriate, a contested vote basis, but you will not be
adopting anything in version 2 as your work product to be delivered to
the EAC later this month.

That would be my explanation of the parliamentarian\'s memo that you
have in your packet. Thank you.

MR. CHAIRMAN: Thank you, Mr. Burkhardt. The scientists and I look
forward to the committee\'s review of VVSG version 1. The time required
to accomplish the agenda items means that the committee cannot take
public comments at this meeting; however, there will continue to be
opportunities for the public to comment on relevant issues. Comments and
position statements should be sent to voting@nist.gov where they were be
posted on the NIST voting website, vote.nist.gov. The comments we have
received to date have been posted and reviewed by NIST staff and TGDC
committee members.

At this time, I call on the Vice Chairman of the U.S. Election
Assistance Commission, Mr. Paul DiGregorio, to address the committee.
The Vice-Chairman, along with the other EAC commissioners, have provided
the committee with helpful remarks at our previous meetings. I
appreciate the Commissioner\'s offer to address the TGDC at this
meeting. Please welcome Commissioner DiGregorio.

MALE: Thank you, Dr. Semerjian. And thank you, members of the TGDC for
giving me this opportunity to speak with you this morning. I\'m pleased
to be here this morning with Commissioner Rey Martinez (phonetic sp.). I
think you\'ve been aware that Commissioner Martinez and I have attended
all of your meetings and followed your proceedings very closely. It\'s a
pleasure to be here to watch your deliberations on this very important
day.

At the July 9, 2004 initial meeting of the TGDC, then-Chairman of the
EAC, Buster Sorez (phonetic sp.) charged this group to complete its work
in 9 months as required by the Help America Vote Act of 2002. We are now
reaching the conclusion of that period. We\'re pleased to note that you
have taken this charge seriously as you are convened today to consider
the initial set of recommendations for the voluntary voting system
guidelines that you will soon be forwarding to the EAC.

Let me reiterate the commission\'s expectations for this work product,
again, as expressed by Commissioner Sorez at that July meeting. We are
looking for standards that are performance based, that can measure
success as it relates to voting. We\'re looking for standards against
which new voting devices can be measured that embrace existing and
emerging technologies. That is not the EAC\'s responsibility to dictate
to states what kind of voting systems they use. But it is our
responsibility to establish standards against which states can make
informed decisions. We know that this has been a difficult job and we
deeply appreciate all the effort that the TGDC and the NIST staff have
put forth in the past 9 months for this truly historic first effort by
the federal government to provide assistance and guidance in this
important area. As aptly described by Dr. Scull (phonetic sp.) at the
EAC\'s March 22, 2005 public meeting, there are two separate goals for
this effort. The first is to develop the best long-term guidelines
possible, building on the strengths of the 2002 voting system standards.
We understand that this goal will take some additional period of time to
achieve. EAC has requested funding to continue this work throughout
fiscal year 2006. In fact, we had our hearing before the House
Appropriations Committee just last week to make the case for more
funding for NIST to continue this work. The second near-term goal is to
provide guidance to the states for the 2006 election cycle. To
accomplish this goal, we need to make some important revisions to the
2002 voting system standards that fill gaps concerning issues facing
election officials as they prepare for the 2006 elections regarding
security, accessibility, and audibility the voting systems. We look
forward to the discussions of the next 2 days as the TGDC deliberates on
this work product and considers what your final recommendations to the
EAC will be.

I have been asked to address the process that will occur after the
delivery of the TGDC recommendations to the EAC that until work \-- will
occur no later than May the 9^th^. As always, we will be following the
ma \-- the provisions of HAVA regarding the review and possible
modification of these recommendations to become the proposed guidelines
that will be published for public comment and ultimately adopted by the
commission.

The first step will be for the EAC to review and assess your
recommendations and consider what modifications, if any, we may wish to
make before submitting our proposed guidelines to the EAC Board of
Advisors and Standards Boards. HAVA requires each board to review and
comment on EAC\'s proposed guidelines.

At the same time, we will publish a notice in the federal register
inviting the public to comment on the proposed guidelines. We anticipate
that a 90-day public comment period will be provided given the volume
and the scope of the materials to be reviewed. There will also be a
public hearing conducted on the record during the comment period. We
will be reviewing public comments as received so that we can produce the
final version of the guidelines as quickly as possible after the comment
period has ended. We will also review and incorporate as appropriate
comments provided by the Board of Advisors and the Standards Board.
After all comments have been reviewed and acted upon, the next step is
for the commission to vote on the adoption of the guidelines followed by
publication of the final guidelines in the federal register.

Also at this time, as Section 221 of HAVA directs, the TGD \-- the
document that you produce from this meeting will be published in the
federal register so it can be compared \-- the initial recommendation
can be compared with the final guidelines. We envision this entire
process to be concluded towards the end of August of this year.

Tomorrow, I will be speaking in Vienna, Austria, about your work as I
will be leading a U.S. delegation that is participating at a conference
of officials from 55 nations that is discussing election technology
issues. Many of these officials are aware of your work and are following
it very closely in this website. And they are looking to use some of
your recommendations in their country. They\'ve told them \-- they\'ve
told that to me themselves. So I\'m here to tell you that your work \--
the work that you do will have implications beyond U.S. borders.

On behalf of my fellow commissioners and your fellow citizens of the
United States, I would like to once again express our sincere thanks to
all of you for this tremendous service and time that you\'ve put in to
provide more confidence in our system of democracy to the voters of the
United States of America. So thank you for what you do, thank you for
the time you\'ve put in, and we look forward to receiving your work
product. Thank you.

MR. CHAIRMAN: Thank you, Vice-Chairman DiGregorio for your comments. We
very much appreciate them.

I will now introduce three procedural resolutions for adoption that I
believe will assist the TGDC in accomplishing our work at this meeting.
The resolutions are in your workbook. It\'s the last tab in the first
set. Says proposed new resolutions. And they\'re numbered 37-05, 38-05,
and 39-05.

If you allow me, I would like to read the first resolution. Resolution
Number 37-05. Work product instructions to chair and staff of National
Institute of Science and Technology. It reads as follows: The Technical
Guidelines Development Committee intends to consider and adopt sections
of the final draft of the initial recommendations to the Executive
Director of the Election Assistance Commission during its April 20 and
21, 2005 meeting. Each section of the final draft is to be presented by
a NIST staff member followed by a question and answer session.
Immediately thereafter, specific proposals for changes to that section
will be entertained by the TGDC. The chair will attempt to reach
unanimous consent for suggesting changes. If unanimous consent is not
reached, a TGDC member may make a motion and a recorded vote will be
taken on the matter. At the conclusion of the consideration of each
section, a vote will be taken to adopt the entire section as revised by
motions adopted through unanimous consent or recorded vote. At the
conclusion of the meeting, the TGDC chair will assign NIST staff members
to revise the sections as required by votes of the TGDC. The TGDC chair
will supervise this process to assure that revisions reflect the intent
of the TGDC as expressed in its votes and resolutions. In supervising
the revision process, the TGDC chair shall not depart from technical
decisions made by the TGDC. Initial recommendations to the Executive
Director of the EAC shall consist of the adopted sections as revised by
NIST staff under the supervision of the TGDC chair. The TGDC chair is to
deliver this work product to the EAC.

Because the work product will have been developed under a tight
statutory schedule, the TGDC expects that minor and non-substantive
drafting errors may have occurred. Based on inputs from the TGDC
members, NIST is requested to compile all of the corrections in a
supplement which shall be delivered to the TGDC and EAC at an
appropriate time.

Do I hear a second for this motion?

MALE: (indiscernible)

MR. CHAIRMAN: We have a second.

Any questions \-- I guess I shouldn\'t be \-- do I hear a motion
supporting? And Dr. Schutzer (phonetic sp.) second it, so.

Do we have comments/questions on this motion? This basically formalizes
the procedure that Mr. Burkhardt explained so there is nothing new about
\-- we just want to make sure everybody on this \'stands that we will
not, in fact, have a lot of time for reiteration and \-- given the time
constraints, so any comments?

Okay. Hearing none, we\'ll take a roll call. Mr. Burkhardt?

MALE: Williams. Williams votes yes. Berger?

MALE: Yes.

MALE: Berger votes yes. Caldez? Caldez is absent. Craft?

MALE: Yes.

MALE: Craft votes yes. Davidson?

FEMALE: Yes.

MALE: Davidson votes yes. Elekes? Elekes?

MALE: Yes!

MALE: Elekes votes yes. Harding?

MALE: Yes.

MALE: Harding votes yes. Miller?

FEMALE: Yes.

MALE: Miller votes yes. Purcell?

FEMALE: Yes.

MALE: Purcell votes yes. Quesenbery?

FEMALE: Yes.

MALE: Quesenbery votes yes. Rivest?

MALE: Yes.

MALE: Rivest votes yes. Schutzer?

MALE: Yes.

MALE: Schutzer votes yes. Semerjian?

MR. CHAIRMAN: Yes.

MALE: Semerjian votes yes. That\'s 12 votes in favor.

MR. CHAIRMAN: Thank you. The \-- the resolution has been adopted.

The next resolution, Number 38-05. Procedural resolution regarding
grandfathering. It reads as follows: Pursuant to HAVA, the TGDC will
recommend voluntary voting systems guidelines to the EAC. The VVSG
recommended may not include all practices currently followed or
technologies currently utilized by election administrators.
Consequently, existing practices in some jurisdictions may not be in
compliance with the VVSG. The TGDC finds that whether such practices or
technologies not contained within the VVSG should be grandfathered is a
policy question not within the jurisdiction of the TGDC and not within
the statutory duties of NIST.

MALE: I\'ll second for second discussion.

MR. CHAIRMAN: Any questions or comments? I think this was \-- this
resolution was put forth to address some of the concerns expressed by
some of the TGDC members in between this meeting and the previous one.

Yes, (indiscernible).

MALE: (indiscernible)

MALE: Microphone!

MALE: Thank you, sir. Because fulfilling our 2006 elections and not
discrediting some of our election environments, could we just have some
greater clarity of what this means for the general public and what the
expectation (indiscernible) so that we\'re all on board here in
understanding the implication of what we are expressing than \-- that,
in fact, it is not in our pro view but rather the EAC?

MR. CHAIRMAN: Yes, I think that \-- that\'s the general idea that this
is not a policy-making body. We provide the technical guidelines. Any
exceptions or grandfathering that needs to be done, that can only be
decided by the EAC based on our own view. This body is not in a position
to grant such exceptions, so I think that is the main point. Do you feel
that we need to add something to this or is that clarification
sufficient?

MALE: Well, it\'s sufficient for me, sir, but others may have other
comments.

MR. CHAIRMAN: Mr. Craft.

MALE: Yes, I guess my problem is with the second sentence both in the
way it\'s worded and perhaps in the actual fact, and that\'s a part that
I would like to see clarified. That the voting system guidelines
recommended may not include all practices currently followed or
technologies currently utilized. I think it\'s been made abundantly
clear by Congressional intent and the discussions we\'ve had in prior
meetings that what we want the guidelines to do is to include current
best practice. We do not want elements in this particular standard which
do not currently exist and which are not currently deliverable to
election administrators who are trying to buy equipment for the January
1, \'06 election cycle. So if there are elements here which can\'t be
met, leaving them in under the argument that we\'re going to leave the
policy decisions in grandfathering to the EAC is, I think,
inappropriate. I think this committee needs to make sure that, in fact,
everything in the initial version 1 that we endorsed today reflects
stuff that is real, that can be implemented, and that can be implemented
in short order across the country.

MR. CHAIRMAN: Yes, Dr. Schutzer.

MALE: I don\'t think what this says violates that. I mean, this is, I
guess, recognizing the fact that there may be some districts that are
currently practicing or currently have equipment which in the judgment
of TGDC is not up to spec with the current best practices and the
current technology that you can get today. And so, therefore, they may
find themselves out of compliance with the current specification. We
don\'t think we should be influenced by what they currently have or how
they currently practice. We think we should be influenced by what we
think is the current best standards, the current technology today. It\'s
not our place to decide whether they get a waiver or not. That\'s what
we\'re saying. And this says \-- doesn\'t say current best practice.
This says may be practicing, may have technology that is not recommended
and not compliant.

MALE: I agree with what you say, sir, but I think the resolution needs
to say that in place of the current language. The current language
leaves open (indiscernible) and standards that simply cannot be complied
with and I think it needs to be more clear as to that.

MR. CHAIRMAN: Excuse me.

FEMALE: I think I just wanted to agree with what Mr. Schutzer said which
is I think there is a big difference between existing equipment or
existing practices that could be followed today if you chose to do so
and theoretical or speculative ideas about what we might be able to do
in the future and I think the first is well within our purview,
certainly for VVSG version 1. And I think that we discussed this in the
past, that we would be basing our current \-- the current version 1
standards on existing and available options but not necessarily those
that are in use at all \-- in all jurisdictions.

MALE: (indiscernible)

MALE: How \'bout something, let me try some word snipping and see if
you\'d be okay with it. Let\'s say we preceded this sentence with saying
something like \"although the.\"

MALE: Exactly where are we?

MALE: At the end of the first sentence, so right before the.

MALE: After VVSG? No.

MALE: After EAC.

MALE: After EAC.

MALE: Yeah.

MALE: Okay.

MALE: So we might say \"although the VVSC isn\'t \-- was developed based
upon current practices and current available technology, the
recommendations may not include\" then go on to the rest. Is that okay?

MALE: Yes, that would be acceptable.

MR. CHAIRMAN: But then \-- but then how? Okay did you capture?

MALE: I didn\'t get after VVSG.

MR. CHAIRMAN: Could you read again Dr. Schutzer?

FEMALE: (indiscernible)

MALE: Although the VVSG was developed \--

FEMALE: Developed.

MALE: \-- to include \-- to be based upon current best practices and
best available technology, and then the rest stays the same.

FEMALE: Best practices.

MALE: To include.

FEMALE: And technology.

MALE: Based on. Develop based on.

FEMALE: (indiscernible)

MALE: Current practices, I think it was.

MALE: Yes.

FEMALE: Okay.

MALE: Excuse me, Chair, James Elekes.

MR. CHAIRMAN: Yes, go ahead Mr. Elekes.

MALE: Thank you. That sentence that you read back in its entirety, I
have someone here who\'s doing electronic Braille copy for me and \--

MR. CHAIRMAN: Yeah, as soon as we complete the typing \-- \[laughter\]
will just take a few minutes, we\'ll read back.

MALE: I appreciate that. Thank you.

FEMALE: On current practices.

MALE: Gotcha.

MALE: Got it.

MALE: All right. That\'s it.

FEMALE: (indiscernible)

MALE: And available technology?

MALE: (indiscernible)

MALE: Just a small editing change makes (indiscernible)

MALE: May can be interpreted as shall. Which might be the opposite of
what you (indiscernible).

MALE: Okay.

MALE: Were we going to have the word current technology? Or currently
available technology?

FEMALE: Just best practices (indiscernible).

MALE: Current best practices \--

MALE: And available technology.

MALE: And available technology.

MALE: Yes.

MR. CHAIRMAN: Okay and then after that, there\'s a comma, I guess, after
technology.

MR. CHAIRMAN: Okay. The motion reads now: Pursuant to HAVA, the TGDC
will recommend voluntary voting system guidelines to the EAC. Although
the VVSG was developed based on current best practices and available
technology, the recommendations might not include all practices
currently followed or technologies currently utilized by election
administrators. Consequently, existing practices in some jurisdiction
might not be in compliance with the VVSG. The TGDC finds that whether
such practices or technologies not contained within the VVSG should be
grandfathered is a policy question not within the jurisdiction of the
TGDC and not within the statutory duties of NIST.

MALE: Got it.

MR. CHAIRMAN: Are we comfortable with that? J.R., did you have a
comment?

MALE: That\'s fine with me now, sir. I think it speaks more clearly to
encouraging those states that have already raised the bar of performance
and expectation while also recognizing that a number of states have a
long way to go.

MR. CHAIRMAN: Thank you.

MALE: (indiscernible)

FEMALE: (indiscernible)

MR. CHAIRMAN: Do we have unanimous consent on this \-- is everybody in
favor, or do we have any objections? If not, I\'ll declare unanimous
consent and the resolution is adopted as modified. Thank you.

The next resolution, Number 39-05, voter-verified paper audit trail
assignment. It reads as follows: The TGDC recognizes that voter-verified
paper audit trails have been developed in some jurisdictions without
formal requirements. The TGDC is aware that some states currently
require or intend to require use of VVPATs.

Actually, I have made a minor editorial here. I have added at the
beginning of the paragraph, second paragraph \"at its January 18^th^
meeting.\" I just wanna make it clear because it was not in our last
meeting; it was the previous meeting, so I just added \"at \-- at its
January 18^th^ meeting\" the TGDC received a request from the EAC to
develop VVPAT formal requirements for use by states in election
jurisdictions that have chosen to require VVPATs so that those states
can more effectively implement VVPATs. Subsequently, the TGDC instructed
NIST to develop and submit VVPAT formal requirements as a part of its
voluntary voting systems guidelines technical assistance work product.
Neither the TGDC nor NIST express any opinion regarding the use of
VVPATs as an independent verification process nor do they endorse the
use of the VVPAT approach.

Do I hear a?

MALE: Second the purpose of discussion.

MR. CHAIRMAN: Okay. Thank you.

Yes, Dr. Williams.

MALE: I would like to suggest that the word \"formal requirements\" \--
the two words \"formal requirements\" in two locations be changed to the
single word \"guidelines.\" I \-- I believe this is more in keeping with
the semantics that we\'re currently using on those.

MALE: (indiscernible)

MALE: I agree with Dr. Williams.

MR. CHAIRMAN: Are we in general agreement on the change? Do we have any
comments?

MALE: I have a question.

MR. CHAIRMAN: Yes, Dr. (indiscernible).

MALE: The last phrase here, \"nor do they endorse these, the VVPAT
approach\" the committee here is not in a position to be endorsing
technologies per se. This last phrase seems a little bit strange and I
think just eliminating the \"nor do they endorse the use of the VVPAT
approach\" could be eliminated without harm.

MR. CHAIRMAN: Yes, Ms. Davidson.

FEMALE: You know, I \-- I understand what you mean, but I \-- I disagree
because with this not having standards in there for the ones without the
voter-verifiable paper, it looks like the standards are supporting this
right now. We\'re addressing the other in version 2 and I think that a
statement like this needs to be made so that that\'s not an indication
that\'s where this committee\'s coming from. \'Cause it, by perception
right now, looks like it.

MR. CHAIRMAN: Mr. Craft?

MALE: And I think regardless of the other documents and our records of
discussions on this after this work (indiscernible) on the street, there
will be people trying to construe it to require VV \-- VVPAT. So I think
clearly stating our intent is appropriate.

FEMALE: Well, perhaps \--

MR. CHAIRMAN: Ms. (indiscernible).

FEMALE: Perhaps we\'d like to word it more neutrally; that is that we
neither endorse nor deprecate the approach. Probably not the right word,
I\'m sure. Parliamentarian has a better one, but if the intent is to say
that we\'re providing guidelines for a technology that\'s in use in
states and for which various states have, in fact, expressed interest in
having guidelines, that\'s fine, but having only the negative suggests
that we\'re not endorsing it rather than saying we\'re simply taking no
position on it.

MR. CHAIRMAN: Would it be better to simply, maybe, after the
verification process, put a semicolon \"this does not constitute an
endorsement.\"

FEMALE: Or maybe \"the TGDC takes no position on VVPAT as a \-- as an
approach.\"

MR. CHAIRMAN: Dr. Williams and then.

MALE: I don\'t want to get ahead of ourselves and talk about specific
documents we\'re going to be talking about, but I\'d like to suggest
this \-- this resolution be withdrawn at this time and brought up again
after we have looked at what sort of guidelines we\'re recommending.
Because, as I read this, if it stay \-- if it stands the way it\'s
written right now, I think that the \-- that the implication is very
much that we are endorsing VVPAT and if we\'re not, we need to
emphatically state that. So I\'d \-- I\'d like to suggest that we simply
withdraw this right now and then bring it up after we have discussed
that portion \-- that portion of the document. Then I\'ll know more what
we\'re talking about.

MALE: Rather than endorse or not endorse, maybe another way around this
is to say that unlike the other parts specification. I\'m a little
long-winded, but we can succincter view of the gist of what I was going
to say. I like the other parts of the specification when you provided
specification and you\'re either in compliance or not in compliance.
This particular area, if one chooses not to implement VVPAT, then
they\'re not out of compliance with the specification. If they choose to
implement VVPAT, then they need to be in compliance with that section.
And that\'s, I think, essentially what we\'re saying. We\'re not
requiring it for compliance. You can \-- you can have a compliance
system without VVPAT. If you choose to implement VVPAT, then this
particular section is applicable. In \-- in fact, if you were to put it
that way, the specification \-- and indeed, you might not need the
resolution, but if you still felt comfortable having a resolution for
some of the reasons that was discussed, you might use language along
those lines rather than endorse or not endorse.

MR. CHAIRMAN: Yes.

FEMALE: Would it be appropriate to \-- to table this for a while and
allow our parliamentarian to draft this carefully rather than trying to
wordsmith it in this group session?

MR. CHAIRMAN: Okay, I think the \-- we\'ll table this motion for now.
We\'ll make the changes to capture the spirit the comments made here and
then we\'ll bring it up again after the discussion of the VVPAT part of
the guidelines, the version 1. Okay. Thank you.

At this time, then, I call on Mr. Mark Scull (phonetic sp.) of NIST
Information Technology Laboratory to provide an \--

MALE: Mr. Chairman.

MR. CHAIRMAN: Oh!

FEMALE: (indiscernible)

MR. CHAIRMAN: Sorry. Resolution Number 40-05. Title is EAC
(indiscernible) of initial recommendations. The Technical Guidelines
Development Committee recognizes that it will deliver its first set of
recommendations to the Executive Director of the Election Assistance
Commission (phonetic sp.). And then shortly thereafter, such
recommendations will be reviewed by the EAC and its Board of Advisors
and Standards Board. The TGDC is aware of individuals and organizations
that wish to provide comments on the recommendations and is further
informed such individuals and organizations may not understand how they
can effectively provide such comments. The TGDC, therefore, recommends
that the EAC announce how and when comments on the initial
recommendations may be provided to the EAC for its consideration.

Do I hear a motion?

FEMALE: I \--

MALE: (indiscernible)

FEMALE: Yes, I think coming \--

MR. CHAIRMAN: Well, yes, I think this is certainly consistent with what
Vice-Chair DiGregorio (phonetic sp.) mentioned. I think this was \--
making sure \-- this was formalizing that sort of \--

FEMALE: Yeah.

MR. CHAIRMAN: \-- everybody knows and it\'s part of the record.

FEMALE: Yes, I was going to say coming on the heels of the excellent
presentation, thank you very much, Commissioner DiGregorio, it seems a
little anticlimactic, but we have \-- several members of this committee
have been receiving comments from people who were not sure how to
effectively submit comments and I just wanted to make that point. I\'m
\-- I\'m sure that the EAC, as they have been very concerned as we have
been with the transparency and openness of this process, will be widely
publicizing opportunities for comments.

MR. CHAIRMAN: Yeah. Perhaps after that presentation, this is a statement
of the obvious, but sometimes \-- since not everybody\'s here \--

FEMALE: \[laughing\]

MR. CHAIRMAN: \-- it may be useful to make this part of the record. Any
other questions, comments? Did I hear a second?

MALE: Second.

MR. CHAIRMAN: Any other questions, comments? Do we have a unanimous
consent? Any? All in favor.

MALE: Aye.

MR. CHAIRMAN: Any opposed? Okay. We have a unanimous consent; the
resolution is adopted. Thank you very much.

Okay, now I can call on Mr. Mark Scull of NIST Information Technology
Laboratory to provide an overview of voluntary voting system guidelines,
VVSG version 1. Mr. Scull?

MALE: Mr. Chair.

MR. CHAIRMAN: Yes, Mr. (indiscernible).

MALE: Can I do a quick point of order?

MR. CHAIRMAN: Sure.

MALE: I have a question in my mind how the necessary number of votes to
pass a resolution was computed in view of the fact that we have a vacant
position rather than simply a member not in attendance.

MR. CHAIRMAN: I will turn to our parliamentarian. Mr. Burkhardt.

MALE: Yes. Generally speaking, under federal advisory committee
guidelines, the requirement would be a majority of those who are capa
\-- majority of the slots which are available.

MALE: Mr. Chairman, Mr. Burkhardt\'s gonna to step up to the mike
\'cause you\'re not being heard from the teleconference.

MALE: Course, in terms of the majority that would be required, the first
thing we would look to is the statute as to whether the statute provides
any guidance as to what the majority is that\'s required. The statute,
of course, is silent on the issue, so then we would default to Roberts\'
Rules of Order. Roberts\' Rules of Order would require in a situation
such as this that there be a simple majority of those who are appointed
to the commission; however, I can take that under advisement and take a
look at that. Generally speaking, that would mean that eight votes would
be required as a simple majority of the members of the commission. The
\-- there is one vacancy on the commission due to a resignation and
there is a second person who has not been replaced, so the membership of
the commission right now would be 14 people. And a simple majority of 14
would, of course, be half, 7, plus 1, which would make 8. So I believe
that 8 would be required, really, under any scenario in this case
because we have an open vacancy which has not been replaced in the case
of one person. Thank you.

MR. CHAIRMAN: Thank you, Mr. Burkhardt. Mark?

MALE: Thank you, Dr. Semerjian.

I\'d like to just give the TGDC an overview of the Voluntary Voting
System Guidelines version 1. First a little background. VVSG version 1
constitutes the initial set of recommendations mandated by HAVA. HAVA
asked that the initial set be delivered to the EAC 9 months after the
formation of the TGDC. VVSG version 1 is intended to assist the states
in preparing for the 2006 election. It augments the VSS 2002 to address
the critical areas of security, accessibility, and usability, so it
essentially fills in the gaps to the VSS 2002 and makes it usable for
the 2006 election. And it literally augments the \-- the VSS 2002, so
what you have in front of you is the VSS 2002 with many additional
pages, probably 150 or 200 additional pages that were provided by the
NIST (indiscernible) team.

VVSG version 2 will be a complete redesign of the 2002 standard. It will
be much more comprehensive, and we will rewrite existing requirements
when necessary to make them more precise and testable.

Changes required by VVSG version 2 cannot be implemented and tested in
time for the 2006 election, so we have this dual strategy. Version 1,
which will be available in time to \-- to help states run the election
2006 is really an interim standard; version 2 will be the more permanent
standard, the long-range redesign and future standard.

There are many areas that are addressed and enhanced in VVSG version 1.
There\'s a conformance clause, the human factor section, there\'s a
security section which has 4 subsections, there\'s a new glossary, a
redone section on error rates, a new appendix called Best Practices for
Voting Officials, the voting process is alluded to differently in the
new sections, and the structure of the requirements for the new sections
are different. So I\'m just going to go through these one-by-one
quickly. You will have detailed presentations on each of these the rest
of today.

VS 2002 did not contain a conformance clause. Conformance is defined as
fulfillment by a product, process, or service of specified requirements.
And the conformance clause is high-level discretion of who shall conform
and what is required. Conformance clause, we believe, is fundamental to
a standard. We\'ve \-- we\'ve worked on many, many standards committees;
they all have conformance clauses. You need to know who the standard
applies to and what is expected of them so that, in fact, when you
develop tests and run these tests, you understand the criteria for when
the implementation passes and fails.

Human factors. VSS 2002 Section 227 addressed accessibility and Section
349 addressed human engineering. VSS 2002 also contained Appendix C on
usability and two (indiscernible) technical guides. The VVSG version 1
contains a new Section 227 addressing human factors consisting of
accessibility, usability, and limited English proficiency, and this
replaces old Section 227 and 349 as well as Appendix C.

Security. VVSG contains a new section, Section 6.0 on security which
consists of 4 subsections, including an overview. The overview is an
informative section which means it\'s not normative. One \-- it doesn\'t
\-- nothing in the section has to do with conformance. There are, in
fact, no requirements in that section. The overview explains the VVSG
approach to security which essentially is independent verification.
Future versions like VVSG version 2 will have requirements for this
section. We \-- we thought about this long and hard, actually, about
whether to put requirements into VVSG version 1 for many of the other
types of verification besides VVPAT. We were sensitive to, as the
committee expressed, perhaps a misperception that by including VVPAT, we
were tacitly endorsing it. We \-- we clearly are not; we take no
position on it, and we want to put other methods of verification in to
\-- to reinforce that point. We did not want to put requirements in for
the other methods, however, for at least two reasons. Number one, we
have not done, we believe, all of the research necessary to be sure that
these requirements are, in fact, correct and that\'s one thing we will
not do; we will not put requirements in if we have not completed our
research to make sure they\'re correct. Secondly, putting requirements
in for \-- for many of the other technologies would be so onerous as to
make them impossible to be implemented by 2006, and again, VVSG version
1 is intended for the 2006 election. So those requirements as a
consequence, the detailed requirements for those other sections on
security will be put into VVSG version 2.

Voter-verified paper audit trails. Again, I\'m hopefully repeating what
the TGDC has just expressed. VVSG does not require or endorse VVPATs.
VVPATs are one method to achieve independent verification. Other methods
exist which are explained in the overview. The requirements are provided
so that states that choose to implement VVPAT can implement them
effectively, and I think Dr. Schutzer expressed it exactly right. There
is no requirement to have VVPAT, but if you do have VVPAT, what the
standard does is to say to conform, you need to do it according to the
requirements we put in, so if you have VVPAT, follow these requirements.
There is, in fact, no requirement to include VVPAT.

TGDC conclude that wireless technology introduces severe risk and should
be approached with extreme caution. VVSG includes a special section on
wireless that augments the general telecommunications guidelines in
Section 5.

VSS 2002 contain requirements to support validation of software and set
up of voting systems. The new section augments the VSS 2002 and also
includes use of our national software reference library as well as other
mechanisms.

Glossary. VSS 2002 had a glossary, a very fine glossary. We\'ve enhanced
that glossary. The new glossary contains terms from the VSS 2002 as well
as many new terms needed to understand voting. Each term in the new
glossary contains a definition and its source as well as an association.
The glossary is also available online and \-- and I think when we get to
the glossary section, you\'ll see an online demo. And allows searches by
the term itself, by the source, for instance, VSS or HAVA or IEEE or
searches by association so you can find things related to, for instance,
security or testing. The website is also listed.

Volume 2, Appendix C in the 2002 VSS sets certain error rates for voting
systems. Appendix C has been modified in the VVSG to revise the
procedures to test that systems meet the indicated error rates. This
applies to errors introduced by the system and not by a voter\'s action.
More research is needed to develop standards for error rates that
account for \-- for human actions.

VSS 2002 contain requirements essentially for voting systems and testing
entities. There were requirements for other words there, but \-- but
essentially they were equivalent to these two terms. The requirements in
the VVSG for many areas including wireless, VVPAT, human factors, depend
on voting officials developing and carrying out appropriate procedures
as well as having the correct voting systems and the correct testing
procedures. So VVSG contains the best practices for voting officials.
These best practices are actually contained in line when we \-- when we
develop each of the requirements. We actually have a section called
Responsible Entity where we list voting systems testing entities as well
as voting officials. We pull out all the voting official references and
put them in the Best Practices Appendix C. These requirements are not
testable; they do not have anything to do with conformance. They are, in
fact, guidance for voting officials, and they\'re contained again in
Appendix C of Volume 1.

VSS 2002 define three major stages of voting: pre-voting, voting, and
post-voting. The new sections we\'ve written designate which stage each
requirement pertains to. VVSG version 2 will contain a much more
detailed voting process model and hopefully if we get to that tomorrow,
you will hear about it in detail.

The new sections of the VVSG contain a much more structured approach.
Each requirement is numbered according to hierarchical scheme.
Higher-level requirements are supported by low-level requirements, so
227, which is Human Factors, 2271 would be Accessibility, the first
requirement under Accessibility would be 22711 and so on. High-level
requirements may not be directly testable, but they can be indirectly
tested via their lower-level requirements, so essentially we have a tree
structure. The leaves of the tree are directly testable and the
higher-level requirements are testable by summing up the leaves that are
\-- that are under that particular branch.

My last slide has to do with the grandfathering issue which we discussed
this morning. I just wanna say a few more things about it. This issue
came in response to some questions from TGDC members and basically, we
decided that it\'s not the purview again of the TGDC to make
grandfathering decisions. The EAC can handle these. I just want to point
out this is not a one-time issue; this will happen every time there\'s a
revision to the standard. I just wanna say one other thing to \-- to
balance this and give a little bit of our thinking for how we decided
what requirements to put into VVSG version 1. We need to take this
instruction and counterbalance it by the fact that we did not put
requirements in for two reasons. Again, one, if our research was not
concluded, we would not put requirements in. And again, secondly, we
want to make sure that everything we put in is doable by the 2006
election. There may be things that need to be changed, but if things are
so onerous that to change them would be so dramatic they couldn\'t
possibly be done by 2006 election, we did not include them. So that\'s a
little bit of our strategy and philosophy.

I think that\'s my last slide. Any questions? Yes, Mr. Craft.

MALE: Yeah, I just \-- I \-- I have a little problem with the sticker on
the front page and basically for those of you that don\'t have a hard
copy of the document, it states \"This document is a work product of the
Technical Guidelines Development Committee which received technical
assistance from the National Institute of Standards and Technology. I
think for the sake of historical accuracy, the work product \-- the work
product of the Technical Guidelines Development Committee thus far has
been the resolutions the committee has passed. The document before us is
very much a work product of NIST which over the next two days, perhaps,
major pieces of it will be adopted by the TGDC and it will endorse
those. But I think, very clearly, we need to differentiate between the
committee\'s work product which is strictly its resolutions and in this
work product which is the deliverables that NIST has created in response
to the resolutions.

MALE: Thank you. Our esteemed parliamentarian ruling.

MALE: Yes. Your comment is taken very, very well that \-- that sticker
was drafted for the work product which you will adopt today, so \-- and
has been applied, if you will, probably prematurely to this particular
document. So that would only be accurate with respect to those work
products which you actually adopt today.

MALE: Okay.

MALE: So. We\'ll \-- we\'ll make sure that doesn\'t go out in any kind
of a public release. That was something we put on these paper releases
because we did not want anybody to look to these materials as being
authoritative unless and until you folks adopted them and the EAC
themselves adopt them as well.

MALE: Okay, well, I guess my concern is since the documents now exist.

FEMALE: Can\'t hear you.

MALE: Since the documents now exist, since they may be archived and flow
into the (indiscernible), we need to make it very clear on the record
that application of that sticker is an error.

MALE: I\'ll draft up a brief resolution that you can read into the
record to that effect. Thank you.

MALE: (indiscernible)

MR. CHAIRMAN: Thank you. Any other questions, comments?

MALE: Dr. Semerjian, can I just add one \-- one thing to the response? I
agree with you Mr. Craft. I just want to add one thing, though. These
\-- we have done these things not in a vacuum and in many cases, we\'ve
gotten input from TGDC members, subcommittee chairs to give us advice on
how to write redraftings, but \-- but I agree with your comment. I just
want everyone to know this was not done in a vacuum, was certainly done
in cooperation with various TGDC members and committees.

MALE: Okay.

MR. CHAIRMAN: Any other comments?

We were scheduled to take a break now, but we\'re actually ahead of
schedule so I \-- I propose that we go on with the next presentation and
then take a break. So at this time, I call on Ms. Lynn Rosenthal
(phonetic sp.) of NIST Information (indiscernible) Laboratory to present
the report on the conformance clause for VVSG version 1. Lynn?

FEMALE: Thank you. Good morning. Actually, it\'s better going before the
break.

Since the conformance clause comes at the beginning of the VVSG version
1, I get to go first and provide for you a overview of what this new
section is. It\'s Section 1.7. It replaces the old 1.7 which now becomes
1.8, which is basically a table of contents of this section.

So, today, what I\'d like to do is \-- is give you an overview of the
conformance clause, go through the various sections, point out any
changes from the previous version that you saw at our last plenary.
Basically, there is no major drastic changes here. Most of the work was
a clarification or refinement of the text that was there before we
filled in some of the holes. We\'ve maybe adjusted the organization of
the document to the way it\'s presented in the conformance clause. We
added a new section, but it shouldn\'t be a major supr \-- surprise
because before we had a placeholder for this section, it was called
\"Conformance Model\" so the name change and we renamed some of the
sections and moved some things around.

So, to start with, is the first subsection which is \"Scope and
Applicability.\" This basically sets the stage for the rest of this
clause and the whole VVSG version 1. It talks about having requirements
that are imposed or applied to voting systems and voting system vendors.
There are requirements that are imposed on test authorities. This may be
and is \-- is specifically directed at the EAC accredited test
authority, but it could be used by any other test authority. And
finally, as Mark pointed out, there is guidance for voting officials.
Again, these are meant as best practices; it\'s not subject to testing,
and it really serves as an adjunct to the technical requirements as
you\'ll hear more through the other presentations dealing with human
factors and security. We tried to be very clear about this, up front.

The next section is actually a rework and reorganization. We \-- the
previous version it was the sections entitled \"Who and What May
Conform\" and \"The Conformance Model.\" And the conformance framework
basically puts together what \-- what your conformance model is \-- is
what some people think of it as various parts. In particular, it
addresses the applicable entities who is this targeted to, the
relationship among those entities, and the conformance designation. So
the applicle \-- applicable entities we had before, those that you would
expect, new section is a description of how these entities interact and
the relationship among them, and we added a picture just to illustrate
the description of the text. And then finally, a new section called
\"Conformance Designations.\" This is basically to \-- to reaffirm that
voting systems, if all the mandatory requirements that apply to that
voting system are met, then the voting system would conform. That
there\'s no concept of different levels of conformance or different
degrees of conformance, conformance doesn\'t have various names
depending on \-- on what you do, for instance, there\'s no notion of
hardware conformance versus software conformance versus human factor or
security conformance, et cetera. And that there\'s no concept of partial
conformance, in other words, a voting system cannot conform 80% or be
80% conforming. It\'s \-- it\'s an all deal. You do or you don\'t.
That\'s it.

The next section is pretty much what was there before. There are several
keywords. Shall is (indiscernible) \-- is encouraged or should, may.
Normative text has to do with conformance, and we\'ve added some words
regarding informative parts of the VVSG version 1. Informative parts
would be things like examples, extended explanations within the
requirements, the text prefixed by responsible entity process and
discussion. Informative parts have no bearing on conformance and we\'ve
tried to, where possible, identify the difference between the two
informative or normative sections.

Categories \-- categorizing requirements. This, in the previous version,
was called \"Subsets for Voting Systems\" is pretty much the same, did
clean up the text a little bit to try to make it clearer. The VV \-- the
2002 VSS actually used the word \"categorizing requirements\", so to be
consistent, we \-- we went to that \-- that title. It\'s basically the
idea of grouping requirements according to requirements that pertain to
a certain type of equipment or a certain component or a certain
capability and that if the voting system does not have that capability
or is not that equipment type, then, of course, those requirements would
not apply.

Extensions and Implementation Statement were in the previous version and
these sections have not changed. That would be it. Mr. Chairman.

MR. CHAIRMAN: Thank you, Ms. Rosenthal. Any comments? Before we start,
actually, it was suggested that we want to make sure that we capture any
changes that you may propose. It may be easiest to write down your
proposed change in your hard copy so that one of our staff will come and
get that from you and then produce it on the screen and then will return
it to you. So that way, it will capture accurately and a little more
efficiently any changes anybody may suggest, so, any \-- Mr. Craft.

MALE: I had no suggested changes.

PARTICIPANTS: \[laughter\]

MALE: Well, that\'s a welcome change!

MR. CHAIRMAN: Any other comments?

FEMALE: It\'s nice to start off this way. \[laughing\]

MR. CHAIRMAN: Is there a motion \-- a request for unanimous consent on
this?

MALE: Also move.

PARTICIPANTS: \[laughter\]

FEMALE: I\'ll second.

MR. CHAIRMAN: Okay. We are motion, a second.

MALE: You actually have to read that for people.

MR. CHAIRMAN: Okay.

Okay, I\'m told that I have to read this for legal reasons, so, there
being no further motions to change VVSG version 1, Volume 1, Section
1.7, I will now entertain a motion for the TGDC to adopt this draft of
Section 1.1 \-- 1.7 as part of its first set of recommendations to the
Executive Director of the EAC, subject to changes expressed in any
motions we have adopted today that expressly apply to Section 1.7 which
changes shall be made pursuant to TGDC Resolution Number 3705. So do I
hear a \-- I guess I did hear a second? And \-- and at this point, I\'ll
take a \-- we\'ll take a roll call. Mr. Green? (phonetic sp.)

MALE: Williams?

MALE: (indiscernible)

MALE: Williams votes yes. Berger?

MALE: Yes.

MALE: Berger votes yes. Craft?

MALE: Yes.

MALE: Craft votes yes. Davidson?

FEMALE: Yes.

MALE: Davidson votes yes. Elekes?

MALE: Yes.

MALE: Elekes votes yes. Harding?

MALE: Yes.

MALE: Harding votes yes. Miller?

FEMALE: Yes.

MALE: Miller votes yes. Purcell?

FEMALE: Yes.

MALE: Purcell votes yes. Quesenbery?

FEMALE: Yes.

MALE: Quesenbery votes yes. Rivest?

MALE: Yes.

MALE: Rivest votes yes. Schutzer?

MALE: Yes.

MALE: Schutzer votes yes. Semerjian?

MALE: Yes.

MALE: Semerjian votes yes. 12 votes in favor.

MR. CHAIRMAN: Well, the resolution has been adopted. I think we\'ve
taken a big step for this TGDC committee formally adopting this 1 \--
Section 1.7.

I declare that we\'ve earned a break here \[laughter\] so we will take a
\-- a 20-minute break and we will start at 10:40. Please come back in
time so that we get going quickly. Thank you very much.

MR. CHAIRMAN: If everyone can take their seats, we\'ll get started.
We\'re still missing a couple of members. Guess we\'re missing.

FEMALE: I didn\'t see him out there. Alan? Is this someone else\'s
water?

MALE: It\'s clean water.

FEMALE: Excellent.

MR. CHAIRMAN: All right, we\'ll proceed. At this time, I call on Dr.
Sharon Leskowski (phonetic sp.) of NIST Information Technology
Laboratory to present the report on human factors requirements in VVSG
version 1. Dr. Leskowski?

FEMALE: Thank you. Before I start, is there going to be a little
discussion of the editing process? If there\'s \-- if there\'s changes
or?

MR. CHAIRMAN: We\'ve been discussing how to do this most efficiently and
the suggestion is that we \-- if there are specific changes, suggest
that first of all, you please write it down on your hard copy. We will
try to address them and come to an agreement, you know, but once we
(indiscernible) there are several of these. Before we vote on the entire
section, what we will do is we will take those changes, create a
modified version of the \-- of those modifi \-- of those pages, and then
take a vote on the entire section so that when we vote on it, we know
what we\'re voting for and you actually can see the changes made so that
there\'s no debate later on so \-- which means that we will \-- we \--
in some cases, we will discuss one particular section, have discussion
and some changes, but we will not take the final vote on that until
later, so we\'ll proceed to the next section, and then once the document
is modified, we will come back and vote \-- take a final vote on the
modified section. Is that \-- is that a reasonable approach? Because
otherwise, either we\'ll be voting without seeing the final version, or
it\'s going to take very long if we don\'t do some parallel processing,
so. Hearing no objection, I think we\'ll proceed with that unless the
changes are very marginal, so. All right.

FEMALE: Okay. Thank you.

I\'m going to be talking about the human factor section of the VVSG
version 1, which is Section 2. \-- 2.7 in your binders. There we go.

Quick overview. I\'m going to do a quick discussion of our goals for
this section, then I\'ll be talking about, sort of, just the general
overview of the changes from the March 9^th^ version, and then I have a
couple slides that outline key decisions and issues that arose in
producing this current draft.

So our \-- our goals were first to focus primarily on the voting
equipment, but there is some \-- some discussion about polling place
setup, but mainly voting equipment. Because accessibility\'s called out
so clearly in HAVA, we spent most of our time to try to get as
comprehensive a set of accessibility requirements as possible and these
were derived primarily from the VSS 2002 and then from other sources,
Section 508, IEEE, P 1583, et cetera, as appropriate. And in general,
and this comment applies for all the sections actually, if we were
trying to make a distinction between sort of what is sort of clearly
being met today and make sure we capture that, but \-- and if, as Mark
Scull pointed out earlier, if something required some research and we
weren\'t sure and \-- or \-- that we did not include it and then
there\'s these things, kind of, in the middle. Something wasn\'t readily
achievable with current technology for 2006, we said we should at least
point the way, so let\'s put it in as a should rather than a shall so
it\'s a recommendation rather than a requirement because we felt then
that would give everyone sort of a head\'s up as to what\'s coming in
version 2. Although I will point out that there are several of these \--
that (indiscernible) the boundary between shall and should and their
value judgments so we did the best we could try \-- based on what we
know about the existing systems in making that determination, so I
imagine there, perhaps, may be some discussion on (indiscernible).

MALE: Mr. Chairman?

MR. CHAIRMAN: Yes, Mr. (indiscernible).

MALE: Can I ask a question?

MR. CHAIRMAN: Yes.

MALE: Great. Just to understand you correctly, you were then defining
readily achievable in a shall context?

FEMALE: That\'s correct.

MALE: Okay. And a should, then, is more of, you know, the future because
it was not universally agreeable as readily achievable.

FEMALE: That\'s correct. And in some cases, we knew of some systems that
currently did implement it, but \-- but not all existing and that would
require some re-engineering to achieve. That was kind of how I made
those decisions. But, as I say, you know, we\'re not perfect in our
value judgments, so we did the best we could.

MALE: Thank you.

FEMALE: And another \-- something new that you will see is evidence of
summative usability testing. All we ask in the requirement is that a
test with users as appropriate is done and there is a standard for how
to run those tests and how to report on them. It\'s an (indiscernible)
standard common industry format for usability tests. We don\'t require
anything but that test at this point, but this points the way to the
future for when we do have some performance requirements. A
(indiscernible) for the usability requirements, there weren\'t that
many. There were a few design requirements in the VSS 2002, but there
wasn\'t a usability appendix that was just informative, so we mainly
took existing guidelines from those sources, mainly the design
guidelines, and then we, again, put in these \-- this requirement of
doing some usability testing, but didn\'t specify anything about those
tests. The thought being at least people will start to become familiar
with what we mean by usability testing, what it entails, and \-- and
take a look at the standard, et cetera.

We have a few privacy requirements that were focused on the voter
interacting with the equipment. So I\'ll talk briefly about those, but
\-- but there\'re not very many of them. And we note that version 2 will
have substantial changes and expansion.

Changes from the March draft. We did heavy editing of the accessibility
section and that included addressing comments from the access board and
I will point out that two days ago, I did get some additional comments
from the access board, so we might wanna discuss that as one of the
issues of how much to incorporate from that. In those versions, it\'s
mostly wordsmithing, I believe.

The usability requirements were based on the outline we produced from
March 9^th^, the minimal design standards at this point. We added the
small privacy section gleaned from existing requirements which just talk
about configuration at the polling place to preserve privacy, not
identifying features on the record of the vote, say, via how you \-- if
you use some specific accessibility component to vote, et cetera, and
preserving privacy in absentee ballot handling, very high-level
requirement. Again, just pulled out from existing requirements.

Okay. I\'m going to \-- to list some specific changes and then go into
decision points and issues.

We have a requirement for functional equivalents of all alternative
formats. We did some restructuring. Included in restructuring was
pulling out alternative language requirements in a separate subsection.
We specifically incorportated \-- that\'s ABA, little typo there \-- and
ABA guidelines. We reformulated the reach envelope for wheelchair
accessibility. We added an automatic universal reset after someone sets
to vote so they\'ve adjusted any particular settings on a DRE, for
example, they would automatically reset for the next person. We put in
some recommendations. These are shall clauses: to synchronize
audio/video, some people call it \"dual audio/video.\" Should. Yes.
Should. Thank you. The ability to control the rate of speech in an audio
ballot; the use of recorded speech on an audio ballot as opposed to
synthesized speech; skip navigation for referenda and contest an audio
ballot; accessible verification for those who are blind if there\'s a
verification component in the voting equipment; and sip and puff. I have
gotten some comments about the sip and puff to make that a little more
general to deal with different motor skill disabilities from the access
board, so we will be looking at those comments.

All right, so to the thornier issues. We organized accessibility
requirements by disability. This is different from the way Section 508
is organized, but we found that \-- that it worked for us. There \--
there are some requirements that support different disabilities and we
so note, so there is some crossover, but because a voting system is used
for a very specific task, we found that this organization worked in this
case for this kind of standard. We had a lot of discussion about which
features should be required for an accessible voting station as opposed
to which features would apply to all voting stations. So, for example,
having an audio interface, that\'s clearly applies to an accessible
voting station. Control of font size applies to all DREs, whether or not
it\'s the designated accessible voting station. To have redundancy of
color coding in the user interface applies to all voting stations. For
low vision, you should have minimally two font sizes. But what about
VVPAT and a paper roll? These \-- these \-- so some \-- some of these we
made should clauses for low vision because of this issue with \-- with
\-- you want to address some low-vision two font sizes on all the
systems because many people have, you know, because it helps a lot of
people, seems like a general \-- in general, a good thing to do. Was
unclear to us what to do about VVPAT, though, in \-- in that case
because of the \-- with the paper rolls, et cetera. We do say that all
accessibility and usability requirements apply to VVPAT across the
board.

And we\'ve got a general question about the shalls versus the shoulds.
Do we have the right balance? Do we move some to shalls? Do we move some
to shoulds? I \-- I was at a recent meeting at the EAC on \-- for an
accessibility discussion and \-- and someone in the audience said, \"You
should have the omit no should philosophy.\" And we like that because it
puts in placeholders for future work and future standards that would be
coming, so and \-- and when I look through, we did more or less follow
that philosophy.

My second \-- second slide of decisions we made, we require the
initialization of this voter settable attributes. That is, it\'s a shall
clause that resets \-- should it be a recommendation?

**\[End of Audiotape 1\]**

FEMALE: \-- justment to set up the accessible work voting station for a
person coming to use it in accessible mode. We did not put that in at
this point. Is it \-- should that be a sub requirement under
initialization of voter settable attributes?

We did not include anthropometric requirements. The IEEE P-1583 did talk
about them. They referred to an old military standard for measurement
that we know is outdated and only applied to soldiers, and we\'re aware
of a much better seizer data that Wright-Patterson Air Force Base
collected across many different populations. But it\'s very difficult to
know how to apply anthropometric data to specific piece of equipment and
people often misuse that data. So we decided that needed more research.
We did not include it.

We have no guidance specifically for cognitive disabilities although I
will note at this point, I will note that many of the requirements that
are in there now help to reduce cognitive load in different ways and
that will also help with cognitive disabilities and we might want to
think about calling those specifically out in the next version and also
looking at some other approaches to make sure we\'ve covered that well.

We do require vendors to perform target (indiscernible) usability tests,
but there are no benchmarks associated with them. And they can run those
tests however they want, just show proof that they\'ve been run.

We have minimal usability design standards at this point and these \--
because these were interim requirements pending the development of
performance requirements. And we didn\'t want to do complex design
standards \'cause they\'re difficult to prove or measure and we have
this plan for performance requirements for version 2. So that\'s why we
took a minimalistic viewpoint.

And those are kind of the highlights of the \-- the issues. I can \-- I
can back up if we need to look at that list of decisions. And I suspect
folks have some specific issues they want to talk about.

MR. CHAIRMAN: Thank you, Dr. Leskowski (phonetic sp.). Any questions or
comments? J.R., did you have a?

MALE: Yes, sir. I would definitely like to include a shall with the
automatic setup, startup system there.

FEMALE: On the accessible systems.

MALE: Correct.

FEMALE: Mr. Chairman.

MALE: Chairman, where is that chair?

FEMALE: Yeah. I\'d just like to say something as sort of echoing
something that Sharon said. I\'m sure that people may have specific
comments on other sections. There are two things. One is we have
received a fair number of direct comments that were submitted to
voting.nist.gov that have what I \-- what I believe are small wording
changes that people think will clarify the intent of the comment and I
don\'t intend to bring those up here in the theory that they can be
handled as general editing. But there are a few of the cases where as
presented, we\'ve opted to take a recommendation approach rather than
requirement approach, and I think those might be useful for us to
address directly in an orderly manner and look at those requirements
specifically, actually read them together so that we\'re very clear on
what it is we\'re requiring now. I would also note that in the language
of the document that we have in front of us, many of those should
recommendations also include a discussion that they will become shalls
later as a way of putting a stake in the ground that while we\'re not
requiring it for this \-- this round, that by the later round, so I
think these are well worth having some discussion and input from the
full committee.

MR. CHAIRMAN: Would you like to walk us through these, you know, in the
section? We have line-item \-- line numbers \--

FEMALE: Yep.

MR. CHAIRMAN: \-- to facilitate the discussion, so if you \-- if
everyone could go to their blue binders, the sections are \-- are marked
as Human Factors is starting at 2.27.

FEMALE: I suppose what I could do is bring up my first big issue. We
could either go through those and then go back through \-- I mean, it
might be helpful to go in numerical order so we\'re not flipping back
and forth a lot. The first thing I\'d like to discuss is on page 2-16.
And it\'s \-- I\'m not going to read the 227s \'cause they all start
with 227. It\'s section 2271219. And the language of this section says
\"Any voting station using an electronic image display should also
provide synchronized audio output to convey the same information that
was on the screen. The discussion is that synchronized presentation of
information in both visual and oral modes is a recommendation in this
version, but as anticipate that will become a requirement for future
versions.\" I\'d to suggest that it be a requirement in this version.

MALE: Mr. Chairman.

MR. CHAIRMAN: Yes, Mr. Craft.

MALE: At this time, there really is only one of the major three vendors
and I limit my discussion to the major three: Sequoia, ES&S, and Diebold
because they have such a large footprint on elections nationwide.
Diebold is currently the only system that has the audio/video
simultaneous. Both ES&S and Sequoia are working very hard to bring out a
system that will give you this capability, but I think until it\'s
something we see all the vendors can reach, it\'s dangerous to make it a
should for the \'06 elections. We may find ourselves in a position where
we can\'t comply with our own standards.

FEMALE: I guess I\'d like to go back to the discussion we had earlier.
It is certainly technically capable, feasible, it can be done; we have
actual proof that it can be done. We have proof of intent to do it. And
we know that at least some vendors are \-- that some jurisdictions are
complying. I think this in \-- in the interest of making this a best \--
best technical practices, well.

MALE: Well, while it can be done very factually, we are now 8 months, if
my math is correct, from the deadline. These things have yet to be
produced. After they\'re produced, they must go through the
certification process. After they go through the certification process,
they must then go through the purchasing process of the governments that
are going to acquire them.

FEMALE: But isn\'t this a grandfathering question?

MALE: I don\'t think it\'s a grandfathering question. I think it\'s \--
if you make it a should as a requirement that we very frankly don\'t
know if we can meet in time for the election.

FEMALE: Mean shall.

MALE: Or shall.

MALE: Yeah.

MALE: We don\'t know if we can meet it in time for the election.

MR. CHAIRMAN: Secretary \--

FEMALE: Oh, I\'ll let someone else speak.

MR. CHAIRMAN: Yeah, let me. Go ahead.

FEMALE: You know, we all understand that it \-- it needs to turn to
shall, but I was on that committee and I took a very hard line that it
should be should because we just cannot meet it for the 2006 or we\'re
going to be saying you\'re only buying from one vendor. And I think that
possibly, that\'s what we\'re looking at. And that could be a problem.
They couldn\'t even meet the demands if we ended up with one vendor in
such an area like this. So there\'s a lot of problems and I \-- I
understand the need to turn it into shall and think that\'s exactly what
we need to do, but with it coming up, the should is \-- that\'s the
reason why we took this approach.

MR. CHAIRMAN: Yes, Dr. Williams.

MALE: We \-- we\'ve got to look at the objective we\'re trying to
achieve here. We\'re trying to help \-- to assist people to make
decisions for systems to use in November 2006. This is not going to have
any impact on the state of Georgia. We\'ve got a system in place. This
is going to impact those 615 jurisdictions out there that are still
using paper punch cards and lever voting machines that need to make a
decision. And if we put a shall in here, we\'re \-- we\'re restricting
their choices because they\'ve got to choose according to these
guidelines, not the previous standards. So I think we need to be very,
very careful what we put in here because we\'re gonna \-- gonna whittle
everybody\'s choices down to the point where there are no choices. All
\-- to go back a couple of pages, there are several of these that
require things to be done under the control of the voter. There\'s \--
there\'s not a system out there right now that \-- that allows the voter
to manipulate contrast or what have you. Well, Diebold has just \-- has
just come out with a \-- where the voter can change contrast and oh,
size. Type size. But nobody allows them to change (indiscernible)
controls on the Realstat-type (phonetic sp.) controls on the voting
machines where the voters can turn things up and down. Those are set at
the time that the voting station is set up. And so, again, if we put
those kinds of restrictions in here, we\'re basically eliminating
practically, well, I think all of the systems on the market. So we \--
we need to look at who we\'re trying to help here. We\'re not \-- we\'re
not trying to help people that already have systems installed; we\'re
trying to help people that are \-- that are faced with a decision.
They\'re \-- they\'re looking at HAVA that says you\'ve gotta get rid of
that punch card, you gotta get rid of that lever machine and if we
publish this \-- whatever we publish is what they\'ve got to adhere to
and if it gives \'em no flexibility, then it\'s a moot document.

MALE: Mr. Chairman? Mr. Elekes.

MR. CHAIRMAN: Yes, go ahead Mr. Elekes.

MALE: Okay. The question I\'m hearing is directed to the \-- the
governmental entity that has to purchase the equipment or the individual
that appears to have to manufacture the equipment. Having been blind for
27 years, the technology for adjustable font sizes, contrast, has been
engineered since the mid-90s. It has been available on the commercial
market since that time. So we\'re basically making excuses for people
who have failed to keep current with the technology when they\'re
manufacturing or designing equipment and to delay what is ultimately the
accommodation for the end user, we\'re falling short on the
accessibility section if we don\'t make sure it is a shall.

MALE: Okay.

MR. CHAIRMAN: Dr. Williams.

MALE: My \-- my objection was not to the large font sizes. All of the
\-- all of the current systems, again, you know, we get back to the big
three, they can all do multiple-size fonts. What I was referring to is
controls on the voting machine where the voter themselves can alter the
configuration of the voting machine. We went through this with the \--
in the IEEE procee \-- committee. And the initial 2002 standard, in
fact, had provision in there for the voter to be able to control on a
graduated scale, contrast and font size. And that\'s just not
implementable. What \-- what you could do is say okay, you\'ve gotta
have two font sizes, this little one and that big one. Or you\'ve got to
have two \-- two contrasts, one black and white and one whatever else.
But to allow continuously variable controls under the control of the
voter, you eliminate every voting system on the market.

MR. CHAIRMAN: Okay, look, there are two questions. Before we go there, I
think we\'ve expended discussion here from this particular case to
other, so I\'m not quite sure how to handle this. I \-- I would suggest
that we go ahead and make some \-- at least have some discussion on
these cases where you may wanna change from should to shall and \--
because otherwise right now, we\'re talking sort of in a vacuum, not
having a particular point of reference.

FEMALE: I mean, in this case, are you suggesting that a shall be a
should, so one \-- one solution is to simply go numerically through it,
not reading them all but just making sure that we\'re.

FEMALE: \'Cause I don\'t think there\'s that many.

MALE: Mr. Chair, can I comment before we go into that?

MR. CHAIRMAN: Well, I\'ll take.

FEMALE: (indiscernible) as they come up and deal with them.

MR. CHAIRMAN: I\'ll take Secretary Davidson and then Mr. Berger and then
Mr. Craft.

FEMALE: I was just wanting to make a statement that if we put something
in place in our standards, they are volunteer standards. And my goal is
to have every state utilize these volunteer standards. But if we put
things in there that they can\'t meet, they\'re going to back off from
it.

MALE: Right.

FEMALE: And I think that is a mistake, so I think that we have to
proceed and keep in mind what is capable of being done by 2006? That is
a time frame that we\'re meeting is fastly approaching every state. So I
guess that\'s my \-- just a real philosophy that I have.

FEMALE: I hear it and I \-- I agree that creating standards that people
will simply reject is an exercise in futility. The thing that I just
heard that disturbs me is this came up in 2002, it was admitted in 2002,
we\'re three years later, I mean, that \-- that we \-- one of the things
that I like about the solution that the staff came up with, which is to
put in a should clause here that points forward, essentially puts a
stake in the ground that we move forward. We may simply vote to leave
things shoulds that are shoulds. We may vote to change shoulds to shalls
and so on, but for me, the important thing is that we begin to say it\'s
time to begin to move forward, to really think about what it\'s going to
take to create truly accessible voting. And that we do that in a way
that will not just delay it forever.

MR. CHAIRMAN: Well, let me suggest something, maybe it will sort of get
away from this. Obviously, we have some strong opinions on both sides. I
guess the concern is unless we make a decision, it will just keep on
getting delayed and delayed. One possibility is to, in the discussion
section, instead of saying \"but it is anticipated that this will become
a requirement\", can we change that section that says \"but this will
become a requirement in version 2\"?

FEMALE: I don\'t think we can say more than it\'s anticipated or that we
plan to because until we vote on it, it doesn\'t exist, so.

MR. CHAIRMAN: No, but I mean, if we vote on that change leaving the
should but saying \"this is a heads up in the next version which will
apply to elections after 2006\", it will become a requirement which
means that we will expect this to be part of version 2. Would that
address the concerns?

MALE: I\'m not confident it would, sir.

MALE: I \-- I think I\'ve been misunderstood. Let me give some specific
examples if I may. Look at section 1212 on page 214. It says, \"You
shall display all information at least two font sizes, under control of
the voter.\" Now, if you interpret that to mean that the voter can tell
the poll worker which font size he wants, then that exists right now. If
you mean a switch on the voting system where the voter, in the process
of voting, can change that, it only exists on one system. So \-- so what
I\'m suggesting is we take out that \"under control of the voter\" that
\-- that \-- we have the capability to display the font sizes. We
require the dis \-- capability to display the font sizes, but it may not
be done by the voter themselves. It may have to be done by the poll
worker at the time they activate the voting station.

MALE: Bert (phonetic sp.), I\'m not sure all three basically can do it
even with a poll worker.

MALE: Can I comment here?

MR. CHAIRMAN: Yes.

MALE: I \-- I\'m concerned about the nature of the discussion we\'re
having here. And I\'m concerned that this committee may degenerate into
a consumer reports kind of evaluation of what\'s currently on the
market. I mean, if all our considerations at this point are which are
the systems on the market, what \-- what can we do given the market, we
have a problem here. I think I\'d like to see us if possible elevate the
discussion to that of principle and see where it is we\'re going. And
we\'ve got two documents we\'re trying to produce, VVSG 1 and VVSG 2.
VVSG 1 is admittedly directed at the more near-term, but even given
that, I think trying to look at every line of this document and view
what\'s on the market is probably a mistake and we need, instead, find a
mechanism for grandfathering. That is to say, if this committee in its
judgment views that, you know, this principle should be a shall at this
point and it causes problems, there should be a process by which a state
or the EAC could say, you know, this is not something that\'s going to
be enforced, you know, that strictly now. We can proceed on that basis
so that. This consumer reports attitude is saying this doesn\'t exist
now, you know, you can\'t buy that. You know, is a process we get locked
in to what the decision\'s made by the vendors to date, you know, in
their wisdom or lack of wisdom as the case may be on the particular
features and I feel this committee can \-- can raise the level of
discussion above that a bit.

MALE: Mr. Chairman? Mr. Elekes.

MALE: Mr. Chairman, point of order. You said Mr. (indiscernible) was
gonna go next.

MR. CHAIRMAN: Yes.

MALE: And then I was going to go beyond that.

MR. CHAIRMAN: Yes. Thank you, Mr. Craft. I\'ll get back to you, Mr.
Elekes.

MALE: Thank you.

MR. CHAIRMAN: Mr. Craft.

MALE: It\'s Mr. Berger going now.

MR. CHAIRMAN: Sorry. Mr. Berger.

MALE: Mr. Chairman, let me ask a question first. I actually have some
comments and I would be ready to make a proposal on 712, some
subsections there. But I think Ms. Quesenbery had a suggestion on a
different section. Do we want to close that section and then move to
this one? I think right now, we\'re kind of moving between two sections.

FEMALE: I think we\'re jumping (indiscernible).

MALE: Well, I\'m waiting to comment on that. I would prefer not to close
it.

MR. CHAIRMAN: Why don\'t we recognize Mr. Craft and then I\'ll make a
ruling.

MALE: Okay, Mr. Chair. As you\'re aware, we have all had very limited
time to review this document. This particular piece is about a half inch
thick. It is fairly complex. It has a lot of issues in it. What I would
like to see is a traceability matrix that will show us basically that
what I believe is the Congressional intent comes into this section. And
I think the Congressional intent was that the mandated requirements for
accessibility in the 2002 FEC voting systems standards will flow into
this document. The optional accessibility standards in the 2002 as to
audio ballot will come into this version of the standards and lines 9 to
16 on page 212 which is extracted from HAVA will be given effect in this
document. Everything else here, the shoulds, I have no disagreement
with. I have no disagreement with the EAC putting a stake in the ground
at some point and making those absolutely mandated requirements, but
I\'m telling you right now, some of the shalls in this document will
prevent a great number of jurisdictions in this country from being able
to comply with these standards and for many of them, it will leave them
no option for complying with these standards, which will lay a good
groundwork for a legal action have these standards set aside. So I \-- I
cannot support this section unless I have a high level of confidence
that this will mandate nationwide the best of currently available
accessibility in voting systems. And there was a gentleman who commented
that many of these accessible items had been in place for years. That\'s
true. But they have yet to be integrated into voting systems and
successfully used by voters. That is where I believe we need to get.

Also, on lines 41 and 42, we\'ve got this statement that each ballot
cast shall capture the intent of the voter who cast that ballot. That is
not a human factor standard.

MR. CHAIRMAN: Which page?

MALE: On page 210. Lines 41, 42. There is no human factors standard for
reaching into the mind of the voter and taking data out. Systems must be
designed so that they facilitate the voter\'s ability to express their
intent, but not to capture their intent. You can\'t do that.

FEMALE: I would point.

MR. CHAIRMAN: Excuse me. I tried to play the referee here and not
express opinions to the extent possible. But I very much agree with the
opinions \-- the opinion \-- the statement made by Dr. Rivest in the
sense that these standards should not be controlled by what is actually
available because that doesn\'t mean that the technology is not
available; it simply means that that particular technology has not been
utilized in a particular application area. If the technology wasn\'t
available anywhere, then I would agree with that, that we cannot count
on the technology to be developed in the given time frame and make it
available for a particular application area. So I\'m not necessarily
pushing for definitive rule making saying these shall be used, but I
think unless there is a stake put on the ground saying okay, we realize
the time frame is such that it may not be available, you know, over the
next 12 months, 8 months, whatever the appropriate time frame is, but
unless we put a stake in the ground that says this will be \-- this is
the rule, perhaps, as of such-and-such date, so that this is a head\'s
up, basically, to the vendors that you can\'t delay this.\
We realize the practical aspects of this, but you \-- we cannot
continually delay it, that this is a heads up, this is coming, and the
technology better be there for the next round. So somehow I think we
need to get that message across and that was what I was trying to do.
But let me.

MALE: (indiscernible) a sponsor.

MR. CHAIRMAN: Yeah. Well, I think Mr. Elekes has been waiting so let me
capture his comment and then I will come back to you, Mr. Craft.

MALE: Okay.

MALE: Thanks, I appreciate it. Basically, you stated what my
considerations were. The other issue is that I believe it was Dr.
Williams brought up, and I just have to make a point of accessibility.
Presently, the voting systems may not require the individual to touch
the voting machine to adjust the contrast or color or font size. We are
seeking, based on our reading and unless I\'m misreading it, the
interpretation of HAVA that regardless whether the voter has a
disability or not, it is an independent voting process. If you require
someone else to physically adjust that, the voter does not have the
ability as a non-disabled person does to independently vote. They have
to require the assistance of a poll worker who may not have had
appropriate training or any other myriad of facts, so those components
have to be built in and have to be available if you are truly going to
have an individual with a disability who is an independent voter.

MALE: Dr. (indiscernible) one more statement.

MALE: I\'ll \-- I\'ll read from \-- from the guidelines that the
overview that Mr. Scull gave. Version 1 is intended to assist state
election officials in preparing for the 2006 election, and then down
below there, version 2 has changes that cannot reasonably be made and
tested in time for 2006. I have no objection to delineating all of these
things that can be \-- that will be done after 2006, but I think that
the way we\'ve got them intermixed right now makes this document almost
impossible to \-- to read by the people who are anxiously waiting for
it. Maybe what we need to do is separate these out and have here\'s \--
here are the things that can assist you in 2006. Pick those out and
(indiscernible) like them and then put the heads up for what\'s coming
up in another section.

MR. CHAIRMAN: Mr. Craft and then Ms. Quesenbery and then Mr. Berger.

MALE: Well, Mr. Chairman, I agree with you. I like stakes in the ground
and there are probably some voting system vendor reps in the audience
who are a little confused because we have, in fact, in Florida, driven a
stake in the ground for July 1. But in Florida, we began the process of
getting newer technology out there back in 2001. We have recently begun
very aggressively pursuing accessibility, and all I\'m saying is, don\'t
drive that stake in the ground at a point 8 months away where you\'re
going to fall on it. Let\'s drive it in the ground. Let\'s make the
vendors comply with it. But to attempt to force that by January 1,
particularly for those counties who were still on punch card, on paper
ballots, on lever machines, even the window for them to train their poll
workers to use that stuff is rapidly closing. The windows for voter
education are rapidly closing. I think what Congress intended, once
again, was to take the current state of the art in voting system
accessibility, which is the audio ballot, and mandate that jurisdictions
across the country get up to that standard. And the backside of the
sword, if you go forward with the shoulds and if you mandate things that
can\'t be met, if you wind up with this standard being thrown out in
court because it contains things that can\'t be met, the backside of
that sword is people who need this accessibility in these systems, who
need the audio ballots across the country will not have them in \'06.
And I think it is better to go forward, give them the stuff that\'s
there now, let these jurisdictions go ahead and buy it, start training
with it, start using it, and then to set a good stake in the ground, if
you wish, for the next upgrade. And I started out with Dr. Williams came
back to. This section needs to be condensed so that those shoulds are
fairly obvious and the jurisdictions out there trying to make decisions
can very quickly narrow down what they\'ve got to do.

FEMALE: If I might suggest, it\'s easy enough to just make the shoulds
in a gray instead of black in the document to make that clear, or some
other, you know, technique.

FEMALE: Could I speak, please?

MR. CHAIRMAN: Ms. Quesenbery.

FEMALE: Can I speak please?

MR. CHAIRMAN: Yes. Ms. Quesenbery.

FEMALE: I\'d like to say two things. First is that one of the reasons
why I think that the should should be integrated in this document,
although I do agree that they should be culled out visually separately
so it\'s a little easier to find them; I keep going through and
highlighting them with my orange highlighter. So the fact that I\'m
doing that means that probably other people need something like that.

If you isolate them in a separate section, they will never be read. They
will never be looked at, and they will never be considered. This
document has a structure that may or may not be the perfect structure,
but it\'s a structure that has some integrity. And in general, I think
we\'re talking about general principle and then here\'s how it should be
met.

I\'d also like to suggest that, I think we\'ve sort of heard the general
discussions. I\'d like \-- I\'d like to move from a general statements
principles to looking at specific sections. We may find that there\'s a
small number of them. We can resolve it either \-- either by vote or by
general consent, and that we will end up with something that\'s not
quite as contentious as it may seem when we simply argue principle.

MR. CHAIRMAN: Mr. Berger.

MALE: Well, I have a suggestion and I\'d be willing to make it a motion
if it finds general favor. That would be that the equipment-related
requirements we make effective on new submittals for certification 9
months the EAC adopts these doc \-- these guidelines. That would say
that equipment out in the field, we\'re not dealing with. Individual
election officials may choose to impose additional requirements. That\'s
certainly their prerogative, but to me, that would be a reasonable time
frame, 9 months after this, a vendor brings in a new system. Here are
the requirements.

MR. CHAIRMAN: I \-- I\'m not quite sure how that fits in with this
should and shall business. (indiscernible)

MALE: Well, I think that makes it easier to make shalls because
certainly from this point to 9 months after the EAC would adopt these
guidelines, in my \-- my view for many things, makes it quite reasonable
to make that a shall. And that gives a time frame, I think, that
election officials could \-- could work with as well.

MR. CHAIRMAN: But it does not address the issue of which ones will stay
as shall for this election.

MALE: Yeah. But what it \-- what it does do is as we had that
discussion, there\'s a specific framework which we can look at is that a
reasonable requirement. Is it a reasonable expectation that multiple
vendors can meet it in \-- in that time frame.

MALE: There are several shalls we wanna keep.

MR. CHAIRMAN: Mr. Harding? Did you have a?

MALE: Yes, thank you, Mr. Chairman.

Accessibility and disability issues, historically, have always been a
back burner, and after-a-fact issue. And so from one standpoint, I would
agree with Whitney (phonetic sp.) that inclusion throughout the
principle documents on accessibility matters is essential as any
equality issue, recognizing it as an equality issue.

Then at the same time, having the issue of the \'06 and \'08 on a stake
in the ground issue. I believe Mr. Craft and Dr. Williams raised a
significant issue here, that we\'re on a very tight kind of walkway here
and it\'s not the issue the consumer report kind of thing, it is
reality, it is politics. These are everyday lives. And we must be very
careful that we do not inadvertently do away with all of this work by
setting expectations for failure in \'06. Because if we screw it up, a
whole (indiscernible) can come out from underneath us. And so by having
two separate \-- separate documents as \-- as Dr. Williams was
indicating, this is what we believe is doable; this will be done in
\'06; and having that stake in the ground for the \'08, I think, is a
very prudent court \-- course of action. So I\'d leave it there.

MR. CHAIRMAN: Thank you. Dr. Schutzer.

MALE: I \-- I think there\'s one thing we might be missing, so I was
thinking about what we were talking about, you know, the idea that gee,
it\'s bad to put something in if there\'s only one vendor \'cause then
you\'re sort of like requiring everybody to buy that vendor. So use that
same example, the audio since I know something about that technology.
I\'d like to point your attention that actually to implement that audio
is simply a software module that you add on. Doesn\'t really do anything
for the hardware, works on all the existing operating systems and so
forth. I put that technology in myself. You just buy another package
from some of these software vendors. It\'s not a very expensive package
which means that it\'s equivalent, let\'s say, a software security patch
to put the thing in. Which \-- so \-- so in that particular case, the
issue is if I went to buy another vendor and they didn\'t currently have
it, I\'m out of compliance spec. It wouldn\'t be so terribly impossible
to upgrade that particular device. So perhaps some of the reasons it\'s
not in all the different vendors\' equipment is because it\'s not a
current requirement, and so therefore, they don\'t find the necessity of
doing it became as requirement, or might find there would be quickly a
software patch to provide that. And not one you have to write; one you
could buy from a standing vendor.

MALE: Mr. Chair. All three of the vendors currently employ audio. What
is at issue here is audio/video simultaneous, the ability to speed up
and slow down speech, the ability to adjust contrast on the screen
independently by the voter. The reason, frankly, that two of our vendors
cannot reach audio/video simultaneous right now is because they were
both very proactive and back in 2000, both Sequoia and ES&S charged
ahead on audio ballots, and they looked at the state of their
architecture on their systems and they realized the best way to
implement audio ballot was to set up basically a separate processor; the
DRE machine becomes two computers in one. One handles audio; one handles
video.

Diebold came out a little later with the audio ballot, realizing there
was a need for simultaneous use of audio and video, and had a platform
that would support it. Basically, ES&S and Sequoia are paying a cost now
of being behind in the market based on very prudent effort to bring
accessible devices out in the market.

That said, for both of those companies, they\'ve got to come up with a
radically-changed architecture for their DRE in order to meet the
audio/video requirement. I believe they are both working on that very
aggressively. Florida has pushed them, and I believe we will see
solutions available for testing in September/October. That said, it
doesn\'t pass and it can\'t be used until it does pass and when it
brings it in, if we knew it was going to pass, we wouldn\'t have to test
it. To have those devices become available that late in the year with a
need to certify them and counties sitting out there trying to figure out
what to buy, you simply can\'t require that they buy that because you
can\'t tell if it\'s going to be there or not.

MR. CHAIRMAN: Mr. Berger.

MALE: I think Dan brings us an important example and I would point out
and I think we need to do our work with a mindset that after the
simplest change, the vendor has to do aggression testing to make sure
there are no unintended consequences of that change, then there\'s a
process of re-certification and then if there\'s an election imminent,
there\'s a deployment time. I would say all of that\'s at least 12
months. And we really need to do our work with the mindset that from the
simplest change, it requires virtually no engineering effort. You\'ve
got a 12-month process to have that effectively deployed.

MALE: At least.

MR. CHAIRMAN: Yes, Dr. Schutzer.

MALE: I know, but we were discussing this and we \-- we know this is not
a one-time deal. I mean, we will find that technology will continually
advance every year. And the bar will continually be raised every year,
so we\'re always gonna be sitting there with new systems and fixes that
will be coming in for the current elections that we\'ve chosen, even if
it\'s a simple software fix. Logistics will just prevent us from
effecting those security patches, those software upgrades, HAVA add-ins,
whatever. But it doesn\'t mean that if you know that today\'s technology
is such, I mean, we don\'t write these specs and want to re-write them
every 6 months or every year just to accommodate the fact that, you
know, the logistics is such that it\'ll take a year to do regression
testing. So why not put it in and then we had a resolution there, I
think, grandfather clause that says, well, each municipality has to use
his own judgment. Clearly, if the city with equipment that \-- the city
logistics, the regression testing, all that kind of thing they can\'t
accommodate in the coming election, so they put it in in the next
election, after they\'ve done the testing, but do you want to degrade
the technology for that, or the unfortunate choice of architecture makes
it a little harder for one vendor than another vendor.

MR. CHAIRMAN: Secretary Davidson.

FEMALE: You know, I \-- I understand and \-- and it does take 12 months,
you know, at least. And technology does change daily. But I think if we
put something in here and it says shall and we do have the resolution
that gives the others the option to (indiscernible) where they\'re at,
but still putting in shall, sets them up for a court case that I think
that I \-- as an election official in Colorado, I would have a real
problem with doing that to my cohorts.

MR. CHAIRMAN: Ms. Quesenbery.

FEMALE: Chairman.

FEMALE: Well, I just \-- I hear the argument and what I would like to do
is consider it on an item-by-item basis. As I suspect, listening to the
kind of examples that we\'ve used, that we may actually have very few
places where we wanna say this should be a should, where we\'re putting
that soft stake in the ground, we\'re saying we\'re going to consider it
later so that \-- so that people \-- so that vendors and officials can
begin thinking about where they\'re going in their development, but not
making them hard shalls now. I think that was the philosophy that the
NIST staff tried to take and it may be that we have much less problem
than it sounds from this discussion, if we just look at the specific
sections we\'re talking about. Perhaps I could ease this by saying well,
you know, and we could either just take a voice vote or just \-- just
maybe go through and confirm that we like the shoulds or shoulds, that
we have some shalls we\'d like to move down to shoulds, there may be
some shoulds that should move up to shalls, but maybe we could very
quickly go through this section looking at the specifics rather than
talking in generalities. I agree. I \-- I would like this to be a
document that is useful, that moves the art forward in a meaningful way
and that doesn\'t cause more problems than it creates.

MR. CHAIRMAN: Yes. Secretary Davidson.

FEMALE: My closing remark would be \-- and I agree and I think everybody
here at this table does agree that the shoulds is \-- is initially. The
shalls, we definitely want in version 2. I mean, you know, that we want
to move forward. We\'re not saying stand still. We want to move forward.

MR. CHAIRMAN: Okay. I \-- I think that that\'s a good approach because
that way, we\'ll sort of size up the magnitude of the issue and I think
we can come up with an approach. Perhaps we\'ll address this if it turns
out to be a major concern. So why don\'t we then?

MALE: (indiscernible)

MR. CHAIRMAN: Do we \-- do we have a comment from the phone? Hello?

MALE: No, not comment from here. Mr. Elekes.

FEMALE: No comment from here.

MR. CHAIRMAN: Okay. Thank you.

All right, then why don\'t we go ahead, Ms. Quesenbery, and walk us
through these and at least identify the question \-- the issues. Could
you? You\'re?

FEMALE: Yeah. If we start on, I think page 13 is the beginning of the
first substantive stuff and just to call out the page number, let
everybody look at it, read it a sec, and see if we have anything that we
wanna offer changes to. So, 13. \[laughing\]

MR. CHAIRMAN: Well, do you want to point out where the shalls and the
shoulds are?

FEMALE: Oh. Okay. So the first one is that \-- is a general statement
that it shall incorporate features that are applicable to several types
of disabilities. The second, 1.1.1, looks for is a general principle to
be followed for alternate formats that they shall be, you know,
equivalent, that \-- that things for that in one format are also
presented in another. 1.1.2 says that accessibility \-- that providing
accessibility does not require personal assistive devices; that is, the
voter is not required to bring equipment to the polling place. 1.1.3
says that if biometrics are used, that there shall be another \-- that
there shall, excuse me, be another means of using identification, for
instance, if you can\'t sign your name, there\'s an \-- I think most
states already have this in place \-- and the last one on this page is
that polling places shall conform to ADA and ABA.

Moving on to page 14. 1. \-- yeah \-- 1.2 is a general statement.

MR. CHAIRMAN: Can \-- can I \-- can I just get a quick pause here. It
seems to me like 1.4, do we have an issue there? We shall conform?

FEMALE: \[laughing\]

MALE: (indiscernible) 1.4.

MR. CHAIRMAN: Beg your pardon?

FEMALE: \[laughing\] We don\'t \-- we don\'t get to have an issue. Mr.
Harding said \--.

MR. CHAIRMAN: Well, that\'s my point, so I mean that there are some
things that are given.

FEMALE: Yeah. So, I mean, I think.

MR. CHAIRMAN: So maybe we can sort of mark them up and say okay,
there\'s no issue here.

FEMALE: Yeah. I think silence is consent (indiscernible).

MR. CHAIRMAN: Is it, though?

FEMALE: (indiscernible)

MR. CHAIRMAN: Okay, so we have no problem with any of these shalls \--

FEMALE: Right.

MR. CHAIRMAN: \-- on page 13.

FEMALE: On page 13.

MR. CHAIRMAN: I was trying to clarify that. Okay, good.

FEMALE: So, moving on to page 14 which begins to discuss accessibility
for visual disabilities. I suspect that the first one we wanna talk
about is 1212 on the bottom of the page.

MALE: Yeah, and there, my suggestion is we simply delete the \-- the
last thing under \"control of the voter.\" But keep the requirement
there. But \-- but.

FEMALE: So it remains a shall, but we (indiscernible).

MALE: Right.

MALE: But I\'m not sure the (indiscernible).

MR. CHAIRMAN: (indiscernible) microphone, please.

FEMALE: So we\'re keep \-- so you\'re suggesting that we keep it a shall
but we \-- and it \-- but we include the ability for it to be set by
someone other than the voter?

MALE: I think it should be a should because I\'m not sure that all of
the machines out there with an audio ballot can

FEMALE: It\'s actually in NASA \-- this is actually in the current NASA
technical brief.

MALE: Yeah.

FEMALE: So I think it actually is a current requirement.

MALE: Okay. That\'s the current 2002?

FEMALE: Yeah.

MR. CHAIRMAN: Were they under control of the voter?

MALE: This is \-- this is the one, Paul, that in the original 2002
standard, set for a variable control from this figure to that figure,
and that quickly became obvious that that was not implementable and it
was amended to mean that it has two sizes and I believe those are the
ones right there.

MALE: Okay.

FEMALE: I think this is an exact copy from.

MALE: Okay.

MALE: What (indiscernible) number is that?

MR. CHAIRMAN: This is page 2 \-- page 214, line 33. So the only issue is
do we leave under control of the voter or not?

FEMALE: How do we handle the procedure? We have a suggestion on the
floor. I think \--

MR. CHAIRMAN: Well.

FEMALE: \-- we need to get general consent on it or a vote? Is that
right?

MR. CHAIRMAN: Yeah. What is being proposed is to take out \"under
control of the voter.\"

MALE: Right.

MR. CHAIRMAN: Do we have? Right. Everything stays as shall and the rest
of that, the only suggestion is to take out \"under control of the
voter.\"

MALE: Right. I agree.

MR. CHAIRMAN: Do we have a unanimous consent on that?

MALE: No, we do not.

MR. CHAIRMAN: Mr. \--.

MALE: There \-- there are some voting systems where basically the poll
worker has to set up select your ballot, select whether you\'re going to
have an audio ballot, and whether you have a disability or not, the poll
worker has to activate the system for you in the way that you want it
activated, so.

FEMALE: We\'re talking about only this one and the specific \-- the
specific wording of this section. I think where we have disagreement, we
take a vote, right?

MR. CHAIRMAN: Mr. Elekes, would you elaborate?

MALE: Yes, as I\'ve said before, Dr. Semerjian, the ide \-- the concept
is that the individual to the maximum extent possible with disability be
able to independently vote. And as we\'ve said in previous discussion
this morning, the technology has been out there since mid-90s. I have
technology in the kind of computers I\'m using in front of me right now
and it\'s off the shelf, so, I mean, it\'s a matter of what vendors need
to do in order to make the voting system accessible and independently
usable by the person with a disability.

MALE: Well, I agree with that 100%, but it \-- but it\'s a future
requirement; it is not a present capability. That \-- that should be a
should.

FEMALE: Yeah.

MALE: The part we have right now is the shall.

FEMALE: I don\'t \-- I don\'t think.

MALE: And that capability should be a should.

FEMALE: I can\'t draft it live, but perhaps we should split this into a
shall and a should where the shall is a requirement for the two font
sizes \--

MALE: Yeah.

FEMALE: \-- and then we would get another \--

MALE: Should, yes.

FEMALE: \-- another \-- another item, whatever number it would be that
it would be a should \--

MALE: For \"under the control of the voter.\"

FEMALE: \-- \"under the control of the voter\" becomes a should.

MR. CHAIRMAN: Well, maybe then we could simply stop after 9.0 millimeter
period.

FEMALE: Right.

MR. CHAIRMAN: Version VVSG, version 2 will require \--

FEMALE: Right, I\'m just gonna.

MR. CHAIRMAN: \-- this control to be \-- this feature to be \"under the
control of the voter\" or something to that effect.

MALE: Uh-huh. (affirmative)

FEMALE: I would \-- I would think we would \-- I think we would end up
adding a section that said it \-- that would be 1. \-- 12121
\[laughter\] that said the ability to set the font size should be under
the control of the voter or appropriate wording to that effect.

MR. CHAIRMAN: Sounds like we have a general agreement to the approach,
then.

FEMALE: Yeah.

MR. CHAIRMAN: Will you please work with Alan \--

FEMALE: Yeah.

MR. CHAIRMAN: And make this \--.

FEMALE: John, can I ask the NIST staff to do that \'cause I think that I
saw them writing and I think they\'ve got it.

MR. CHAIRMAN: Okay. So. Other than that, we\'re okay on page 14?

FEMALE: So we\'re hol \-- so we\'re holding this until we move forward
with rewording to look at.

MR. CHAIRMAN: Right.

FEMALE: Okay.

MR. CHAIRMAN: Mr. Berger.

MALE: I\'d like to suggest we omit the section just above and below that
so that\'s 211 and 213.

FEMALE: Take \'em one at a time, please.

MALE: Okay. 211 requires summative usability testing. But in 212, we
have a very clear and objectively verifiable requirement, so I think 211
is just unnecessary and, you know, requires unnecessary resources where
the science supports an objective requirement.

FEMALE: I\'d like \--.

MR. CHAIRMAN: Ms. (indiscernible).

FEMALE: I think the purpose you\'ll find that this \-- this a
requirement like this exists in three places here in this document, in
this section of the document. I actually would like to keep it as a
shall. I think it\'s very important that we begin to get people thinking
about what usability testing looks like and how it\'s done and that it
be done with appropriate users.

Sharon, did you have some comments on this?

FEMALE: Yeah, I \-- it \-- it is an objective requirement. Just produce
a SIP (phonetic sp.) report. Yes or no.

FEMALE: We don\'t say you have to do it with 500 people, we say \--.

MALE: But we\'re spending very limited resources.

FEMALE: It\'s like a documentation requirement.

MALE: Is this really where we want the vendors \-- what \-- what\'s the
value at of this test?

FEMALE: Do you want to speak to that, Whitney, or shall I?

FEMALE: I \-- I hardly know where to begin since this is sort of meat of
my life \[laughing\] and I know that nobody wants to hear the whole
story.

MALE: And by the way, I\'m not fighting this kind of testing \--

FEMALE: Yeah.

MALE: \-- in general, so, in other places, I agree, so it\'s very good
contribution.

FEMALE: Hmmm. I think there\'s a big value added in having the vendors
start this kind of testing because that will drive their designs to
better designs, even.

MALE: Yeah. And in many places, I agree. With \-- this requirement for
font size, what would be learned and what would \--

FEMALE: This is.

MALE: \-- change as a result of testing.

FEMALE: This isn\'t just font size, though. I mean, you wouldn\'t \--
you end up \-- I think, well.

FEMALE: It\'s for partial vision.

FEMALE: It\'s for partial vision in general.

MALE: Okay. Question stands. What \-- what would change as a result of
this test being performed?

FEMALE: It\'s a future looking change. We want \-- we want to make sure
that the \-- the technology of usability testing is well understood in
the community.

MALE: I guess what I\'d like to see is NIST go forward with controlled
independent research into that level of usability for future standards.
I mean, we\'re speaking two sides of our mouth: one, we don\'t want the
vendor to drive the process and yet we hear to tell the vendors to go do
some research \--

FEMALE: No.

MALE: \-- and that research doesn\'t bind them to producing or achieving
anything.

FEMALE: We\'re not actually \-- there\'s a difference between using the
techniques of usability testing for user research and using usability
testing to actually evaluate a specific implementation of a general
standard. And I don\'t think that we\'re asking vendors to do general
research that would contribute to future standards here. That\'s
something that I hope and expect that NIST will be doing. What we are
asking is that vendors not just design their system and hope that it\'s
good but that they actually test it with users themselves.

FEMALE: My \-- my feeling is that I \-- if I can avoid it, I would avoid
purchasing any software that has not undergone some kind of usability
testing.

MR. CHAIRMAN: Dr. Schutzer.

MALE: If I understand what you\'re saying on the issue here is that you
just told me I have to build a system that\'s capable of presenting one
or two fonts. Then Vendor A could do one job of how they would design
that system with all the other surrounding aspects of that system. And
Vendor B could do another one, and frankly, it could turn out that based
upon the design, one is much more usable than the other. One, even
though it does go for the letter of the spirit in terms of being able to
have different fonts, it\'s not going to be terribly usable. And the
other one might do a much better job of \-- I think that\'s what you\'re
trying to get after by that kind of a test.

FEMALE: I think that the other thing we\'re getting after by calling
this out in three places and not just asking for a general usability
test is that people not just test with 5 fully-sighted people, but that
they actually look at people with partial vision specifically.

MALE: Just to add one other thought to it is that right now, you have
these requirements as if they\'re separate, independent serial
requirements so that \-- let\'s get back to the audio thing again, okay?
So I have a partially-sighted person and the administrator can tap it to
the higher font and they could go vote. But it could be that the other
one actually has the two fonts along with audio stream. And when you do
that testing, of course, they can hear it and see it, they might do
better. Now you\'ve (indiscernible) the combination of those two senses
working together so it would have a \-- score higher in a usability
test. It doesn\'t mean you can\'t buy the one that has the poor
usability, but at least you\'ll be notified of that. And likewise, I
imagine contrast and a dozen other kinds of factors could evolve that
would make one vendor\'s solution better than another\'s in usability
and you outta be able to measure that and know that.

MR. CHAIRMAN: Secretary Davidson and then Dr. (indiscernible).

FEMALE: You know, one part, I see this being a test, really, that the
state should do. We just did one in our state and had over 300 probably
disability individuals come in and test and evaluate each piece of
equipment on every segment. And I returned those over to the vendors
also. It also was a very useful tool to us to \-- to utilize. So maybe
this is something that I \-- I don\'t know if there\'s something that
you can do. The vendors, if they get a few people in, they may get
input, but if they have \-- if they\'re comparing them with other
systems, it really helps, too, at the same time.

FEMALE: Well, I \-- I think the purpose of this is to encourage vendors
to incorporate a user-centered design process in their design. Later on
when we have performance-based standards and a testing ag \-- authority
does the tests, then you\'re looking at the benchmarks. So I think this
is in the same category as when vendors required to provide
documentation that they did software testing. That\'s \-- that\'s how I
view it \-- view it.

MR. CHAIRMAN: Dr. Rivest.

MALE: I think Sharon may have answered my question. But let me proceed
with it anyway for \-- for Whitney. So, I\'m a general fan of usability
testing and I like the idea of having testing incorporated with the
requirements, but I\'d like to understand a little bit of your thinking
about how this fits in and where it\'s going. I mean, if a vendor merely
does the usability testing after the design is done and just
(indiscernible) the results, is this intended to be informative for the
perspective purchasers? Does this information get out to perspective
purchasers? The flip side of that is do you envision that the VVSG 2
will have actual levels of satisfaction of those tests that will be
mandated?

FEMALE: Yeah. We don\'t have any benchmarks in this version because the
research hasn\'t been done to set those benchmarks, but the intention
for version 2 is that we will be able to remove some of the design
requirements and simply say that we \-- and specify performance
requirements which will be evaluated through a usability test.

And to answer the question of who gets to see it and I guess also to
address Secretary Davidson\'s point, I think that everybody should be
doing it. \[laughing\] I think we should be doing it before, during, and
after. I think it should be done at the state level where you\'re
dealing with your people in your context in your laws. I think it should
be diagnostic during design. I think it should be summative to evaluate
the end point of the design. And that the more we do it, the easier it
will get. It will seem a great deal less onerous if we\'re doing it on a
regular basis. I \-- I have a personal hope that at least portions of
the standard (indiscernible) will be made available as part of a public
record, but that\'s way beyond, I think, the discussion of this
question, and right now, all this says is that it has to be submitted to
the test lab.

MALE: I\'ll just add the comment I think Secretary Davidson\'s remarks
were very well taken and point out that there\'s more parts to this
process than just these guidelines. I can\'t conceive of any vendor
saying anything to 1211 other than, \"Our product\'s great!\" Now,
election official comparing various products, very likely would find
there\'s differences that are \-- that are germane to a decision. I
think it\'s a meaningless clause and we outta remove it.

MR. CHAIRMAN: I \-- I heard that it was very useful. I\'m not sure I can
equate that to meaningless. \[laughter\]

MALE: By \"meaningless\", is the vendor \-- the vendor performing this
test.

MR. CHAIRMAN: Well, I understand, so, I mean, I think that what we\'re
saying, there is value to it. The question is who should be responsible
for doing the test, so.

MALE: I think if you want these tests done, they should be done by the
ITA labs or the jurisdictions that are buying the machines. I think it
is \-- it is a very valid approach to testing because you do learn
things such as large font breaks a race (phonetic sp.) across two pages
and isn\'t very usable. Those are real things of system design about
design, but I think to just put it out there as something the vendor is
to do. Vendors are driven and, you know, vendors like every
organization, run on limited resources. They are out there trying to use
those limited resources to come as close as they can to the legal
requirements for using systems and the wants and needs of their
customers. I think even if \-- even if they were to come up with some
profound discovery of usability within their systems, they would still
be having to go and market in a venue where that may not be considered.
I think it needs to be the work of NIST; it needs to be the work of this
board, the EAC, and local jurisdictions to develop the standards, do the
research, and push it out there. And I\'m very much in favor of that,
but I think just to make it a courtesy requirement every time a vendor
rolls out a product that he\'s going to run this test routine, I don\'t
see where that\'s valued process.

MALE: (indiscernible) change of the responsible entity as Paul
suggested, to the ITA.

MR. CHAIRMAN: Is that?

MALE: But the vendor will guaranteed to be doing it first.

FEMALE: Yes, that is true, if it\'s gonna be \-- if it\'s gonna be
tested by the ITA.

I guess that would move this out of this section, however, wouldn\'t it,
John?

No, but, I mean, if it\'s an ITA test, doesn\'t that make \-- doesn\'t
that move?

MALE: (indiscernible)

MALE: I don\'t think so.

FEMALE: I \-- I don\'t view this as an ITA test but a documentation
requirement, just like documentation of the software testing to \-- to
\-- to \-- so vendors that are doing best practice with the
user-centered design and has \-- have usability engineers on board,
it\'s for free.

FEMALE: Hmmm. I don\'t know (indiscernible). \[laughing\]

MR. CHAIRMAN: I thought the question was if this applies to ITA as
opposed to vendors, does it belong in this section?

MALE: I think the answer to that is no, it does not belong in this
section \--

FEMALE: Right.

MALE: \-- \'cause that becomes an official conformance test.

FEMALE: And because part of it \--.

MALE: This is a \-- now structured as a documentation requirement.

FEMALE: Okay.

MALE: Your vendor can do the test and tell us what happened.

FEMALE: Do we have a \--? Is there a solution of moving it to a should?

MALE: It\'s okay with me.

MALE: That\'ll work.

MR. CHAIRMAN: Well, if we go to should, I mean, that\'s basically a
recommendation \--

MALE: Uh-huh. (affirmative)

MR. CHAIRMAN: \-- and if they see a value, that\'s fine. If \-- is that
\-- is that acceptable to you, Miss Quesenbery?

FEMALE: I don\'t \--.

MR. CHAIRMAN: I mean, clearly this is something that needs to be
addressed in version 2.

FEMALE: Yes.

MR. CHAIRMAN: So the question is \--

FEMALE: Well.

MR. CHAIRMAN: \-- what \-- what would be the requirement for version 1?

FEMALE: Well, what if we change it to a should and make the document \--
made the discussion have a note that in version 2, we expect to have IT
\--

MR. CHAIRMAN: (indiscernible)

FEMALE: \-- similar tests run by the ITA as part of the conformance
process.

MALE: Okay.

MR. CHAIRMAN: Okay, so we change this to sh \-- should and then future
versions of the \-- what were your conditions?

FEMALE: Yeah, I\'ll \-- I\'ll write this out.

MR. CHAIRMAN: So you will?

MALE: (indiscernible) discussion (indiscernible).

FEMALE: Yeah.

MR. CHAIRMAN: Okay. Is that \-- is that generally acceptable?

MALE: Yep.

MR. CHAIRMAN: Then you will come back with a modified version of this,
Miss Quesenbery?

FEMALE: Yes.

MR. CHAIRMAN: Okay. So now, there was a question about the 2.1.3.

MALE: I\'ll withdraw that. I noted, is already a should.

MR. CHAIRMAN: You are \--? Okay.

FEMALE: Sorry. John, can you \-- can you get that note since we\'re
pushing ahead?

MALE: Let me clarify it before I write it down. (indiscernible). Okay.
So what I \-- what I have here is that the requirement is written should
replaces shall \--

FEMALE: Uh-huh. (affirmative)

MALE: \-- and under the discussion that says \"future\" \--

MR. CHAIRMAN: (indiscernible) documentation.

MALE: \-- something along the lines of this testing \--

FEMALE: Right. This requirement \--.

MALE: \-- will be done by the ITA \--

FEMALE: Yep.

MALE: \-- in the future?

FEMALE: Maybe, \"This requirement is meant to encourage that ACS \--
ACCVS designers conduct some realistic usability tests. For \-- for now,
it\'s \-- some \-- encourage that the vendors do it, but in future
versions, it will be part of the ITA conformance tests.\"

MALE: Okay. Got it.

FEMALE: Something \-- or something like that?

MALE: Okay.

MR. CHAIRMAN: Moving right along \--

FEMALE: We are on page 15.

MR. CHAIRMAN: \-- we are on \-- at page 15.

MALE: On 1214, the same comment as on 1212 and that is you \-- you
changed the \"under control of a voter\" to a should. (indiscernible)
keep the capability there, but \-- but make it a future requirement that
it be under the control of the voter.

MR. CHAIRMAN: This says \"by default or.\"

MALE: (indiscernible)

FEMALE: Yeah.

MR. CHAIRMAN: That\'s an \"or.\"

MALE: Okay.

FEMALE: Okay.

MALE: Okay.

FEMALE: Okay.

MR. CHAIRMAN: So we\'re okay on that?

MALE: Yeah.

MALE: (indiscernible)

MR. CHAIRMAN: Could you turn your speaker up?

MALE: I\'m sorry. That \-- that \-- as it\'s written, precludes doing it
under the control of the poll worker, though. So.

MR. CHAIRMAN: What\'s the recommendation?

MALE: \"Or\" \-- \"or poll worker.\"

FEMALE: \"Poll voter or poll worker.\"

MALE: Yep.

MR. CHAIRMAN: Is that acceptable to everyone?

MALE: Uh-huh. (affirmative)

MR. CHAIRMAN: So we\'re adding another \"or\"?

FEMALE: No.

MALE: \"Under the control of the voter or the poll.\"

FEMALE: \"Or poller.\"

MALE: Well, you could do the same thing back on 1212. You could make
that \"under control of the voter or the poll worker.\"

MALE: You could, yeah.

FEMALE: Oh, that was (indiscernible).

MALE: That\'d simplify that.

MALE: That would.

MALE: (indiscernible)

MALE: (indiscernible) a global change.

FEMALE: So.

MR. CHAIRMAN: So we are changing \--.

FEMALE: Second votes?

MR. CHAIRMAN: \-- 212.

FEMALE: Sorry. So on both 1212 and 1214, we\'re saying \"under the
control of the voter or poll worker\" \--

MALE: Yeah.

FEMALE: \-- and we\'re adding a note that in the future, we expect to
move this to be a required \-- to be under the control \-- to be under
the independent control of the voter.

MALE: Okay.

MALE: And we might as well go ahead and change that into 1.5 and 1.6.

MALE: (indiscernible)

MALE: All the way through?

MALE: Okay.

MALE: We\'re through 1.6.

FEMALE: Do we need to do the same thing to 5 \-- to 1.5 and 1.6?

MALE: Yeah.

MR. CHAIRMAN: I think that was \-- that was being suggested.

MALE: I don\'t \-- I don\'t know of any system that you can adjust the
red, green, blue components.

MALE: I further state that I don\'t think it\'s desirable.

MALE: Yeah.

MALE: There\'s a NASA technical bulletin on this and I think that
wording is preferable to what\'s here in the. The discussion I\'ve heard
on this is that most users will not get the desired result with this
solution. What is effective is a range of color contrast combinations or
simply the availability of pure black and white. The voter will
effectively choose the one they can see best, but allowing them to
fiddle with knobs is not an effective way to get them to a color
contrast ratio that works for them. Plus it does bad things to time \--
vote (indiscernible) time. So I think we want to replace this with the
language that\'s in the NASA technical bulletin on the topic which is to
provide the voter with a range of selections and let them choose the one
that works for them.

FEMALE: I would be fine with that.

MALE: Okay.

MALE: So \-- so both those sections go together.

FEMALE: And I just heard Paul say that he\'d like to make 1 \-- 1.2.1.6
a should. Should \-- should \-- should supply a range of options.

MALE: I think \-- I think what Steve was suggesting that you combine 1.5
and 1.6 \--

FEMALE: Uh-huh. (affirmative)

MALE: \-- into the wording that\'s \-- that\'s in the current NASA
document.

FEMALE: I believe we did use the current wording, but I don\'t have the
bulletin in front of me so I can\'t confirm that.

MALE: You may have, but there\'s an addendum. There\'s something similar
to this in the original \--

FEMALE: Uh-huh. (affirmative) But.

MALE: \-- 2002 standard. But we came back with an addendum because this
\--

FEMALE: Okay.

MALE: \-- (indiscernible) \--

FEMALE: Okay. So. All right. That might.

MALE: \-- (indiscernible) work.

FEMALE: Okay. Maybe missed the addendum there.

FEMALE: So we\'re going to have revised language for 1.5, 1.6.

MR. CHAIRMAN: Okay, so we\'ll.

FEMALE: The addendum was a NASA technical bulletin?

MALE: Yes.

FEMALE: I believe that\'s what we used, but we\'ll \-- we\'ll double
check.

MR. CHAIRMAN: Okay, we\'ll check on that.

2.1.7.

MALE: This probably \-- the system should be capable of maximizing. I
think all these systems allow \-- the color systems allow election
officials to have some control over the colors on the screen.

FEMALE: Then we might want to add \-- maybe we wanna add the voting
system vendor, I mean, the \-- the voting official as an additional
responsible party.

MALE: Yeah.

FEMALE: Jim, you\'re crackling.

MR. CHAIRMAN: Say that again? Yeah. So. Do the suggestion on 1.2.1.7 was
to add \--

FEMALE: Well, one is to add \--

MALE: \-- responsible?

FEMALE: \-- to add voting officials as one of the responsible parties
since they often control the final design of the ballot.

MALE: (indiscernible)

FEMALE: Yep.

MR. CHAIRMAN: Are we okay with the rest?

FEMALE: Okay. I think this moves us on.

MR. CHAIRMAN: 1.2, 1.8?

FEMALE: Yeah. I think this moves us on to page 216. And I\'ll withdraw
my suggestion \[laughing\] that we change that to a shall. The next is a
should \--.

MR. CHAIRMAN: Wait a minute. I lost you. Are we on 1.2?

FEMALE: 1.9.

MR. CHAIRMAN: Okay, what happened to 1.2, 1.8?

FEMALE: I think we went right by it. It\'s a sh \-- everybody okay with
it?

MALE: Mr. Chairman, I didn\'t even disagree with that one. \[laughter\]

MALE: What was that?

MALE: I say, I didn\'t even disagree with that one.

FEMALE: Quick, let\'s curb it; it\'s done.

MALE: All right.

MALE: We better move on before he changes his mind.

FEMALE: Yep. \[laughter\]

Okay, we have \--.

MR. CHAIRMAN: So we\'re back to 1.2.1.9.

FEMALE: And I\'m withdrawing my suggestion that we change it.

MR. CHAIRMAN: So you are comfortable leaving it as should?

MALE: Yes.

FEMALE: Yes.

MR. CHAIRMAN: Are we okay with that?

FEMALE: Okay.

MR. CHAIRMAN: All right.

FEMALE: 1.10 is also a should. Are we okay with this as a should?

MALE: Well, I guess.

FEMALE: I\'m not sure it\'s necessary given 18.

MALE: Yeah. What we want in place of that, we want controls to be
tactile in nature, which, to me, \"tactile\" means that the voter can
tell by touch what he\'s doing. Obviously, they\'ve got to be visually
identifiable.

FEMALE: Sharon or John, are we talking about tactile controls here?

MALE: The reason this is written the way it is, is this applies to all
voting stations. All accessible voting stations, so we do want to
recommend tactile, discernible buttons on all voting stations. We wanted
to (indiscernible). That was the \--.

MALE: Okay. In that case, leave it as a should.

FEMALE: Okay.

MR. CHAIRMAN: Okay.

FEMALE: We\'re up to another example of the usability testing and I
would suggest that we would \-- whatever change we\'re about to make for
the previous version which is 1.2.1.1. that we make the same change to
1.2.2.1.

MALE: Actually, I wouldn\'t ask for it there, but if you wanna make it?

FEMALE: \[laughter\] Why?

MALE: I \-- I believe for this issue, we\'re not able to provide
sufficient objective verifiable requirements and so the testing has
value.

FEMALE: This is actually interesting because in some research that was
done at the National Cancer Institute, we had exactly the opposite.

MALE: Okay.

FEMALE: They \-- they did research with both line voters \-- I\'m sorry,
line users and with partially-sighted users. And what they found was
that it was easier to create firm design requirements for \-- for the
blind than it was for people with different visual disabilities because
the range of problems is so much greater.

MALE: Right.

MALE: Right.

FEMALE: So \--

MALE: (indiscernible) blind.

FEMALE: \-- research is actually opposite. \[laughing\]

MALE: So on this section, I\'ll value your expertise.

MALE: I guess my concern is that we need to define what specific
functions and reliability we\'re looking at there because the
requirement as stated isn\'t something that you can test and.

FEMALE: Which one? 1.2.2?

MALE: 1.2.2.

FEMALE: 1 \-- 1.2.2, there\'s several of these that are high-level
requirements. I think Mark Scull and Sharon both also alluded to this
that there are high-level requirements that are essentially satisfied by
satisfying the indented requirements under them.

MALE: Okay, I guess perhaps this should be a should and then the
indented requirements become shalls.

FEMALE: Well, but actually, HAVA says that \-- I mean, the HAVA
requirement is that it shall.

MALE: Well, it shall, but then it gives you some very specifics such as
the audio ballot element.

FEMALE: Right, but if you look at 1.2.2.2. through \-- the next several
pages are all the specific requirements.

MALE: Okay.

FEMALE: John?

MALE: (indiscernible) a little bit? This gets to the question of
testability and one of the things NIST was very concerned about from the
VSS were what some requirements seemed like there\'s a pretty specific
test for it and others seemed more general \--

MALE: Right.

MALE: \-- so we were very concerned to distinguish between let\'s say
requirements that were more goals and general versus ones where you
could really pretty well nail it down and we did that through this
mechanism of high- and low-level requirements where the understanding is
that the low-level requirements will be the ones that directly \--
directly testable. It\'s \-- also, implicitly, the high-level
requirements are not directly testable and I don\'t know, you can just
say yes, this is accessible to the blind or no, it\'s not. But the point
is, by looking at the lower-level requirements under it, then that \--
that higher-level requirement is served. But we felt it was still
valuable to make a statement about the high-level purposes for which the
lower-level requirements were directed. So that\'s why it was structured
\-- this has to do with the structuring of the standard as a whole and
the rest of the standard uses this \-- this scheme to try to make things
clearer. At least, that was the intent.

MALE: I guess. My \-- my concern is \-- and for me and the other testing
labs when we get to the point of defending our work product, this needs
to be very, very clear, that yeah, that is \-- that is the goal of this
section is to make voting systems accessible to people who are blind and
in that regard, the following things are shalls or mandatory.

MALE: Yes. There\'s a general statement to that effect and I \-- I agree
and I \-- I guess \--

MALE: I guess that what I\'m saying is \--.

MALE: \-- I would like to see each requirement tagged to say \"this one
is intended as a directly testable requirement\" versus a high-level
this is \-- is intended as a goal statement.

FEMALE: Is \-- is this (indiscernible).

MALE: But that\'s something we didn\'t \-- we thought about that and
didn\'t quite have time to do it, but I think that\'s something that
needs to be.

FEMALE: Is what \-- is what you\'re saying implicitly the accessible
voting stations shall be accessible to voters who are blind by meeting
the requirements in this section? I mean, is that \-- and so the \--

MALE: That \-- that \-- that wouldn\'t (indiscernible), no.

FEMALE: \-- implication of what you\'re saying.

MALE: Uh-huh. (affirmative)

MALE: Yes.

FEMALE: And would that phrase help clarify it for people?

MALE: I guess \-- I guess the trouble is if you do that, you\'ll wind up
doing that all through the standard because the whole standard \--

FEMALE: Yes, I know.

MALE: \-- is structured in terms of this tree, so I don\'t want every
high-level note to say and oh, by the way, you\'ll do this by meeting
the low-level requirements \'cause you\'re just going to be saying that
40 times. So we have a general statement up front that this is how the
standard is structured and has to be understood in that way.

FEMALE: And this isn\'t just in this section. This is throughout \--

MALE: Uh-huh. (affirmative)

MALE: Oh, right, yes. Not just human factors. Yeah. Yeah.

FEMALE: \-- yeah.

MALE: So if you buy into the hierarchical scheme, then this makes sense.
But \-- but you do have to sort of \-- I admit that there\'s a little
cognitive low there; you have to sort of understand how to interpret
what \-- what we\'ve written and I \-- I think at some point, we do have
to be much more specific about what we intend to be directly testable
and \-- and what not.

MALE: Well, I \-- I definitely think you\'re going to have to do that
because when you come to this document looking at what accessibility
must you provide for people who are blind, you \-- you don\'t read the
entire document; you start with \--

MALE: (indiscernible)

MALE: \-- okay. When you come to this document looking for what
standards apply to systems providing accessibility to voters who are
blind, you\'re generally not going to be reading the entire document or
taking it entirely in its context. I think \-- I think this section, as
all of these sections, needs to stand alone and make it very clear that
okay, yeah, this is our goal to make it accessible for people who are
blind and these are the things we are going to do in that regard which
are testable, but if \-- if there\'s a blind person out there who cannot
use this system because of something no one here thought of today, that
then \--

MALE: Yeah.

MALE: \-- needs to flow into development of future standard rather than
be held up as a failure of the (indiscernible) standards.

MALE: Right, yeah.

MALE: I \-- I sympathize with that, but \-- but I also disagree a little
bit in that I \-- I think if you sort of open the standard to the middle
and start reading, you\'re gonna be confused. I \-- I think there has to
be some understanding of the context up \-- up front if you, you know,
if you skip over the introduction, you might have a problem and I think
that\'s true with almost any standard. Any standard I\'ve ever seen has
some kind of notation, conventions, or whatever, or a glossary and, like
I say, if you just sort of open it in the middle, you\'re going to be a
little lost, so that \-- I \-- I think you have to expect the \-- the
reader, you know, the serious reader who is really gonna work with this
to have some \-- some sense of how the document is organized. At least
that\'s the hope. That \-- that was our thinking, so.

MR. CHAIRMAN: Okay.

MALE: But \-- but I do \-- I do think also that there should be a
greater clarification, a greater distinction between what we expect to
be directly tested and what not.

MALE: Okay. So how do we do that?

MR. CHAIRMAN: Mark, did you wanna make a comment?

MALE: Yeah, yeah.

MALE: Sorry, sorry.

MALE: I just wanted to mention \--

MR. CHAIRMAN: Okay.

MALE: \-- there is a discussion of this in the overview \--.

MR. CHAIRMAN: (indiscernible).

MALE: Mike.

MALE: Mike.

MALE: Can you hear me?

MALE: Yeah.

MALE: Okay. There is a discussion of this in the overview, but what we
could do is enhance the conformance clause and talk about the issue of
structuring and testing and make this explicit so that people who
actually pay attention to conformance clause will actually understand
where we\'re coming from and what we\'re trying to accomplish. Would
that help?

MALE: I guess, Mark, I\'m having trouble visualizing how you\'re going
to do that. I mean, are we going to say that six digit statements or
standards are all high-level and seven-digit standards are intended to
be testable? I\'m not sure \--.

MALE: No, because that \-- that \-- that\'s variable. I think we\'ll
explain the concept of that the lowest-level tree, the leaf-type
statements are testable and \-- and it will probably \-- we\'ll have to
wordsmith it to \-- to logically explain how we get there. I don\'t have
the answer for how \-- what we will say right now, but what I\'m asking
is if we put it in a conform \-- if we figure out a good way to say it
and put it in a conformance clause, would that be helpful in the sense
it will give people an up front indication of what we\'re trying to do?

MALE: Perhaps, I mean, we\'ll have to look at it.

MR. CHAIRMAN: Mr. Berger.

MALE: That discussion\'s raised a question. Do we have anywhere in the
document an equivalent facilitation clause? The access board uses those
where they\'re commonly \-- which is if someone, some piece of equipment
can meet the intent of a requirement but not the specific requirements
of a document, is there a provision where that \-- where those novel
implementations can be judged to be compliant?

MALE: It\'s not there now, you know. There are no such things.

MALE: I \-- I\'d like to suggest I think that\'s a useful and productive
clause to have at some point. That an ITA, some of these very specific
requirements \-- there be a provision by which a vendor can say I
figured out how to build a better mousetrap. They can prove it, I
suggest, to the ITA and be judged in compliance.

FEMALE: Well. Interestingly, although it isn\'t in via \-- VVSG 1, that
is kind of the intent of moving to performance requirements \--

MALE: Uh-huh. (affirmative) Exactly.

FEMALE: \-- is to get away from design requirements that are that
specific. I suspect that when we move to performance requirements, this
whole section gets a great deal shorter.

MALE: Yeah, I think that\'s a two-edged sword. I mean, the first thing
that comes out when you go there is magnifying glasses to deal with a
font requirement for DREs and we don\'t really wanna go there.

FEMALE: Right. Right. So \-- so if you have performance requirement that
says not only do they have to be able to use it but they have to be able
to use it effectively in a reasonable period of time and we\'ve been
able to specify what reasonable is and what effective is, then solutions
that may sound plausible but don\'t, in fact, produce the performance
you \-- you were looking for, would \-- would therefore not pass.

MALE: It is a useful clause to have because there\'s all kinds of novel
innovations that come along that we don\'t foresee in a \-- in a body
like this.

MR. CHAIRMAN: I think the idea is with a performance-based standard, you
don\'t need the clause \--

FEMALE: Yeah.

MR. CHAIRMAN: \-- because you\'re not asking them to do \-- you\'re not
specifying how to meet the standard; you\'re specifying the requirement
for the standard and it\'s up to the vendor to demonstrate that they
meet the requirement, provided of course, the requirement is
quantitative and testable. So, I mean, there is a whole change of
philosophy.

FEMALE: I\'d \-- I\'d also say that without disagreeing with you that
it\'s valuable. Without \-- without disagreeing that it\'s value, since
the focus of VVSG 1 is existing equipment, \[laughing\] it\'s sort of
(indiscernible).

MALE: Yeah.

MR. CHAIRMAN: Where are we?

MALE: Yes.

FEMALE: I believe we\'re on page 17.

MR. CHAIRMAN: We\'re on page 17 \--

FEMALE: These get easier as we go, by the way.

MR. CHAIRMAN: \-- well, I hope so because \--

FEMALE: I don\'t know.

MR. CHAIRMAN: \-- we still have a lot of material to go through.

FEMALE: I \-- I don\'t actually know why things are in italics.
\[laughing\]

MALE: What if we decide on 1.2.2?

FEMALE: That was the word (indiscernible). The italics mean nothing.
That\'s what (indiscernible).

FEMALE: Oh, it\'s a glitch?

FEMALE: (indiscernible) when they (indiscernible) it again.

FEMALE: We just (indiscernible) nothing. We\'re leaving it.

MALE: 1.2.2.6.

FEMALE: Yep.

MR. CHAIRMAN: We are on 1.2.2.2.

FEMALE: \[laughing\]

MR. CHAIRMAN: Is that correct?

MALE: Wait, we skipped 1.2.2.1, did we not?

FEMALE: I believe what we said, we were going to do to 1.2.2.1 whatever
we did to 1.2.1.1.

MALE: Which was make it part of?

MALE: The ITA.

FEMALE: The IT \-- yeah.

MALE: Okay.

MR. CHAIRMAN: Well, I thought we were going to make that a should.

FEMALE: We\'re \-- we\'re gonna do the exact same treatment that we did
to it in a parallel clause.

MALE: Should and go to the ITA?

FEMALE: Yep.

MALE: (indiscernible)

FEMALE: Okay. Any comments on 1.2.2.2 or on its sub clauses 1.2.2.2.1?
(indiscernible) how \'bout pages 217 and 218 down through the last,
what\'s italicized in our hard copies which is 1.2.2.2.4. The ATI should
allow the voter to skip over the reading of a referendum so as to able
to vote on it immediately?

MR. CHAIRMAN: Secretary Davidson.

FEMALE: I just have a question. If \-- and this is tied to the system
and the system is capable of going back, you know, and reviewing
something they voted on or maybe they didn\'t vote on. But when they
have the ability to skip to the next one, can they back up? That\'s my
question because if they can skip, skip, skip, you\'ve gone over votes.
I mean, there\'s a big concern about undervotes. So I \-- I just don\'t
understand the technology well enough to know if it can do that?

FEMALE: It\'s a should clause, for one thing. And other, you know, we
have existence proofs, you know, for how \-- how screen readers go over
what pages, et cetera, to do this kind of skip navigation.

MR. CHAIRMAN: It\'s not a should.

FEMALE: Not a should.

MALE: It\'s a shall.

MALE: 1.2.2.3?

MALE: 2.2.3.

MALE: You won\'t be able to navigate in both directions.

FEMALE: It\'s 3 and 4 and I \-- I just don\'t understand the technology
well enough, I believe, because it talks about skipping over the
initiatives and referendums, skipping over to the next contest, so.

MR. CHAIRMAN: Could you turn on your speaker, please?

FEMALE: I\'m sorry. I can\'t find it, but I thought there was one later
that said that they could go back and review.

FEMALE: I \-- I think it\'s giving equivalent to skip over a contest,
just like if you\'re sighted, you skip over a contest. It\'s equivalent
functionality. I mean, you would still review and it would point out
undervotes, just like with the visual, so.

FEMALE: And I just want to make sure they could back up on the video \--
on the audio as well as skip, was my \-- was my concern.

FEMALE: So \-- so \-- so you\'re suggesting shall be able to skip to the
next contest and back up to previous contests?

MALE: Yeah.

FEMALE: Yeah. Maybe we should add \"and back up to previous contests.\"

FEMALE: That\'s \-- that\'s my concern.

MALE: And basically all the systems we\'ve seen, I don\'t know about
you, Brett, but all the systems that we\'ve seen allow you to go back
and review your input on any race, go back and change your input,
basically do all the functions that you can actually do with a touch
screen or paper ballot.

MR. CHAIRMAN: Okay, can we be specific? Now, which one are we talking
about? Is it 2.2.2.3?

FEMALE: 2.2.2.3 and we\'re adding \"and \--.

MR. CHAIRMAN: Allow the voter to skip to the next contest\....

FEMALE: Or return to previous contests.

MR. CHAIRMAN: Or return to previous.

FEMALE: Mr. Chairman \--

MR. CHAIRMAN: Yes.

FEMALE: \-- I noticed that it is now 11:29 and we\'re actually \--
perhaps we could \--

MALE: It\'s 12:29.

FEMALE: 12 \-- I\'m sorry \-- 12:29. And I\'m looking for a good place
to break. So this \-- so this might be a good place to break because
we\'re at the end of a subsection.

MR. CHAIRMAN: Yes, and perhaps during lunch, we can find a \-- find a
little more efficient way of going through this rather than one-by-one
\--

FEMALE: That would be nice.

MR. CHAIRMAN: \-- otherwise it will take a long time. So I propose that
we break for lunch and \-- and we come back, resume at 1:30.

MR. CHAIRMAN: If everyone can take their seats, we\'ll start shortly.

FEMALE: Come up with a better system?

MR. CHAIRMAN: Huh?

FEMALE: Come up with a better system?

MR. CHAIRMAN: Well, we\'ll.

**\[End of Audiotape 2\]**

MR. CHAIRMAN: \-- position of making value judgment, and we should
proceed there.

MALE: John?

MALE: I didn\'t mean it that way. So I guess what I\'m saying is that
everything\'s imperfect. For 2006, there\'s two methods that are
acceptable. Both would have to provide some compensating controls to
overcome some of the imperfections that we have faced to that will
attempt to raise the bar somewhat and make it less imperfect. \[laughs\]

MALE: I guess part of the problem with this entire subject. A great
disservice has been done, I think, to impress upholding systems security
by writers who have the vision that these machines should be so secure
that you can sit them out on the sidewalk unattended, and they will only
let authorized voters vote in secret and only vote once. And that\'s not
the reality of the world that we\'re designing these systems to work at.

And, you know, I think the new thought and this document is good. I
think it needs to be continued on. But to say that a system is weak on
security because it only has a single record, that\'s not logical. There
are systems that have multiple records that have people spending their
entire lives trying to make the two records balance. Whether you have
one or two records is irrelevant. Whether or not the system is
adequately protected from manipulation and from sabotage, from operator
error, whether it\'s accurate and reliable; those are important pieces
of security and integrity. And that\'s what we need to be getting to.

If the art emerges where we can do it with two independently maintained
duplicate records with the ability to reconcile them against each other
and do that in such a way that it doesn\'t create more errors than it
solves, then yes. That\'s where we need to go. But we need to let the
prototypes that are being worked continue to evolve. And we need to look
at how to make systems right now that meet the art that we have and that
can be used to conduct elections.

MALE: Well, can I come on now?

MR. CHAIRMAN: Okay. Last word. Then we better go on to the quote,
unquote, more useful part of the discussion.

MALE: Paul makes a number of good points. And I agree with almost
everything ahead. I just wanted to respond to that and a little bit to
what Brit said too and to try and put things in context as I see it a
little bit more, too.

I think one of the goals here that we\'re charted with, all of us are
trying to collectively work with this, is raise the bar on security. And
one of the key lessons we\'ve learned in security over the years is that
single points of failure need to be strengthened and improved.

And so the suggestions of this team here is to try to focus on one of
the single points of failure that have been identified by many of the
experts that have come to testify before us, which is the difficulty of
assessing the software that\'s being used here. It\'s not impossible to
verify perhaps, but it\'s extremely difficult and costly and difficult
to do well.

And so having a dual record proposal that\'s been put in front of us
here as having a dual record system where one of the records is either
directly verified or verified by a different piece of software, with the
help of a different piece of software can help strengthen against is the
single point of failure.

It\'s not the only security issue to worry about. There\'s lots of them.
Paul, you made a good list of them there. You got to sort of cover the
map and all the security issues and trade off against usability and so
on too. But this is a very innovative and interesting proposal I think
that (Indiscernible) has put together. And I think it\'s nice to have it
in the version one here for people to start considering to see how we
might integrate this kind of thinking into our future developments.

FEMALE: Mr. Chairman, since I note that we\'re coming up towards a
break, I wonder if it would be possible to decide what we\'re going to
do with this section. We\'re obviously not going to go through it and do
line-by-line edits of any kind, so \[laughs\]. One hopes.

MR. CHAIRMAN: Well, as was pointed out, this is informational in nature.
It does not set requirements, and it\'s really to provide for some
future thinking. And do I hear a motion basically to adopt this section?

MALE: Mr. Chairman, without committing to support the motion, I will
make a motion that we adopt this section.

MR. CHAIRMAN: Do I hear a second? \[laughter\]

FEMALE: I second it. \[laughter\] If we\'ve had some discussion, I would
note that we did have one suggested change to it that would need to be
made as part of your editing process, which was the addressing the
footnote and clarifying the intent of that line.

MR. CHAIRMAN: Yes. So have we --

MALE: Also, we questioned whether or not we want to go into the level of
detail we go into talking about design, the specifics of the design of
systems that are on the drawing board. I mean, this doesn\'t have to be
24 pages to get the idea across. Now I think it\'s a disproportionate --
You know, just -- We got an elephant in the living room. \[laughs\] And
that leads people to come to certain conclusions about us here. And I
don\'t have any objection to any of the things I\'ve heard. I think
these are good designs. They not only should be explored, they are being
explored.

But to put them in this document whose stated purpose is to provide
guidance for 2006 at the magnitude they are is what I\'m questioning.

MR. CHAIRMAN: Would you be satisfied if we have it or not, but a
statement is put at the very beginning that this it to encourage some
thinking --

MALE: Mr. Caret?

MR. CHAIRMAN: Encourage some thinking, etc. to make that clear.

MALE: Maybe what we could do is offline somebody could edit the document
so that the part that\'s in the main body is shorter and more succinct,
and the detail designs are like examples in an appendix or something.

MALE: Mr. Chair?

MR. CHAIRMAN: Yes.

MALE: I think that this entire work product that we are attempting to
graft here is very confusing to people who aren\'t intimately involved
in this process. To hang out in that document at the beginning of
security issues, a 24 page or whatever proposal for the future, I think
it makes it difficult to tell what the real intent of this document is.
It\'s going to lead to confusion. It will probably lead to litigation.
It will, to some extent, limit the creativity and innovation that
vendors are going to do in coming up with prototypes, because it seems
to suggest that this is where we\'re going.

FEMALE: Well, \--

MALE: I think it\'s inappropriate for it to be in version one.

FEMALE: If I could offer a pick up on Mr. Schitzer\'s (phonetic sp.)
comment and try for another thing. We\'ve looked at a series of
definitions that are fairly short and that I think are important because
they lead forward into the language in the VB pat section. I don\'t see
why we couldn\'t pull out the core language of this section, which is
specifically the definitions and leave it in here as informative
definitions. And then take the rest of this document and put it into an
appendix for discussion.

MALE: (Indiscernible).

FEMALE: And just reference the appendix in the core, so we haven\'t lost
the work. We aren\'t forcing ourselves back into a long editing process.
I know there\'s going to be a lot of work in the next two weeks. But we
don\'t interrupt the flow of the document.

MALE: Could I just clarify -- Oh, I\'m sorry. You want to --

MALE: (Indiscernible) still be starting (Indiscernible). Starting with
section 6013 would be the suggestion is I interpret it right. It\'s on
page 617. And afterwards, by interpreting your suggestion, the core
definitions, which I agree are the more fundamental thing
(Indiscernible) just then preceding section. So up through page 6-16
leave in the main document. That sounds like an amendment to me to the
original proposal.

MALE: Well, are we going to --

FEMALE: (Indiscernible).

MALE: Point of order we have a motion and a second on the floor to adopt
it as it is.

MR. CHAIRMAN: Wait a minute. We already -- This was part of the
discussion of a motion that was to adopt it as it stands. Now the
discussion has gone in a different direction.

MALE: Which is an amendment to the original (Indiscernible).

MR. CHAIRMAN: Okay. So the amendment is to distill the parts that were
basically in John\'s discussion, the main definitions. To adopt them in
--

FEMALE: So am I offering an amendment -- I think I\'m offering an
amendment to keep in the main document the material that\'s 6.012, the
core definitions, and move the rest of the material intact to an
appendix.

MALE: Oh, so 601 would move to the end?

MR. CHAIRMAN: Which one are we keeping?

MALE: Whitney, if I could maybe clarify what I think I\'m hearing is
that I think you\'re saying that all the material up until page 6-17.

FEMALE: No. No. I was actually looking at keep -- I think -- Sorry,
correct me. Dr. Revess (phonetic sp.), I may need your help on this. But
I think I\'m saying let\'s keep the material on pages 613 through 616,
which corresponds to the slides, that ends with the slide sections
that\'s up here, which are core definitions written in fairly tight
format. And take the rest of this section, before and after it, and move
it to an appendix beginning with -- What did you just say? 601? Right,
601, two.

MALE: (Indiscernible).

FEMALE: No. That\'s a long way, 6012. 6012 is where we begin what we
want to keep.

MALE: It seems like about two and half, three pages.

FEMALE: I think we\'re taking 6011 all the way through line 18 on page
613.

MR. CHAIRMAN: To do what?

FEMALE: And putting it in the appendix.

MR. CHAIRMAN: Oh, okay. So --

FEMALE: And then we\'re taking pages 617 and on and putting in an
appendix, or are we keeping those? We haven\'t gotten that far, so I\'m
really not sure. Because those all describe other possible systems, and
I think those will probably end up moving as well.

MALE: If I could comment on the proposal. I thought what you were
suggesting first was to keep everything up through the core definitions,
because 6011 has motivation for the definitions. You\'d have a section
with bare definitions and little motivation. I don\'t think it would
terribly readable. So I would think the alternative of having everything
up through 6012 inclusive, 6-1 up to 16. Might be a more readable
document.

MR. CHAIRMAN: Okay. May I suggest that the subcommittee get together?
This strictly a cutting and pasting issue. John, can you basically
recreate this section? Pull out the part that\'s going to go into the
actual text?

MALE: Sure.

MR. CHAIRMAN: And then separate the rest of it, put it under appendix,
whatever X, and bring that for a vote tomorrow morning.

FEMALE: But there --

MR. CHAIRMAN: But the general understanding is that what\'s going to go
into the version one is this section from 613 through 617, probably with
some preamble. And I think what we\'re discussing is how long a
preamble. So if you can work that out, we can then vote on that
tomorrow. Is that acceptable? Would you withdraw your motion Mr. Kraft?

MALE: I will withdraw my motion for the sake of tabling the issue.

MR. CHAIRMAN: Thank you. Do we all agree on the action? Thank you.

MALE: Okay. At this point we could watch into VVPAT. I\'m not sure if
we\'re near a break.

MR. CHAIRMAN: What\'s your pleasure? Do you want to take a break now, or
do you want to go ahead with VVPAT?

FEMALE: I think (Indiscernible).

MR. CHAIRMAN: Okay. Can we make a short break, and let\'s meet at a
quarter to four? Thank you.

\[people talking during break\]

MALE: We\'re going to start in a second. I just wanted to -- Peter
Ketchum offered one piece of advice, and I\'m not sure how late we\'ll
go. If we do go past five thirty, it turns out that there is a bus, a
ride on bus that will take you to the metro at five fifty. And Peter has
offered to be a guide right there if we do go that long.

The other thing is J.R., are you with us? No. Okay.

MALE: I heard him a minute ago. J.R.? Are you there?

FEMALE: Not right now.

MALE: Just your (Indiscernible). J.R., I think they have cut out. I
heard this (Indiscernible).

FEMALE: And this is Joan Kirshellan (phonetic sp.) still on the line.

MALE: Okay. Good.

MR. CHAIRMAN: Okay. Ah, let\'s see. Who are we missing? Whitney and what
was that \--. Okay. Could we corral a couple of the members from out
there? Mark, Whitney, and Steven? Whitney is there. Okay. We\'re moving
onto the next topic, and at this time I call on again, Mr. John Wack
(phonetic sp.) of our information (Indiscernible) laboratory to present
the next report, bona verifiable paper or a trail requirements for VBSG
version one. John?

JOHN: Thank you. Okay. I think we\'re -- everybody\'s here who\'s going
to be here. Before I start, can everybody on the phone hear me properly?

MALE: Yes.

JOHN: Okay. Thank you. Okay. What I\'m going to talk about is basically
our final version of the VVPAT requirements and I\'ll launch right into
it. I think based on what we want to get accomplished today, I\'m hoping
that we can do this within the hour. And I\'ll take any suggestions you
have for speeding things up or skipping any material you don\'t think is
relevant.

MR. CHAIRMAN: J.R., is that you? J.R. is that you? Well, Sharon and Jim
are there, but --

FEMALE: Mr. Chairman, what page are we starting on?

MR. CHAIRMAN: We are on the VVPAT requirements and it\'s on 6.28, six
dash twenty-eight.

FEMALE: Thank you.

MALE: Now this is the TGD (Indiscernible). But I was just concerned.
I\'m trying to figure out how to check on J.R., because all the sudden
he dropped off the line, and I could hear an open phone line.

MEDITATOR: Excuse me. Do you have a mute button there? Thank you.

JOHN: Okay, well I guess we\'ll go ahead. Okay, we\'re looking at the
overview slide here, and this is what I\'d like to discuss here.
Basically, I\'ve got a couple of slides that talk about our previous
version and a couple of other things. And then we can launch right into
the requirements.

So, in March we presented some preliminary requirements to you. And
essentially it was a document with three chapters. The first chapter was
a fair amount of boiler plate introduction to VDPAT. The second chapter
had a high level overview of various issues. The third chapter had
preliminary requirements.

And I think at that particular point, looking at the overview of state
legislation, I think we had six or seven states that had enacted VDPAT
legislation. And my last bit of research indicates that we have roughly
13. I think some of those are by state mandate as opposed to actually
enacted legislation.

Something else I looked at said that three more bills are awaiting the
governor\'s signature. And then we have approximately 19 or 20 other
states looking at this issue right now.

Okay, so why don\'t I go into kind of an overview of some of the
comments I received. I received oh, I\'ll say roughly around 20
comments. And I would say that the comments were fairly evenly
distributed among the various issues.

One thread that I thought I\'d point out was that some people felt the
requirements were way too design specific. And going through it again
I\'d have to agree. As a result of that we tried to make the
requirements a big more performance oriented as opposed to design
specific.

Now some of the major issues that came up in the comments regarding the
VVPAT are privacy and accessibility. And one of the big comments was
basically VVPAT systems --

FEMALE: (Indiscernible).

JOHN: Folks on the line, can you hear me?

MALE: Yeah.

JOHN: We are getting a fair amount of feedback from somebody.

MALE: I\'m hearing it (Indiscernible).

FEMALE: I\'m getting a lot of feedback on mine.

JOHN: I\'m guessing -- Pardon me. It sounds to me like J.R.\'s phone
connection may not be working properly. If he\'s on a cell phone, that
may be part of the reason.

MALE: (Indiscernible) dropped off (Indiscernible).

JOHN: Yeah. Okay. Well, as soon as I started talking about the paper
roll issue it got real quiet, so. Basically the problem there, if you
don\'t know already, is that paper rolls store paper records
sequentially in the order in which voters voted, which affects privacy.
One of the comments I\'ll just make is that there are many pros and cons
to the different paper formats that have to do with usability,
accessibility, handling the paper. So it\'s a difficult issue.

Accessibility, we had some comments on that as well. And I think Dr.
Leskowski (phonetic sp.) handled a lot of those very well this morning.
I will talk a little bit about that when I get to the specific
requirements.

Okay, moving onto the next slide. Did I skip one? Issue resolution?

MALE: Is this being an optional piece handled in the conformance clause
or does that need to be in the introduction to this document? I mean,
this very clearly is intended to be a mandated requirement or an
optional component of the system.

JOHN: It is basically for people who are considering VVPAT. Here are
VVPAT requirements. It is not a mandate or a requirement to go the VVPAT
route. It is simply if you\'re going to do VVPAT, here\'s VVPAT.

MALE: Yeah. I understand. I just -- I\'m not seeing that in the
document. I mean, this starts out reading as though these are
requirements for voter verifiable paper audit trail systems. It doesn\'t
really tell you that the system itself is not required.

JOHN: Ah.

MALE: So that\'s why I was asking if that is in the conformance clause
or if it needs an introduction explaining exactly what the
(Indiscernible) is.

JOHN: I think we\'re --

FEMALE: Probably (Indiscernible).

JOHN: Yeah. That\'s a --

MALE: It\'s not in the conformance clause per se, but there are words
that talk about the situation. But if it makes it clearer, we can
specifically either in the conformance clause or in the introduction
here make that very, very explicit. That\'s probably what we want to do.

JOHN: Yeah. Okay. So to be clear we will make that more clear in the
conformance clause.

One of the things I wanted to talk about on this slide is just basically
trying to get a little bit of perspective on VVPAT. And one of the
things that if you really think about it, that is the biggest issue with
it, is that it\'s just new. And people have been trying to develop
approaches to it without consistent standards.

Some of the vendors are a bit at a disadvantage, because they\'ve been
moving ahead and they haven\'t had consistent standards in some areas.
At the same time, they\'ve come up with some interesting approaches and
added a few things that I thought were impressive.

We think that the usability for voters and for voting officials has to
be a very high priority with VVPAT. It won\'t achieve its purposes
unless it\'s useable for the voting officials. The records need to be
used in audits. And if it\'s difficult to use the records in audits,
then it really won\'t achieve its purpose. Yes?

FEMALE: Just one statement on 60211. When you got to recounts, it says,
\"and in full recounts.\" I mean, you know, I think it needs to say,
\"Possibility of use in a full recount.\" Because the states are not --
In some states. I know in our state, we are not using that in a full
recount unless the audit is not meeting the requirements. And then we
can go to a full recount if that is necessary. But I don\'t want to say
in our documents that it has to be a full recount that we use that
paper.

JOHN: You are right. It differs from state to state.

MR. CHAIRMAN: Yes, but, well. This doesn\'t imply that to me. It says
\"that can be used.\" It doesn\'t say \"must be used.\" I think the idea
here is that if it is to be used, it has to have all the information so
that you can use it for a recount if you decide to have a recount.

So I think \"can be\" in the sense that it has all the tools. It has all
the information to enable you to use it in a recount.

FEMALE: Okay.

MR. CHAIRMAN: I don\'t know. That\'s my interpretation of it.

JOHN: Well, also in the discussion field for that particular
requirement, the very last sentence says, \"The paper records shall also
be suitable for use in full, manual recounts of the election.\" But --

MR. CHAIRMAN: Again, the issue there is suitability.

JOHN: Well, how about if we take up that issue again. We\'ll get back to
this requirement, and I\'ll go through the rest of this analysis here.
And I think I was really at the last bullet. Just basically saying that
we have decided that the best route with VVPAT is to stick to good
technology, independent, performance drive requirements. And essentially
let the vendors, let the marketplace proceed and hopefully follow the
requirements.

Okay, here\'s just a very brief overview. We emphasize usability
accessibility. And in working quite closely with Dr. Leskowski, it
seemed to make more sense that the human factor section really address
as much as possible accessibility and usability and also privacy, I
should say. That\'s basically because we made a determination that a
number of those requirements already do apply to the verification step
in VVPAT. So it seemed less confusion and proper to keep them there.

So in the VVPAT requirements regarding usability and accessibility, I
mainly list only those that would be in addition to what\'s in the human
factors section except for one or two I think that were included for
emphasis. And we do have a privacy requirement for stored records.
We\'ve continued to stick with that requirement. And there will be
issues of grandfathering that we will leave to the EAAC.

And then the record formats, primarily we have a goal of making the
records useful in valid audits. That\'s really the important thing with
VVPAT is make them useful in audits. So the record formats kind of
reflect that goal.

Okay, we used to have eight. Now we have seven. Try to make it a little
easier. Number eight, that requirement really basically centered around
procedures. And one of the comments I did receive is that we really
shouldn\'t be talking so much about procedures here. It\'s really not
our domain. And largely, I removed a number of the requirements within
that section. Where I thought they were appropriate to keep, I put them
in other sections, other requirements. And you\'ll see that when we go
through the individual sections.

So now we\'re down to seven. And those are largely the same wording from
before except for two and three. And we\'re basically just saying that
usability requirements from the human factors and accessibility
requirements apply to voting stations with VVPAT.

Now, I\'m not sure the best way to go through for you, or what\'s going
to work best for you. What I thought I would do would be simply to go
through the requirements. And if that would be most suitable for you, I
can continue on and do that. And perhaps that would give you an
opportunity to comment on specific requirements or make changes as you
wish. Does that sound like a good approach for everybody? I see no
objections. Okay.

All right. Well, we\'re really talking about the first requirement. And
if you\'re looking at your documentation here, I think we\'re on page
628. And we\'re looking at requirement, let me make sure. Yeah. 628.
We\'re looking at requirement 60211. The requirement above at 6021 is
basically the high level requirement that basically says what we\'re
going to do in VVPAT. We\'re going to print and display a paper record.

And this requirement here, up on the top, basically says we\'re making
clear that the paper record can be used in audits. Audits that can help
determine whether the voting machine is recording ballots correctly as
cast and audits of the election. So that we want the paper records to be
useable in audits. Useful for audits. And we want the paper records to
contain all the information stored in the electronic record. Are there
any issues with either? Yes.

MALE: Well, I continue to object to the misuse of the term audit. If you
want the paper records to be used in a recount or in the canvassing
board\'s determination that they can certify results, that is an
administrative and accounting process. That is not an audit. An audit is
where after the fact, an independent third party comes in, reviews the
records, and determines if in fact the people who conducted the election
did it properly and consistent with the standards and the election code.

I continue to object to the misuse of the word audit when we\'re talking
about accounting and internal control validation within election
administration.

MR. CHAIRMAN: Do you have recommendations for alternate wording?

MALE: I think we -- Within the glossary, if I\'m correct, we were
working on making audit a commonly accepted version of audit. I think
the controller general\'s auditing standards provide certainly an
acceptable definition. None of the definitions out there in any of the
literature give the meaning that we\'re applying to audit here.

MALE: Which are these here.

MALE: We seem to be using audit for recounts and for validation of the
election process during the election.

FEMALE: What do you think it should be?

MALE: I think an audit should be an independent third party coming in to
review the records of an election and make a determination as to whether
the election was held in compliance with the standards for that
jurisdiction.

Voting system audit is an important part of the election administration
process. And I think a jurisdiction that wants to be very careful could
actually have periodic audits and take the information from those audits
and incorporate them back into the election process.

JOHN: Well, I know where you\'re coming from, and audit generally does
imply a third party. Audit does -- The word audit is found in at least
the enacted state legislation I looked at. And the requirement 60211,
towards the end it says basically, \"The paper records shall be useful
in audits of the election results.\" And that\'s where I generally see
audit being used, in audits of the election results.

But I\'m happy to change that to different wording if we could make it
more precise.

MALE: We can look for some words. Validation of the election results is
probably closer to what you\'re looking for.

JOHN: Assessments as well.

MALE: Or assessments.

FEMALE: Assessment.

JOHN: Assessment? That requirement, I think it could be reworded
basically to say, \"The paper record shall constitute a complete record
of ballot choices that can be used in checks of the accuracy of the
voting station\'s electronic records in assessments of the election
results and in full recounts.\"

MALE: Yes. Uh-huh (affirmative).

MR. CHAIRMAN: Are we creating a nomenclature of our own? I mean, would
that be clear to election officials if we start using words like
checking? Verification, is that in our glossary in that sense?

FEMALE: Verification is in the glossary, but I don\'t (Indiscernible).
The word audit is in the glossary (Indiscernible), and we are lacking a
definition or classification of what audit here would be in the sense of
it -- You know, adding a word to it like ballot audit or election audit.
So in order words refining or replacing it.

MR. CHAIRMAN: How about validation?

FEMALE: Validation is also in the glossary.

MR. CHAIRMAN: Well, it says, \"Process of evaluating a system or
component during or at the end of the development process to
determine.\" But I guess that\'s the development process not the voting
process itself.

MALE: Well, in the glossary it says, \"A systematic, independent
documented process for obtaining records, statements, a fact, or other
relevant information in assessing them objectively to determine the
extent of which specified requirements are fulfilled.\" Which is very
different from the way that we\'re using audit and the standard that
we\'re looking at.

MR. CHAIRMAN: No. I understand. I\'m trying to see if there is a -- Yes?

MALE: John, isn\'t there a definition for the word audit in the computer
security domain that is more what was intended here?

MALE: (Indiscernible).

MALE: You talk about (Indiscernible) related to (Indiscernible) that
verified (Indiscernible).

JOHN: This is my question. I believe there is a definition for audit
there, and you would think that I would know that, but I don\'t. I did a
Google search on audit a couple days ago. Actually, no. I went to
Dictionary.com. And their definition was it could be an examination of
records or financial accounts to check their accuracy. It could be an
adjustment or correction of accounts, or it can be an examined and
verified account.

Paul is right to bring up this issue a little bit. It is confusing. And
there are a number -- Even validation or verification are used a little
bit inaccurately. Michael Shamus, Dr. Michael Shamus or Carnage Melon
calls it a valid audit. And I, for lack of a better term, tried to use
that. But I think it is best to be most precise here. I\'m just not sure
of which words to use.

MR. CHAIRMAN: I think in this context, validation works.

MALE: Yeah. I continue to see, and this is close to it. I continue to
see written references and official stuff talking about the
reconciliation and the numbers of voters who voted in a precinct versus
the ballots cast in the precinct as an audit. Well, that\'s not an
audit. That is a basic administrative step that you take before you
decide that you\'re going to certify your election results.

MR. CHAIRMAN: Could I ask clarification? Do you think audit, the term
audit, is okay in the second part of that statement? \"In audits of the
election results and in full recounts.\" Is that the proper use?

MALE: Let\'s see.

MR. CHAIRMAN: In the 60211.

MALE: I don\'t think you should be doing -- I mean I don\'t see audit of
an election result as being an audit. Audit of an election result as
you\'re using here is I think the validation that the number of votes
and the number of voters are equivalent and all the records are in
place. And that\'s good administration. Audits come in to auditing the
election process.

MR. CHAIRMAN: So audit applies to overall process rather than the
results? Is that --

MALE: Yes. And with the intent of determining if in fact the process was
in compliance with standards.

MR. CHAIRMAN: Yes.

FEMALE: You know, I agree. And one of the things that we looked at is
you know you\'re testing the equipment prior to the election. This is
part of the test, to make sure that that test after the election it also
verifies.

So we looked at it in our state, do we continue -- That is one of the
tests that is run. You run tests before the election of several
different types and then you run a test after the election to make sure
that -- Whether you\'re checking a machine to the verify paper. And
that\'s really what you want to do. You don\'t want to check a precinct,
because then you\'re checking -- You know, you want to do more of a --
You want to do a test of so many pieces of equipment. And so it\'s
equipment to that and it\'s not the precinct count.

So you could even refer to it as one of your tests. And if you\'re
glossary defined it well enough and so on, because it\'s a test that you
have to do just like you do before an election. It\'s one after the
election.

MALE: And it is a combination of validation, valid accounting,
reconciliation.

MR. CHAIRMAN: Yeah. In the first part, I think you can easily put
verification, because you\'re talking about the verification or
validation of the accuracy of the voting station\'s electronic records.
But it doesn\'t quite fit that. Do you want to say (Indiscernible)?

MALE: Well, in this case it could be in certification of the election
results.

MR. CHAIRMAN: Now certification is certainly in the I saw 1700 etc. It
has a very different connotation.

MALE: Well, under election law it\'s usually the election board\'s
certificate of the results.

JOHN: Well, one suggestion might be to make them into verbs.

MR. CHAIRMAN: In what?

JOHN: We could say -- The first could read, \"That can be used to assess
the accuracy of the voting station\'s electronic records to verify the
election results.\"

MALE: Uh-huh (affirmative). Yeah.

JOHN: That might work a little better.

MALE: I think that works better.

JOHN: Okay. All right. Okay. Very good.

MR. CHAIRMAN: Okay.

JOHN: Are there any other comments on this particular slide? Okay, well
then we\'ll go to the next slide. And here what I\'ve done on this slide
is just summarized, in essence, the requirements that are on page 6-30,
6-31, 6-32, and 6-33. Kind of lumped them together.

The first one, \"The voting station shall be capable of showing the
information on the paper in a font size of three millimeters and should
be capable of showing the information that goes onto the font range.\"

Based on this morning\'s discussion, I\'m not sure if that requirement
should stay as is or if it needs to be changed. And I\'m kind of looking
at John Kujini (phonetic sp.) and Sharon to nod their head. \[laughs\]

FEMALE: (Indiscernible).

MALE: (Indiscernible).

JOHN: Uh-huh (affirmative). Well, in the interest of time, I think -- I
could suggest that I could take this off line, because basically that
wording needs to conform to the wording in your requirements.

MALE: What we did on the other ones, we said, \"Under the control of the
voter or poll worker.\"

MALE: Uh-huh (affirmative).

MALE: Right. And we need that consistency.

MALE: All right. Then my procedural question is when we do approve this,
will we approve chapters two in its entirety? And what about chapters --

**\[End of Audiotape 3, Side A\]**

FEMALE: (Indiscernible).

MR. CHAIRMAN: That\'s not the issue. The issues is we are making changes
to certain sections of the 2002 standard creating the VBSG version one.

MALE: Right.

MR. CHAIRMAN: The question is do we need to approve formally the
sections where we\'re not making any changes.

MALE: And I think yes. Because we\'re forwarding to the EAC a total
package.

MR. CHAIRMAN: There is a tacit approval by the fact that we are leaving
those in place so that it seems to me requires approval that we are
saying not only are we making these changes, but those other sections
are generally okay. I mean there is a sort of tacit approval there. So I
agree with you. I think we should, even though we haven\'t made any
changes, we should have it clear that we are approving the whole
document not just parts of it. Okay. So, we will then make a motion at
the end to approve the whole rest of the document where there were no
changes so that we have approved formally the entire document. Okay. I
think that\'s a good point. Thank you.

FEMALE: Before we move on I would just like to thank the new staff for
all their hard work on this. I know it looks like we started into the
first section with lots and lots of changes, but this is one of the big
substantively new sections. And I\'d like to just formally thank them.

MR. CHAIRMAN: Thank you.

MALE: Sorry.

MR. CHAIRMAN: Okay, we\'ll then proceed. And at this time I call on Mr.
John Wack (phonetic sp.) of a misinformation technology laboratory to
present the newest report overview and security requirements for VBSG
version one. John.

JOHN: So there\'s nothing new in 228? Or are we not covering that? Or?
I\'m a little confused I\'m afraid.

MR. CHAIRMAN: Yes. The only change in -- Actually, if you -- Yes. There
is in section two all the changes are in section 227. No changes in 228
or 2.3. And 2.4, five, six, and sections three. Let\'s see. Yes. No
changes in three, four, five. The next set of changes are in section
six. Go ahead then.

WACK, J.: Okay. Well, my name is John Wack. And you heard from me I
guess approximately six weeks ago, seven weeks ago. And it\'s a pleasure
and an honor to be here again trying to work on this with you. And we
took longer than I initially thought right now. So I\'m going to try and
do you a favor and myself as well, if you don\'t mind. And what I\'m
going to try to do is skip through some of the slides, and that may
allow you a little bit more time for discussion.

I\'ll talk a little bit about what we\'re going to do. Specifically,
we\'re talking about section 6.0 --

MR. CHAIRMAN: John.

WACK, J.: Yes.

MR. CHAIRMAN: For the benefit of the people on the phone, will you make
sure you point us to which view graph, which slide you are referring to
so the people can follow?

WACK, J.: I certainly will. Okay. We\'re starting pretty much on page
6-3, which is section 6.0.1.1, Independent Verification Systems. And
what I\'m going to talk about in this particular section goes all the
way up to VVPAT, which I think is page 6-27. So we\'ve got 24 small
pages to get through.

And really, what we have here in this document is an overview that goes
on for about nine pages and then a series of definitions.

Now let me talk a little big about this just for a second or two.
Actually, let me move to the next slide here. Okay. For the background.
This section really wasn\'t intended to be in this document to begin
with. Basically we presented the VVPAT requirements, draft requirements
back in early March. And we had some feedback. We had some good feedback
from that. And part of it was that it may appear to other states that we
are recommending VVPAT as the solution, because we aren\'t talking about
other sorts of solutions, other sorts of systems.

So we had some requests that we talk about other sorts of voting systems
that kind of fall within our security framework that we\'re proposition
for VBSG2. And we thought that would satisfy that request. And at the
same time, it would allow us to get some information out that you could
comment on and that we could hear comments back from other people as
well.

With the VVPAT guidance, we had a number of vendors that commented. And
I found those very helpful comments basically. And I think the
requirements have improved as a result of that. So I thought this was a
good opportunity to do somewhat the same. And I\'ll talk a little bit
about the chronology of this and just go over it briefly.

Way back in January we had a couple of resolutions. And specifically
those were resolution 1205, which was voter verifiability one and
resolution 21-05, multiple representation of ballots. And those got
approved. And then John Kelsey presented several presentations to you
back in March. One on an approach that we call DVIV, direct verification
indirect verification. And we got a number of comments back from you on
that. And that was basically material that we intended to put into
VBSG2. And then as I said, we had some comments about were we by not
recommending, or by not talking about other approaches to independent
verification, are we in fact promoting VVPAT. And we didn\'t want to
leave anybody with that impression. So we included this material.

Now at the same time, we looked at other system that are being marketed
out there. And I have to say I was fairly impressed. Because when I
started this whole project, I tended to feel that some of our
requirements were kind of out there. And it actually turns out that a
number of vendors are actually working along fairly well in certain
areas with security and coming up with some interesting and some
impressive approaches.

So we felt that it wasn\'t entirely premature to talk about some of
these other approaches here. So basically we\'re not talking about
anything that is required in 2006. What we\'re talking about is
including an informative section in VBSG1. But these are not
requirements for anybody to meet in 2006. And essentially again, they
are four states who are considering VVPAT. This is other material, other
information they can take a look at and use in their decisions.

I feel good we got all this material done. I feel a little bit bad
because -- I\'ll just have to say that usability and accessibility
weren\'t things that we could adequately address at this point. And I
don\'t want anybody to have the impression that we didn\'t think that
that was important. And I tend to think that it\'s an iterative process
where you basically start with a security solution. You see if you can
make it useable and accessible. If you can\'t, you go back. You keep
trying. You work all three. And finally you end up with something that
basically satisfies everybody\'s needs and desires.

Okay. With that, I think I\'ll start in. I don\'t want to forget to
thank a few people. First of all, I want to thank John Kelsey who
contributed quite a bit of material to this. And had a lot of help from
the rest in his staff as well. John hasn\'t been around as much because
he\'s been helping his newborn son enter life in the greater D.C. area
for the past couple of weeks. And I talk to John actually for the first
time in a couple of weeks last night. And at one point I had to get up,
answer the door. I came back and John didn\'t know I was on the phone.
And I could hear his wife complaining that the baby just won\'t go to
sleep. She\'s done everything she can.

And so John started reading section 6.0.3.1 and the kid went out like a
light. \[laughter\] So, a little bit of humor there. Okay.

MALE: (Indiscernible).

WACK, J.: You are hearing that very correctly. It is a should in 6.01
and I will furthermore point out the paragraph right up above 6.0.1.1,
which basically says that the remainder of this section is an
informative section with discussion of independent verification systems.
These definitions are preliminary and will be evolving with further
research. So I know for a fact that we did not get everything right
here.

MALE: Can I just clarify something? It\'s not all of section six. It\'s
just the overview part.

FEMALE: Just 601.

MALE: 601 is the part that is informative only. And their not even
shoulds. They\'re just definitions.

MALE: Well, I guess I\'m looking at paren (phonetic sp.) three and 601,
Use of Wireless Network and Voting Systems. How wireless networks and
data sent across wireless networks should be secured. Is there in this a
measurable standard that would be applied in \'06? Or is this simply a
should in its entirety?

MALE: (Indiscernible).

FEMALE: Let me clarify. In the new section 6.0, 6.01 is purely
informative. 6.02, which is wireless is normative.

MALE: (Indiscernible).

FEMALE: Oh, I\'m sorry. 602 is VVPAT and is normative for systems that
use VVPAT. 6.03 is normative, which is wireless. And 6.04 is normative,
which is setup and distribution.

MALE: Okay.

FEMALE: Okay? And I\'ve made that correction in my text.

MALE: (Indiscernible).

FEMALE: 602, VVPAT is normative, but it is only if your system does
VVPAT, then you should follow these --

MALE: Right. Okay.

FEMALE: Okay.

WACK, J.: Okay. We did that just to keep you on your toes. Okay. What I
shall do is move onto slide number three, which is terminology. And I
just thought it was worth it to talk about these terms a little bit.

Direct verification, basically directly verifying presumably an
electronic record, a paper record directly verifying ones choices with
human senses. Indirect verification you\'re using a voting system, for
example, to indirectly verify. The voting system is recording your
verification.

Now audit. A lot of definitions for audit, and in the past I don\'t
think I\'ve used it properly. A ballot audit, we\'re really talking
about basically a process whereby the voting records from a system are
audited. And your goal basically there is to determine whether the
voting system is recording the ballots as cast. That\'s what we\'re
talking about when we say a ballot audit as opposed to a system audit
and a vant (phonetic sp.) log audit, a financial audit.

And electronic records, I just want to make sure that really talking
about valid images in electronic form. Okay.

I\'m on slide four. I think I\'ve talked about the resolutions there.
And I\'ll go to slide five, which basically has what are our goals here.
And I included that quote there simply because Dick Tuck apparently had
a good sense of humor, and he had confidence that he actually did lose.
Things have changed, and I think what we\'re seeing is more contentious
elections, more litigation, and people want more proof that they
actually lost.

So in a sense, what we\'re trying to do when we\'re talking about
independent verification with ballot audits is we\'re trying to ensure
that someone very quickly understands that they actually did lose. They
have faith in the voting system. They trust that the records are
correct.

Okay, if you don\'t mind, I\'m going to skip slides six and go onto
slide seven. And here I\'m kind of repeating some things that John said.
Basically, why are we moving in this general direction in VBSG2?

And in a sense, basically we\'re seeing increasing sophistication and
technology, which breeds more threats in a sense. And we\'re seeing that
down the road we may have more sophisticated voting systems. Already
we\'re seeing some that are highly networked in a sense where we have
the voting terminal talking with a controller throughout the voting
session. We are seeing the introduction of wireless. Things of that
sort.

So everything that we do now in terms of procedures, testing, all of
that is important. And we aren\'t going to change any of that. We have
to do that in the future as well. But we think here that it is also a
good idea and it\'s prudent for the future that we do independent
verification. We actually produce multiple records of votes in a way
that we can actually run reliable audits on them.

Okay. I\'m going to skip over to slide 9.

FEMALE: You may (Indiscernible).

WACK, J.: Which is called Missed Analysis and Approach. And I just
basically want to say that VVPAT is an interesting approach. Is it the
best? Is it the only? No. There are other approaches. What we\'re doing
here with this presentation is drawing a larger circle around a class of
voting systems that have independent verification capabilities. And
we\'re providing this for comments, and in the future we may recommend
these definitions as mandatory, as requirements I should say.

And moving onto page 10. Let me just stop here for a second. I don\'t
want to go so fast that I\'m preventing you from asking a question. If
you have questions, please raise your hand at this point. Otherwise,
I\'ll just continue.

Okay. So this is the general class. In your handouts, we\'re calling it
independent verification. Earlier we called it dual verification. When
we called it dual verification it was DV, and then people may confuse
that with direct verification. And then we started calling it
independent verification, which people think it\'s indirect
verification. And we decided really to confuse you some more and just
keep IDV. Being good government workers, we conserved on the number of
letters in the alphabet. We just stuck to I-D and V.

And actually the state of Maryland hosted a meeting sometime within the
past month where they took a look at a number of different systems that
had independent verification capabilities. And they actually came up
with that term. Or that\'s where we first saw it is independent
verification. And we decided that our approach really is we\'re talking
about two sets of records. And we\'re talking about being able to
independently audit the records, in a sense. So we basically decided to
use IDVER, independent dual verification.

Moving onto slide 11, IDV properties. Again, John presented a lot of
this material. And essentially what we\'re saying is down the road in
the future we think we\'re all better off with systems that produce
multiple records that are just basically more resistant to fraud. More
resistant to damage, to loss, being able to determine whether ballots or
records have been inserted, deleted.

By doing that we\'re also in a sense making voting systems more
resistant to subversion. Done properly, there could be potential
reductions in testing expense and overall greater confidence that if you
lose an election, you actually really did lose the election.

Okay, up to the next slide, which I think would be slide 12 if I\'m
right. IDV record production. Again, to repeat this a little bit.
Here\'s an example of how this might work. And may be I could just walk
you through with one particular technology.

Let\'s say you\'re standing at a DRE. You make a record of your choices.
You press a button. So there you\'ve done some indirect verification.
And the DRE could then send your verification in a sense onto a
different system. In this particular example, let\'s say there\'s
another system that\'s able to capture with a picture your verification.
It actually takes a picture of the DRE screen as you\'re verifying it.
So then you have a record. You\'ve got another record. It is independent
of the voting system. It can be verified by looking at it. It is another
indirect verification. But it is on a separate system.

So at that point you have two records right there. If the voting system
were to be sabotaged in a way or if there were accidents, whatever, you
do have another record that has been verified. Is that fairly clear?
We\'ve kind of gone over that material before, but -- Okay. Then let me
skip --

FEMALE: Can I ask a question?

WACK, J.: Oh, sure.

FEMALE: That\'s clear, but if the voter then felt like that wasn\'t
because of maybe even an accidental voting for the wrong thing that he
wanted to vote for, how is he going to change that?

WACK, J.: Well, in that specific technology I don\'t know how best to
answer that.

MALE: (Indiscernible).

WACK, J.: Well, actually it\'s not imaginary. There is a company
producing something similar to that, which doesn\'t actually take
pictures but it actually takes screen snapshots.

MR. CHAIRMAN: I assume that that gets done after you have verified your
vote. Is that right?

WACK, J.: Yes. Yeah.

MR. CHAIRMAN: I mean, you look at the screen. You say, you know, accept
or whatever. At that point the next verification happens. Is that right
or not?

WACK, J.: Yes. You would be right at that point.

MALE: Why show it to me if I can\'t do anything with it. What\'s the
whole purpose of it?

FEMALE: Yeah. Isn\'t this like if you have an op scan? You finish the
ballot. You walk up to the reader. It says you have an over vote. You
can -- In that case it\'s sort of easy because you\'re holding onto the
thing. But you can take it back and get anew ballot and vote again. So
isn\'t it somewhat similar?

WACK, J.: Well, in this particular case you want to know did the camera
do its job. And I would think a video monitor would be connected.

FEMALE: The question was if the voter perceived there to be a problem,
do they have a means to essentially restart their ballot or to roll
back?

WACK, J.: I would think there would have to be a means for doing that.
Yeah.

FEMALE: Then my concern is -- There\'s a reason why I brought it up. You
really have to think about the whole election process. And if that voter
-- There\'s already somebody else in that voting booth voting. So how
are you going to know what ballot to take out of that electronic device,
whether it was the direct record device? And how are you going to get
that vote back? You can\'t. Because they cast it on that machine, so you
can\'t send them back to that same machine and then cast something. So
that was part of my problem that I\'ve seen with some of the things.

MR. CHAIRMAN: (Indiscernible).

MALE: Couldn\'t the same thing be said of the verified paper trail? The
same thing. The very same thing. I see it. I can\'t undo it. Well, you
can undo it because you can indeed say that that vote that I saw I will
just subtract a vote like that.

FEMALE: I don\'t believe so.

MALE: If you don\'t know what the electronic vote had.

FEMALE: You\'re seeing your paper at the time you\'re voting. It\'s
right there beside you, and you verify that before you -- It\'s asked
you, \"Are you ready to cast your ballot?\" And you\'ve got it on both.
And if it\'s not what you wanted to see, you could cancel it and start
over. And it rolls it up and you could start over.

MALE: But can\'t the same be done with this camera snapshot?

WACK, J.: I think the point is you need to commit to both of them at the
same time.

FEMALE: That\'s exactly right. I think you\'re going to have to.

MALE: Right. Correct.

MALE: Yes.

FEMALE: I don\'t know how you can do that.

MALE: You push a button and the camera goes off, and the electronic
record get (Indiscernible). You can make that work. You hit the nail on
the head. That\'s exactly the property you want. You commit to both of
them at the same time once you verify both of them.

FEMALE: It can\'t be a different station.

MALE: You verify what you see indirectly and then you verify the thing
at the same time. Next to each other. Right.

MALE: It\'s fun to design voting systems, but these systems we\'re
talking about right now don\'t exist. They\'re not going to exist
probably until 2008, maybe 2010. Could we get back on track and get more
directed toward our stated goal of providing guidance to election
officials in 2006?

FEMALE: I think this whole thing is a big should. In the language of the
last section there\'s a big should statement to point forward.

MALE: I don\'t have any objection to this. I think these are nice
designs, and it\'s a lot of fun to design them. But they\'re more
appropriate in version two then version one. In fact, that\'s going to
be my recommendation John when you get through is that we take this
whole section out. Because we\'ve got 24 pages here of version two, not
version one. And if you want to get it out for comment or what have you,
then put it in an appendix or something like that. But it has no place
where it is.

MALE: (Indiscernible) and make that a motion or second it. Whichever way
you want to do it.

MALE: Well, I don\'t now if it\'s time for a motion yet.

FEMALE: I was going to say --

MALE: I think our time here is precious, and I think we\'ve got other
items that are going to go in the standards that need to be addressed
that we need to discuss. And if this entire piece is drafted as a
should, it is a nice work product. It is some nice original thought.
It\'s certainly the basis for further study. But I don\'t know that we
need to take the time today to go through it if it\'s all going to be a
should.

FEMALE: Well, I\'m sorry.

WACK, J.: May I get in one comment? I just want to answer Dr. Williams.
Actually, a couple of the systems that we\'re talking about here
actually are fielded today. Cryptographic systems right now we describe
in here. And do fit this category. The other approach that I was talking
about with screen snapshots is something that\'s out there today. There
are systems being field tested right now that do, in a sense, an audio
verification. So we are talking about today\'s technology, although I
think the technology is not there all the way. But we\'re certainly --

MALE: Those are prototype systems, John.

MALE: VVPAT fits into this category too. So those are more real in a
sense (Indiscernible).

MR. CHAIRMAN: And we\'ve been asked by EAC to work on these. Mark, did
you have a comment?

MALE: Yeah. I just wanted to make a comment to Brid (phonetic sp.). Like
John explained, this is put in here for two reasons, and I think it
would lose a lot if it was removed and put in an appendix.

Number one, we were told by many different people, including concern
from some EAC commissioners or at least one, that in fact even though we
make many, many, statements that were not necessarily endorsing the
VVPAT, we\'ve had a resolution. It still looks like we are if it\'s the
only technology mentioned to do independent verification. So we were
very conscious of that, and we were asked by a few different sources to
put in at least some discussion so that it doesn\'t stand alone. I think
that\'s very, very important that it stay in here. It\'s not mandatory.
It\'s normative. It\'s not even a shoulder, by the way. Everyone keeps
saying it\'s a should. I\'m sorry. It\'s informative. But it\'s not even
a should.

We don\'t have shoulds or shalls. We just have definitions. We discussed
them. So it\'s clear these are not requirements. Secondarily, I think
like John said, these are things we\'re looking for to put in the next
version, and we really need discussion on them. And by putting them in
now we\'ll get comments. If people ignore them and it\'s hidden in an
appendix, we won\'t get that.

So I think it\'s very important to put them in. It\'s clear they\'re not
mandatory. It\'s clear they\'re not normative. And it\'s there for the
reasons I just sited.

MR. CHAIRMAN: Secretary Davidson.

FEMALE: I tend to agree on this because then states that are being
really, whether you want to use the word pushed or really reviewing that
they need paper verification on the equipment that they\'re purchasing.
This might help them and help their legislators understand there is --
This is all brand new. And so making statements now and putting it in
law may be a little early.

So I would think something like this might help them.

MR. CHAIRMAN: Maybe what I would suggest John is let\'s try to get -- I
mean, this is clearly an information part of the presentation. Maybe we
can get through this a little more quickly so that we have time for the
rest of --

WACK, J.: You will hear no objections from me. \[laughter\] Let me think
for a sec here on how best I can do that. Because I think it\'s a good
suggestion. We do have a lot of other stuff. I know you can\'t wait to
hear about VVPAT.

Why don\'t I move ahead in a sense here to -- Am I going in the right
direction here? I\'m going to --

MALE: I\'d like to make one more comment on this while we\'re on the
subject. If this is informative, why do we go through all of the -- Why
not just give the definitions of them? Why go on for 24 pages listing
features that they\'ve got to have when they\'re not even designed yet?

WACK, J.: Well, I think that\'s a good suggestion. And I would suggest
that we actually take a look at what we\'re calling the core definitions
for these systems.

MALE: Yeah.

WACK, J.: And take a look at that. And maybe that\'s where we can best
use our time, and we can get them relatively quickly.

With that, I think -- Let me make sure what slide I\'m on here. You
would end up turning to slide number 14, which is titled, \"IDV
Definitions.\" And what I\'ve done there is I\'ve actually got the
requirements right out of the document. And so you could either go to
the document or you could look at the slides here. And let me make sure
that I am on the same page here.

Okay. So if you were looking at the document, you\'d be looking at
section 6012, which is on page 6-13. Okay.

MR. CHAIRMAN: You\'re confusing us, because you\'re referring to slide
numbers and then page numbers. Which one are --

MALE: Slide 14.

MR. CHAIRMAN: Well, slide 14 is not this.

FEMALE: Yeah. They changed the format. The title is there.

MALE: Yeah. You\'re right. It\'s not the same.

MR. CHAIRMAN: Slide 14 is not this.

WACK, J.: I have core definitions starting on page 6.

FEMALE: The title is different on our printouts. On our printouts it
says, \"Core IDV Requirements.\" Okay.

WACK, J.: Oh.

MR. CHAIRMAN: That\'s true. It\'s the same thing, but (Indiscernible).

FEMALE: It\'s the same text but it\'s got a different title.

WACK, J.: Okay. Okay. Yup.

FEMALE: And if you\'re in the document it\'s 6-4 and 6-5.

WACK, J.: Well, originally this was going to be right after lunch, and I
thought I\'d do that so I could wake you up a little bit. Okay. I
apologize for that. That\'s true. We did make a couple of changes here.

Okay. Looking at the requirements. Why don\'t we just go through these?
And if I\'m going too quickly, stop me. But in a sense, what I\'ll try
to do is just summarize each requirement quickly and kind of just say
what it\'s saying.

And really the first one is the fundamental core definition for IDV
systems. And it basically just says that it\'s producing two records,
one or both which can be verified directly and indirectly outside the
control of the voting system. And the second one basically says that if
one record is compromised it should not end up compromising the other
record. That we actually have two independent records.

And the third requirement, the processes of verification don\'t all rely
on the same voting system. The voting system produces two records. You
can verify one of the records independently of the voting system. That
is very necessary. And moving to the next slide, which would be slide
number 15.

The records can be used in audits of one another. In other words, the
records formatted properly can be cross-checked. Can be counted against
each other and can result in a ballot audit of high precision.

Now I\'ve added another requirement there. Sorry about that, but it\'s
in bold. And it was supposed to be in the core requirements. And I ended
up deleting it accidentally. But basically that\'s an important one.
We\'re basically saying each record needs to have some sort of unique
identifier so that if you had two sets of records, each record can be
identified uniquely within its set, and it will point to its
corresponding record in the other set.

And we also want the records to contain other information that will be
useful to auditors, to voting officials. And these would include
identification of the voting site, the precinct, ballot style, any other
information that could be of use in identifying the records.

We have some requirements in there. Basically a voting session
identifier. I know that\'s already done by at least one of the voting
system vendors now on their VVPAT system. We would like the serial
number of some sort of identification of the voting system that produced
the records.

And the last requirement. Basically we\'re saying that crypto is very
difficult to get right. It\'s one of these things that we feel fairly
firmly about that ought to be a design requirement. We really think that
cryptographic software and voting systems ought to use modules that have
been through the government\'s crypto module validation program as
applicable. They may be using a different form of an encryption that may
not be applicable here or feasible here.

And with that, I\'ve really been through our basic requirements. Are
there comments on these that I could entertain? Questions? Anything to
make more clear?

MALE: Could I just point out one thing? When John says requirements,
he\'s using that term.

WACK, J.: I\'m sorry.

MALE: What they will be in VBSG version two. Right now, again, they\'re
just definitions of concepts. They will return into requirements after
they\'re massaged and more research is done in VBSG version two, unless
you tell us not to.

MALE: That, Mark, is what I don\'t see here. In a footnote on page 6-4,
you summarily dismiss all existing systems. And then go into this long
discussion about these theoretical systems that are not going to exist
for two to four years. And then you go from there into a discussion of
VVPAT. Now what conclusion am I supposed to draw from that except that
the current systems are no good? There\'s not going to be anything
worthwhile for at least for years except VVPAT systems.

WACK, J.: I think the footnote on page one -- Well, I understand where
you\'re coming from there. But I see it a little bit differently.
Basically, we\'re saying there that electronic voting systems today that
create multiple records generally create copies of their records, and
all the records are under the control of the voting system. So if the
voting system let\'s say is sabotaged somehow or other, all those
records are in peril.

And what we\'re talking about, just to be clear, is that we\'re talking
about multiple records, one which exists outside the voting systems. I
don\'t want that footnote to say that current voting systems are bad.
I\'m not saying that. But I\'m saying in the future, we want it done
differently, because we think it\'s going to be a rougher environment,
and we need more reliability in the records.

The second thing, I again want to take a little bit of issue. We\'re
seeing products that are going in this direction today. And I know of
one cryptographic software voting system vendor who would probably
disagree quite a bit with your statement who does have a system today
that pretty well fits into this category. So I don\'t think we\'re
talking about systems four or five years down the road, but we\'re
talking about the very near future.

MALE: Is that system qualified?

WACK, J.: I do not know yet.

MALE: Okay. I do. It\'s not. I know the systems you\'re talking about.
They\'re in prototype stage. I\'m not disagreeing with you. These things
are on the drawing boards, and that\'s good. But what are we saying to
people for 2006?

FEMALE: Well, Burt, I mean here\'s -- It seems to me that we\'re sort of
once again up against the sort of rigidity of the standards process,
which is that we\'re both trying to address now and kind of cast
forward. Because if we only -- I think this is another situation where
looking only at this year without anything else -- I don\'t -- You know,
should it be an annex? Should it be a whole section? Should it be a
white paper? Should it be a what? I don\'t quite understand the format
or channel possibilities that we have. But ignoring the question of
whether this should be in the standard in a section like it is now for a
moment. I think the concept of having this discussion --

I mean, this was not easy reading. I have to say. It\'s hard concepts,
and it was hard to get your head around the abstraction of it. But once
I did, I found it quite helpful as a way of thinking about systems in a
different way than did I punch a button? Did a piece of paper come out?
Which are all very design specific.

So I found a lot of value in thinking through this process in reading
this section. Maybe there\'s a question about where and how it ought to
be presented in a way that will get it paid appropriate attention.

MALE: I agree, but it should be in version two, not version one. And if
you want --

FEMALE: Or should it be --

MALE: It is, it is --

FEMALE: One of the things that Mr. Schitzer (phonetic sp.) suggested a
while ago, and actually we have a draft circulating on this, is that
there are a number of issues where there\'s some kind of -- I guess I
would call them white papers where there\'s some discussion issues that
have come up that might be useful to communicate more broadly to get
input on rather than just six people on a subcommittee having talked
about.

And we\'ve never quite resolved how those will fit into the workload.
Let\'s start there with a practical issue. But get communicated. Get
commented on. We have no way to submit anything to EAC except by putting
it into a piece of the standard. So I have sort of all kinds of
procedural questions about how we move the discussion forward in a
constructive way.

MR. CHAIRMAN: I think there were two purposes for including this in this
set of discussion. I don\'t think anybody agrees that this is really a
target for version two, but I think there were two issues. One is the
perception issue that you\'re quite aware of, and I think it was
discussed before. That we did not want to present VVPAT issues in a
vacuum making it sound like that\'s the only possibility. That\'s the
only choice, and implicitly endorsing that. So we needed to put that in
context, number one.

Number two, this computer security issues have a much longer time
constant probably in terms of getting things done. And it\'s a complex
issue. Therefore, it needs a lot more discussion, a lot more feedback.
And we did not want to wait until we\'re finished with version one, you
know, in nine months from now, because then we will be told that we\'re
too late for perhaps the 2008 cycle. So we wanted to start the
discussion and the feedback process now.

I understand it takes away from some of the valuable time we have at
this meeting, but I think this is a very important discussion. And we
felt that we needed to get this discussion started.

MALE: Would it also be possible to kind of get in here somewhere,
footnote not withstanding, that it is entirely possible to run safe,
accurate, secure elections with existing systems?

MR. CHAIRMAN: Is that a function for VBGC?

MALE: There\'s a clear implication here that you cannot run a secure,
accurate election on existing systems.

MR. CHAIRMAN: I think what the statement says is that you are not in
fact creating two, independent records. That one may be the screen. One
may be a paper. But in fact, the source of both sets of information is
the same. And the core requirements that John is trying to address, if
my understanding is correct, is how to generate two independent records
that cannot be intertwined, and therefore, by changing one you can\'t
change the other. That\'s the most secure form that we\'re seeking in
the future.

FEMALE: Perhaps we should simply say that. I mean, that\'s a much
clearer statement. I\'m sorry. It was a long winded statement, but
nobody took it down. But that\'s a very clear statement. That the real
requirement you\'re talking about is that you have two records, which
once completed are in fact independent of each other. Not simply a
re-printout of the same record. And that\'s actually a pretty clear
thing to say, and maybe we should just say that.

MR. CHAIRMAN: I think maybe what\'s down here at the bottom of page 6.4
is half the story. It states where things are now and then maybe we need
to add something that says, \"This is what we\'re trying to
accomplish.\" Not simply show the same information from the same source
in two different forms, but to provide a facsimile of two independent
(Indiscernible).

FEMALE: Yeah. I don\'t hear a disagreement with that. I just hear some
objection to the tone. I would rather get to the substance.

MALE: Let me see if I can unravel what we\'re -- Okay. If we perform an
election today with a DRE equipment without a verifiable paper trail, it
still can be a good, clean election. There are some concerns. In case it
was challenged or something, you wouldn\'t be able to reproduce that
record for someone to see.

MALE: We have methods for dealing with challenged elections.

MALE: Okay. Now, I think it was also said that some of the
implementations of the VVPAT that people are buying right now has some
equal flaws. Good, but has equal flaws. So what we\'re saying is neither
system is ideal, and we want to shoot for something higher.

Now are there any VV paper trail systems out that I can buy today in
2006 elections that will meet the guidelines that we would be saying
even for verifiable paper trials to make it more secure.

WACK, J.: Uh, you\'re asking me.

MALE: I don\'t know. I\'m asking the question.

WACK, J.: It\'s a matter of opinion. I think a number of the vendors
would say yes, for sure. And some other people would say no.

There were some issues in the VVPAT area. And one that was brought up
earlier was the paper roll sequentially stored records issue.

MALE: The privacy issue.

WACK, J.: There are some VVPAT implementations right now that do things
differently. And then there\'s this whole issue of grandfather. Can I
punt on that question a little bit?

MALE: The only reason I\'m asking that is in other words -- Otherwise,
let\'s say that was the case. That what you\'re going to write as the
guidelines for verifiable paper or the trail would basically say that
nothing in 2006 is totally compliant, then you\'re saying a district in
2006 has a choice. They can either go without a verifiable paper
trailing or procedures and so forth and punt as best they can. It\'s
imperfect, but it\'ll work. They can have the verifiable paper trail and
overcome some of the objections, and it will work. Neither one will be
the target that you want to have. And so they can use either/or in 2006.
And beyond 2006 here comes the phase two and here\'s what we have to say
about what the ideal system would be, whether you\'re using a paper
trail. And here\'s how you design it. We\'re using some indirect method
of two independent records. Here\'s how you design that. And so you will
be looking for designs either A or B that would satisfy that. And it
would be lamentable, but in 2006 we\'re going to have to go along with a
variety of different solutions that are all relatively imperfect, but
that\'s life. I mean, we\'ll cover it through procedures and etc.

MALE: Mr. Chairman, did I just hear that it\'s regrettable that we\'re
going to have to go into 2006 with systems that aren\'t perfect.

MALE: That\'s what I thought I said. \[laughter\] But you\'ll probably
see the same answer in 2007, and eight, and nine.

MALE: I\'ve never seen a perfect system. I don\'t think we\'re ever
going to see a perfect system.

MALE: Yes. I agree. Right.

MALE: And if we make perfection our goal, we\'re never going to get
there. Systems have strengths and weaknesses. You have to put management
procedures around them to effectively use them.

MR. CHAIRMAN: Actually, I was going to make the statement then. The
function of this committee is not to make value judgments. I think our
function is to --

J.R.: J.R. is on the line now.

MR. CHAIRMAN: Thank you J.R.

J.R.: Where are we by chance? \[laughter\]

MR. CHAIRMAN: We were wondering that ourselves.

**\[END OF AUDIOTAPE 3\]**

WACK, J.: I will talk up line with Sharon and John and make sure our
requirement is accurate with what was decided upon this morning.

MR. CHAIRMAN: John?

WACK, J.: Yes.

MR. CHAIRMAN: Why does that say in the bond size of three millimeters?
Shouldn\'t there be a minimum? Because in the next sentence you\'re
saying in the range of three to four millimeters and then six point
three and nine. I don\'t understand that.

WACK, J.: Well, yeah. In the discussion, the first sentence ends with
but at least be capable of three millimeters. But it isn\'t reflected in
the requirement.

MR. CHAIRMAN: Right.

WACK, J.: To me it seems like reasonable language to put it in the
requirement.

MR. CHAIRMAN: It should be consistent wit that.

WACK, J.: So perhaps I would recommend that it be changed to, \"In a
font size of at least three millimeters.\"

MR. CHAIRMAN: Yeah.

WACK, J.: Okay. All right.

MALE: If it\'s important, John, it needs to be in the rule, the
guidelines, because the deductions, people don\'t go down there very
often.

MR. CHAIRMAN: Right.

WACK, J.: Okay. Good point. Okay. Then if there are no objections, then
I\'ll move onto the next requirement.

MALE: (Indiscernible).

WACK, J.: \[laughs\] Yeah. You caught that. \[laughter\] Okay, the next
requirement is that paper and electronic records shall be presented so
as to allow for easy, simultaneous comparison. I think that\'s probably
self-evident. And that has a couple derived requirements underneath it
basically talking about the paper records being positioned so that at
the same posture you can look at them.

Talking also in 60222. If the paper record can\'t be displayed in its
entirety, there shall be a means for moving the paper so that you can
look at the entire record.

MALE: (Indiscernible) both directions.

WACK, J.: I think that question came up, and it could. You could read it
that way. The implementations I know of today move in one direction.

MALE: I think we should be more explicit. (Indiscernible).

FEMALE: If you move the paper both directions, aren\'t you getting in
more of a problem then where it\'s going to stop. I can see real
problems then and voting on if you\'re moving it in both directions. I
mean, I think about Colorado and some of the states that have
initiatives on their ballots. And our paper will be a lot longer than
most, because we have judges and we have so many candidates. And then we
get on into all the different initiatives and referendums. Our paper
will be quite lengthy. And so moving that paper back and forth really
worries me. I think it should move forward.

MALE: I agree. I\'ve raised the question (Indiscernible).

MR. CHAIRMAN: Do you want to replace the word \"moving\" with
\"advancing?\"

MALE: Yes. Also, the question should that be on the voter\'s control.
Because it calls for, especially an advanced person, a voter be able to
indicate (Indiscernible).

MALE: Well, \--

FEMALE: Is this on now? We have --

MALE: Moving (Indiscernible) either forward or backward. Advancing is
only a forward direction.

FEMALE: Right. We recognized when John and I discussed this that there
are lots of issues with moving backwards and a lot of confusion. The
intention of this, I think what we finally decided was that rather than
having the paper just scroll, scroll, scroll automatically whereas the
voter might miss part of it scrolling by, it would be under the voter\'s
control. So a page would scroll up. Stop. A voter could verify. Press a
button. Scroll some more. And it was a usability issue. So that was the
intention of this.

MALE: So we would want this to say \"advancing the paper.\" And then at
the end say \"under the control of the voter.\"

FEMALE: Under the voter control. Yes.

MALE: Right.

WACK, J.: Okay. I think I have that. If the paper record cannot be
displayed in its entirety, the means for advancing the paper to show all
paper record contents shall be provided under the voter\'s control.

MR. CHAIRMAN: No. I think you want to put for advancing the paper comma
under the control of the voter comma to show all paper record contents
shall be provided.

WACK, J.: Okay.

MR. CHAIRMAN: Is that agreeable to everyone?

MALE: Do we need to re-think (Indiscernible) there as well?

FEMALE: Yeah.

MALE: Well, there\'s an interesting implication here. And that is that
this paper is on some kind of a roll. If this is producing cut sheets of
paper --

WACK, J.: Yeah.

MALE: The word advance seems to go with forward. But it\'s probably not
intended here.

WACK, J.: Earlier I thought maybe we could reword it to say, \"A
mechanism shall be provided to show all paper record contents.\"
Something along those lines.

FEMALE: Could we maybe help this by saying the paper record \"should
not\" instead of \"cannot?\" Or no. That won\'t help it. I\'m sorry. But
I was trying to say this is not a mandate right now. But it could be
looked at more in the version two. I see this as being a real problem
with what\'s possibly out there right now and what the vendors are doing
and have them certified. And if this doesn\'t meet the needs by 2006,
I\'m hurting.

MR. CHAIRMAN: Yeah, but isn\'t this something necessary? I mean, if you
cannot see the entirety of your paper ballot, what is the point of
having it?

FEMALE: Well, one of the things they have, the ones I\'ve seen is as
you\'re voting, it marks it on that paper right then.

MALE: It just keeps moving up?

FEMALE: And then if you changed and decided, \"Oh, I\'m not going to
vote yes on that issue.\" And you change it. It says, \"cancel\" on that
one vote. And then you can go on and vote however you want to, and it
indicates it on that paper. It\'s there simultaneously as you vote so
the verification kind of takes place, the whole process, as you\'re
voting. And if your ballot is really long, that paper is only twelve --
Or that pack is only what? Eighteen inches maybe at the most.

You\'re going to have -- That\'s going to be rolled around twice for us
possibly. So backing it up and seeing -- You\'re never going to see the
whole ballot at one time. Even if it\'s on a scroll of it it\'s being
cut. You\'re never -- You\'re going to have to get it back to show.

I just don\'t know like we\'re at the position of making statements
there today with what\'s being done. Like you said, the vendors have
been out already moving on this and not having direction to go by. And
they\'ve even been certified. And now if they have to start over,
they\'ll never meet that mandate for the states that need to buy it to
have the paper verification.

WACK, J.: Yeah. There is at least one vendor who prints out on an eight
and a half by eleven sheet of paper. I don\'t know what their specific
procedure is. If they have to use multiple pages. But it seems that the
requirement should make it clear that the voter should have some control
over the process of viewing the next part of the record.

FEMALE: Mr. Chairman, to back up what Secretary Davidson said. Our
ballot was not set on an eight and a half by eleven piece of paper.

FEMALE: Ours don\'t either.

FEMALE: When you have 90 choices, it just won\'t go on one piece of
paper.

FEMALE: Ours is the same way. We have two sides on our scanned ballots,
and I\'ll tell you what. The print is so small that it wouldn\'t approve
any of this that they are doing. If we make the print size it is here,
we would have three to four pages that it would be printed onto. So
there is really issues with this.

WACK, J.: Do I understand that there are issues with the way the
requirement is worded? Or issues in being able to actually accommodate
multi-page records? Is it the latter?

MALE: (Indiscernible).

MR. CHAIRMAN: Yes to both it sounds like.

FEMALE: So I can clarify. I think there are two cases. And I believe
I\'ve seen both. One is that you verify at the end, so it\'s scrolling
by whatever mechanism. And that needs to be under voter control. The
other case is where you verify one at a time back and forth, not clear
if that\'s very useable. But at this point without doing some further
study, we can\'t make a statement on that one way or the other.

So we can qualify this particular thing with saying if it\'s being
verified at the end, you\'d have to have the scrolling under control of
the -- Advanced scrolling under the control of the voter. I don\'t think
there are any other cases that are implemented.

MALE: How about if we change that to say (Indiscernible).

MR. CHAIRMAN: Use the speaker.

MALE: Paper record cannot be displayed in its entirety, a means must be
provided for allowing the voter to view the entire ballot. And leave it
up to the vendor how to implement that.

MALE: I think something like that sounds good to me. This is not a
security issue. It\'s a question of usability. These are new systems,
and having a bit of flexibility here to try to explore the design space
here seems like a good idea. So rather light language here that allows
vendors to experiment with a number of different approaches to managing
(Indiscernible) seems like a good idea.

MR. CHAIRMAN: Did you write that down Brit?

MALE: If the paper record cannot displayed in its entirety, a means must
be provided for allowing the voter to view the entire record, the entire
ballot, record, whatever you call it. Record.

WACK, J.: Okay. I don\'t see. It looks like everybody\'s nodding I
think.

MR. CHAIRMAN: Did we capture it? That\'s the question.

WACK, J.: Oh, yes. Okay.

MR. CHAIRMAN: Would you read that Barbara?

FEMALE: If a paper record cannot be displayed in its entirety --

MR. CHAIRMAN: You got to get up here.

FEMALE: If a paper record cannot be displayed in its entirety, a means
must be provided to allow the voter to view the entire ballot.

MALE: (Indiscernible).

FEMALE: Shall. Got it.

MALE: (Indiscernible) to be preventable (Indiscernible).

MALE: Yeah. We\'re letting the vendor decide how to implement it. We\'re
just saying that you\'ve got to be able to show the voter their entire
ballot. And if your mechanism is such that you can\'t display all of it
at once, then you\'ve got to demonstrate how the voter can see the
entire ballot. It\'s the vendor\'s problem instead of ours. \[laughter\]

MALE: That\'s a performance issue, and that\'s what we\'re supposed to
be doing.

FEMALE: And I understand, but I\'m a little concerned that I don\'t know
if they can meet it by 2006.

MR. CHAIRMAN: It seems like they\'re already meeting it.

MALE: They\'ve got to. I mean, you don\'t have a bona verified ballot
without this requirement. If I can\'t look at the whole ballot, how can
I verify it?

WACK, J.: The one implementation --

FEMALE: Maybe I\'m crazy. Maybe I haven\'t gotten the point. But I mean,
as the DRE screen moves up, you\'ve got another segment to it. It\'s the
same way with that paper. To be able to see -- What we\'re saying here
is you\'ve got to see that whole ballot.

MR. CHAIRMAN: No. That\'s not what it\'s saying. I mean, I think that
may be a perception, but that\'s not what it\'s saying.

MALE: No. Think summaries.

MR. CHAIRMAN: That\'s a higher level requirement. If you require that
the whole thing is seen all at once, you know, I think that\'s something
that the committee needs to think about. But this language simply says,
\"I need to be able to see everything that\'s on that paper.\"

FEMALE: Very good. I\'m all right then.

MR. CHAIRMAN: Is that the appropriate interpretation?

FEMALE: Thank you.

WACK, J.: Yeah. And just the one VVPAT implementation I\'ve seen that I
think is certified basically does do that. If you look at a page on the
electronic record, it prints out that page on the paper record. You
essentially say, \"I\'m through. Let\'s go onto the next page.\" You
press a button. It has the next page on display.

MR. CHAIRMAN: Okay. Let\'s go on John. Okay. \[laughter\] Yes, sir.
Okay. Well moving to the next one. If the paper record cannot be
displayed in its entirety, each page of the record shall be numbered and
shall include the total count of pages for the record simply just to
help the voter know where they are. If they\'re looking at page three,
it might be useful to have that three of seven just to make sure they
know where they are in the verification process. Because you can imagine
it would be confusing otherwise.

FEMALE: Would they know? I mean in the case of something that\'s
printing a screen. You know, it\'s matching a screen display to the
print display, would the system actually know how many more pages of
print there are?

WACK, J.: Yes. That would be entirely capable. Or entirely doable.

J.R: Word processor does it, so why couldn\'t a voting machine?

MALE: Say that again J.R.

J.R.: I said the word processor, when you open up word it tells you one
of two, one of twelve. Likewise when you print.

MALE: Right.

J.R.: So it has an electronic image of the page numbers of the bottom of
your computer screen, and then the numbering system can also appear on
the printed page.

MR. CHAIRMAN: Well, should we make that clearer and maybe put an example
there that says for example, page one of three?

MALE: There it is at the bottom.

MR. CHAIRMAN: Oh, okay.

MALE: I want to wordsmith this a little bit too. We\'ve already said
that you\'ve got to be able to display the ballot in its entirety. I
want to change that to say, \"If the paper record will not fit on a
single page, then each page much be, etc., etc.\"

MALE: Thereby combining them.

MALE: I wanted to add as well that I think there is a concern about the
number of pages. J.R. said that word processors do it. But the word
processors know the document entirely ahead of time. If you have a
write-in ballot and you write in for somebody\'s who\'s got a 494
character name, or even just a small name that happens to hit the end of
the page, you could run over.

So I would actually prefer to see each page be numbered and the last
page shall be clearly distinguished. That\'s suffice.

FEMALE: I agree. I mean, I can begin to think of a lot of things. Like
you only voted for one of six, and the page number changes. And I would
think that having a situation where there would normally be three pages,
but you only have two because of how you voted and now you don\'t know
where your third page is, would actually cause more consternation than
it solved.

MR. CHAIRMAN: What is the suggested wording?

MALE: I guess I would propose that each page of each record shall be
numbered and the last page shall be clearly distinguished.

MR. CHAIRMAN: But we need a (Indiscernible). How about if the paper --

FEMALE: If the paper record cannot be displayed in its entirety, each
page of the record shall be numbered --

MR. CHAIRMAN: Well, I actually -- If it\'s on three pages, it is still
displayed in its entirety. I don\'t think that\'s correct. I think it
should say, \"If the paper record cannot be displayed on a single
page.\"

MALE: That\'s right. Each page shall be numbered and the last page
(Indiscernible).

MALE: Yeah. That\'s good.

MR. CHAIRMAN: Does that capture? Thank you.

WACK, J.: Okay. We have that. And moving onto the last requirement in
the usability section there. There shall be instructions for performing
the verification process made available to the voter in a location on
the voting system. And I don\'t think I see any issues with that.

So I would favor moving onto the --

MALE: Question. One question John.

WACK, J.: Yes?

MALE: (Indiscernible). I hate to go back to accessibility and kick a --
the constant force. Is that assumed it\'s going to be in an accessible
format to the voter? If you\'re giving them instruction? Will it be
audited? Will it be audible? Will it be print? Will it be large print?
Will it be brail? What do you do for the people who are handicapped in
order to access the instruction?

WACK, J.: Well, you may have brought up a point. I think we originally
had some sort of a requirement.

FEMALE: We have a section in 227 that addresses the need for
instructions to be in a format. And I think we could simply reference
it. I mean, I could go look it up, but I think if we simply reference
that section, we\'ll be fine.

J.R.: Yeah. That\'s what I was suggesting. We (Indiscernible) set it up
there, but some notation needs to be made here to either reference back
to that or to make it clear to the election official that the
instructions have to be there in a format understandable by the
individual.

FEMALE: I personally would rather just reference it so we can wordsmith
in one place.

J.R.: I have no objection.

MR. CHAIRMAN: Okay. So we\'ll find that particular section to refer to.
6023.

FEMALE: You have a typo at the top. I assume you mean accessibility
requirements from section 227, not 224.

WACK, J.: Ah, yes. I\'m sorry about that. \[laughs\] Okay. All right. We
will reference the appropriate requirement. And okay. Then moving onto
page 632. Talking about the accessibility requirements.

Starting with 60231, voting stations shall display print store paper
record in any of the alternative languages chosen for making ballot
selections. Okay. I think for the purposes -- The next requirement
underneath that, 602311 for the purposes of auditing, candidate names on
the records shall be in English. I might anticipate a problem with the
use of the word auditing there. We could even leave out the four
purposes of auditing and just say candidate --

MR. CHAIRMAN: How about verification?

MALE: Actually in that case, wouldn\'t auditing be acceptable? Because
it would allow third parties to come in and function.

MALE: (Indiscernible).

MR. CHAIRMAN: Is verification acceptable in that case? Okay.

WACK, J.: Okay, that shall read for the purposes of verification. Okay,
down below, 602312, other markings not related to ballot selection on
the paper ballot shall be in English. Essentially the precinct name is
included and so on and so forth. Those shall be in English. I see no
problems with that.

FEMALE: Does this section allow for those languages that are not
written?

MALE: (Indiscernible). \[laughter\]

FEMALE: If you know the -- Most of the Indian languages are not written
languages. Will we have to provide --\
At least in (Indiscernible) jurisdiction we have to provide for five
Indian dialects.

MALE: Uh-huh (affirmative).

WACK, J.: Sharon, can I -- I\'m not going to -- I\'m going to ask for
your help there, because we\'ve talked about this issue, and I don\'t
want to misstate how you\'ve handled it already.

FEMALE: Well, the audio ballot is the alternative for a non-written
language, obviously. Now if you\'re going to insist on a fully
accessible VVPAT voting, a voting station with VVPAT to be fully
accessible, then you need something in addition to the paper audit trail
to do the verification in an audio way as well. Same for blind or anyone
using the audio ballot.

MR. CHAIRMAN: Is that a topic for version two?

WACK, J.: The next requirement addresses in a sense the audio ballot,
the audio verification. 60232. And that requirement is repeated from the
human factors section.

FEMALE: Okay. We\'ve got a normalization problem that I missed. Because
the section from 227 is on page 221. It\'s number 2271226. This is a
shall, and that\'s a should. And sorry. It was on my list of things to
deal with, but we did a lot of other things. And I think it should be a
shall in both cases.

MR. CHAIRMAN: Which number was that again?

FEMALE: It is 2271226 on page 221.

MR. CHAIRMAN: Yes.

FEMALE: It says -- It actually -- If the normal procedures includes
VVPAT, the accessible voting system station should provide features that
enable voters who are blind to perform this verification. This section,
which is supposed to be a direct repeat says, \"If the normal procedure
includes VVPAT, the accessible voting station shall provide features
that enable voters who are blind to perform this verification.\"

So except for some orthographic differences that we also ought to clean
up, we\'ve got a should shall difference, which is a subtenant one.

And I\'d like to suggest that we actually go back to section 227 and
make that a shall.

MR. CHAIRMAN: Okay. So noted.

FEMALE: Okay. And Sharon, would you note it on that piece of paper that
we\'re going to give to Mary. The one that we\'re editing just so we
keep in all in one place.

WACK, J.: Okay. I would like to move on, but I want to make sure that
the question --

FEMALE: Can I interrupt for a moment? The ratifications of making that a
shall means I don\'t believe there\'s any systems that are marketed
right now that will meet that requirement.

FEMALE: That\'s what I was just saying.

FEMALE: Point that out.

FEMALE: There again, can we meet it? I understand it\'s very important,
but I think it has to be in the -- I mean I think it has to be in
version two that it should and that we ought to have a should here.

MALE: This is Jim Elkes (phonetic sp.). How about leaving the should in
there and saying that it will be required as part of the version two for
purposes of moving this --

FEMALE: That\'s what we say in section 227.

FEMALE: (Indiscernible).

FEMALE: Yes.

FEMALE: And in both sections we\'ll use the language pointing forward
that we\'ve used before. Either way, it just has to be the same.
\[laughs\]

WACK, J.: Okay.

FEMALE: Thank you (Indiscernible).

MR. CHAIRMAN: Okay, so we\'re back to 6024?

WACK, J.: We are. And let me move onto the next slide here. Approve or
spoil. Start with 60241, voting stations shall in the presence of the
voter mark the paper record as being accepted by the voter or spoiled.
No problems there.

60242, the voting station shall also mark and preserve electronic and
paper records that have been spoiled. I\'m sorry if I\'m confusing you a
little bit. I added that also for emphasis. That isn\'t actually in the
requirement. Ron, looking over these earlier, pointed out that it may be
confusing to people that we\'re saying to preserve the spoiled records
and not the approved records.

So by that requirement, it is assumed in the top level requirement that
we are preserving the accepted records. We have a requirement here that
we\'re preserving the electronic and paper records that have been
spoiled.

MALE: Electronic records aren\'t spoiled. You don\'t maintain a --

MR. CHAIRMAN: But they\'re erased.

MALE: Huh?

MR. CHAIRMAN: They\'re erased or they\'re not?

MALE: They\'re changed in place.

MR. CHAIRMAN: Right.

MALE: You know, I voted for Ron. I changed my mind. I deselect that. I
vote for you. When that ballot is finally recorded, the fact that I
deselected Ron is never recorded.

MALE: I think you\'re saying something else. You\'re saying -- Are you
saying you want the electronic record that\'s got the same linking
number to indicate whether (Indiscernible).

WACK, J.: Essentially we\'re saying if we have a spoiled paper record,
we\'d like to know if there was indeed a spoiled electronic record as
opposed to that electronic record actually being accepted.

MALE: You don\'t spoil an electronic record.

MALE: It\'s a better definition. I think the question is if you want to
maintain a one-to-one correspondence of your paper records and your
electronic records so that for every piece of paper you\'ve got you have
an identical check so that you can mark the electronic records. You\'re
right that it\'s not spoiled in the sense that you can erase it or
whatever.

MALE: I strongly suspect that none of the systems out there right now
are capable of doing that.

MALE: Well, it\'s a matter of programming (Indiscernible) if we save it.

MALE: No. They basically are designed for security sake to make sure
that no actions other than the actual casting the ballot create the
electronic record.

MALE: Well, there\'s two types of spoiling paper records right now. One
of them Donetta (phonetic sp.) was just describing. It does it on a race
by race basis. I vote for you and the paper record says vote for Ron. I
change my mind and change my vote to Donetta, and the paper record says,
\"Spoiled.\" And it puts Donetta. So I\'ve got this interactive record
of the way I preceded through the ballot. But when I get down to the
end, I\'ve just got one electronic record, and it\'s whichever one is
the final.

MALE: So there\'s issues with that. The incremental commitment scheme,
if you want to call it that, or the incremental casing of your vote also
has issues for privacy and so on, too. Because the voter can potentially
mark his ballot by canceling this record, erase five times, and
canceling that one three times and so on too.

MALE: Yeah.

MALE: So there\'s other issues of security with that. When you get down
to the summary, putting that aside then as a separate category. If you
just have the electronic record created, the paper record created to
correspond to that, they\'re both clean. They don\'t have any erasers or
anything like that, then there should be a nice one-to-one
correspondence.

MALE: Right. Agreed that if you didn\'t print the paper record until you
go to the summary record then you could do it. But their systems now,
they don\'t do that.

MALE: If they print incrementally then you\'ve got other issues too with
privacy, which I think may be more important.

FEMALE: But the privacy issues can be handled in other ways too. I mean,
yes I agree. Every ballot has to be private. But you can handle those
privacy issues by never -- I mean, you\'ve got more than one unit in a
polling place. You never record what unit that voter is voting on.

MALE: That\'s a separate question. That\'s an important issue, but
you\'re right there. The issue I was raising, I guess I wasn\'t clear.
Let me try to be clear.

If you know, you can write in a write-in vote that says Mickey Mouse or
some other name. You\'re essentially marking your ballot and to the
extent we care about that. You have to worry about, you know, is there a
way for some voter to mark his ballot so that he can point to it later
and he\'s got some procedure by which he can be paid off for marking his
ballot in a certain way. He can say, \"Look. I did it this way.\"

And so with this incremental kind of voting that Rick\'s talking about
and that you mentioned earlier, there is the potential -- I\'m just
noting that there is the potential for marking your ballot. You can say
I have this particular pattern of voting. (Indiscernible) one this way
and then I changed my mind and I voted that way. You know, I\'ve got
enough leverage there to be able to mark your ballot because by the
pattern of changes.

And maybe this is a minor issue, and we shouldn\'t worry about it too
much. But I\'m noting there is a privacy concern there that should be
addressed.

FEMALE: And I think states have been addressing it. I know in Colorado,
we only do a write-in on somebody that has filed an affidavit for a
write in. And so you don\'t have the Mickey Mouses and the Donald Ducks
or something like that. It\'s only for a verified candidate that is been
indicated. So that\'s how we\'ve handled it in Colorado. And that way
there\'s only one possibility maybe, or two possibilities that you can
write in. And they can\'t be -- You know, you can\'t go back and sell
that vote.

MALE: If you\'ve allowed this incremental voting then you\'re opening
the barn door again to people being able to mark their ballots in some
way. So I\'m not sure what the right procedure is.

WACK, J.: Well, I think the issue right now is do we want voting
stations to preserve spoiled records to maintain a one-to-one
correspondence?

MALE: (Indiscernible).

MALE: Again, we could state that as a requirement and leave the
implementation to the vendors.

FEMALE: Then one solution is to just make that the requirement and leave
the rest of it alone. The other is to say if in fact we\'re up against a
problem of how the systems work today, should this be one of our shoulds
with the point forwards as a shall.

MALE: I think that that\'s probably the best post you could take right
now.

FEMALE: And I think that would let us make the technical point about
where we want to go and still --

MALE: Change 242 to a should with that caveat that you think.

FEMALE: And I agree, because I think that when we get into this area --
You know, you\'re paper records, if it says cancelled, you\'re going to
have a cancelled record here. And on that machine, you want to know what
the end results are. So we even need to look and see if it has to be
both. Because as Brit says, right now. You change it immediately, and
then when you cast the vote, it\'s cast. You never -- The electronic is
never cancelled.

MALE: Okay. If I can get a mic (phonetic sp.) here. Probably the desktop
engineering, the best way to handle this would be to have the ballot
images reflect only those ballots that were actually cast. To have the
spoiled ballots preserved in the system and then to have a system log
file, which reflects a number of ballots that were spoiled. And
obviously your log file entries and your ballot image files in memory
should equal the number of paper slips or entries on the spool.

MALE: I was going to point out that one of the ways to bring a closer
equivalence is using write only medial electronically, which frankly I
have been surprised we don\'t see more of in this field. Where the only
thing you can do is write to it and possibility put a cancel after and
put a fresh record.

MALE: It\'s much more like the paper.

MALE: Exactly.

MALE: I think one of the questions -- I think should is probably fine
for language here, but from a security viewpoint maybe, Paul, you can
address that too. Whether having the spoiled records around helps in the
security evaluation of how did this election go. You know. Was there a
bias in what was spoiled for example? Are there any strange things
happening with the way records are spoiled? I think having a complete
record of what happened there, I don\'t see any issues with -- other
concerns other than just keep trying to have a complete record of what
happened. And a copy of the spoiled ballots could be of some, maybe not
large value in accessing how well the election went.

MALE: Basically, you need to be able to show that the number of votes
cast in the precinct are equivalent to the number of voters who signed
in. And there has to be a process of balancing provisional ballots,
actual cast ballots, and spoiled ballots that were issued to that
number. So yeah. I think you\'ve got to track your spoiled ballots.
You\'ve got to track the occurrence of spoiled ballots. And that all
should reconcile.

MR. CHAIRMAN: Okay, what I\'m hearing is we\'re changing 60242 to a
should.

MALE: There\'s a problem with that, because when you get down to -- If
that\'s a should, then you can avoid the nested things up under it. And
2422 and 423 should be shalls.

MALE: Yes.

MALE: So whether you\'re keeping that with electronic records or not,
you need to let people know when they are spoiled the maximum number of
records. And there should be some procedure once they have spoiled to go
on and cast the electronic ballot.

WACK, J.: Brit?

MALE: So as I understand the nesting here, if we make 242 a should, then
a vendor could complete avoid 2422 and 2423.

FEMALE: Yes. So we have to elevate that.

MALE: So we\'ve got get those out from under that nesting.

WACK, J.: I agree. Yeah. Yeah. I agree. They should be moved to the left
and be higher level. So we will un-nest those. Okay.

MR. CHAIRMAN: So are we basically talking about changing the numbering
system?

MALE: I would take those two and (Indiscernible) 4.2 and 4.3 and
(Indiscernible).

MALE: Another alternative would be to move the one that we just changed
to a should to a sub-bullet and to create a new super bullet that
encompasses all of them.

MALE: (Indiscernible).

FEMALE: (Indiscernible).

WACK, J.: Okay. Just to be clear, 60242 has a should in it. The voting
station should. 602421, let me just make sure we\'re not keeping that
requirement?

MALE: (Indiscernible).

WACK, J.: Okay.

MR. CHAIRMAN: Well, the next three are all shalls and they need to be
maintained so the nesting is inconsistent. So we have to change it
somehow.

FEMALE: I know what to do.

WACK, J.: Okay. We got it. Could I infer from that that you all agree
with those three nested requirements and we could move on to 60243,
which reads, \"In case of conditions that prevent voter review with a
paper record, there shall be a means for the voter to notify an election
official.\" And simply, that requirement there is a common sense
requirement. If the voter can\'t -- If something has happened, then
there shall be some means for the voter to notify a pool worker or an
election official.

That has a nested requirement underneath it. Conditions that prevent
voter review of the paper record that are detectable to the voting
station shall cause an error message to be displayed and shall prevent
recording of the electronic record.

MALE: (Indiscernible).

J.R.: John? J.R. If the voting station is going to give an error message
of some sort, you got to have the accessible message as well. So some
kind of flashing light. Some kind of dinging or something to cover the
various distility (phonetic sp.).

FEMALE: I think the assumption we\'re working under is that all general
display requirements for accessibility in 227 apply to anything here.

MALE: Okay.

FEMALE: And that we\'re only calling out additional requirements.

WACK, J.: That is correct. Yeah.

FEMALE: Okay.

MALE: My concern with 431 is that if say the printer jams and that
prevents me from casting an electronic record, have I been
disenfranchised? What happens?

WACK, J.: Well, the way I read the requirement it is to prevent an
electronic record from being stored and recorded if there is some other
error that prevents the voter from viewing the paper record. It\'s
really to handle -- There was a situation where voter\'s electronic
records were accepted in some particular situations; however, they
really weren\'t. They really weren\'t being recorded by the voting
system. There wasn\'t an error display.

MALE: I agree with your attempt to keep this one-to-one correspondence,
but I think the wording here is flawed. What it needs to say is that if
there\'s some sort of an error that prevents -- Where did it go? I\'ve
lost it again. Oh, if something that prevents me from reviewing the
paper record, then there needs to be a means to void that transaction
and allow me to start over on another voting station. And I don\'t know
how you want to word that. Okay. But the way it\'s worded right now, you
put me in limbo.

FEMALE: Isn\'t that the same as if the maximum number of spoiled ballots
occurs, procedures shall be in place for the voter to otherwise cast a
ballot. Just above that. 423. It\'ll serve the same problem

MALE: Or 245. The voting station should not record the electronic record
as being approved by the voter until the paper record has been stored.
The paper record won\'t be stored in that case, so nothing has happened.
There\'s no transaction.

MALE: Then maybe we don\'t need that at all.

FEMALE: (Indiscernible).

MALE: Yeah.

WACK, J.: Okay. So we\'re basically considering getting rid of 602431
because we think it\'s covered in other requirements.

MALE: Yeah. 431 has a condition that stops me from voting without giving
me a remedy.

WACK, J.: Okay. That\'s --

MR. CHAIRMAN: Well, the only that did was actually to have this
requirement for an error message of some sort. If we take that out, are
we removing that requirement?

MALE: (Indiscernible).

MALE: Well, you\'re removing my objection. My objection is saying that
you\'re going to prevent me from voting. My objection is from the and
on. And shall prevent recording of the electronic record.

MR. CHAIRMAN: Well, it seems like that part is covered by 60245.

MALE: Yeah. I think so.

MR. CHAIRMAN: So if we just take out that last part, is that acceptable
then to everybody? Are we okay on that? Ron, does that --

MALE: Yeah.

WACK, J.: Okay. Well, in a sense we\'ve talked about the next couple
already. 60244, procedures by which election officials can be notified
and prescribed actions can be taken to address discrepancies if the
voter indicates that the electronic and paper records do not match shall
be documented.

In the, I would think highly unlikely event that the electronic and
paper records actually do not match, there should be some procedure that
election officials know how to follow at that point to deal with this.
It could be a variety of different things. I would probably indicate
something wrong with the system.

MR. CHAIRMAN: 6045.

WACK, J.: Okay. The votings -- Okay, on 45 the voting stations --

MR. CHAIRMAN: (Indiscernible).

WACK, J.: I\'m sorry.

MR. CHAIRMAN: I think we already discussed that. So I assume we\'re okay
on that.

WACK, J.: Okay. 45 is okay as written?

MR. CHAIRMAN: 60246.

WACK, J.: Actually, would it be simpler for me just to call out the
requirement numbers. If you have an objection or a comment. Why don\'t
we do that. Okay. So we\'re looking at 46 and 461. Going onto 47.

MALE: Ah, 246. I guess 246. This is a shall. It caused the capability to
address situations in which an electronic or paper record has been
recorded approved and stored without the intention of the voter. We need
to give the vendors fairly specific information on what we expect them
to do.

MALE: Well, that goes against standard practice now.

MALE: Uh-huh (affirmative).

MALE: If you push the cast ballot button on a DRE voting machine,
you\'ve recorded your vote, and there\'s no way to go back and unravel
that even if you did it inadvertently.

FEMALE: Yeah.

MALE: That\'s a different situation than what it\'s talking about here.
It says, \"without the attention of the voters.\" So if the voter
didn\'t push anything.

MALE: Well, I\'m saying that voters do that unintentionally. We actually
changed the face of a voting system because it had a tendency to cause
voters to do that. The scroll bar was right over the cast ballot button,
and if they\'re hand slipped they\'d cast their ballot. But once they
cast that ballot, \--

MALE: It\'s gone.

MALE: Thanks to the secrecy of the ballot, it\'s in the box and there\'s
no way to retrieve it.

FEMALE: And currently you have voters that come to you always and say,
\"I only voted for one thing on the ballot, and I forgot to vote
everything else. And I had pushed the cast ballot.\" You don\'t know if
they did that or if they voted a whole ballot. Because you can\'t get
back their ballot. You have no idea what they voted. So you\'ve got to
be very careful there. Your ballots are never equal. If you give them
another chance of voting, it\'s a problem.

MR. CHAIRMAN: Is this strictly a matter of having the capability to
basically say spoil the record. I want to start all over again? I\'m not
quite sure what we\'re asking.

MALE: Well, at this point the voter is past the point where he spoils
the record. How he got there, we don\'t know.

MALE: Yeah. You\'ve can spoil a record up to the time you cast the
ballot. Right.

FEMALE: I just -- When I read it, I really wasn\'t sure what it meant. I
mean, it sounded good, but then I thought about it and I really wasn\'t
sure what kind of situation --

**\[End of Audiotape 4 -- Side A\]**

FEMALE: In the previous one we say that you can\'t record the electronic
record until the paper record has been stored.

WACK, J.: Well, that\'s a should.

FEMALE: Oh, it\'s a should. But I mean, I guess I --

MR. CHAIRMAN: Well, maybe that should be a shall.

MALE: I think this maybe should be struck.

FEMALE: Yeah. This is just going too far.

MALE: (Indiscernible) -- And not be able to retrieve it. The printer
doesn\'t have to run out of paper. It can run out of ink, and you don\'t
even notice that\'s happening because you\'re intent on what\'s going on
over here. And all of the sudden you cast your ballot and you notice
that the paper\'s blank. Now it\'s cast. You can\'t go back and
regenerate that missing piece of paper.

MR. CHAIRMAN: Do I hear a motion to strike this?

MALE: Yes.

MALE: Second. \[laughter\]

MR. CHAIRMAN: Any objection? Thank you. 247.

WACK, J.: 247. Any problems with that? Onto the next page.

MR. CHAIRMAN: Section 6025.

WACK, J.: We\'re on page 637, 60251. Anything on page 637? And 638?

MR. CHAIRMAN: There are a lot of items here. My suggestion is to
adjourn. Your homework would be to review these items --

MALE: Corrections.

MR. CHAIRMAN: And come back with a list of issues and concerns, because
I don\'t see us finishing this any time soon if we go one by one.

FEMALE: Do that.

MALE: We can at least (Indiscernible).

MR. CHAIRMAN: Okay. Let\'s do that.

FEMALE: (Indiscernible).

MR. CHAIRMAN: 6025. 60251.

MALE: Do you want to do this now that the resolution --?

MALE: (Indiscernible).

MR. CHAIRMAN: Yeah. Give me that. (Indiscernible). 60251.

MALE: Good.

MR. CHAIRMAN: Two?

MALE: Good.

MR. CHAIRMAN: Three?

MALE: Good.

MR. CHAIRMAN: Four?

MALE: Yeah. Whatever.

FEMALE: It\'s good.

MR. CHAIRMAN: Why do we need the last part of that sentence?

FEMALE: Why do we even need that?

MR. CHAIRMAN: I mean, the voter should not be able to leave the voting
area with the paper record of a ballot.

WACK, J.: I can address that.

MR. CHAIRMAN: Okay.

WACK, J.: In some schemes of the voter could actually leave with paper
record that has markings on it, encrypted codes, things of that sort,
but it doesn\'t reveal the voter\'s choices.

MALE: Yeah. I think John\'s right. There are some cryptographic
proposals, which uses cryptography in an innovative way. The voter
actually leaves with a paper record. The voter can\'t prove to anybody
else how they voted with that paper record because it\'s encrypted.

MR. CHAIRMAN: It just proves that he or she has voted.

MALE: It proves he\'s voted and also allows him to check that his vote
was counted later correctly in an interesting mathematical technique. So
that last clause is actually important.

MR. CHAIRMAN: Okay. Any objection? 255?

MALE: (Indiscernible).

MR. CHAIRMAN: 255?

MALE: Yeah. Information for the purposes of auditing the electronic or
paper records that may permit a voter to reveal his or her ballot
choices shall be displayed as not to be memorable by the voter.

WACK, J.: Well, I think having about a week\'s perspective on that, I
would probably word it differently. \[laughter\] And I would basically
say unique identifiers shall not be displayed so as to be memorable by
the voter. The unique identifiers --

MALE: (Indiscernible) say (Indiscernible).

WACK, J.: Exactly.

MALE: So that should not be displayed period.

MALE: No. No. You could display them in the glyphs that are not the
usual ones. Bar code or the Xerox dated glyphs in a way that you look at
them and it doesn\'t look like anything you can memorize. It doesn\'t
look like a sequence of digits even. So that there are ways to display
information that you look at them and you can\'t walk away and say I can
go back later and recognize my vote, because the unique I.D. that was on
that vote was displayed in 64521.

MALE: What would be the value added of having it displayed at all.

MALE: Ah, there was a requirement that we had earlier that said that the
paper and the electronic information display should be the same. And so
that either one you could not display it. The paper record and the
electronic record should have the same information so that if you don\'t
record it on the paper, then you\'ve got no way to link the ballots to
correct it with the electronic record.

WACK, J.: The other issue too is that earlier we kind of said that it
had to be hidden in a bar code. And we\'ve had a little bit of push back
on that. Some people don\'t want a bar code because then it -- What
could the bar code be hiding? So that\'s the wording there.

MALE: (Indiscernible).

MALE: You could perhaps change it to say not to be easily memorable.
Some people can remember amazingly.

MALE: Photographic memory.

MR. CHAIRMAN: Okay. 256.

FEMALE: Well, besides suggesting that you edit this so it\'s not in
passive voice, I think it\'s fine.

WACK, J.: This particular requirement I think was maybe a repeat, I\'m
not sure, from the human factors section. And I guess it\'s pretty clear
what the issue is. You recommend rewording it, and I could do that and
show it to you tomorrow morning when we start in again if that would be
acceptable. It sounds like it is. Okay.

MR. CHAIRMAN: You\'re going to redo this?

WACK, J.: I will. I\'ll talk with Sharon. That\'s the reason I\'d like
to do it off stage.

MALE: Question.

MR. CHAIRMAN: Yes.

J.R.: J.R. The way it read for me it says, \"Unable to handle paper and
use the accessible machine.\" So is it a double prompt or is it one or
the other? Meaning, is this only applicable for someone who can handle
paper, can use the accessible machine, or one or the other or
combination thereof?

WACK, J.: As it was explained to me, I think it\'s the former. I think
it\'s the accessible voting station requires one to manually handle
paper. So obviously something needs to be done about that to maintain
privacy and anonymity.

FEMALE: J.R., Sharon had to leave and I\'d like to check with her. But I
do believe that part of the intent of this was to address systems like
the -- Oh, dear. What\'s it called? The auto mark where you end up with
a ballot where you would in fact have to remove that ballot from the
machine. And if you can\'t see it or if you can\'t handle it, that
someone would have to help you and that could compromise your privacy.
And that doesn\'t mean it can\'t be done. It just means it has to be
done in a way that does not compromise your privacy.

J.R.: Right.

FEMALE: So maybe a little wordsmithing on this with Sharon.

MR. CHAIRMAN: Okay. Why don\'t we stop there. And before we go, if you
remember we agreed early on about tabling a motion which was reworded.
This is resolution number 3905. You have been just given a copy, an
updated version of this.

J.R: Read it aloud for the record for those of us who don\'t have one.

MR. CHAIRMAN: Yes. I will read that J.R.

J.R.: All right.

MR. CHAIRMAN: This is titled, Voter Verified Paper Audit Trail
Assignment. The TGDC recognizes that voter verified paper audit trails,
VVPAT, has been developed in some jurisdictions without guidelines. The
TGDC is aware that some states currently require or intend to require
use of VVPAT. During this January 18, 2005 meeting, the TGDC received a
request from the EAC to develop VVPAT guidelines for use by states and
election jurisdictions that have chosen to acquire VVPAT so that those
states can more effectively implement VVPAT. Subsequently, the TGDC
instructed in this to develop and submit VVPAT formal requirements as a
part of its voluntary voting system guidelines technical assistance work
product. The TGDC neither endorses nor opposes the use of VVPAT.

This is really sort of statement of the obvious and to make sure that
it\'s clear that this is not endorsement. We know these machines are
being used out there, and this is simply to make their use more
effective.

J.R.: (Indiscernible).

MALE: Second.

MR. CHAIRMAN: Thank you. Any comments or discussion? Do we have a
unanimous consent?

MALE: Yes.

MR. CHAIRMAN: Or do we have to vote on this?

MALE: Ah, it would be a good style to at least take a voice vote.

MR. CHAIRMAN: All those in favor?

MANY VOICES: I.

MR. CHAIRMAN: Any opposed? The resolution number 3905 has been adopted
unanimously. Thank you.

MALE: Mr. Chairman?

MR. CHAIRMAN: Yes.

MALE: I have a writing here that somebody sitting behind me wrote and
suggested that we go on the record dealing with the issue of the sticker
this morning. So should we go ahead?

MR. CHAIRMAN: Issue of the?

MALE: The sticker issue on who the work product belonged to that we had
this morning.

MR. CHAIRMAN: Oh. I see.

MALE: And I\'ve got that ready to read in the record if it\'s your
pleasure.

MR. CHAIRMAN: Please go ahead.

MALE: Okay. Mr. Chair, I have a point of clarification regarding our
meeting document. A sticker has been affixed on the cover of our
documents that states they are TGDC work products. I wish the chair to
state on the record that no document is a work product of the TGDC
unless and until such document is adopted by vote of the TGDC.

MR. CHAIRMAN: So stated. \[laughter\]

MALE: Thank you sir.

MR. CHAIRMAN: For the record.

MALE: (Indiscernible).

MR. CHAIRMAN: Thank you very much everybody. You can leave the documents
here. And see you bright and early tomorrow morning.

**\[END OF AUDIOTAPE 4\]**

MR. CHAIRMAN: If we could all take our seats, we\'d like to start. Thank
you.

MALE: Good morning. Do we have anybody on our teleconference yet this
morning? Nobody yet? Okay. Good morning. Who\'s joining us?

FEMALE: This is Helen Purcell.

MALE: Morning Helen. All right, we\'ll begin the Thursday morning
session. Good morning to everyone who is here and on the web cast as
well. The agenda has somewhat shifted today as a result of our progress
yesterday. There are new copies of the proposed or drafted agenda for
today out on the front desk. TGDC members, you each have a copy as well
to fit in your folder. While I think of it so you TGDC do not have to
look like you\'re carrying two Manhattan telephone books home with you.
We\'d be more than willing to send them to you at the end of the day. If
you have a business card or something, stick is in there so we know
which copies are yours, and we will send them to you.

Briefly, to go over our usual items, please turn off cell phones and
pagers. There were a couple of cell phones that went off yesterday. That
does go out to the web and it is disconcerting. So that would be most
helpful. No food in the auditorium as I said. Everybody\'s been very
good about wearing their name badges, so we haven\'t had to call the
police. And again, our signer will be up front, although she is not here
yet. She will be shortly I\'m sure.

MR. CHAIRMAN: She is here.

MALE: Oh, she is here? Okay. Good. Quickly, to take a look at our
emergency exits one more time. We have two exits right out the back door
and two exits here on the front as well. J.R., both myself and John Wack
have keys to get you out should something happen. So we\'ll take care of
you. And we\'ll take our breaks again in the morning and in the
afternoon about the regular time. There are also evacuation directions
on the sides there of the aisle.

With that, I turn it over to Chairman Samergian (phonetic sp.) to begin
today\'s proceedings.

MR. CHAIRMAN: Good morning. Welcome back everyone. For those of you who
were not here yesterday, I\'m (Indiscernible) Samergian, Acting Director
of the National (Indiscernible) of Service and Technology and chairman
of the Technical (Indiscernible) Development Committee. I hereby call to
order the fourth meeting of this committee today, Thursday, April 21,
2005. Let us now stand and pledge allegiance.

EVERYONE: I pledge allegiance to the flag of the United States of
America. And to the Republic for which is stands, one nation, under God,
indivisible, with liberty and justice for all.

MR. CHAIRMAN: At this time I recognize Mr. Phil Green as the TGDC
parliamentarian and request that he determine if a chorum of the
committee is present. Mr. Green?

MR. GREEN: Thank you. I\'d like to begin by calling role. Williams?

WILLIAMS: Present.

MR. GREEN: Williams is here. Berger?

BERGER: Present.

MR. GREEN: Berger is here. Caldus (phonetic sp.)? Caldus is absent.
Kraft?

KRAFT: Here.

MR. GREEN: Kraft is here. Davidson?

DAVIDSON: Here.

MR. GREEN: Davidson is here. Elokeys (phonetic sp.)? Perhaps he\'ll be
joining us by phone. Gannon?

GANNON: Here.

MR. GREEN: Gannon is here. Harding?

HARDING: Here.

MR. GREEN: Harding is here. Miller?

MILLER: Here.

MR. GREEN: Miller is here. Quisonberry (phonetic sp.)?

QUISONBERRY: Here.

MR. GREEN: Quisonberry is here. Rivest (phonetic sp.)?

REVEST: Here.

MR. GREEN: Rivest is here. Shutzer (phonetic sp.)?

SHUTZER: Here.

MR. GREEN: Shutzer is here. Tuner-Buwi (phonetic sp.)? Not here.
Samergian?

MR. CHAIRMAN: Here.

MR. GREEN: Samergian is here. I may have missed Purcell.

PURCELL: I\'m here.

MR. GREEN: Purcell is here. We have 12 present. That does constitute a
chorum. We can proceed.

MR. CHAIRMAN: Thank you Mr. Green. We have distributed a revised agenda
that I\'d like to review with the committee. Our goal today is to
complete the review and editing of VBSG version one. We will then
consider any additional resolutions and plan our next steps as a
committee. If there is time at the end of the day, we will discuss VBSG
two.

Yesterday, we approved the conformance clause of VBSG version one. We
will begin this session with a review of the VBSG sections that have
been edited as per the committee\'s instructions. We will then vote on
those sections.

Before we go there, just in case you think we are working in a vacuum or
our work is not being appreciated perhaps. Just in case you\'re feeling
a little down on yourself, let me assure you that the world is actually
watching us. And not only that, I understand there is some fan mail
coming in, encouraging us to stay on the path. \[laughter\] So that has
come in, I guess, through e-mail. But there is a formal letter I
understand. And Mr. Harding would like to read this letter for the
record. Mr. Harding?

MR. HARDING: Thank you Mr. Chairman. This letter comes from the
executive director of the governor\'s ADA working group for the state of
Florida. Subject, voluntary voting system guidelines.

\"Congratulations on your draft voluntary voting system guidelines. The
technical guidelines committee has clearly gone a tremendous amount of
work to ensure the needs of Americans with disabilities are met on
Election Day. The committee appears to have successfully balanced the
needs of the Federal standardization with the needs of states to have
flexibility to implement the standards in a manner that is appropriate
for each state population. We support allowing flexibility of states to
address geographic cultural diversity of populations such as the
Hispanic and Asian population groups. The guidance on personnel and
training also allows needed flexibility at the local level to address
the needs of the community, in particular, demographic groups.

Many features of the guidelines will inspire voter confidence in the
process. They include excellent standards for rigorous, electronic and
paper validation process including applying accessible requirements to
the paper validation process. The performance testing of equipment and
software provide a foundation for voter confidence in the process.

Also, the strong system data telecommunications network security
procedures will facilitate voter confidence. The processes set up to
allow voter access to the validation process will reinforce the trust
and the reliability of the process and outcomes.

We encourage the committee to consider specifically recommending
individuals with disabilities to be actively involved in the quality
assurance efforts, including accessibility, usability, setup validation,
and compliance processes.

We also encourage the committee to look at voting processes as more than
the interaction between the individual and the ballot on a given
election day. Access to information about election and voting process
must be accessible and usable by individual with a wide range of
disabilities. In order for the guidelines to achieve their full
potential, individuals with disabilities need information about how to
fully participate in the electoral process.

Thank you for your excellent work. The committee has truly set the
standard.\"

MR. CHAIRMAN: Thank you very much. We have three revised documents
distributed to you. Sections 277, I\'d like to make sure that in my copy
page 23 was missing, but there are others -- Will you please make sure
that you have no missing pages on this 2.2.7. Maybe it was just that I
got special treatment.

FEMALE: Mine has two copies. So perhaps I have yours.

MR. CHAIRMAN: Oh. Maybe. Okay. Well, just make sure that you have all
the appropriate pages. And then we have two revised documents for the
security standards section 146.0.1. And the other for 6.0.2. I want to
make sure that everyone has these three documents.

MALE: Mr. Chairman?

MR. CHAIRMAN: Yes.

MALE: It\'s Jim Elekeys from the U.S. Access Port.

MR. CHAIRMAN: Okay. Jim, first of all let me make sure that your
presence is duly noted in our records. Mr. Green, will you please make a
note that Mr. Elekeys has joined.

MR. GREEN: Thank you.

MR. CHAIRMAN: So that makes 13 members present for this meeting. Yes?

ELEKEYS: Thank you Mr. Chairman. While I\'m confident of my personal
assistant\'s capabilities to edit the material we heard yesterday, would
it be possible for someone to get an e-mail out to me so I have the
document and I\'m working from the same papers that everyone else is?

MR. CHAIRMAN: Yes. Ellen is doing that as we speak to you and Ms.
Purcell.

ELEKEYS: Thank you.

MR. CHAIRMAN: So this morning, we\'ll begin this session with a review
of these sections that were worked on yesterday and that were edited per
the committee\'s instructions. And then we will vote on those sections.
So at this time, I call on Dr. Sharon Leskowski (phonetic sp.) on this
information technology laboratory to review the edited sections of VBSG
version one, section 2.2.7.

LESKOWSKI: Okay. Good morning. Should I just run through the changes, or
are there any other issues we need to discuss first?

FEMALE: Well, why don\'t we just start with a brief statement about what
we did, which is that places where we had simple -- Changes that were
simple edits, changes of shalls to shoulds or changing of simple
wording, we\'ve made the changes. There were several places where the
changes that we\'ve requested will require a little bit of research. For
instance, the section where we\'re going to normalize language in two
standards. What we\'ve done in this case is in this draft we have put a
note in that we will do that. There was not time between five thirty
yesterday and eight thirty this morning to get that work done. And we
will recirculate that draft with the pleasure of the committee. But it
seemed better to have a well-considered draft than a fast draft.

MR. CHAIRMAN: I suggest that we assume that the normal, simple editing
changes are done properly. People can look at them later on. But they
were I think pretty clearly noted yesterday. So we\'ll assume that they
are done. So I think the only thing I would talk about is there were a
couple of areas where there are some issues or some questions.

FEMALE: I did want to raise one issue just to make sure that we as a
committee are clear on it. One of the things that we did yesterday was
vote on two sections. One in this section -- Two clauses. One in this
section and one in the VVPAT section. The sections are 2271226, which is
at the bottom of page 21. And then the VVPAT document is section 60232
at the -- the only thing on page 67.

We voted to make this a should, and in both cases it reads, \"If the
normal procedure includes VVPAT, the accessible voting station should
provide features that enable voters who are blind to perform this
function.\" I don\'t know the answer and I\'m not a lawyer, but I do
know that the havoc language is very specific about the participation of
people who are blind in the voting process in an independent manner. And
I just want to call this back to our attention. One of the reasons this
was one of the sections that came up against our wish to ensure that
equipment -- That the standards, the guidelines that we create here are
capable of being implemented with existing equipment or perhaps it
should be existing technology. And I just want to re-raise this question
briefly.

MALE: Would it be appropriate to ask a lawyer to give us --

FEMALE: I think it would be.

FEMALE: That might be something worth doing. I mean, I see both sides of
this. I see one opening us up to a problem of not being able to meet the
standard and the other opening us up to a problem of lawsuits because we
have set the standard in this way. So perhaps this is a place where
asking for some legal opinion and reconsidering it with a little more
input would be useful.

FEMALE: We could talk to Craig. I don\'t think he\'s here right now.
Okay. Phil?

PHIL: Craig and I can work on that. Can we get the site from the hava
(phonetic sp.) that discusses that?

FEMALE: Yes.

FEMALE: When we get done with this section, I\'ll bring this over to
you.

FEMALE: Yes. We quote this section.

MALE: I think it\'s 212 of this.

MR. CHAIRMAN: Okay. We\'ll get a clarification on that. Let\'s proceed.
Any other issues? Sharon or Ms. Quisonberry?

FEMALE: Okay. I can go through very quickly those changes that were
substantive. Is that what we\'d like to do? The first substantive change
is on page 2-15. Excuse me, 2-14.

MR. CHAIRMAN: Five zero.

FEMALE: I could quickly summarize. We did change all the clauses that
talked about summative usable test to shoulds. Um, we added -- Those
phrases where we said under control of the voter, we changed those to
under control of the voter or poll worker.

MR. CHAIRMAN: Could you turn your --

FEMALE: Starting on page 214 at the bottom.

FEMALE: Thank you.

FEMALE: If you look at the bars on the left, those denote any changes
that were made.

FEMALE: Oh, yes. Okay. And we did add the clause that it is anticipated
in future -- In the discussion section, it is anticipated that in future
versions of the VBSG will require whatever the -- is to be under the
independent control of the voter.

MR. CHAIRMAN: Okay. So I guess the main change there is --

FEMALE: Yeah. They are there. I just wanted to point it out.

MR. CHAIRMAN: Because in the previous version is said, \"May require.\"
Or, \"May include\" for the version two.

FEMALE: Right. Okay. That\'s right.

MR. CHAIRMAN: This says will. I mean, it\'s a more definitive statement.

FEMALE: Yes. It\'s a more definitive statement, but it allows a broader
interpretation of what meets the possibility for version one with the
anticipation of narrowing it for version two.

MR. CHAIRMAN: Okay. So obviously there are a number of them like this in
different places that we noted yesterday.

FEMALE: Yes. And they have different wording.

FEMALE: Okay. Then on page 2-15 we have that same change to adding \"or
poll worker.\" We had a question about 1215 and 1216. Those two?

MALE: Yes.

FEMALE: Because when we looked at the nasad (phonetic sp.) bulletin,
those were unclear as well. I think what we\'re really trying to get at
and what we assumed from the discussion was that the voter should not
have full control of the knobs to try to adjust contrast and color.
That\'s just too confusing. What they need is to be able to select from
a small range. We were confused last night and tired, so this is not
reflected in the re-write here. But we will do that if there\'s no
disagreement.

FEMALE: So the plan as I understand is and for approval by us is to
broaden -- to actually more generalize this language to say that the
system shall allow the voter or poll worker to adjust the color and
contrast without specifying exactly how that\'s done.

FEMALE: Well, there\'s two ways to do it. We could be kind of vague
about it. But since there was so much confusion with the VSS 2002 and
the nasad (phonetic sp.) follow-up bulletin, it might be better to just
say that there is a range that the voter can select, voter or poll
worker can select from.

FEMALE: Yeah. We did some technical discussions last night about the
nasad guideline. It seems that there is a consensus that emerged after
that about allowing selections as a better option. So rather than carry
disputed and probably precluded, or superceded by research language
forward simply because it existed but not wanting to put in very
specific language that we haven\'t carefully crafted.

FEMALE: So I assume that there\'s no disagreement. We will reflect that
change when we do the final edits.

MR. CHAIRMAN: Would you please repeat the change again, just so that
there is a clear understanding on everybody\'s part, including me.

FEMALE: Okay. The current language reads that an accessible voting
station with a color-only electronic image display shall allow the voter
or poll worker to adjust the red, green, and blue components of the
foreground and background color. We will change that to wording that
will say in effect, sorry, without specifically wording it that it will
allow the voter or the poll worker to adjust the color contrast without
specifying that it\'s the red, green, or blue components.

MALE: (Indiscernible).

FEMALE: No. That\'s one five is the color contrast.

FEMALE: I\'m sorry. The color combinations. One states that --

MR. CHAIRMAN: Okay. One will say to be able to adjust the color
contrast. The other one will say the color combination.

FEMALE: One five is about contrast specifically. One six is about color.
What we\'d like to do is remove the -- Well, not just imply but written
discussion that the voter or the poll worker can adjust specific
elements. That is can do a three-way adjustment to \"can simply
adjust.\"

MALE: Just the color.

FEMALE: The color.

MALE: Got it. I think what we want to specifically allow is for a
selection of presentations that have been prepared to avoid the common
color contrast combination. Color blindness issues.

FEMALE: But also visual perception. Other --

MALE: Right. So a range of presentations should be allows. The poll
worker or voter can go through and select the one that they see the
best.

FEMALE: Right. But we don\'t want to go as specific as that in this
(Indiscernible).

FEMALE: So would we put that in the discussion then?

FEMALE: Yes. I think that\'s going in the discussion.

FEMALE: Feed sprays goes in the discussion.

FEMALE: Yes. Not in the guideline.

FEMALE: Okay.

FEMALE: I just fear creating language that will cause more problems than
it\'s intended to solve by doing it quickly.

FEMALE: Okay. So we\'ll clarify that in the discussion. I think that
makes sense.

MALE: Do you want the same thing for one five, the color contrast as
opposed to the black and white contrast? Or leave that as is?

FEMALE: One of the suggestions we had was to combine these and simply
say that -- Because when you look at vision issues, it\'s often both the
color and the contrast together that makes it possible for people to see
the screen.

MALE: Okay.

MALE: Yeah. I would concur with that. In the research we did preparing
the nasad bulletin, it appears that all the issues are satisfied by
presenting a pure black and white, high-contrast display. So that alone
satisfies the need that\'s trying to be addressed here.

MALE: Okay.

MR. CHAIRMAN: Okay. So let me see if I captured the spirit of this then.
We will combine these two and it will say, \"To provide the ability --
allow the voter or the poll worker to adjust contract and color to
provide best visibility.\" Or something to that effect.

FEMALE: Can I? Boy, I know time it tight, but I would love to just get
this drafted and then pass it quickly around the committee in the next
week just to put eyes on it from people who have been looking at this
issue in the field.

FEMALE: Well, we can edit it and e-mail it out to the TGDC list.

FEMALE: Yeah. I mean, I think we all understand what we\'re trying to
do, but the devil\'s going to be in the details of the wording.

FEMALE: (Indiscernible).

MR. CHAIRMAN: I would suggest that if we are going to have reviews after
this meeting, it\'s going to be on a very short fuse.

FEMALE: It will be on a very short fuse. And it will be just --

FEMALE: Minor edits.

MR. CHAIRMAN: The approach will be to send the e-mail and give you 48
hours or something to that effect. And whoever wants to comment on it is
fine. If we don\'t hear from you, we will assume concurrence. Because we
cannot wait for everybody, etc. Time is ticking.

MALE: Yeah. I think one thing that will probably be helpful in preparing
the language. If the three examples in the nasad bulletin that were
found to be acceptable are clearly allowable under the language that\'s
drafted, then I think we\'ve satisfied what\'s being sought after.

One of those is that as long as you provide a high-contrast, black and
white display, you\'ve satisfied the requirement. The second one is you
can provide a range of color and contrast combinations. The user can
select the one they see best. And the then the third is this. If someone
chooses to, they can provide knobs where they can \--

FEMALE: Twiddle. \[laughs\]

MALE: Twiddle. Yeah.

MR. CHAIRMAN: Okay. Next item.

FEMALE: Page 2-16, 21217, we added voting official to the list of
responsible entities. Page 2-17, that was the usability test change, and
we just added the discussion as we decided on.

MR. CHAIRMAN: Yeah. That\'s consistent with the previous change. So
let\'s go on.

FEMALE: 2-18, we added to 12223 the phrase \"or return to previous
contests.\"

MR. CHAIRMAN: Right.

FEMALE: Page 2-19.

FEMALE: This is another section where we\'re going to have to do a
little work on it, but the intent is to make both of these sections
conform to C63.19.

FEMALE: That\'s the intention. We put that in the comments bubbles on
the right. But given the time crunch --

MR. CHAIRMAN: So this is something we are going to handle afterwards?

FEMALE: Yes.

FEMALE: Yes.

MALE: There\'s actually -- I sent an e-mail to Allen a short while ago,
so he\'s got some suggested language (Indiscernible).

FEMALE: Okay. Great. Thanks.

MR. CHAIRMAN: Well, certainly. I mean, if we can -- I don\'t know if
it\'s doable. If we can do this today, we can --

FEMALE: If we can, that would be great.

FEMALE: Well, we don\'t have easy internet access. There\'s some
logistical problems to put that in.

FEMALE: Well, let\'s --

MR. CHAIRMAN: Okay. Let\'s go ahead.

FEMALE: Okay. 2-20 at the top.

MR. CHAIRMAN: That became a should.

FEMALE: That became a should.

MR. CHAIRMAN: Okay.

FEMALE: We fixed up the typo where the DB was missing the SPL
afterwards. We increased the audible speech range frequencies in 12237
to 10 kilohertz to reflect the range of speech.

Page 2-22, that was the usability test again. 2-23, we generalized 1.33
from (Indiscernible) to a more general phrase to now allow non-manual
input that is fully functionally equivalent to tactile input. And
reflected that in the discussion as well.

Okay. On 2-24, towards the bottom. 14223, there is a comment. We have to
harmonize the wording with the adad (phonetic sp.) guidelines. We did
not have time yesterday evening to do the research to do that editing.
We\'ll run it by the access board to make sure we\'ve done the proper
harmonization if that\'s acceptable.

Moving onto 2-27. 717, that became a should.

FEMALE: Uh-huh (affirmative).

FEMALE: Oh, what was it?

MALE: (Indiscernible).

FEMALE: Oh, yeah. There is a comment. Actually we got from the access
board a couple of days ago that we should make inches the primary
length. Metric in the diagrams to coincide with the phrasing of the
standard itself.

MALE: (Indiscernible).

MR. CHAIRMAN: I don\'t know if we can get this through the werb
(phonetic sp.) with the --

FEMALE: \[laughs\] There\'s a couple things that are against the werb
rules. \[laughs\] Our editorial review board (Indiscernible).

Let\'s see, 2-29, that was the summit of usability change again.

MR. CHAIRMAN: Let me get back to that for a minute. These charts have
both English and metric units. Are we saying \--?

FEMALE: Inches was the primary unit, so we\'re going to swap them.

MR. CHAIRMAN: So simply exchange the order?

FEMALE: That\'s the proposal.

MR. CHAIRMAN: Is that the idea? Okay. So both units will be there. Just
the order will be different.

FEMALE: Yes.

MR. CHAIRMAN: Okay.

FEMALE: 2-33, that was a usability change again. And we changed --
Let\'s see. We added instead of the voting process, the voting system
shall support a process.

FEMALE: Uh-huh (affirmative).

FEMALE: In 321 and 322.

FEMALE: Uh-huh (affirmative).

FEMALE: And also on the next page, the same change in 324.

FEMALE: Uh-huh (affirmative).

FEMALE: Let\'s see. At the bottom 733, we left this as a shall, because
let\'s see. Oh, because it\'s a higher level requirement. The
sub-requirements include both shalls and shoulds.

Let\'s see, we changed at the top of page 235, 331 to a should. We
deleted 332.

MALE: (Indiscernible).

FEMALE: Yeah. We just left it in and marked deleted because we didn\'t
want to mess up all the numbering, because then we couldn\'t trace back
to the document we saw yesterday.

MR. CHAIRMAN: The only recommendation I would make there is let\'s not
leave the text in there.

FEMALE: No. That\'s going to be deleted, but for today we just left it
in as a place holder so that we could keep the numbering and the paging
the same.

FEMALE: When you remove one of these the numbers all change, and we\'ll
never be able to keep track of where we were.

MR. CHAIRMAN: I understand that. But I just don\'t want the --

FEMALE: It will be deleted. Yes.

MR. CHAIRMAN: Okay.

MALE: I want to show what was being deleted.

FEMALE: The entire section. The entire clause is being deleted.

MR. CHAIRMAN: Yes. Okay.

FEMALE: Yes. If you look to the right, you\'ll see the entire clause
what it was originally. And we just kept enough so that we could
remember what it was we were deleting in line.

MR. CHAIRMAN: Okay. Page 36.

FEMALE: Well, there was system or related materials was --

MR. CHAIRMAN: Yeah. Those were just added.

FEMALE: Yeah. Those were. And then at the bottom, that was deleted.
Rewording 334. I think that\'s it.

FEMALE: Do I need to --

FEMALE: I think that\'s it.

FEMALE: Okay. I think the next process is for somebody, and I can do it,
to make a money to accept these edited sections.

MALE: I second.

MR. CHAIRMAN: Okay. Are there -- We have to do this formally.
\[laughter\] Are there any motions or requests for unanimous consent to
change the content of the human factors requirements for VBSG version
one that we have just reviewed? Are there any other changes? If not,
there being no further motions to change volume one, section 227, I will
now entertain a motion for the TGDC to adopt this draft of section 227
as part of the first set of recommendations -- Well, I should say adopt
this draft of section 227 with the noted changes as part of its first
set of recommendations to the executive director of the EAC. Subject to
change is expressed in any motions that we have adopted today that
express the applied to section 227, which changes shall be made pursuing
to TGDC resolution number 37-05. Do I hear a second?

MALE: Second.

MALE: Second.

MR. CHAIRMAN: Any further comments? If not, we\'ll take a roll call.

MR. GREEN: Voting on section 227, Williams?

WILLIAMS: Yes.

MR. GREEN: Williams votes yes. Berger?

BERGER: Yes.

MR. GREEN: Berger votes yes. Kraft?

KRAFT: Yes.

MR. GREEN: Kraft votes yes. Davidson?

DAVIDSON: Yes.

MR. GREEN: Davidson votes yes. Elekeys?

ELEKEYS: Yes.

MR. GREEN: Elekeys votes yes. Gannon?

GANNON: Yes.

MR. GREEN: Gannon votes yes. Harding?

HARDING: Yes.

MR. GREEN: Harding votes yes. Miller?

MILLER: Yes.

MR. GREEN: Miller votes yes. Purcell?

PERCEL: Yes.

MR. GREEN: Purcell votes yes. Quisonberry?

QUISONBERRY: Yes.

MR. GREEN: Quisonberry votes yes? Rivest?

RIVEST: Yes.

MR. GREEN: Rivest votes yes. Shutzer?

MR. CHAIRMAN: Um, he stepped out. We\'ll try to get him in a minute.

MR. GREEN: Samergian?

MR. CHAIRMAN: Yes.

MR. CHAIRMAN: Samergian votes yes. It\'s 12 voting and four. Two absent,
or three absent at the moment. The motion passes.

MR. CHAIRMAN: Thank you. At this time, I call on Mr. John Wack of
(Indiscernible) information technology laboratory to review the edited
sections of VBSG version one, section 6.0.1, overview of security
requirements.

WACK, J.: Good morning again. Okay. I don\'t think I really need slides
here. If it\'s okay with you, I\'ll just quickly go over what our
instructions were from yesterday and then go through the changes I made.

Okay, specifically I\'m talking about the security overview that started
on section 6.0.1.1. And that overview consisted of several sections
describing IDV systems. Then several more sections describing different
types of IDV systems. And then it went on to include core definitions
for IDV systems. And then it had other definitions for other types of
IDV systems.

Now, I believe the instructions were from yesterday to essentially keep
the overview for IDV systems and stop there. So that\'s what we did, and
we removed the remaining text in the overview that described different
types of IDV systems. And then we kept the core definitions for IDV
systems. And then we removed the remaining definitions for different
types of IDV systems.

So in the handout that we prepared for you, you see now that we have
roughly a short overview that has two sections. Section 6.011 and two
sub-sections, 1.1.1 and 1.1.2. And then we go directly to 6.0.1.2, which
are the core definitions for IDV systems. And we stop there.

I reviewed -- Barbara and I reviewed the overview for tone. We didn\'t
want to say things that implied anything about existing voting systems
as far as their security. And therefore, we removed the one section we
had up front that talked about the voting systems that produce single
records. And there was a footnote along with that as well that\'s out.

So that\'s it. Are there any questions?

MR. CHAIRMAN: Let me add something. We were talking about putting the
rest of the material in the appendix. And my suggestion to the staff was
that I did not want the appendix to be missing the part that was in the
main text. So that appendix, what goes into the appendix should be the
original material in its entirety. So if somebody simply looks at the
appendix, all the material is there so that this material that is in the
front, in the main body of the guidelines, is in the appendix as well as
the additional information.

MALE: And those sections (Indiscernible). Are you including that in the
appendix too?

MR. CHAIRMAN: That was my suggestion so that it is a complete text in
the appendix. So that it doesn\'t leave part of the discussion or part
of the preamble out. It is repeated. But if somebody simply looks at the
appendix, it will not be missing part of the information. It is
redundant, but it\'s better to repeat than to be missing.

MALE: Well, the part I\'m talking about is not redundant, because you
deleted it from the revised draft. I\'m talking about the one that says,
\"Problems in auditing single elected voting systems.\"

MR. CHAIRMAN: Well, I\'m assuming that what\'s going to be in the
appendix is this revised version of the preamble.

MALE: Okay.

MR. CHAIRMAN: And everything else that was there. So the two parts will
be consistent. The two sections will not say different things. The
appendix will have additional material, but the front part will be
consistent.

WACK, J.: In other words, the section that addressed single record
systems in the footnote will not be in the appendix.

MALE: Thank you.

WACK, J.: What will be in the appendix will be what I\'ve just described
to you is in the security overview as well as the remaining text on
different types of IDV systems and then the definitions for those.

MR. CHAIRMAN: Is that acceptable? Do we have any objections to that?
Okay. So any \-- Yes. Mr. (Indiscernible).

MALE: Yes. Just so that we\'re clear on which sections have been deleted
or extracted out of 6.0.1, could you quickly go through and just from
the version that we had from yesterday, just tell us exactly which
sections are being extracted?

WACK, J.: Okay. I\'m looking at page 6-4, section 60111 is removed,
problems in auditing single record voting systems. That\'s removed. That
also removes the footnote.

In 60112, we removed some text at the very end that described an
example. We didn\'t think that that text was really necessary in there
and it shortened the overview somewhat.

Okay, now turning to page 66, section 60113, example independent
verification systems. That section is gone. That section has been
removed. Okay, turning to -- Yes.

FEMALE: So, John. Is that removed and will appear in the appendix? I
think the question is removed and will appear -- Removed entirely versus
removed and will appear in the appendix.

WACK, J.: Removed from the overview. Will appear in the appendix.

MR. CHAIRMAN: Okay. But that\'s not for 1.1.1.

FEMALE: Right.

MR. CHAIRMAN: 1.1.1 is not going to be included anywhere. Is that
correct?

FEMALE: Right.

WACK, J.: That is correct.

MR. CHAIRMAN: Okay. So let\'s make that clear.

FEMALE: So is that the only subsant (phonetic sp.) of change to the text
that will appear anywhere in here that is -- It sounds to me like what
we\'ve done is split up the pieces. Decide some of it is abstracted into
the main document. Some of it goes into the appendix. But that 60111 is
removed entirely. Is that a clear statement?

WACK, J.: That is true.

MALE: Why don\'t we use the word deleted if it\'s -- Removed means moved
to the appendix.

WACK, J.: Deleted from the overview and deleted from the appendix as
well. I\'m sorry. \[laughs\]

MALE: So removed to the appendix. Deleted all together.

WACK, J.: All together. That\'s correct.

MR. CHAIRMAN: Does that answer your question (Indiscernible)?

MALE: (Indiscernible).

WACK, J.: Okay, starting on 66, section 60113, removed. Deleted from the
overview and moved to the appendix.

MALE: And all of its subtitles?

FEMALE: And all of its subs go with it?

WACK, J.: And all of the subtitles go with it that include and to and,
witness, and so on and so forth. Okay, now looking at page 6-11, section
60114. We kept that section in the overview. We shortened it a little.
There were a couple paragraphs at the end that seemed more commentary
than anything else that didn\'t need to be in there.

MALE: (Indiscernible).

WACK, J.: Those paragraphs are gone completely from all text. Deleted
all together. They will not appear anywhere.

FEMALE: So that\'s page 6-12 starting line 43?

WACK, J.: Line 43 all the way up to the end on page 6-13. Okay, 6-13,
section 6012 remains.

MR. CHAIRMAN: That\'s actually in the front now.

WACK, J.: That\'s in the overview.

MR. CHAIRMAN: As well as in the appendix. Right?

WACK, J.: That\'s correct.

MR. CHAIRMAN: Okay.

WACK, J.: In both areas. Okay, on 617, section 6013 and every section
thereafter, all the way up to VVPAT, those sections are removed from the
overview but are in the appendix. So that goes all the way up to page
630.

MR. CHAIRMAN: Okay.

WACK, J.: Okay, do we --

MR. CHAIRMAN: So any questions, comments on this section 601 that will
go into the main body? There is basically no new information, no new
text here. This is a shortened version of the front end of the report
from yesterday that we discussed.

MALE: Mr. Chairman?

MR. CHAIRMAN: Yes.

MALE: Just a general question. With all of these repositionings and
deletes, we will get fresh documents when it\'s all over so we can
delete and throw away and keep the latest?

MR. CHAIRMAN: I think -- I\'m just talking off the top of my head, but
obviously until we are truly finished with all the changes, we will keep
the numbering system so that there is no confusion since people will be
referring to them as they comment. But once we get through some of these
clarifications after this meeting, once that\'s done then we will create
a new document where the numbering will be done in a consistent manner.
And we\'ll make sure that all the committee members get a copy. Of
course, that will also be the text that will be sent to EAC.

MALE: Great. Thank you.

MR. CHAIRMAN: Are there any more motions or requests for unanimous
consent to change the content of the overview of security requirements
for VBSG version one that we\'ve just reviewed? There being no further
motions to change VBSG version one, volume one, section 601, I will now
entertain a motion for the TGDC to adopt this draft of section 6 --

**\[End of Audiotape 5 -- Side A\]**

MR. CHAIRMAN: \-- As part of its first set of recommendations to the
executive director of the EAC. Subject to change is expressed in any
motions we have adopted today that expressly apply to section 601, which
actually we don\'t have any at this point.

MALE: (Indiscernible).

MR. CHAIRMAN: Do I have a second?

MALE: (Indiscernible).

MR. CHAIRMAN: Okay. We have a motion. A second. Any further comments? If
not, we\'ll take a role call. Mr. Green.

MR. GREEN: This is section 6.01. Williams?

WILLIAMS: Yes.

MR. GREEN: Williams votes yes. Berger?

BERGER: Yes.

MR. GREEN: Berger votes yes. Kraft?

KRAFT: Yes.

MR. GREEN: Kraft votes yes. Davidson?

DAVIDSON: Yes.

MR. GREEN: Davidson votes yes. Elekeys?

ELEKEYS: Yes.

MR. GREEN: Elekeys votes yes. Gannon?

GANNON: Yes.

MR. GREEN: Gannon votes yes. Harding?

HARDING: Yes.

MR. GREEN: Harding votes yes. Miller?

MILLER: Yes.

MR. GREEN: Miller votes yes. Purcell?

PERCEL: Yes.

MR. GREEN: Purcell votes yes. Quisonberry?

QUISONBERRY: Yes.

MR. GREEN: Quisonberry votes yes? Rivest?

RIVEST: Yes.

MR. GREEN: Rivest votes yes. Shutzer?

SCHUTZER: Yes.

MR. GREEN: Shutzer votes yes. Samergian?

MR. CHAIRMAN: Yes.

MR. CHAIRMAN: Samergian votes yes. It\'s 13 votes in favor. The motion
passes.

MR. CHAIRMAN: Could we go back and record Dr. Shutzer\'s vote on the
previous section, 2.2.7? We did not receive your vote.

SCHUTZER: I vote yes.

MR. GREEN: Record reflects that Mr. Shutzer votes yes on section 227,
bringing that tally to 13 in favor.

MR. CHAIRMAN: Thank you very much.

WACK, J.: Okay, what I\'d like to do now is just simply pick up where we
left off with VVPAT, and I\'m hoping that we could fairly quickly go
through this section. You instructed us to do some edits and add a
little bit of text. And I\'m wondering if what we could do in the
interest of time go over those in the afternoon. Would that be
acceptable if we just pick up where we left off with the requirements,
and then we\'ll deal with any edits later on? No objections? Okay.

MR. CHAIRMAN: Okay. Let\'s just make sure that we know where we are.

MALE: I don\'t object, but I\'m not sure I understand what is proposed.

MR. CHAIRMAN: Okay. Yesterday we went through -- If you go back to your
binders, we had the section marked as VVPAT with the VVPAT tab, and we
covered through page 6-38. Okay. So now we will pick up from that point
on and review the rest of the material. And then come back, unless there
are major changes to be looked at now. We\'ll come back and look at the
edited version of this based on yesterdays\' discussion, and approve
that. But let\'s pick up -- Basically, is this section repeated in this
edited version or is that only for the first \--?

WACK, J.: Yes. It is repeated.

MR. CHAIRMAN: So, in fact then we can look at the version that\'s
distributed to you this morning rather than the one from yesterday. But
it is the same material, so it -- Is it the same page number? Let\'s
see.

WACK, J.: We would have preferred to do the same numbers. Microsoft word
started working non-deterministically.

MR. CHAIRMAN: The numbering is different, so now we\'re starting from
page 613. Is that correct?

WACK, J.: That is correct.

MR. CHAIRMAN: So now we\'re reviewing the section starting on page 6-13.
Section 6026. Okay. Why don\'t we go ahead.

WACK, J.: Okay. At the risk of maybe hurrying you along a little bit,
what I\'m just going to do is read off the requirement number. I\'ll
pause for a brief second. If you have anything, raise your hand or call
out. Otherwise, I\'ll just zip on through.

Okay, 60261.

MALE: Reading the comment down below, you say that the paper record
should contain information identifying the voting station. Now just as a
point of information, the Sequoia reel-to-reel system was approved by
nasad with the condition that that paper record not contain any
information that identified the voting station.

The reason for that being that if you can identify the voting station,
then you can use that information plus the order of voting to identify
individual\'s ballots. So the thinking was that if there was no
identification of the voting station. In other words, if you could not
identify a real of paper with a voting station, then you couldn\'t
identify a ballot with a voter. That\'s just for information.

WACK, J.: The suggestion is to -- Perhaps the requirement should read
\"shall be able to include information\" as opposed to shall include
information.

FEMALE: (Indiscernible).

WACK, J.: Oh. Nothing? Okay.

MALE: (Indiscernible) that system.

WACK, J.: Do you \--?

MALE: (Indiscernible).

MR. CHAIRMAN: Could you put your mike on please?

MALE: Based on what I heard it means to take out that particular
example, because that particular piece of information is apparently not
appropriate. But that doesn\'t mean there isn\'t other information you
might want to include in that record.

WACK, J.: Okay.

MALE: Well, here\'s something the committee can keep in mind as we go
through this. The current system that has been certified in California,
was certified by nasad on the condition that the paper records,
including the bar code on the paper record, not contain any identifier
of the individual voting station.

Now there are other systems coming on the market that use that same
reel-to-reel technology. And as we go through this, we have to keep in
mind what the impact of these guidelines are going to be on those types
of systems.

Now with a reel-to-reel system, obviously if you see somebody vote and
you walk over to that voting station and you record the voting station
I.D. and the public counter number, you can take those two pieces of
information. And if you can get your hands on the reel of paper off of
that voting station, you can identify that individual\'s ballot. That\'s
a violation of the standards.

So to avoid that, we put in the caveat that those reel-to-reel systems,
the paper record, could not contain any voting station identifier so
that you could not -- The fact that I knew that you were the fifth voter
on the voting station wouldn\'t do me any good if I couldn\'t identify
that reel of paper with that voting station.

FEMALE: So Brit, what you\'re saying is that when you decked a privacy
concern against -- I\'m sorry. I\'m going to use the word Paul, audit
ability concern. I\'m not sure what the right word is. That you decided
the privacy concern was paramount.

MALE: That\'s correct. Because almost every state has a law concerning
the secrecy of the ballot. Very few of them have laws about the audit
ability of a ballot.

MALE: I think the audit ability should be preserved here though because
the ballots will still have unique identifiers allowing you to
correspond with paper record on the reel with the electronic record that
corresponds. Right? Without having the voting system --

MALE: And Ron, I agree with you completely. And I personally would not
approve a system that I couldn\'t audit back to a ballot station. So
this is the catch 22 here see. This came up in a situation where
something had to be done, and that was what was done.

MALE: I don\'t think the audit ability is suffering actually on this.
The only thing you\'re missing is if you\'re discovering some problem
with the audit -- I\'m sorry Paul. With the correspondence checking
you\'re doing later to verify --

MALE: Shouldn\'t we say verify --

MALE: It is an audit ability issue because if the problem is identified
in the ballot in a reel paper and I can\'t identify that reel of paper
back to a voting station, that becomes an audit ability issue.

MALE: You have a question of being able to identify the machine that was
misbehaving. All right. But you won\'t be able to do if you don\'t have
the information on the ballot. But you will be able to tell if there\'s
a mismatch in the electronic and the paper records because they still
have cross-linking identifiers. And you can tell all of the votes that
were produces on a given machine or produced on a given reel because
they\'re all on the same reel, so that you\'ve got pretty good ability
to do whatever kind of evaluation you think you need to do to figure out
how to recover. It probably would mean the paper looks damaged somehow
or something. Trying to trust the electronic records in that case
instead.

But I think there\'s sufficient information here. I\'m actually
comfortable with John\'s suggestion to revise the wording to say \"shall
be able to include identification of the voting --\" Ah, let\'s see
here. Where does it say that? This is voting site and precinct. It\'s
not talking about machine here right? But you\'re saying, Brit, is they
shouldn\'t identify the machine. But this is actually not requiring that
right? It says voting site.

MALE: (Indiscernible).

MALE: Oh, I see.

MALE: So if you just change (Indiscernible).

MR. CHAIRMAN: I\'m not the expert here, but this is not a catch 22. The
reason we\'re getting into this situation is because you\'re keeping the
reel intact.

MALE: That (Indiscernible).

MR. CHAIRMAN: Well, I thought that was part of the issue. That if you
didn\'t keep the reel intact, then you wouldn\'t worry about the order.

FEMALE: Right. But I think Brit\'s point was that there are systems that
are proposing a reel-to-reel solution, and how do you put constraints
around them to protect ballot secrecy while preserving their
verifiability.

FEMALE: (Indiscernible).

MALE: I\'m not in love with our solution there. I\'m perfectly open to
suggestions if anybody could think of a better way to do that. But the
question is, how do you preserve secrecy of the ballot on a reel-to-reel
voting station?

FEMALE: (Indiscernible).

MR. CHAIRMAN: Yes (Indiscernible).

FEMALE: Yeah. I mean, I come from the country. And you look for
solutions. And you could even say after the -- The public number could
be covered after it was recorded early in the morning and then uncovered
after the voting so nobody could take and connect that number to the
number of person that voted. So I mean, you could do things like that so
it protects this person\'s right to vote. I mean, there\'s some things
you could do by rules.

MALE: Right. There\'s some procedural things you could do. But you
can\'t get around the fact that if I can somehow know the record the
order of voting on a voting station and then get hold of that roll of
paper, I can reconstruct everybody\'s ballot. And there are a lot of
ways to record the order of voting on a voting station. I just mentioned
the public count as an example. But a less dignified way would be for
some poll watcher to just sit there with a yellow tablet and write them
down.

MALE: Mr. Chair?

MR. CHAIRMAN: Yes. I think part of our problem here is we\'re trying to
solve someone else\'s problem. I think logically when you try to have
accountability in the system, you try to have a secret ballot, and you
try to have an automated reel-to-reel recount process, those three
notions are incompatible. And when you embrace that technology, you make
a decision to compromise some elements of one of those three.

Either you\'re going to cut the ballots up and get away from the
reel-to-reel. You\'re going to take the accountability I.D. off the
receipt. I\'m sure there\'s another option, but I think I\'ve made the
point.

I think we need to prescribe what the capabilities of the system should
be and let the jurisdiction buying these devices resolve how they\'re
going to handle the necessary compromises.

MR. CHAIRMAN: Well, I think that was -- I thought that was John\'s
recommendation basically so that the machine would have the capability
of providing that information, but it\'s up to the local jurisdiction
depending on how things are done to include or not to include that,
depending on other requirements. Is that a fair interpretation?

MALE: I don\'t know what John intended. I think that\'s the way the
issue needs to be addressed. Whether it takes us back to his original
recommendation or not.

MR. CHAIRMAN: Dr. Rivest, did you have a comment?

MALE: Yeah. I think that this section was primarily about the audit
ability. And so the notion here is to include the identifiers to allow
the electronic and paper --

MR. CHAIRMAN: To allow it.

MALE: Well, that\'s -- I think we\'re getting ahead of ourselves. But
include information about the election so that we can have verifiability
of these things. And Brit brings up a good point though that this
information could conceivably used if we have precise indication of the
machine as well to allow privacy.

So we get back into the other section, which talks about privacy of
(Indiscernible), which we\'ve already been by. That was section 6025.
But as Paul says, these things are butting up head on head here.

We have a high level statement of the sort of goal to preserve privacy,
which we previously talked about and (Indiscernible) upon. And then this
section, which talks about the identification information that needs to
be put in for verification. And I think that if we\'re precise about
what we\'re including here, we can try to -- We have a path that\'s
pretty clear. I think the ability -- Having requiring that the system
include which election it is, which polling site it is should be okay I
think. Other committee members can comment on that. Identifying the
machine is less valuable and probably should stand down in respect of
the privacy goal in general.

I think it\'s useful for determining what to do should a machine be
misbehaving, but that\'s a lesser goal than the privacy goals.

MALE: I don\'t think that identifying the machine is unimportant. Very
frankly, when you would actually be using these types of records would
be in the case where you found there was a discrepancy in the results
coming from a precinct. You had 15 more voters sign in than there were
ballots on the machines. And you want to go find out why. To be left
with solving that problem for a polling place with 12 machines and a
pile of 12 rolls of paper that you can\'t trace to any particular
machine. Those records are not --

MALE: You should identify (Indiscernible).

MALE: I think if you want accountability, then yeah. You\'ve got to have
machine identifiers on those records. That compromises voter secrecy.
And that\'s a fact. It\'s a problem we can\'t solve. And jurisdiction
such as California and Nevada are going to have to decide how they work
that out.

The machine has to have the capability with providing them with the
tools to administer their elections however they\'re going to do it
under state law.

FEMALE: I hate to introduce this documentation idea, but I always think
about clarity of communication. And I wonder since a lot of this
discussion has in fact circled around one specific design implementation
if maybe this should be called out as if you\'re using a reel-to-reel
time system, then things apply. Because that is really what we\'re
talking about. I hate to suggest structural changes at this point.

MALE: I think there\'s ways around it. You know, I mean if you didn\'t
have it down to the machine but you knew it was at a precinct level and
you had the right kind of diagnostics in the machine, you could probably
hunt down where the problem lied.

So I would say if you\'re not that prescriptive. If you\'re just
indicating the fact that you want to have a system devised that
preserves privacy, which is somewhat dependent upon the design of the
system whether it\'s a reel or not.

You also want to be able to have information in the electronic records
and the paper that could match things up and do an audit. And you would
leave that design and that test as more of a function performance test
to see to what degree the vendor comes up with a solution that can
accomplish those two objectives. We have those function requirements in
there. That\'s the way I would leave it rather than give this one
example versus another.

MR. CHAIRMAN: Well, would it help simply to put a statement that says in
the case of reel-to-reel systems, we caution -- Or caution should be e

MR. CHAIRMAN: Well, would it help simply to put a statement that says in
the case of reel-to-reel systems, we caution -- Or caution should be
exercised regarding privacy issues. Or something to that effect. That
basically raises a flag. That I mean, you may have to make a choice in
some case. Would that be right?

MALE: Yeah. All I\'ve done is bring up an example. The inherent problem
is that secrecy of the ballot great impedes audit ability. \[laughter\]
That\'s the dilemma of a voting system. That as long as we think secrecy
of the ballot is concerned, is the more important issue, we can\'t let
audit ability tromp secrecy.

And so if compromises have to be made, then the question is where do you
make the compromise? And I think the answer is in the audit ability, not
in the secrecy of the ballot.

MR. CHAIRMAN: But to me, I think this committee would be doing its job
as long as we point out these issues and say that, well, in this case.
And then we\'ll leave it up to the local jurisdictions to make those
choices depending on their particular situation. So --

MALE: We could solve a lot of problems we\'re dealing with if we could
deal away with the secrecy of the ballot. \[laughter\]

WACK, J.: Dr. Semerjian, could I propose a change --

FEMALE: I think that\'s a policy decision beyond this committee.

WACK, J.: Could I propose a change to one of the requirements then to
take care of that issue?

MR. CHAIRMAN: Okay. Which one are we talking about?

WACK, J.: Okay. I would like to propose a change to requirement 602621.

MR. CHAIRMAN: And that\'s at the bottom of -- line 38 of page 613. The
new 613.

WACK, J.: And I would like to propose that that say \"the voting station
shall be able to include.\"

MR. CHAIRMAN: Are you adding? You\'re adding a sentence?

WACK, J.: I\'m changing it just so there is the option to include the
information.

MR. CHAIRMAN: Changing what though?

WACK, J.: Well, I would like to change the whole sentence to something
difference.

MR. CHAIRMAN: Instead of the record shall include identification to the
voting sites/precinct?

WACK, J.: I would like it to read, \"The voting station shall be able to
include an identification of the voting site, precinct, and voting
system.\"

MR. CHAIRMAN: Could you repeat that again?

WACK, J.: The voting station shall be able to include an identification
of the voting site --

MR. CHAIRMAN: You got to go more slowly. My short hand is not that good.

WACK, J.: Oh, I\'m sorry. I had a couple triple espressos. The voting
station shall --

MR. CHAIRMAN: Shall or should?

WACK, J.: Shall be able to include an identification of the voting site
precinct and voting station. And a possibility would be in the
discussion field to note the purpose of this. I guess basically some
words to the effect of \"precincts may wish to include this information
or not depending on paper reels.\" Something along those effects. Would
that, Dr. Williams, would that be something you would advise?

MALE: I wish I could give you the magic solution. This is one of those
instances where I\'m really just identifying a problem that we have to
try to work around when unfortunately I don\'t think any of us have a
real neat solution to this.

I mean, we\'re dealing with the inherent conflict between secrecy and
audit ability.

MR. CHAIRMAN: I guess I\'m having a little bit of a problem here,
because maybe I\'m not looking at the right line. Because I don\'t see a
-- Are we talking about 262?

WACK, J.: 602621.

MALE: (Indiscernible).

MR. CHAIRMAN: Yeah. But that doesn\'t say put together a machine. Is
that what you mean by voting site?

WACK, J.: And voting station.

MALE: (Indiscernible).

MR. CHAIRMAN: Where does it say voting station?

WACK, J.: Well, I am adding that.

FEMALE: He is proposing to add voting station in the language but also
add a caution in the discussion about the implications of using that,
and that\'s why it\'s shall be able to but not shall include.

MALE: Also, I notice that there\'s isn\'t any leaf level requirement
that corresponds as saying what election it\'s for. I mean, I think the
high level one says about the election but it doesn\'t say what year or
which election it is or which state. We could add something along those
lines to instantiate the high level goal.

MALE: And (Indiscernible).

MALE: Yeah. There\'s privacy issues with date if you have multi-date
voting and there\'s only one person voting on a given day perhaps. But
--

MALE: (Indiscernible).

MALE: Even that, that would (Indiscernible) privacy (Indiscernible).

FEMALE: Microphone.

MALE: Most voting stations, all of them that are in what you call the
major group right now have the ability to protect the secrecy of the
voter. Once that ballot is cast, the only way that you would violate the
secrecy of the voter with the current voting system would be if some
extremely small number of people voted on a single voting station.

Obviously, if one person voted on a voting station, that\'s their
ballot. If two voted, you could toss a coin and be right 50 percent of
the time. And if as many as five voted, then you\'re getting into an
area where you\'re probably protecting the secrecy of the ballot.

So that\'s not an issue unless they just took this machine right back
out of service.

MALE: Well, what we\'ve got here is we\'ve got a chain of system design
events which now have frozen in place. I mean, when the people promoting
voter verifiable paper ballots started out, they wanted to print out the
voter\'s choices on a piece of paper and hand it to the voter. They
realized that wouldn\'t work.

Then someone came up with this concept of a ballot under glass. And the
issue was raised then protecting the secrecy of the ballot. And the
designs morphed into something where the paper tape would be cut after
the voter approved it and drop it in a box, which preserves secrecy.

And then a couple of states looking at the real difficult issues said,
\"Okay. If you\'re going to use those things for recount, how do you do
it?\" They came up with this concept of bar coding and doing a
reel-to-reel, which goes back and compromises the secrecy of the ballot.

I suspect that this evolution isn\'t over yet. But unfortunately, we do
have a snapshot in time of a design that\'s been deployed in some states
that those states plan to take into the 2006 elections. So, I don\'t
know how we solve it except that it remains yet to be solved. And
anything we can do to lay a groundwork for solving it, we need to do.

MALE: Well, that\'s why I say we might want not to be too prescriptive
except for the rights of discussion so people understand the complexity.
But essentially I think what we\'re saying is we don\'t necessarily have
the solution. We think it\'s going to evolve as you say over time. But
we can\'t indicate that.

There\'s a desire to do two things, preserve privacy and to be able to
audit and do all those things you can in terms of tracing back problems
and so forth. And that one has to be sacrificed over the other. The
audit ability gets sacrificed over the secrecy. And then we\'re looking
for solutions so we can evaluate those solutions as they come up. And
when those different solutions come up, we may find that one solves them
both better than another.

MR. CHAIRMAN: Let me suggest something and see if we agree on this. I
suggest that we change the language to read, \"The voting station shall
be able to include an identification of the particular election, voting
site, precinct, and voting station.\" Under discussion, I would add to
the sentence that\'s already there, \"Some of this information may have
to be excluded to protect voter privacy.\"

MALE: Right.

MALE: Yeah.

MR. CHAIRMAN: Does that capture the --

MALE: Right.

MALE: Because over time, we may see solutions. As Ron knows, you think
of some of the things that David Jom\'s (phonetic sp.) done in the
electronic money area. It\'s possible that some of those solutions could
be adapted to achieve both of these objectives. But to sit here now.
\[laughs\] (Indiscernible).

MALE: Yeah. People are working on that one.

MALE: In the guideline you say shall, but then over here you say you can
exclude some of them. So if you can exclude some of them shouldn\'t it
be should?

MR. CHAIRMAN: No. No. It says shall be able to include. The important
thing is the machine has to have that. And then you may have to make
some decisions locally.

MALE: Right.

MR. CHAIRMAN: Are we okay with that? All right. So we\'ll make that
change. Go ahead John.

WACK, J.: Okay. I have that noted. Okay. I would like to skip to then
requirement 60263. 60264. Next page 60265.

MR. CHAIRMAN: Slow down just a little bit.

WACK, J.: Yes.

MALE: I have a comment or question on 60265 and 602651. In the sentence
on 602651 where it talks about the export of a (Indiscernible) record
shall be on open not priortary (phonetic sp.) format and should
preferentially be in a format that is commonly used by electronic voting
system manufacturers. I\'m not sure today that the voting system
manufacturers are using a common format today. So it\'s almost in
contrast to what\'s in the discussion, which is suggesting to use a
standard format. But in fact the statement here is saying, \"Well, just
use whatever the manufacturers are using today.\" Which may not be an
open standard.

MALE: Why not just put a period after non-proprietary format.

MR. CHAIRMAN: I would recommend that.

WACK, J.: Okay. All right. I have that noted. Any other comments on leaf
requirements under 60265? And moving --

MALE: Let\'s back up to 63. I\'m sorry, 64. The voting station shall
generate and store a digital signature for each electronic record. What
--

MALE: Could you use the microphone please?

MALE: Oh, sorry. 60264, the voting station shall generate and store a
digital signature for each electronic record. What are we talking about,
and is that out there now?

WACK, J.: There we\'re talking about a digital signature for the
purposes of integrity and also for linking it back indirectly to the
voting system itself.

MALE: So you\'re going to hash out and store to memory a digital
signature on every ballot cast?

WACK, J.: That\'s right. As well as then on the entire set of records.

MALE: Let\'s talk about how you do that just a minute. Shallots are
stored as a bitmap. If on the ballot you\'ve got say 30 choices. You\'ve
got five elections with six candidates in each election. So you\'ve got
30 choices. What\'s stored is 30 bits. Their either on or off to
indicate those choices.

So you\'re not going to do a very sophisticated digital signature on a
30 bit word. What would you do with that Ron?

MALE: Certainly you can. You can do a sophisticated digital signature on
a one bit word. The point here is not secrecy. \[laughs\] The point is
integrity. So you want to have some indication that this is a record
that\'s -- And a media record identifier which makes it more unique than
just the one bit information. But you want something that gives you
integrity for that record. The point is integrity, not secrecy. Short
message links are not a problem.

MALE: I\'m trying to think how you compute digital signature records the
way they\'re stored now.

MALE: There are digital signature algorithms such as those that nistes
(phonetic sp.) is worked with and did fit all government standards. So
we had digital signature algorithms. These are our routine, state of the
art technology. It allows authentication of the message contents as well
as the message source. And the message length is not an issue on any of
these.

FEMALE: I was asking to clarify that bitmap has two meanings. You mean a
digital string of zeroes and ones, not a graphical image.

MALE: It doesn\'t matter for the purposes of the signature whether you
do a pixel map or a text or anything else. Yeah.

MALE: What\'s the purpose (Indiscernible).

MALE: The goal is to add integrity to the record. So if you have an
electronic record that\'s accompanied by a digital signature, that
record cannot be altered and preserve the validity of the signature
along the path of transmission. So it\'s to preserve that -- It\'s not
just a hash. It is a digital signature that requires a cryptographic
signing key and a separate public verification key.

MALE: I think it\'s no secret that I\'m not an advocate for voter
verifiable paper ballot. But I have to tell you that if you leave 60264
and this document as a shall, you won\'t have to worry about voter
verifiable paper ballot for probably six to ten years. \[laughter\]

MALE: Just concerned about the implementation. The difficulty of that.

MALE: Yeah.

MALE: I think the manufacturers are up to this if that\'s --

WACK, J.: Actually, there is one manufacture I did take a look at. The
only one that\'s certified right now. In their documentation, they say
they do include a digital signature in their bar code. I hold out that
they may not be using digital signature the way we\'re using it here.
They may be thinking of something a little bit different.

MALE: But they do (Indiscernible).

WACK, J.: They include it in the bar code.

MALE: We\'re moving to an area of clearly a more electronic information
storage, electronic transmission, and the use of digital signatures as a
way of maintaining integrity on this kind of information. It\'s clearly
a direction I think we want to be moving in. Not only here in the VVPAT
sections, but more broadly the communication between the various
components of the system.

MALE: Well, it\'s fine with me.

MALE: (Indiscernible). \[laughter\]

FEMALE: (Indiscernible).

MALE: Maybe they should and maybe they shall (Indiscernible).

MR. CHAIRMAN: I thought Paul agreed. So let\'s move on.

FEMALE: (Indiscernible) shall.

MR. CHAIRMAN: Yes.

WACK, J.: Okay. Moving on to -- Okay, I noted a change on 602651. Are
there any remaining changes on those leaf requirements there? Okay.
Moving then onto 60266. 67. 60268. 69. And any of the leaf requirements
under 69. And then 610. Okay. Very good. Then we\'re on to the last
requirement on page 619.

Okay. And then 60271. And any of the leaf requirements under 60271.

MALE: I have a question on 712. What\'s the purpose of the last phrase,
\"as specified by local law?\"

WACK, J.: Well, to be honest, it may be a clumsy bit of words there. If
access needs to be provided to a poll worker to an election official,
then it has to be provided. And I don\'t want to make a requirement that
says you can\'t -- I guess basically what I\'m trying to say is it shall
remain a secure, sealed container. Actually, I\'m not real good at
rewording this right now. I suspect that is probably something that
should say something alone the lines of a should statement. This should
remain sealed. Or access should not be provided unless required by a
poll worker or election official.

MALE: Let me ask, do we lose anything if we just put a period after
election official?

WACK, J.: Okay. Looks good.

MR. CHAIRMAN: I guess the word authorized sort of implies that you are
authorized by law. So, yeah. I think that\'s fine with me. Is that okay?

WACK, J.: Okay. Very good.

MALE: Um, I\'ve got a problem with 60271 in total. I mean, this is very
much a restriction in design. It provides that the voting station shall
communicate with its printers over a standard publicly documented
printer port using a standard communication protocol. That tends to
imply that the printer is to be separate from the voting station and
that vendors would be precluded from building printers into their voting
stations.

That whole thing carries through back in further on there\'s a
requirement that the printer not be able to do various networking and
communication functions. Well, what is the printer? Is it simply a print
engine and print head module in a case? Or is the vision that we are
going to restrict printers to being separate components that connect to
a voting station?

WACK, J.: I can tell you the background behind that. First of all, even
though the printer could print in some of the units now, could look like
it\'s integrated into the machine, it could still have an internal port,
a USB or whatever.

The other thing is that a lot of printers these days have amazing
networking capabilities. Telenet (phonetic sp.), FTP servers, and other
things. And the philosophy here was basically to ensure that the printer
is just a printer and does not have any additional networking or
anything else that could be enabled somehow. So it\'s just basically
saying we want this to be a printer and nothing but a printer.

MALE: (Indiscernible).

MALE: (Indiscernible).

MALE: I said and yet a separate component.

WACK, J.: Well, again going back to the one that\'s certified. It can be
removed. In fact, if there\'s a problem with the paper it has to be
removed and then a new module has to be put on. So it\'s integrated but
at the same time it is a separate component.

MALE: So we\'ve got basically a technology now that has evolved by
cobbling these two separate devices together running wire between them.
And we\'re starming (phonetic sp.) our standard in such a way that
they\'re going to stay that way rather than evolving into more elegant,
integrated products.

MALE: John. Let me tell you. You talk about the one that\'s certified
now. You\'re referring to the Sequoia? The way that came about is that
the Sequoia edge did not have a build-in printer. They plug a printer
into the back to print results on. So when they wanted to put the
verifiable printer on it, they used that port. So it\'s like Paul said.
This came about because of things in place, not because it\'s
necessarily good design. And I don\'t think we want to perpetrate that.

I don\'t see any problem with the printer being integrally built into
the device as opposed to connected via port.

FEMALE: Well, but I think the point you\'re trying to make John is
however the printing function is integrated into the station that the
connection -- That it shouldn\'t be able to talk to anything outside of
that station. Is that fair?

WACK, J.: Well, that as well as --

FEMALE: Let me just say that more clearly. Instead of implying that
it\'s a separate physical device.

WACK, J.: There\'s also the other factor that printers fail. And we want
basically a printer to be able to be replaced.

FEMALE: I\'m just suggesting that we change the wording to instead of to
imply that it\'s a printing device that\'s somehow separate, however
well-enclosed it might be, that we broaden it to say the printing
component or the printing function or whatever the right technical word
would be. Because I think you could build the thing completely into the
system and nonetheless have a communication protocol to talk to it. And
that\'s what you want to avoid.

WACK, J.: Okay. I\'m sorry. Could you point to the -- If you could point
to the specific requirement where you\'re recommending the language --

FEMALE: Well, just for an example. In 2711, it says, \"the voting
station shall communicate with its printers over a standard publicly
port.\" And I think the point that they\'re trying to make is that that
could be a piece of hardware that\'s built into the station and isn\'t
using an external printer port. But that nonetheless you still want it
to communicate in a very tightly bound way.

MALE: I really don\'t (Indiscernible) paragraph is necessary. I think
that your main ones are one three and one four.

FEMALE: Uh-huh (affirmative).

MR. CHAIRMAN: Your mike please.

FEMALE: Mike.

MR. CHAIRMAN: Microphone.

MALE: Oh, okay. What I was saying is I really don\'t think 711 is
germane. I think that the ones that give you what you want are one two,
one three, and one four.

MR. CHAIRMAN: I\'m not sure that I agree with that. Here, this is partly
associated with the testability. I mean, you want to make sure that
there aren\'t some unusual configurations that cannot be tested
otherwise.

MALE: The only way you\'d get that would be if the vendor decided to
manufacture some off-brand printer. Because they\'re going to go out and
buy a commercial printers. They\'re going to have standard ports and all
on them.

FEMALE: It (Indiscernible).

MALE: They may just wire it into their machine through their own
connection.

MR. CHAIRMAN: Would it solve this problem if we said at the beginning of
that \"a separate printer is used as part of the system\" or something
like that? Would that solve the problem? Is that -- Because clearly if
it\'s an integral part of the station, then this may not apply. Does
that solve the problem?

MALE: It depends on what the problem is you\'re trying to solve. One of
the -- Some of the voting system vendors I\'ve heard have proposed
systems that try to monitor the printer port for auditing purposes and
so on. There\'s some kind of tap. Maybe for accessibility reasons even.
And so I don\'t know if the intent here John was to in part make that
available for those kinds of purposes or whether -- Which would be one
goal, which wasn\'t mentioned before. It may not be the goal that\'s
intended here. The other one would be to enable the replacement of
printers with other standard printers.

I guess the high-level question is what\'s the main purpose for this?

MALE: Well, let me ask you a question. Ron, you and John appear all --
The availability of a standard port would enable external devices like
you\'re talking about in some of your alternative designs. So maybe what
we want to do is require the existence of a standard port. Now whether
the vendor attaches his particular printer to it or not -- Is that
important to us? But I can see the importance of the availability of a
standard printer port.

MALE: Yeah, that makes sense to me.

MR. CHAIRMAN: What is the proposed change?

MALE: The following (Indiscernible) language. John, I don\'t know if you
have any comments on this, but the (Indiscernible) shall --

MR. CHAIRMAN: Hello. Ah, one of the folks on the phone, we\'re hearing
some noise. Thank you.

MALE: What if you just said it shall provide a standard public
documented port.

MALE: I\'m happy with that.

WACK, J.: The voting station shall provide a standard publicly
documented printer port.

MALE: Yes.

WACK, J.: Using a standard communication protocol. Okay.

MALE: I\'m sorry. Did you just say a standard printer port? I thought we
were dropping the word printer.

WACK, J.: Oh, let\'s drop the -- Yeah. Right. Okay. The voting station
shall provide a standard publicly documented port using a standard
communication protocol.

MR. CHAIRMAN: For what?

MALE: To communicate with its printers? Is that --

MALE: Do you want to be that vague?

MALE: Why not leave it there?

MALE: Because you\'ve got parallel ports on all these things now,
because that\'s where they plug in most of the accessibility devices.

WACK, J.: So it seems as if we want to say that for the purposes of
connecting a printer we want this requirement.

MALE: Yes.

WACK, J.: So, \--

MR. CHAIRMAN: Okay. So what is the wording?

WACK, J.: I would --

**\[END OF AUDIOTAPE 5\]**

MALE: \-- the word printer out of that line there, Mike, so.

MR. CHAIRMAN: Yeah, but then we need to say what it is for, so.

MALE: Well, it says, if we read the original statement 6.0.2.7.1.1, "The
voting system shall communicate with its printers over a standard
perfectly documented port using a standard communication protocol." Is
that?

MALE: It's a little different since you're not necessarily making it
available if it's internally bound inside and you've got a USB port
internal. So if \-- if the goal here is to make it printer \-- port \--
port and printer \-- the printing output available externally, then I
think Brett had some good language earlier on. It was, "voting station
shall"....

MALE: (indiscernible)

MALE: Yeah, printer port or equivalent, I think. I think that would be
language, so. "Voting station shall provide a standard
publicly-documented printer port or the equivalent using an
equivalent"....

MALE: (indiscernible) verification. (indiscernible) verification to find
a USB port to be a standard documented printer port. That's what they're
used for now.

MR. CHAIRMAN: Okay, so it \-- it reads: "The voting station shall
provide a standard publicly documented printer port (indiscernible) or
the equivalent using a standard communication protocol." Is that the
language?

MALE: I have that noted.

MALE: Yes.

MR. CHAIRMAN: Okay. Are we all okay with that? Thank you.

MALE: Okay.

MR. CHAIRMAN: We already covered the next one.

MALE: Mr. Chairman?

MR. CHAIRMAN: Yes? Sorry.

MALE: Just because we'll be doing this for years to come, perhaps if we
have a real-time editor available to us, that may facilitate our \-- our
thinking quicker in the future. And then it can be up on the wall and
then all of us are on the same page as opposed to cognitively following
each other's thinking.

MR. CHAIRMAN: You mean you're having trouble reading our mind?

MALE: I guess. \[laughter\]

FEMALE: Now, that would be a real danger to ballot seekers.

MALE: That would violate voter privacy.

MALE: Yes, duly noted.

MALE: Okay, I would like to move on then to 620, page 620, requirement
6.0.2.7.2.

MALE: Question.

MR. CHAIRMAN: Yes?

MALE: Back on 6.0.2.7.1.4. The statement that it cannot spool
information. That seems to be counter to (indiscernible) that most
modern printers are spooling information.

MALE: We \-- we \-- you \-- you have a point, and \-- and really, the
idea behind that is that we wanted this to be a dumb printer, as dumb as
possible so that it was verifiable \-- verifiably easy to determine that
it is just a printer and contains nothing else. But I \-- I \-- I get
your point. Most printers to have that capability. But that's also a
capability provided in the operating system as well, and it \-- it \--
we're not saying that you can't spool information to the printer, it's
just that the printer itself \-- we would prefer it not have memory on
board and things of that nature, just a printer.

MALE: Getting harder to find.

MALE: Yeah, I mean, I think in terms, especially with modern printers
even now to the point where they're accepting markup language,
(indiscernible), things like this where there are proposals for using,
you know, markup language, for being able to communicate from the DREs
to the printers. We may be actually getting in the way of progress here.

MALE: There are concerns about those kinds of printers. I mean, you have
a highly complex printer language that you're (indiscernible) off to the
printer. The security, you know, you have to in principle at least,
worry about the security of the printer. Has it been programmed to
(indiscernible) with the votes somehow? So.

MALE: As I understand printer operation, unless you have some memory and
spooling capability in the printer, your CPU then becomes dependent on
the printer function before it can resume process. Basically, wind up
like we did in the old days \-- you're hung up while the printer catches
up your CPU.

MALE: CPU can manage \-- I'm \-- maybe I should defer this discussion
and remove that language, I think, re my proposal, but I think Paul,
that statement, just for the record, modern CPU can do multitasking and
manage the printer as well as something else, but I think that having a
printer that can spool information at the minimum should be allowed. I
think that's a good catch there and I would recommend that we just
delete the language about spooling information.

MALE: So change that to delete spool information or?

MALE: Okay. I'm sorry, I didn't get that, so could you \-- from the
semicolon on, could you read how that should go?

MALE: It cannot contain any services or any other \-- other services.

MALE: Okay, are you also saying (indiscernible)?

MALE: (indiscernible) the word spool information or.

MALE: Okay. Great. I have that noted. Okay. Thank you. Are there any
other remaining on that \-- on that page?

MALE: Down there.

MALE: (indiscernible)

MALE: Microphone. Microphone.

MALE: What does 7.2 do that 7.1.1 that's revised doesn't do?

MALE: Well, looking at it right now, I think it doesn't do anything else
that early requirement does do. You are right.

MALE: I like the wording of that better than I do 7.1.1.

MALE: I think when we put in 7.2.1, perhaps we're getting too design
specific here. I think \-- our thought there was that if you had to
connect another printer, you know, you could do it. If \-- if \-- this
was really more a reliability issue if you had to connect another
printer because your existing printer didn't work. You have that
capability, but. I could be argued out of that.

MALE: That \-- that's not gonna do you any good unless the voting
station is \-- is programmed to divert to that second port and I'm not
sure you want that capability in there, either.

MALE: Well, first off, I don't think you want to experience a printer
failure in a precinct and have your precinct worker doing R&R of parts
on your voting equipment.

FEMALE: \[laughing\]

MALE: I mean, if \-- if the unit fails, they're going to set it aside
and perhaps have another unit brought in from a backup supply. You're
not going to start taking equipment apart and putting it back together
again on election day. That ain't real.

MALE: No, that's an election management issue. That's really poor
election management to start trying to repair equipment in the precinct.

MALE: But not to argue again, it's a should requirement in \-- in the
ideas that, in general, a voting system should be \-- be configured such
that if you \-- you could connect just a commercial. It's just a nice
thing to be able to connect a commercial off-the-shelf printer as
opposed to a highly specialized printer. And that's not a shall.

MALE: I should probably draw up this. So basically we now have specified
antique printers of extremely high reliability. \[laughter\]

MALE: Well, I think we have a should here which \-- which, you know,
could be ignored. Seemed to be same as the previous one. No, the
previous one was a shall, however. So there's \-- there's \-- with a
change to 7.1.1, we had shall; now we have a should. I think we should
drop at least one of these.

MALE: Let's drop the should.

MALE: Drop the should?

MALE: Okay.

MALE: Should.

MALE: Okay, so we're deleting 6.0.2.7.2.1. Okay. Moving on to the next
page, 621. Are there any comments on any of the requirements on page
621?

MALE: Ed, I have a comment on 7.2.4 and the same thought will extend
over on the next page, but given the use scenario for these printers
which is different from what we've had heretofore, that is, hundreds of
them have to operate for long periods of time and if they don't, they
potentially disrupt the flow of an election or even potentially stop it
in a given precinct. I really think this needs to be tested \-- testable
which means there need to be numbers that represent that. I think,
clearly, that many printer technologies will not be usable in this use
scenario without creating a lot of service problems. So. I'm not sure
today what that number outta be, but I think we can come up with it in a
reasonably short time.

MALE: Okay, I have to take extreme exception to 2.7.2.2. in view of what
has just passed because we want an antique, highly-reliable printer
which will be a separate module from the voting station which now must
enable the voting station to detect errors and malfunctions such as
paper jams, low supply of supply of paper and ink. Guys, I don't think
it's out there. And once again, I'm \-- I'm not an advocate of these
devices, but I \-- I think you're making it impossible to field them.
And if our \-- if our intention in this is to support those states that
have decided to adopt this by giving them a standard for how these
devices should be created, I'm not sure we're doing it.

MALE: If I can comment on 7.2.2, I think the intent there is clear and
it's something you have to be concerned about when you're using
printers, if you're using printers which isn't performing its function,
then the voting station should know about that and I think this is a
high priority item on our list here, I think.

MALE: Okay.

MALE: In a previous item. I don't \-- I don't remember precisely where,
but we \-- we have a requirement previously that says that if \-- if for
whatever reason, the paper ballot will not print, the voting station is
to suspend operation and allow the cancellation of both the paper and
the electronic. Doesn't that take care of what you're trying to do here?
Well, this is basically what you're saying is that if \-- that if for
some reason the printer doesn't print, and we've already addressed that
in a previous \-- John, you're more familiar with this. You can probably
put your hand faster on it than I can.

MALE: Yeah. I know what you're talking about.

MALE: So this is really a function of the overall voting station. And I
think we've addressed that previously.

FEMALE: You know, I just wanna state a concern. And I will admit that a
lot of this is way above my head. But I am concerned that we are putting
requirements in that the equipment that has been certified up to now
that a lot of states will be buying cannot meet. And if we are putting
that kind of requirements in, we cannot meet the 2006 with the states
that have to meet the 2006 with the paper verification. What kind of a
situation are we putting these states in?

MR. CHAIRMAN: Are we saying that currently installed equipment cannot
meet or the technology is not \-- cannot meet?

MALE: (indiscernible) current.

MALE: Microphone.

FEMALE: Microphone.

MALE: Yeah.

FEMALE: Can you repeat that, Brett?

MALE: The currently \-- the currently certified \-- qualified systems
can't meet.

MALE: Well, my \-- the individuals I worked with at NIST on the printer
parts of this standard aren't in the audience. They \-- they did conduct
research with voting system vendors and actually, there is one person in
the audience right now who did work with me. They did conduct research
with some vendor equipment and felt confident about these requirements.

FEMALE: John, is that feeling comfortable with these requirements in the
future after \-- I mean, like we said, once these are done, it'll take
12 months for the vendors to be able to meet a lot of the requirements
that we're putting here, or are they already meeting them? That's my
concern. I mean, it even goes back to the one we passed a while ago,
6.0.2.6.4. I'm not sure that that's being done right now, and that's
really a concern of mine. I \-- I mean, I think that you're putting some
of the states in a possibility of looking at lawsuits by saying they
want paper verification.

MALE: There's a difference, John, between an existence and an
availability. When you say that there exists voting stations that can
meet all of these, the one we're using in Georgia does not meet that 6
\-- 2.7.1.1. It does not have an available external printer port on it.
And that's the leading DRE in the marketplace right now.

FEMALE: Well, we do have one \-- one option which is to \-- to make
these shoulds with the same provision we did in accessibility, that
we'll be look at them as (indiscernible) requirements later.

MALE: But I \-- I agree with you.

FEMALE: I hear, John, that what you're saying is that this is good
practice and the question I think that Secretary Davidson is wrestling
with is whether it's practice that we can implement now, but I think we
had the same battle, you know, the same conundrum in accessibility,
which is how do we point forward to good practice so that as people
evaluate systems, they can choose the systems that meet more of the best
practices.

MALE: Well, I \-- I understand and I won't argue. We were charged with
coming up with requirements which, you know, required us to do research,
basically. Some of the requirements \-- I can't get into specifics right
off the top of my head \-- are actually in some inactive state
legislation, some of the printer reliability requirements. We \-- we
took a look at what was out there. These were available for review as
well, and we didn't, to my recollection, get comments specifically on
these sorts of requirements. So I feel as if we did our research and
we'd stand by it.

MALE: Right. John, having said that you did your research, that doesn't
preclude a state from raising the bar and keeping it as a should and
indicating the shall the coming that's putting everyone on notice, but
it's not telling the state that they can't continue to do what they're
doing.

MALE: And, John, basically, I mean, this is overall very good work
product. I think y'all have done good research. These are things that
really should be there if you're gonna have voter-verifiable paper audit
trails. I'm just concerned that I don't think we really know what effect
this is going to have on the systems that Nevada and California are
currently planning to rely on for the January \-- or the 2006 elections.
And I think perhaps we need to determine what that will be. One thing we
could do, I think we have engineers from the companies in the audience.
We could perhaps on the break which is now 'bout 20 minutes past due,
see if the \-- the two companies that are particularly affected, see
this as being something they can meet or that they already do meet.

MR. CHAIRMAN: For the break, I'll make a statement and then maybe we can
ponder this. I don't think we are here to basically approve the
operations of currently available equipment. If that's all we're here
for, then we're wasting everybody's time. We are here to set minimum
requirements to established trust and confidence in voting systems. If
there are equipment out there that may have been purchased by certain
states that don't meet those criteria, I don't think it is our function
to basically approve their operati \-- continuing operations. I will not
go any further. I will just stop there and let's think about that
whether you agree with that statement or not and at this point, I'll \--
I suggest that we break for \-- until 10 after 10 \-- I mean 10 after
11. And then we can continue with this discussion. Thank you.

MR. CHAIRMAN: John, could you set up (indiscernible)? Are we on page
6-21, item 6.0.2.7.2.2? Is that?

MALE: That is correct.

MALE: Mr. Chairman, you challenged us to think about it during the break
and come back to discuss it. Before John continues, I'd like to make a
statement, if I may.

MR. CHAIRMAN: Please.

MALE: Okay.

In consultation with the engineers here from ES&S, Sequoia Pacific, and
Diebold, all three gentlemen agree that number one, the goals for
functionality and security and reliability that we've put into this
standard are quite desirable. They all agree that the functions that
we're calling for are doable. They are very concerned, though, that the
functions that we're calling for with the design limitations that we're
putting on the solutions are not doable. I think that needs to be
addressed very short order. I don't know if it's a product that we can
do as a committee.

We need to come back, though, to the basic premise of non-restrictive
design. Things such as \-- probably one of the best examples is the
printer restriction on what printers can do. If you want a printer that
can print in multiple languages and different-sized fonts, that becomes
a fairly sophisticated printer. If you also want a printer that,
perhaps, can process and export part of the data coming into it in an
audio file to start dealing with some of the accessibility issues once
again. That's almost a freestanding computer in and of itself. Some of
the security issues and the maintenance issues can be better addressed
if we weren't restricting printers to be separate freestanding articles.
I think we need to concentrate on the function requirements, the
security requirements that we want and then leave design elements open
to the creativity of the people who have to meet those requirements.

MR. CHAIRMAN: Well, certainly that's in the spirit of what we're trying
to do in terms of performance-based standards. Of course, in some cases,
to set performance standards, you need benchmarking, you need some
research and some data, some of which is not currently available. In
those cases, I thought we were trying to set some design specifications
with the understanding that the next step would be to migrate towards
performance-based standards. Certainly, that is the desire and the
intention of this committee. Secretary Davidson.

FEMALE: I think you've hit on something that is very key. I mean,
obviously, with the legislation that came about with HAVA and the
deadlines that was put into place, we obviously are way behind our
deadlines, not due to problems of what we're setting today, I mean, it's
not because of NIST or anybody else. I don't want to point fingers
there. But even the legislature themselves, the \-- the Congress and the
president in appointing the EAC directors, everybody was slow in getting
things done.

But they have not moved our date for, you know, making sure we meet our
requirements. And, so it's put this group and all elected officials in
this nation under a very delicate situation where we have legislators in
our own states that's mandating laws and so we're balancing. We have a
law in place that we have to meet the standards. We also have to meet
the HAVA deadline, and we also have to have paper verification by state
law. That's my concern. And when we did the human factors, we looked at
last November when we put out these two. It's \-- it shall say "shall".
Because at that time frame, it should say shall. But my concern is, part
of it should be \-- should be should because I don't think we can meet
those time frames in certain aspects of this.

MALE: I'd just like to make an observation. I think it's the same thing
we've been facing all along is that we have this complexity of solutions
and the fact that there's nothing's ever gonna be perfect. You can have
an intelligent printer that's programmable and you can then provide all
kinds of safeguards we're talking about for processors and procedures
and probably make the thing work. And frankly, as you move forward in
the future, if you had a programmable printer, then you probably have
your dual verifiable approach because you can build a lot of that stuff
in to the printer and you can have the actual records into the separate
machines verifiable with everything you want. You don't have that today,
but ultimately, I bet that's the way it may evolve, so, I would say,
yeah, keep the performance-based stuff talked about \-- maybe we'll have
to talk about how, in testing, you have to do compensating controls. We
were talking about that at one point, you know, where if something's
programmable, has software, has memory, has spools, there's different
kinds of tests and procedures you have to do, just like they're doing
right now in the practice of the districts. I think they need that kind
of guidance, though, as to how to do it and best practices in that area.

MR. CHAIRMAN: If I may add to this discussion, I had a little bit of a
discussion with Miss Paquette (phonetic sp.), the Executive Director of
the ACU (phonetic sp.) and I think there are different, I mean, in our
deliberations, we are concerned about the phasing issues, you know, the
transition issues and perhaps that's not only our responsibility, but
it's the EAC and other state legislatures, you know, election officials,
et cetera because these are, after all, voluntary standards and it's up
to EAC and it's up to local election officials and legislatures to
decide when they become mandatory for particular jurisdictions and they
can, at that time, take into account how much of this can be
accomplished within a given time frame, et cetera, so perhaps we're
trying to take on too much of the burden of the transition issues that,
in fact, our responsibility is to set the standards for the features and
the performance requirements that are needed and then let that \-- let
others decide when these can actually be implemented.

Dr. Schutzer?

MALE: No, but I was suggesting that you may not wanna specify a
memoryless programmableless printer. You may, in fact, want to allow
that but provide sufficient guidance in how to test that, which gets
involved all the things that the (indiscernible) group for the
processors and the programs you're gonna have to spec the source code,
make sure it hasn't changed or that kind of thing, but it can be done.

MALE: Mr. Chairman, I must respectfully disagree, in part, with your
statement, and I think it's important that we differentiate your role as
Director of NIST from your role as Chairman of this committee. I agree
that NIST is tasked with providing technical expertise and developing
standards, and NIST has no role in assisting either the EAC or states
and local governments with the issues of transition. However, the
Technical Guidelines Development Committee as a body, is expected to
give recommendations to the EAC, not only on standards based on our work
with NIST, but I think that it extends to issues such as transition. As
been said many times, there are number of jurisdictions waiting for
guidance to come out of this group as to how they're going to comply
with HAVA, how they're going to spend their HAVA dollars, and I don't
think it's inappropriate for this group to give the EAC a recommendation
on how to best do that.

MALE: John \-- I would take that a step further and say that it's not
only \-- not inappropriate; it's almost mandatory. I can quantify that
for you a little bit. There are over 48 million people in this country
today that \-- that vote on punch card and lever voting machines. They
have been directed by HAVA that they've got to do something about that.
That's 615 jurisdictions. Those are the people that are looking to us
for guidance. Right now, not something that might be available 6 years
from now, but they want to know of the technology that is available to
us right now. Are there any safe harbors? Are there ways that we can go
that would \-- that will get us through whatever comes up next? And I
think that we're remiss in our duties if we do not provide some guidance
to those 615 jurisdictions that represent 45 million Americans,
registered-voter Americans.

MALE: Mr. Chairman, that's, I think, the essential component to this
equation is how do we move those voting precincts forward as well as
setting the standards in a visionary kind of fashion. I think that's the
heart of our mission before next week.

MR. CHAIRMAN: Thank you.

Miss Paquette, would you like to make a comment?

FEMALE: Thank you.

MALE: It's on now.

FEMALE: \[laughing\] Okay. Mr. Chairman and members of the TGDC, I would
simply like to observe that the EAC is looking for advice and guidance
from the TGDC. We cannot make decisions about transition effective dates
for the standards. These issues that we're all wrestling with, the EAC
needs the advice of this body, we'll certainly be looking for the advice
from our board of advisors and our standards board, so we certainly
welcome any input that the TGDC would like to make to this very
important set of decisions that the EAC is going to have to deal with.
Thank you.

MR. CHAIRMAN: Thank you, Miss Paquette.

Having heard those statements, shall we proceed with the remaining of
this so that we can then come to some closure? I think we need to
complete the review and then we may have some additional discussion. But
obviously, the recommendation we make we'll keep that \-- those
statements in mind.

We were on 2.7.2.2? What \-- where are we on that, John?

MALE: We are on 2.7.2.2. There's been some debate about this. I think
where we left off is some debate about whether that should be a shall or
a should.

FEMALE: (indiscernible)

MALE: 6.0.2.7.2.2, page 621. I'll just note that thermal printers do not
use ink. They \-- they can run out of paper. I'm not entirely positive
if all thermal printers used by voting system vendors are capable of
telling the voting station that they have run out of paper, although it
can be done. With other VVPAT systems that use standard off-the-shelf
printers, those are certainly capable of telling the operating system
that they're low on ink or out of paper.

MR. CHAIRMAN: So is the issue strictly a matter of whether it should be
a shall or a should? Is there a proposal to?

MALE: (indiscernible)

MR. CHAIRMAN: Any objection? Change that to should, then.

MALE: Okay. Okay. Very good.

MR. CHAIRMAN: 7.2.3?

MALE: Expedite this, Mr. Chairman?

MR. CHAIRMAN: Could you put on your mikes, please?

MALE: Sorry, sir. To expedite this area because the whole printer thing
is kind of interrelated. Should we not just follow the same
accessibility approach and do this as a should with an indication for
shall for (indiscernible)? I mean, and then we put this one to rest.

MR. CHAIRMAN: Okay, so the proposal, then, is change to \-- 7.2.2.2.3
and 2.4 is already a should.

FEMALE: 2.5.

MR. CHAIRMAN: 2.5?

MALE: 2.7.

MALE: I have a problem with 2.5, 2.6, and 2.7. Those are election
management issues that have nothing to do with standards that voting
system. There's no way that standards for the voting system can assure
that there are supplies on hand at the polling place. There's no way
that standards for the voting system can see to it that the temperature
and humidity ranges are correct. And there's no way that standards for
the voting system can see to it that there's a sufficient number of
backup printers. These are \-- these are election management issues.
People in the \-- in the field have to decide how many \-- how many \--
how much redundancy they want, how many backups they want, and things
like that. There's \-- these are not issues that can be decided by
standards.

MR. CHAIRMAN: Do we? Let me \-- let me \-- do we have a motion, then, to
strike out 2.5?

MALE: I make a motion that we delete 7.2.5, 7.2.6, and 7.2.7.

MALE: It's \--.

MR. CHAIRMAN: Lemme \-- lemme ask about 2.7. I don't think it should be
a shall, but you do \-- I mean, if indeed some of the materials are
stored in such high humidity, conditions, et cetera that you may
actually modify the performance of the machine, I would propose that we
should leave 2.7 as a should.

MALE: 2.7.

MR. CHAIRMAN: 2.7 \-- 2.6.

MALE: 2.6, I believe's what you're talking about.

MR. CHAIRMAN: 2.6. Printer consumables should be stored within the
temperature/humidity ranges.

MALE: These are issues that come as recommendations from the
manufacturer and \-- and sometimes pass through the ITA and sometimes
not. But \-- but again, as \-- as \-- in working with elections, on \--
on these three issues, these are not things that you look to the
standards for; these are election management issues that are under the
control of the election \--

MR. CHAIRMAN: Yeah. I.

MALE: \-- the local election management people.

MALE: Elsewhere \-- elsewhere.

FEMALE: Elsewhere \--

MR. CHAIRMAN: (indiscernible)

FEMALE: sorry. Elsewhere, we've said the vendor shall provide
documentation recommending blah, blah, blah. Is this?

MALE: The \-- the vendor has to specify the environment for his system
and the ITA process should be evaluating both the documentation and the
accuracy of that specification. In addition, there are already
requirements in the standard for both operating environment and storage
environment which have to be met, so I think this can go away.

FEMALE: So we can either make it go away or we can simply do what we've
done in other cases which is because this is a special section is call
out that printer consumables would be included in that specification.

MALE: Yeah. I would \-- I don't have any problem with \-- with changing
this to say that the vendor shall provide a recommendation for these
three things. But there's no way the standard's gonna \-- I mean, what
is a sufficient number of replacement units?

MR. CHAIRMAN: No. I'm not talking about that. I \-- I was only referring
to 7.2.6 because, in fact, that could affect the performance.

MALE: There's no way that the standard can make me buy a warehouse that
has those attributes. Now, what you can do in the standards is require
that the vendor tell you what those attributes should be.

MALE: If I could interrupt, on 7.2.7, the discussion field says it may
be best for the vendor to recommend that sufficient number, at least,
one replacement printer should be available.

MALE: Okay, that's not what the standard says. That \-- that's the
discussion.

FEMALE: Once again, perhaps what we're looking for in several of these
cases is to ensure that the documentation from the vendor includes
appropriate operating procedures as in 5.2.8, appropriate storage
procedures, and their best recommendation based on their assessment of
failure rates of how many replacement parts you need on hand. It's then
up to voting officials to follow those recommendations for the systems
they purchase.

MALE: And the idea is to force a vendor to document that to test it \--

FEMALE: Right.

MALE: \-- and then when I go to the market looking for a voting system
in Florida, I know there's a possibility that, you know, November and
September and hurricane season, there's a strong possibility equipment
will have to work at 105 degrees and 95% humidity, and we're not going
to consider that can't meet that requirement. Other states may have a
problem with low humidity in November. But we want \-- that operating
temperature range stated, we want it validated, and we want it to be
something to be relied on.

FEMALE: Exactly.

MALE: But it \-- the requirement to keep the system within that range is
as Dr. Williams said, a \-- election administration issue, not a voting
systems standard.

MALE: Well, then, Mr. Chairman, I would propose we use the discussion as
the standard for that section, so take the 2.7 discussion and make that
the standard, which is this prescripted language from the manufacturer.

MALE: I would suggest that in 7.2.7, there's something that we need to
provide and that is what is the target we're gonna ask the vendor to
provide a recommendation against. I would think we want the number of
replacement printers required to assure that any particular precinct has
a 99.99% probability of having at least 80% of its polling stations
available. With that, the engineers can go back and say, okay, 80%
availability of 99.99% confidence, how many replacements do I need? And
they can come back \-- and I see a little table that every vendor
provides that says if you have 2 polling stations, you need this number
of replacement printers; if you have 5, it's this number; if you have
10, it's this number.

MALE: Even that is difficult because my way as election administrator
dealing with that issue rather than buying any extra printers, I'll buy,
like 115% of the machines I actually need so that every precinct has
enough machines that if one has to be taken off line, we're not damaged.
So.

MALE: But you wanna make sure the reliability engineer who feeds you the
information you're making those decisions on is working on the same
mindset that you are \--

MALE: Right.

MALE: \-- and I think that's what we should provide here. Is whatever
that number is, all throughout 99.99% for the precinct and 80% on the
polling places, or, you know, some such. And then \-- then we know what
those numbers mean.

MALE: Right.

MALE: Way \-- way we may go otherwise, you're gonna get too much
variability \-- vendor \-- because they don't know what you're really
asking.

MALE: I like Whitney's suggestion (indiscernible) this be a
documentation requirement for 6.2.6. The sufficient number of
replacement printers being available. I'm cognizant of your earlier
remark all about the fact that (indiscernible) be replacing entire
systems rather than replacing printers, too. And \-- and probably issue
of reliability and having enough available equipment really belongs at a
higher level in this document. This is within the (indiscernible) of the
VVPAT section and the, you know, some point, you know, being able to
service a given number of voters with 99% confidence, 99.99% confidence,
80% availability is an issue which I would like to see at a higher level
in this document.

FEMALE: So are we moving to strike 7.2.7?

MALE: The question is to strike 5, 6, and 7.

MALE: And I second that.

MR. CHAIRMAN: Any other comments on the?

MALE: So what we're talking about is striking these three with the
understanding that we'll draft a higher-level requirement regarding
availability and (indiscernible)?

FEMALE: Does that include storage? Does that include?

MALE: (indiscernible)

FEMALE: Yeah, so storage and availability?

MALE: Yeah.

MALE: If you looked at the \-- the existing standard, some of the parts
that we're not looking at where we talk about the \-- the environmental
and (indiscernible) environmental requirements and the non-operating
requirements, so forth, I think you'll find some of those things are
already there.

MALE: Yeah.

MALE: Yeah.

MR. CHAIRMAN: Okay. Then let's do a quick show of hands. Those in favor
of deleting 7.2.5, 7.2.6, 7.2.7? Anyone against? Okay, so we've deleted
those three. John, you'll develop a \-- maybe you can work with Dr.
Revest to draft a higher-level requirement?

MALE: Certainly shall.

MALE: Well, and John may also want to review the other sections and see
if there's not a requirement already there. I mean, we do require
vendors to specify the storage and use requirements for their systems
and then we have a overall maximum specification for both operating and
non-operating storage. So there's a good bit in the 2002 standards
covering that already.

FEMALE: Mr. Chairman.

MR. CHAIRMAN: Yes. Go ahead.

FEMALE: I would like to go on record that I would support that \-- the
last motion.

MR. CHAIRMAN: Thank you.

MALE: Okay. So noted. We'll \-- we'll take a look at that again and see
\--

MR. CHAIRMAN: Okay.

MALE: If there are other requirements in the 2002.

MR. CHAIRMAN: 7.2.8.

MALE: Okay. Can we move on to 7.2.8, 7.2.9?

**\[End of Audiotape 6, Side A\]**

MALE: There. 7.3, and then turning to the last page, 623, 6.0.2.7.4 and
its leaf requirements.

MR. CHAIRMAN: Mr. Craft, are \-- are you comfortable with this language
auditing?

MALE: I am not. \[laughter\] I think there should be \--

MR. CHAIRMAN: Manual verification?

MALE: \-- verification. Verification.

MR. CHAIRMAN: Is that better?

MALE: Actually, it's verification, reconciliation, and recounts, I would
think would be quite appropriate.

MR. CHAIRMAN: Verification, reconciliation \--

MALE: And recounts.

MR. CHAIRMAN: \-- and recounts. So we take out "manual" and "machine"?

MALE: I think so.

MR. CHAIRMAN: Let me journalize it.

MALE: For verification, for reconciliation \--

MR. CHAIRMAN: To be used for verification, reconciliation, and recounts.

MALE: \-- and recounts.

MR. CHAIRMAN: Yeah, it already \-- "manually" and "machine" is already
repeated again.

MALE: Okay.

MALE: 6.0.2.7.4.1 is already covered elsewhere in the standards.

MALE: There is a \-- there is an item related to that, though, that I'd
raise a concern about. I'm not sure this is sufficient for all our
concerns, specifically that the paper record may be able to withstand 22
months at normal temperature and humidity. I think also that we want
some short-duration overstress, so we don't want a bunch of paper
ballots in a trunk of a car in a hot climate to be unreadable at the end
of the journey. So, I don't think that test \-- excuse me \-- currently
exists in the other sections. I think we need something like that.

MALE: Well, the 1990 standards, and I think perhaps 2002 standards
actually referenced standards for punch cards which actually went into
the tex \-- Textile and Paper Producers' Association standards for punch
cards. And I suspect there probably exist a similar standard for paper
documents are expected to survive in somewhat hostile environments over
long period of time that could be adapted.

MALE: I know there are standard thermal overstress requirements \--
excuse me \-- and I just think we need to make sure that the paper \--
type of paper and ink conform to those.

MR. CHAIRMAN: Okay so we will come up with a recommended addition to
that and that will be part of the approval process after the meeting? Is
that acceptable?

MALE: Yeah.

MALE: If there's an existing standard, we can state \-- we need to find
it.

MR. CHAIRMAN: Yes.

MALE: Another way we could do it is \--.

MR. CHAIRMAN: What \-- which standard were (indiscernible)?

MALE: I'll \-- I'll suggest the IEC, my memory is 721 series. That
series provides recommended ranges for both use, storage, and
transportation. And then it points to test standards in the IEC 68
series for specific tests. So from the 721 series, it may be 731. We can
get recommended ranges of temperature overstress expected in transport
and storage, and then the IEC 68 series will give test to those
requirements.

MALE: Okay.

MR. CHAIRMAN: Are we okay with 742? Okay.

MALE: Okay. Thank you. You've given me some work to do over lunch. One
last.

MR. CHAIRMAN: Yeah. Let \-- let's see. We're not quite ready to break
for lunch yet.

So we have basically gone through the section \-- the pages 613 to the
end. I have particular changes that we agreed to, so those will be made
based on our agreed procedure. These are changes to items 6.2.1, 6.2.1
\-- both the standard and the discussion, 6.5.1, 7.1.1, 7.1.2, 7.2.2 \--
that became a should \-- 7.2.5.6.7. have been deleted. We will come up
with a higher-level language. That's pending. And 7.4 has been modified.
7.4.1 we will come up with an additional language based on IEC 721 to
731 series. So these are the changes we've agreed to that will be made
and sent to you for quick approval.

Yes, Secretary Davidson.

FEMALE: Two issues. I wonder if we shouldn't make some of the shalls
that we had agreed to prior shoulds after our break that we were able to
talk to some of the \-- the vendors. And then the other thing is I'd
like to refer back to page 6-17 of the handout, line 32, 6.0.2.6.9.4. I
guess we went over this one pretty fast, but a scanner for reading and
displaying the bar code shall be made available to a voter at the
request, so you also want a scanner at each and every polling place
besides the paper verification?

MALE: Now, this \-- this specific item here is \-- if the paper record
contains a barcode, then the voter may wonder, you know, what's in that
barcode? And we've recommended that the barcode be a publicly-documented
barcode, like, you know the ones used by Fed Ex or \-- or the major
shippers and that an off-the-shelf scanner be made available to satisfy
a voter in that particular case that they \-- that there is nothing in
that barcode other than what should be available to them on the human
readable part of the paper.

MALE: Yesterday, we were going to include in that barcode a serial
number for the ballot with the assumption that voters couldn't read the
barcode so there'd be no danger of them remembering what the serial
number was and taking it out of the polling place with them. How does
that reconcile?

MALE: The \-- the actual language for the unique identifier was to be
made not memorable so it could be included in there. It would just not
have to be readily memorable to the voter. I think it was \-- actually,
we modified it to make it easily memorable by the voter.

FEMALE: Is this a scanner at every station?

MALE: No, we didn't specify that it should be at every station.

FEMALE: But if you can't take the paper away, how do you transport the
paper to read it?

\[laughter\]

MR. CHAIRMAN: Do I have a proposal \-- motion to delete this?

FEMALE: (indiscernible)

MALE: Well \--.

MR. CHAIRMAN: Any opposed?

MALE: Just to make clear what the point is here \-- the concern is
obviously that the voter may be concerned that there may be personal
information of some sort in the barcode in trying to get some ability
for the voter to get some assurance that there's nothing identifying him
in the barcoded information.

MALE: And we were going to do that by giving him a scanner that will
only read part of the information there. \[laughter\]

MALE: Can read all of it (indiscernible).

MALE: Well, if he can read all of it, then he can memorize the serial
number.

FEMALE: When we have people who are concerned with issues like that, we
\-- we ask them \-- and they're always very willing to come down to our
office or to actually see what is in the barcode and that way it's not
their own ballot, but they can, you know, actually see, even sometimes
when you have numbers that are \-- they want to know what those numbers
relate to. And we talk them through that and show them and they're \--
they're very pleased with the testing and \-- and we handle it that way.
But the expense of having a scanner or \-- and giving out possible
information we shouldn't, worries me at a precinct. That's extra cost
that would be very costly.

MALE: I think your (indiscernible) \-- satisfactory of the voters is a
better approach, yes.

MALE: Can we call the question?

MR. CHAIRMAN: All those in favor of deleting this item?

PARTICIPANTS: Aye!

MR. CHAIRMAN: Those opposed? Okay. Item 6.0.2.6.8.4 deleted.

MALE: Okay. Got that.

MR. CHAIRMAN: Okay, so we worked the part of this document, the front
end, pages 2 through 12, reflect the changes made yesterday. The changes
suggested yesterday. Do we need \-- my recomm \-- my recollection is
they were fairly straightforward editorial changes. Do we need any
further discussion on this?

FEMALE: You know, I need \-- I need to rely on everybody else's. Are
there any shalls that should be made shoulds? That's the only thing I'm
concerned about; that's the only thing.

MALE: In the process we went through, Secretary Davidson, I'm not sure
if, in fact, we converted enough shalls to shoulds. I think after lunch,
we probably \-- or whenever the document comes back to us, we probably
should do a final pass and look for any shalls that, in fact, restrict
design and either delete them, which would be preferable, or at least
convert 'em to shoulds.

MALE: During the break, one of the NIST staff suggested that perhaps the
6.0.2.6.4 on page 614 on digital signatures could be made a should for
more parity with parts of the standard where we don't yet require those.
There's a certain direction we want to go in, but.

FEMALE: I mean, I understand that John's going to have to do it \-- what
we did yesterday with him and human factors, just go through and do a
quick edit pass and maybe if you would look at those things carefully as
you do it and then come back to us and point out anything that you
picked up in the spirit of the communic \-- of the conversation we've
had.

MALE: I can just say one last thing besides thank you for \-- for all
the comments and getting through this \[laughter\], is that it is okay
in the area of security to restrict design. It \-- it \-- and I think in
the VVPAT standard, it's \-- it's a bit of a different beast here. I
would like as much as possible for all of the requirements to be purely
performance driven, but I think in the areas of usability,
accessibility, reliability, and security, there are times when design
has to be restricted, such as how to do encryption a particular way.

MR. CHAIRMAN: Let me \-- let me suggest this. Now that we've made all
the changes in this session and you have the document in front of you,
you can go back and compare to your notes from yesterday to assure
yourself that all the suggested changes were made appropriately and then
we can bring this up for a vote after lunch. Is that acceptable?

MALE: Uh-huh. (affirmative)

MR. CHAIRMAN: Okay. Thank you, John. Then I propose that we proceed and
at this time, I call on Mr. David Seifer (phonetic sp.) of the NIST
Information Technology Laboratory to present the NIST report, Wireless
Requirements for VVSG Version 1. David.

MALE: Thank you.

MR. CHAIRMAN: And this presentation was part of your handouts from
yesterday.

MALE: So, new subject to discuss. Wireless. Soon as we get my display
up.

This is to resolve \-- or, to address, Resolution 3505 which basically
said, NIST cannot say wireless can't be used. So that's the premise
under which I've now tried to make the requirements for securing
wireless. Doesn't mean that I'm happy with the solution, but that's the
way it was proposed to me from the group. So, none of my recommendations
say wireless can't be used, but I do try to control its usage.

MALE: (indiscernible)

MALE: Okay. We're having technical difficulties, so. I'll try to talk.

I'm on slide 2 under goals, so if you're following through the slide
presentation. So I'm trying to reach an understanding of what wireless
communication is by providing background. That was the background
provided at the March 9^th^, and based on that, I'm identifying where
the technical requirements for use of wireless communication devices
including systems.

I'm now on slide 3 for progress. I created a draft which is what is in
your document today. It has been refined from the March meeting based on
the input from this group saying I'm only to look at what's currently
used for wireless technology, not everything, which is what I brought in
with the original request that is just wide open wireless usage.

You will find that most of these requirements are simply re-emphasizing
the requirements that already exist in 2.0.2 that need to be applied in
wireless systems that are currently not applied simply because they're
not called out as wireless. You're thinking, "Oh, wireless isn't
mentioned so I don't have to do these things." You do have to do these
things. These are \-- this is a voting system. Wireless is a component
of that system. If you compromise the system by adding wireless, you
didn't follow the current VSS 2.0.2. Keep that in mind.

The 4^th^ slide which was existing locations, shows four places that
wireless is currently used. That being from the election management
system to the DRE, the DRE to a precinct count, precinct count to
central count. Thank you.

So those are the four areas that I've had the opportunities to talk with
vendors and review their usage in those locations.

Okay. Now. So three general areas of the layout of the section we're
dealing with on wireless. I want everybody to know that we are to apply
the telecommunications section, which already calls out some wireless
points of view. The second point is the information that's transmitted
is of critical importance. It's also important to know when it is
transmitted, how it is transmitted, but the bottom line is the thing
that most people curr \-- in current technology fail to recognize. The
system itself is now vulnerable because it has another additional path.
But those requirements already exist in 2.0.2. Okay. I don't know
whether I should continue with the slides now or go directly into the
document. So. One suggestion was go directly into the document, so on
page 650 is the first recommendation. I will leave the slide that says
"Requirement Overview" up so that you understand where we're at in the
view of things. So we're on the first item. Applying telecommunications.

So my first recomm \-- requirement is that at a minimum, you must, or
you shall follow the requirements in telecommunications section 5.

MALE: I have a comment about that. In your \-- in your narrative leading
in (indiscernible) lines 27-32, those are an opinion and should be
stricken \-- opinions don't have any place in standards.

MALE: This is not an opinion. You cannot secure a wireless device by
physical means if the wireless is going to a base station. It is
physically impossible for me to secure that. So it is not an opinion. It
is fact.

MALE: Let me ask a little earlier than that, you take a very broad
description of wireless including, I assume, audible sound and visible
light. Tell me what \-- what the reason for that selection was.

MALE: The definition of wireless does no \-- does not exist in 2.0.2,
nor does the definition exist in the Resolution 35. I made this point at
the March meeting. DDC (phonetic sp.) did not disagree with that
definition at that time. So that was the definition I proceeded upon. At
that time, I made it known the difficulty in trying to prescribe or
describe a wireless system when you're looking at specific technologies
rather than as a categoric \-- as a way of categorizing something.
Wireless means no wires and you're communicating information. That's in
the simplest form. That's the definition I had at March, didn't have any
disagreement with it, that's the tack I took.

MALE: Well, in spirit of keeping to the prior resolutions passed by this
board and the discussions that we had, I suggest that on page 650, lines
27-31, that that paragraph be replaced with the prior resolve language
regarding the risk of wireless, which I believe \-- if memory serves me
well \-- wireless communications introduce extreme risk and should be
approached with caution. The last sentence almost brought the text of
that resolution in, but I \-- I think that \-- that would solve Dr.
Williams' problem with that.

MALE: It's my understanding we have two issues going around. You just
jumped to another issue.

MR. CHAIRMAN: Yeah.

MALE: I just came back to one that we skipped.

MR. CHAIRMAN: Skipped.

FEMALE: The \-- the language from the resolution 3505 is: "The TGDC has
considered the advisability of using wireless technology within voting
systems from securities perspective. It is concluded that for now, the
use of wireless technology introduces severe risk and should be
approached with extreme caution."

MALE: 'Kay. I'd like to move that lines 27-31 be replaced with that \--
with that sentence and I don't need another lecture.

MALE: That's a good suggestion. (indiscernible)

MALE: Yeah.

MR. CHAIRMAN: So the \-- if I interpret it right, what we're talking
about, deleting lines 27-30 \--

MALE: 31.

MR. CHAIRMAN: \-- no, 30 and leaving the sentence that says, "The use of
wireless technology introduces risk and should be approached with
extreme caution"?

MALE: No, sir. That doesn't match the language of the resolution. I
believe, Whitney, you read "extreme risk"?

MR. CHAIRMAN: Yes. "With extreme caution."

MALE: If we just quote the entire resolution, it'd just replace that
sentence as part \--

MALE: Yeah.

MALE: \-- so.

MALE: Okay.

MALE: Yeah.

MR. CHAIRMAN: Was that 35? What resolution?

MALE: 3505.

MR. CHAIRMAN: 3505. Okay, (indiscernible).

MALE: Okay.

So that addressed the first issue brought up. Is the second issue
addressed or not now?

MALE: I'd like to move that we take some language out that I've got some
difficulty with on a couple of points. Starting in line 8 at the end
where the sentence starts this going down to sentence, or, line 14, the
sentence ending in "only unidirectional". My concern there is I think
we're getting too wide in some interpretations that display which by
visible light showing the voter the ballot would come under as being
wireless.

MALE: That is correct. It is correct and it is covered under usability.
You're trying to protect the privacy of the user so you can't see.
You're trying to prevent that communication.

MALE: I think in this section, we want a more restricted definition so
we can focus in on a specific set of concerns.

MALE: (indiscernible)

MALE: So, anyway, I suggest removing those and then down in line 21, the
sentence starting "also, the generation of some of these wireless
signals" ending in line 23. I \-- I just suggest we drop those
sentences.

MALE: (indiscernible)

MALE: I'll make that a motion.

MR. CHAIRMAN: Okay, could you \-- I caught the ones about lines 21
through 23. What was the other change?

MALE: Okay. There's two deletions I'm \-- this motion's recommending.
The first starts in line 8 at the word "This" right at the end and goes
through line 14 to the words "only directional" at the beginning of that
line. The second deletion starts in line 21 at "Also, the generation of
some" goes through 23, the first three words "voting system accuracy".

MALE: This is a comment, if I may, on the proposal. The second one, I
have no problem deleting the second one. The first one, the requirements
written here do take cognizant distinction between some of these wi \--
political wireless uses that are presented to the user versus those that
are device to device. So there'll be additional changes. Of course, if
you wanna try to narrow down the resolution. (indiscernible) of these
resolutions.

MALE: Part of this may be an organization of the document issue, you
know, some of those concerns, I think, better are in other sections.
When we say wireless, I think we're mostly thinking about RF intentional
transmission and \-- and there's certainly a set of issues we want to be
careful and handle.

MALE: This is admittedly a broader definition than the more traditional
one that you're suggesting, in fact, and I think it might be useful to
\-- to segregate those.

FEMALE: I'm sorry. This is all a little over my head technically, but
\[laughing\] \-- but I \-- I understand and I \-- well, I think I
understand your point that there is a lot more to wireless than what we
think of as wireless. But it might be useful to sort of say that and
then say nonetheless, this section is specifically discussing, so that
we haven't thrown out the broader point, but are helping people focus in
on what aspects of wireless we're really discussing here in this
section.

MALE: Well, I think the issue is, if I understand, everything that
generates electricity generates wireless, including the wires that
transmit the electricity and the communications from the boxes. But
generally, the way that's handled is in sections that talk about trying
to maintain low levels of that kind of electromagnetic radiation, it's
probably in the specifications already.

MALE: It is.

MALE: Right. Where this is talking about intentional communications,
replacing the wires with much stronger signals.

FEMALE: I mean, I realize that much of these sections are aimed at a
technical audience, but \-- but some of us also have to read them and
\-- and \-- so I think something that says, "Look, it's broad. We've
covered this here, this is what we're covering here. Look here for other
things" would really go a long way.

MALE: But what we're actually trying to address here is the use of
wireless interfaces between components of a voting system. Period. We're
not concerned if the telephone call outside goes to a satellite or not.
And we're not concerned \-- within this, I don't think we're actually
concerned with leakage of signals outside. That \-- that's a security
(indiscernible).

MALE: (indiscernible) what should be, I mean (indiscernible).

MALE: (indiscernible) this is going to speak to what communications
between pieces of the system should be expected to do.

MALE: (indiscernible) should not be expected to do as well. I think
that, you know, unexpected use of their radio transmitter in a device is
a security concern that needs to be addressed here today.

MALE: Yeah.

FEMALE: Yeah.

MALE: And I think that's \-- we want to focus in on those intentional
radio transmitters that somebody may build into a system and make sure
that they're adequately secure.

FEMALE: Okay.

MALE: I would like to bring everybody's attention to the \-- section 5,
telecommunication, which is part of the problem that needs to be solved
before we can address it in my section. Page 5.2. Talks about types of
components where the term wireless is used as one of the bullet items.
Microwave is defined. And a very small aperture terminal is also defined
are as technologies.

MR. CHAIRMAN: David, (indiscernible) page?

MALE: Page 5-2 in VSS.

MR. CHAIRMAN: Yes. And which paragraph are you referring to?

MALE: 5-1.1.

MR. CHAIRMAN: Okay.

MALE: Talks about types of components. There is a dial-up communication
technology as the first diamond bulleted and then the next bullet items
start the standard landline. Starts "Wireless, what does this mean?" It
needs to be defined here, not in my section. Microwave, which according
to my definition, it is still wireless. Small (indiscernible) terminal
isn't a wireless technology, or isn't wi \-- it's a device, not a
technology, so it's still using wireless means. So I think the change
needs to occur here first in order for me to address mine, otherwise I
have a problem. And continuing that, going down on the next page, top
\-- talks about cabling technologies. It has wireless connections and
then in parentheses, radio frequencies and infrared. So there is said,
okay, I want to limit wireless technology to RF and infrared, which is
completely separate from the wireless talked about in 5.1.1. This is the
confusion that already exists, so I ask that.

MALE: So since section 5 comes first, wouldn't that be the place to make
some kind of explanatory statement about how all these things fit in,
what you'd be addressing in this section, what's being addressed there,
and so forth?

MALE: Well, I wasn't given access to change anything in 5 because that
was telecommunications, not wireless. But I had to live and try to exist
with it which is why I did what I did. And since I did what I did isn't
being accepted, I'm now going to say that the VS 2.0.2. has to be
changed other places, not just mine.

MALE: I think we could make a definition of this section, something of
the line Steve was saying for the purposes of this section, wireless
should mean "intentional transmission or reception of radio frequency
signals" think would probably be.

MALE: And I think David raises a good point. That the definition in
section 5 may deserve some reworking. Probably something along the line
of transmission of data through an unsecured network. And \-- and
there's better language than that that we can find, but I think that's
what we're talking about. And in wireless, we're talking about
intentional transmission of data in an unsecured conduit, you know, over
the air.

MR. CHAIRMAN: At this stage, it's probably too late to go back and work
on section 5.

MALE: Yeah.

MR. CHAIRMAN: I would suggest, to go along with what was suggested,
maybe changes, language that says this normally, you know, the line that
you suggested to delete, maybe we can modify it and say this normally
covers the entire electromagnetic spectrum.

MALE: Yes.

MR. CHAIRMAN: And is not \-- and I think we can take that and the rest
of it out. And then put a statement that says, "For the purpose of this
section, we are referring to the use of \-- the use of wireless
technologies to weigh communications between systems" or something like
that? Is that?

MALE: I would restrict it to 2.1.

MR. CHAIRMAN: (indiscernible)

MALE: I question, too, because I think in some applications that we saw
in the chart, you would want to have it only capable of one-way
transmission.

MALE: Yeah, I think right now, we're dealing with RF, we're dealing with
infrared, and we're dealing with magnetic when you start looking at some
of the currents that could be swiped in the different devices.

MALE: Yeah. Okay. Wording to that effect would be fine with me.

MR. CHAIRMAN: Have you captured? Has anybody captured?

FEMALE: (indiscernible) along the lines of, "this normally covers the
electromagnetic spectrum" for this section we are referring to RF, IR,
and what was your third call?

MALE: Magnetic.

FEMALE: Magnetic?

MALE: That is not correct because they're all magnetic. So you need a
specific range of that magnetic frequency which your magnetic reader is
reading. That's.

MALE: (indiscernible)

FEMALE: (indiscernible)

MR. CHAIRMAN: How 'bout "this normally covers the entire electromagnetic
spectrum". In parentheses, including radio frequency, infrared, and
microwave. Or maybe not in parentheses. It just finishes that sentence.
And then it says, "For the purpose of this section, wireless refers to"
\-- "For the purpose of this section, we are referring to systems \--
wireless systems used for communication".

MALE: Between components of the voting system.

MR. CHAIRMAN: Communications between the components of the voting
systems.

MALE: And \-- and RF, infrared, and.

MR. CHAIRMAN: Well, that we already mentioned.

MALE: (indiscernible) spectrum would be fine.

MALE: Okay.

MR. CHAIRMAN: Is that? Mr. Berger, is that going to be? Okay. So we're
\-- we're trying to basically narrow it down to definition and define
it. Clearly, we recognize that there is an inconsistency with the
previous section, so we want to set the record straight for the purpose
of this section.

MALE: Okay.

MR. CHAIRMAN: Okay?

MALE: So, the definition as agreed to, but you haven't reviewed it yet,
is adopted. The point is there's no guidance given if you use a wireless
system that doesn't use these technologies. Correct? That's my
understanding of your current definition.

MR. CHAIRMAN: Right.

MALE: So somebody comes along with a new wireless technology, the
document doesn't apply.

MALE: And we're going to have to come up with a standard to address it
at that time.

MALE: Well, I think that's standard procedure for your certified
engineers to know how to take the requirements as they are and adapt
them to new technologies or seek guidance if they're not able to do
that.

MALE: And the process, when they hit that, they come back to the AC with
deals with whatever technical committee is running and figures out how
to deal with that issue until the next version of standards can come
out.

MR. CHAIRMAN: What \-- what technology are we talking about that's not
covered here?

MALE: I think \--.

MALE: We're talking about the entire electromagnetic spectrum.
\[laughter\]

MALE: So you could have \-- you could have sound waves, use audio waves
to communicate from one device to another. So any kind of technology
that's broadcast where an eavesdropper could listen in or a
(indiscernible) signals have some of the same security concerns. I have
no problems with the revised language as we have it here, though, to
talk about the electromagnetic spectrum which has the greatest range.

MR. CHAIRMAN: Okay. I think we have noted the. Okay. We will make that
change. Let's proceed.

MALE: Okay. For the first requirement, can I now have as a minimum for
wireless communications to implement the telecommunications section?

Okay. Onto the information section about controlling usage, on page
6-51. First requirement is on documentation. Major concern since
wireless is being used is you gotta document it's being used. You have
to know what you have, how to use it, and this is what this requirement
is addressing. And the sub bullet items to support it.

Now, 6-52, 6.0.3-2.2. If the voting system includes wireless
capabilities, then the voting system shall be able to accomplish the
same function if the wireless capabilities are not available due to an
error or no service. This is a requirement simply from the fact you
cannot control the air interface around you.

MALE: Okay, now that is a problem for at least one of the current voting
systems which relies on a infrared data stream to activate a voting
terminal and, very frankly, if that infrared device can no longer
communicate, then that particular machine will not work. So it's never
going to function if wireless infrared is not available to it.

MALE: So the system has a single point of failure which is a violation
of 2.0.2.

MALE: Actually, a single point of failure, but you have multiple devices
in precincts. This is basically the ES&S PEB device. On the Ivotronic
(phonetic sp.), you have numerous Ivotronics and you have numerous PEBs,
so I don't think it's a single point of failure within the system, but
yes, without \-- without the infrared communication from a PEB, you
cannot activate an Ivotronic.

MR. CHAIRMAN: Are we okay if we make this a should?

MALE: Yeah.

MALE: Paul, could I ask a little more information on that system?

MALE: Yeah. Understand that the receiving device is a \-- a station.

MALE: What's the transmitting device?

MALE: I'm not sure if it's two-way or one-way, but at least part of the
initiation of the transmission comes from a PEB device and there's an
infrared window \--.

MALE: What is a PEB device?

MALE: That's called a Personal Electronic Ballot. It's the activation
device for the Ivotronic.

MALE: What I'm asking is, if the infrared were interrupted in some way,
is that something that's very feasible to bring it up very close,
virtually giving it a close channel for the transmission?

MALE: It is \-- it is, for all practical effect, a closed channel. Yeah,
it's window-to-window.

FEMALE: So, Paul (indiscernible) \-- 'cause it sounds to me like the
problem here might not be that infrared was interrupted, but that the
devices failed.

MALE: Right.

FEMALE: So, in fact, it's not \-- the \-- the fail \-- the fact that the
infrared failed to activate the device would actually be an indication
of a greater failure of some kind.

MALE: Correct.

MALE: Well, it seems to me there's a conceptual thing here that David's
putting in that in \-- in the use of wireless in general, he's right,
the electromagnetic spectrum in a particular location may be hostile and
\-- and we don't want that to affect the whole precinct. I think you're
talking about something that, conceptually, is a closed channel, you
know, and \--

MALE: We could take that position.

MALE: \-- it would be hard to see how that could be interfered with
since obviously you can't flood the thing with light. It's in a closed
channel. Can we maybe craft some language?

MALE: (indiscernible) this concern. But he said wireless in general so
it's applicable.

MALE: Right, and I agree if you're dealing with, you know, wireless
communication or RF across the room, then the devices need to have an
alternative for communication. But there are going to be instances, I
think, in system design where the system will be dependent on a wireless
communication and as in the design, the Ivotronic, the system design
needs to be such that that wireless communication is very well protected
and can be very reliable.

MALE: Well-protected not only from \-- from, you know, extra \-- you
know, environmental random noise that may be present but also malicious
\--

MALE: Yeah.

MALE: \-- channels.

MALE: Well, I guess I suggest either making this a should or putting in
some language that says if the communication can be put in a control
channel where there isn't a concern about environmental \-- hostile
environment \-- uh-huh (affirmative) \-- then it doesn't apply.

MALE: Yeah, okay.

MALE: One vote for the should.

MALE: I would like to \-- the question \-- I know Ron in our committee,
we talked at great length about the single point of failure of that and
\-- and just before we discard that, I would like to clearly understand
what we're \-- what we're allowing if we drop away from the shall on
this \-- on this particular item.

MALE: I think this is a question along the lines of the human factors
committee where we've got a should intended to move to a shall here. I
think letting the vendors digest this a bit, give us some feedback, move
towards this, you know, this is more, in my mind, one of these
transitional issues rather than view of alternate positioning.

MALE: But let me just say (indiscernible) discussion. I think \-- I
think if we're talking about components failing, then I think it's a
larger issue that should be addressed in the whole voting system, the
memory, the printer, the processor, et cetera, and the way to accomplish
something fails could be that extra systems. The only thing I think
that's unique in the wireless case is that somebody were to walk around
with some kind of a noisemaker and try to jam the communications, in
which case, frankly, there's other ways to overcome that in an
environment like a voting precinct, like being able to locate that and
go after that person \[laughing\] and shoo 'em away as opposed to
necessarily having to have an alternate means of communications.

MALE: How 'bout this? Sorry.

FEMALE: Sorry. We might wanna look at the next section in this
discussion. Does that address the single point of failure?

MR. CHAIRMAN: 323.

MALE: Well, we've gone past something that I wanted to comment on. Page
652, 6.0.3.2.1.4.1. The review should be done by the ITA.

FEMALE: (indiscernible)

MALE: Ma'am?

MR. CHAIRMAN: The responsible entity, it says, testing.

MALE: Testing authority.

MR. CHAIRMAN: Maybe it should say testing authority.

MALE: No, that's a comment under the requirement. The requirement is
that the \--.

MALE: You're correct, Brett. But I think this language \-- I don't think
I've seen the details of that before, but I \-- line 13 and 14. The
concern was that when you're talking about cryptographic protocols and
so on, the ITAs may not have the expertise required to do that. And so
this is calling out for admittedly somewhat unusual process to have
cryptographic protocols or whatever the techniques made available there.
Maybe there's another way to address that. Maybe the ITAs
(indiscernible).

MALE: Well, I think that this is addressed by the NAVLAB (phonetic sp.)
program. It's up to the NAVLAB program to specify how this gets done.
You know, we're introducing a constraint on the NAVLAB program saying,
okay, when you start certifying laboratories to do these reviews, you've
not only got have ITAs, but you gotta go find people to do this, too. So
I think that this is best left to the discretion of the \-- of
implementing the standards rather than trying to state them in the
standards.

MALE: Is it your expectation that the NAV \-- that the certified
laboratories would be required to staff up on the cryptographic well
enough to evaluate these? Is that the requirement we should be putting
on them?

MALE: NAVLAB certifies to IC 17025 \--

MALE: Right.

MALE: \-- which one of the core requirements is that the personnel be
examined as to being appropriately expert in the fields in which they're
being certified.

MALE: So the requirement right above this is that this is to be closely
reviewed for accuracy, completeness, and correctness. Now, we don't need
go beyond that because NAVLAB will look at that and decide how, which,
obviously, will be to refer it to one of these labs.

MALE: I think as long as there's an adequate procedure \--

MALE: Yeah.

MALE: \-- to do that, it doesn't matter how it's done, but we make sure
that the process is such that.

MALE: Well, you know, you have to \-- you have to have confi \--.

**\[END OF AUDIOTAPE 6\]**

** **\* \* \* \* \*

[CERTIFICATE OF AGENCY]{.underline}

I, Carol J. Schwartz, President of Carol J. Thomas Stenotype Reporting
Services, Inc., do hereby certify we were authorized to transcribe the
submitted cassette tape, and that thereafter these proceedings were
transcribed under our supervision, and I further certify that the
forgoing transcription contains a full, true and correct transcription
of the cassette furnished, to the best of our ability.

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

CAROL J. SCHWARTZ

PRESIDENT

**(START OF AUDIOTAPE 7, SIDE A)**

MALE: \-- And trying to make sure you got the best people looking at it
and to inspire some confidence in a review process where it\'s
admittedly a high risk area.

MALE: (indiscernible)

MALE: It says that.

MALE: Or by a subject area recognized. I\'m not sure there\'s any
problem with the language as it\'s stated.

MALE:** **So can I move on or \--

MALE: Yeah, I think the only thing we did was add the word authority
after testing.

MALE: Okay.

MALE: So we were actually on the \--

MALE: We\'re still discussing.

MALE: \-- next page.

MALE: Yeah.

MALE: 3. \-- 2.3

MALE: This is the single point of failure, and I have the \-- under the
discussion exactly where I pulled it out from, which is again under the
telecommunications section. We don\'t wire wireless to be your point of
failure because you really don\'t have full control over it.

MALE: (indiscernible)

MR. CHAIRMAN: Microphone, please.

MALE: Section 241 is election management issue. I recommend that that be
deleted.

MALE: 241.

MALE: 603.

MR. CHAIRMAN: We\'re talking about 3.2.4.

MALE: That\'s where I am.

MR. CHAIRMAN: Yeah, are we okay with 3.2.3?

FEMALE: Yes.

MALE: Yes.

MALE: Yes.

MALE: Okay, 3.2.4. Dr. Williams has (indiscernible).

MALE: 3.2.4 is fine. 3.2.4.1 should be deleted. That\'s election
management. We\'re telling the election management people they should do
their job.

MALE: I think the question is whether the \-- in part, whether the
software turns on the wireless or whether it\'s turned on by some
confirmation of the (indiscernible). Maybe that\'s captured in the \--

MALE: Well it is in the \--

FEMALE: (indiscernible)

MALE: I think it\'s captured in 3.2.5 already. We have 3.2.5

FEMALE: Yeah.

MR. CHAIRMAN: So do we have a motion to \-- suggestion to delete 2.4.1?

MALE: Second.

MR. CHAIRMAN: All those in favor?

PARTICIPANTS: Aye.

MR. CHAIRMAN: Any opposed? Okay, we delete 2.4.1 \-- 3.2.4.1.

MALE: Onto the next requirement, 3.2.5. This requirement is \-- you
don\'t want the wireless communication on without knowing it\'s on. And
if it\'s on, you want to confirm that it\'s on. You want \-- voting
official to actively know to put it on or take it off?

MR. CHAIRMAN: Okay with that?

MALE: Okay.

MALE: Well that poses a problem again for systems such as the ES&S,
where in fact some of the voting officials turning the thing on and off
aren\'t going to know that it\'s a wireless or infrared and basically
it\'s designed to it only turns itself on when it\'s appropriate, when
it\'s ready to communicate it\'s in place. So, I think I could go
without activation or appropriate activation from the user or something
like that.

MALE: In that case, the act of the voting official inserting that device
into that slot is confirmation from the (indiscernible).

MALE: The thing (indiscernible) has a confirmation, and \--

MR. CHAIRMAN: Conformation can be interpreted broadly.

MALE: Okay.

MR. CHAIRMAN: Yeah. Next?

MALE: Okay, next section I specifically called out for radiofrequencies
under the wireless technology because these different electromagnetic
spectrum ranges have different characteristics and this is also one of
the technologies that are being used by a current system. For ray of
frequencies, you can\'t guard against it, so you have to be prepared for
unintended interference.

Next one for reducing potential interference and then the radio
emissions site wise test. And that completes the section on controlling
wireless usage.

MALE: Okay. Let me make a motion that we delete 3.2.6. I want to ask a
question or two first.

MR. CHAIRMAN: All \--

MALE: In its entirety. Let me ask first in 3.2.6.1 it sounds like
you\'re saying wireless has to use dedicated frequencies. Am I reading
that accurately?

MALE: No.

MALE: Okay.

MALE: The reason this is in place is I\'m not allowed to constrain any
technology being used. At the same time, whatever technology is being
used, the \-- not necessarily the vendor in this case but who gets the
device is going to have to be aware of that radio technology.

For example, if I use Blue Tooth in my voting system, there are a lot of
other Blue Tooth devices out there that are not voting systems. I need
to know that my system \-- my voting system may be interfered by anybody
who walks in with another Blue Tooth device, and that could hamper the
performance of my voting system. And I\'m not saying you have to use
something other than what\'s commercially available. I\'m trying to make
the user of this device aware of the problems of wireless
communications.

MALE: Well the FCC assigned frequency use and you have to use the
frequencies that are available for your proposed application. All of
those are general use. There is no dedicated band for voting technology.
So it would not be possible to comply with .1 here. In fact, with Blue
Tooth specifically, those are designed to interoperate and depending on
the security settings they either will or won\'t ignore each other. And
obviously in this application, we would want them to have dedicated use
only to other components of the system and ignore all other Blue Tooth
devices in the area. That\'s quite doable built into the protocol staff.

MALE: That\'s not doable to the actual protocol. Blue Tooth protocol
cannot ignore other Blue Tooth devices in its area. It can ignore \-- it
can choose \--

MALE: That\'s not accurate.

MALE: Yes, it is. It\'s a frequency hopping system. It hops frequencies.

MALE: Yes.

MALE: You can\'t defend \-- you can\'t tell another device, \"Don\'t use
the frequency I\'m using because it\'s the frequency I have to hop
through. It\'s a requirement of the FCC that I have to hop through a
certain number of channels,\" and there is no way to guarantee that Blue
Tooth devices will not hop on other Blue Tooth devices. They can ignore
to join a Blue Tooth pico net, but they cannot avoid the interference
caused by the other device. That\'s actually in their own specification.

MALE: Okay, let\'s separate the issues. One is inclusion of another
device in the communication, which is what I was talking about. The
frequency hopping is over a 75 megahertz spectrum, and it\'s really a
non-issue from this standpoint because the protocol is designed to allow
multiple pico nets to operate independently in a fairly close area.
That\'s one of the reasons for the hopping.

So beyond that, the concern here is that any voting system is pretty
well going to have to use off-the-shelf components and really we want
that to build on infrastructure that is already in place. And that means
that if they use Blue Tooth 80211 or whatever, they don\'t have a choice
of frequencies and transmission protocol. Those are all set up in the
standards in the chip sets that implement them.

MR. CHAIRMAN: Is part of the thinking here that you need to be aware of
potential for interference that, in fact, in some cases maybe the
election of (indiscernible) will have to tell people that you cannot
bring such a device into the precinct because we may have \-- is that
part of the thinking? I\'m trying to get a clarification.

MALE: It is part of the thinking; it\'s not all the thinking. For
example, again with Blue Tooth, I have studied this protocol. I\'m
actually one of the people who are involved in it, and I think you can
tell me I\'m an expert in the first version of version Blue Tooth. You
can ask the people involved. You cannot prevent the interference of Blue
Tooth devices. Now 80211 divides up its technology to direct spectrum
technology. It divides that spectrum up in to multiple channels and you
can selectively say, \"I want to use this channel to avoid the other
channel that might be by a nearby system.\" We have the problem internal
to this, the same thing, trying to manage wireless networks so they do
not overlap in frequency so that they cause interruption.

FEMALE: Mr. Chair?

MR. CHAIRMAN: Yes.

MALE: Go ahead.

FEMALE: First of all, it\'s 12:38.

MR. CHAIRMAN: Yes.

FEMALE: And I\'m cold and I\'m hungry. \[laughter\]

MR. CHAIRMAN: I was \--

FEMALE: So we may be reaching a decreased level of usability of this
committee, if we don\'t give people a break. But here\'s the non \--
sort of non-techno concern I\'m hearing here, which is that what I\'m
hearing Mr. Flater describe is good design practices and thought \-- and
good thought that ought to go into the design of any sort of system,
especially in this case a wireless system. What I\'m not hearing come
out of it is clearly is requirements, is testable requirements. So, in a
way, we\'re back to the discussion of the usability test, which is, you
know, we should \-- you should do these things but we had one step
further on the usability test, which is we actually had a way of
documenting that you\'ve thought about it through the CIF.

So I just am wondering what the requirement is because, as we pointed
out before we don\'t include my new reading devices, so how is it that
we\'re going to know that someone has considered these issues carefully?

MALE: And I guess I have a question with the issue of frequency hopping
and Blue Tooth causing interference with other Blue Tooth devices. Is
that interference of such a level that it actually introduces risk of
degraded performance?

MALE: No. And that\'s a good point. They hop at a 1,200 times per second
rate. And that\'s chosen so that when they do collide, they\'re quickly
on to another frequency, both of them. And so, they, you know,
effectively get their data through.

MALE: So probably what we want here is a design, if we (indiscernible)
at all, is a design that will ensure that the device is not \-- or is at
low risk for interference in its communication.

MALE: I want to say something about the design and the tolerance level
of interference.

MALE: Yeah. I understand that you don\'t want the devices on the police
telecommunications channel, particularly if you\'re polling places
sitting next to the police station. We\'re not talking about that.
That\'s not a reality anyway.

MALE: Well, remember I think in many we\'re exceeding our jurisdiction,
actually exceeding the jurisdiction of the AC. Any device that
incorporates a radiofrequency transmitter has to get an FCC equipment
grant. All the power transmission requirements very carefully reviewed
by the Federal Communication Commission. I think we\'re trying to do
their job for them.

MALE: May I suggest something?

MR. CHAIRMAN: Instead of this being an item under radiofrequencies,
perhaps this actually \-- some comment like this could be part of the
preamble, not so much a requirement but established awareness that these
issues are issues of concern to be paid attention and not as part of one
of the item \-- standards. And then go onto a couple of the other ones.

Let me leave you there. I want to respect our desire to break on time.
We\'re about ten minutes late. Yes, Mark?

MALE: If I may, I would like to just make on comment before we break
because I think it\'s very important.

MR. CHAIRMAN: (indiscernible)

FEMALE: (indiscernible)

MALE: Can you hear me?

MR. CHAIRMAN: Yeah.

MALE: Okay. I\'d like to just make one comment because I\'m concerned
there might be a misperception about something that we\'ve discussed
before. In my overview and in the conformance clause, we\'ve talked
about requirements for voting officials. We\'ve said these are not
mandatory requirements, these cannot be tested, we\'re going to put
those in appendix for best practices. When they\'ve come up here in some
instances we\'ve had objection to them in the \-- with the reasoning
that they don\'t belong here. We\'ve discussed this at the last meeting
and we discussed this again. These are not requirements in a sense the
others are requirements, and we\'ve made that clear in the conformance
clause. They are best practices for voting officials. We put them there
because we obviously think they\'re important. If the voting official
does not turn off the wireless capacity, for instance, you\'re going to
have problems. We\'re not telling them how to do their job but their
practices so that people can use them. And I guess I\'m concerned by
eliminating some of these arbitrarily. We\'re not being consistent here.
We\'ve said we\'re going to put them in, and I guess I\'d like the
committee to just think about why we\'re eliminating some and not
others, again making sure that they understand these are not testable
requirements that affect conformance.

So I\'d just like to leave that and let people think about it over
lunch.

MALE: Yeah, that\'s fine.

MR. CHAIRMAN: We will break for lunch. And when are going to get back?

FEMALE: 1:45.

MR. CHAIRMAN: Okay. We will get back at 1:45. Please let\'s be back in
time. Thank you.

\[off the record\]

\[on the record\]

MALE: One other administrative note. I did provide to all of you TGDC
members a sheet with potential dates for a September meeting. It\'s
basically two weeks in September when at least I know that the folks at
NIST and Dr. Semerjian are free, but I also asked if you have October
\-- what days in October would be available as well for a plenary
meeting.

So with that, I open the meeting to Dr. Rivest.

MALE: Thank you, Allen.

MALE: Question of clarity Dr. Rivest?

MALE: Yes.

MALE: Do we need to respond to our plenary opportunities in September at
close of business today?

MALE: Allen, could you \-- Allen, this is a question for you.

MALE: Allen?

MALE: (indiscernible) e-mail. Just take it with you. You don\'t have to
(indiscernible).

MALE: Okay. Okay. And then on that note, I would like to make it for the
record that this group ought to leave the beltway for our future
meetings and get out to the grassroots communities to allow them to
interact and to watch and to observe because the beltway doesn\'t count
for anything but the beltway. And I would \-- \[laughter\] I think it
would go a long way to educating the public in general, of being able to
reach Colorado or Florida or California.

FEMALE: I will say that there is a NIST that\'s located in Colorado, so
you could easily come there and it would be very \-- you know \--

MALE: Almost sounds like an invitation, yes.

FEMALE: Uh-huh (affirmative). \[laughter\]

FEMALE: I don\'t know.

MALE: (indiscernible)

MALE: Thank you. Those comments are well noted. I believe we probably
should start with attendance. Is that the first step, or do we need that
after lunch?

MALE: Why don\'t we do another roll call for (indiscernible) a couple of
people (indiscernible).

MALE: Taking roll for the afternoon session. Williams? Williams is
absent. Berger?

BERGER: Here.

MALE: Berger is here. Caldas? Craft?

CRAFT: Here.

MALE: Craft is here. Davidson?

DAVIDSON: Here.

MALE: Davidson is here. Elekes?

ELEKES: Here by teleconference.

MALE: Elekes is here. Gannon? Gannon is not here. Harding?

HARDING: Here.

MALE: Harding is here. Miller?

MILLER: Miller is here by teleconference as well.

MALE: Miller is here by teleconference. Purcell?

PURCELL: Purcell is here by teleconference also.

MALE: Purcell is here by teleconference. Quesenbery?

QUESENBERY: Here.

MALE: Quesenbery is here. Rivest?

RIVEST: Here.

MALE: Rivest is here. Schutzer?

SCHUTZER: Here.

MALE: Schutzer is here. Turner-Buoy? Semerjian? Absent. I\'m counting
that we have ten, which does represent a quorum so we can continue.

MALE: Thank you. As Allen noted, I was appointed by the chair in his
absence to proceed as chairman. And if that\'s okay with the committee
by your unanimous consent I will do so.

MALE: That works.

MR. CHAIRMAN: Okay. Thank you. So I would like to suggest we proceed
from where we left off on the wireless section. David Seifer is still
here. I believe we were talking about section 60326 on page 653 and
running onto 654. Is that correct?

MALE: That\'s correct.

MR. CHAIRMAN: Or are we further \-- I guess that\'s \--

MALE: Mr. Chairman?

MR. CHAIRMAN: Yes?

MALE: Before we proceed, I\'d like to just make a suggestion that may
assist us with all of the \-- it struck me this morning that the
wireless and the telecommunications, both of those components to these
are \-- regs are complicated. \[laughter\]

MR. CHAIRMAN: Yes.

MALE: And that we appear \-- or I in general, we may represent a
minority out there. And some of us up here are having great difficulties
keep track of what needs to be laid out in layman\'s terms versus some
more technical kinds of things that might be more appropriate in an
appendix for the technical people to really grasp and understand and
fight over.

And so what I would suggest is that perhaps by the end of the day we
could agree that we come up with really an input and an output on this
level so this average voter understands what the intent is and what the
expectation is and how that is derived to then be placed in another
section as to not to confuse the average voter and the average precinct
person.

MR. CHAIRMAN: Thank you. Yes, I think the clarity and accessibility of
the intent of this committee to the public at large is certainly
important and how we reach it is a good subject for discussion. So I
guess I\'ll open it up to the committee to follow up on that if there\'s
any suggestions or comments on the proposal just made.

MALE: Yeah, let me just second J.R.\'s suggestion and just report to the
committee that we had a \-- I think a very productive conversation over
lunch with Dr. Seifer and I think we share concern about the same
issues, but there\'s some work to be done on getting a set of words down
that will reflect a common agreement on what would be an adequate way to
address them. It may be better for the committee if we did that off line
and brought it back rather than trying to hammer it out here. But
that\'s \-- of course, it\'s a pleasure of the committee.

MALE: We have several ways of proceeding. If this particular section
isn\'t right for approval with minor edits then we probably should
figure out another path, if it\'s something we can clarify here. If
it\'s a matter of repartitioning, then we have an example already of
where we can move things around and do that if it\'s ready for approval,
but merely moving things around, I think it sounds like you\'re talking
more about the first category where when we get to the end of the
section, when we decide there\'s enough substantial rewriting to do that
it would need a different other pass or some other procedure?

MALE: I\'d like to ask Dr. Seifer\'s opinion, but my opinion is that
it\'s probably a little more than we want to try and do as a full
committee.

MR. CHAIRMAN: I think what we were trying to do at lunch is reach
agreement on the current issues of this one section that we\'re dealing
with and when we came back it was brought up by J.R. that there was a
broader scope that we were probably too specific for this technology for
everybody to understand. And so that could be viewed as a complete
restructure or it could be viewed as pull out the high level effects.
And I\'m going to make the suggestion do those high level effects there
on the screen \-- if I would elaborate on what I mean by controlling
usage at a high level or identifying usage, protecting the transmitted
data, protecting a wireless path, and then have the technical details
therefore, would that satisfy? If that\'s the case then that\'s
something that could be done quickly like section 227 was \-- or not it
wasn\'t 227. It was the security section. Pull certain ones out and move
other sections. But I guess my first concern is there any problem with
the text that\'s in there because what\'s the point of doing high level
if there\'s still \-- the devils are in the detail issues.

I realize that not everybody will be knowledgeable on the subject
matter, but again, from this high level view, do we understand at that
view what this is? What we\'re trying to do for security?

MALE: Let me just make sure we share an understanding on the last two
points, but it looks like a pretty good list to me. But when we get to
wireless, what do you mean by protecting the transmitted path and
protecting the wireless path?

MALE: Okay. Protecting the wireless path is again dependent upon the
wireless technology being used. For example, if it\'s RF, the path is
going to be going in multiple directions. The distance of which it goes
is going to be based on the technology used. And if it\'s over a short
breach, there\'s a potential that you can protect it, but you have to
keep the emissions from being received. The RF is a better example of
protecting the path. The RF isn\'t omni directional. It\'s very \--

MALE: By saying RF, you mean infrared?

MALE: Infrared, sorry. Infrared, sorry. Infrared. It\'s line of sight.
You can protect it over short distances. Over long distances, like if I
had an IOR from here to there and if the IOR reached, I wouldn\'t be
able to secure the path. But as was mentioned earlier with another
implementation with the PEB, that is a real close transmission and
you\'re able to protect the path. What I\'m trying to do also is \-- was
cover the microwave effect. You definitely wouldn\'t have a microwave in
your voting station, talking to another voting station. But you may use
microwave on the top of your building to transmit and in that case you
can\'t protect the path either from a physical means. So you have to be
prepared for interference from that path.

Did that clarify what I mean by a wireless path?

MALE: That\'s very helpful. And I think it\'s a good list.

MALE: So based on my description of that, if I add other descriptions
similar to that to these issues, will that satisfy Dr. Harding\'s \--

MALE: (indiscernible) \[laughter\]

MALE: Okay, there\'s a proposal or understanding here that the other
data in the very near future draft some language that would elaborate a
little more for the layman, explaining some of the goals of this section
and making it accessible. Is that the \--

MALE: That\'s my understanding.

MALE: Okay. And I think then further some of the more detailed
requirements to adequately protect RF would go into an annex because I
think we share a concern like if someone is using 80211 that there\'s a
fairly careful review that we want to make sure happens so that \-- of
specific implementation.

MALE: And so that \-- yes, and then those detailed analyses of the
expectations would be in an appendix or some other kind of agreed format
that doesn\'t confuse the average (indiscernible) from the reading of
these regs.

MALE: I think there are two separate issues here, if I may suggest. One
is what recommendations \-- what goes into the guidelines in terms of
what\'s a requirement of the guidelines, what are the shalls and
shoulds? And then the question is how best to organize it and present it
to the audience? And as much as possible I\'d like to suggest we defer
the latter, well motivated as they are, clearly, because we need to make
this communicable to everyone until we understand what\'s in the
guidelines and then we know what we\'re explaining so that we have a
package of recommendations that vendors know what they can bill to and
election officials know.

So I suggest we go through these as they are to figure out what we like
and what we don\'t like there and then organize them appropriately. If
we don\'t like any of them, there\'s nothing to worry about. If we like
them all, we have to \-- okay? Let\'s try that methodology. My concern,
just to express it, is that on some of these in the abstract when we
have problems agreeing until we know, if you will, what the test plan is
going to be and what the specific implementation is going to look like.
But let\'s go that way and see if we end up with that problem.

MR. CHAIRMAN: Good. Okay. So we are then back to, if we go sequentially
\-- is going sequentially all right with what we\'ve been doing? Should
we do that?

MALE: Correct. We\'ve been doing it sequentially, yes.

MR. CHAIRMAN: So, 60326 is the current topic of discussion, and I \-- my
notes don\'t have any suggestive mods to that yet, although I know
there\'s considerable discussion, but I wasn\'t taking careful notes on
that. Do we have any agreed-upon modifications to any of this yet or
suggestions? Are we happy with this?

MALE: (indiscernible) take it out.

MALE: Leave it out, yeah. Repeat any motions regarding this that were
previously made.

MALE: These three requirements here received a great deal of discussion
before lunch and at lunch. I think maybe on this one I\'ll suggest we
can try and craft some language here but it\'s liable to be rather time
consuming, to be honest.

MALE: So, you\'re not happy with the language but you\'re not sure what
to propose at this stage?

MALE: Yeah. Before lunch I had made a motion to remove these sections as
really being adequately covered in the FCC equipment grant requirements
of anything that would have a radio built in. My concern specifically is
that frequencies are the domain of the FCC and those are carefully
controlled, so even if you don\'t like what they do, you don\'t have
much purview in changing them. In 262 many common technologies that are
available don\'t allow dynamic power control. I would note that it\'s a
should so \--

MALE: As is 261.

MALE: Well, I\'ve gone from 261, which talks about frequency to 262,
which talks about power control. And in 263, there the concern is that
the people who are using wireless understand the environment and
understand, you know, the potential problems with it. My concern is that
I don\'t know that this is the most effective remedy. To do an RF site
survey at each polling place is going to be at least 3,000 to 5,000.
It\'s going to take some specialized people with the right equipment.
I\'m not sure it\'s the best way to address the concern, although the
concern is very real. When you use wireless, you need to understand the
environment. You need to understand the environment may be hostile to
the use of that technology, and you need to know how to apply
appropriate remedies.

MR. CHAIRMAN: So I\'d like to make progress, so either a motion a
delete, a motion to leave as it is because they\'re all shoulds, or a
volunteering to rewrite on the (indiscernible).

MALE: He moved to delete, I\'ll second it, and I guess I would add to
that if staff wants to come back with alternative language that meets
some intent that we\'re deleting here then they do so.

MALE: I\'d like to ask Dr. Seifer\'s opinion on that. Do you like that
approach, or would you like to \--

MALE: Well, I would not like to delete them. They are shoulds. They are
not shalls. That\'s the stand I\'m going to take. And I have a concern
in doing my research with the community is that they don\'t know the
problems with wireless inherent in their system. And so it was an
education process on mine learning how they do things, but I believe it
was also an education process on the other side learning how their
systems are vulnerable that they didn\'t know about.

And the 80211 is a perfect example. It\'s documented about work \-- I
can\'t think of it now. Go around and see what 80211 devices are
available and start hacking away. They don\'t know that they have 80211
that can be hackable. This is for information. Again, there is no
requirement. They should. It doesn\'t address the determined hacker to
get into your voting system.

MALE: Dr. Seifer, I\'ve got a question. You said you\'ve researched and
you\'ve basically found their knowledge lacking. But to my knowledge,
there is only two uses of wireless on the market right now. One is the
ES&S PEB with its infrared data stream, which isn\'t terribly high risk.
And the other is a process for uploading election definitions to voting
systems in a warehouse. What other systems were you reviewing?

MALE: Well, the system to which you are referring to does more than
upload databases. It opens and closes polls, which is a very significant
thing to be protected. If I cannot send a wireless signal to open the
device, to open the poll, that\'s a very real problem for the system.
And if a poll worker doesn\'t have a way around it or know that that\'s
a possible point of a problem, it\'s important. The same thing goes for
the closing of the poll. I need to protect that closing of the poll
signal as well. And if they don\'t know that there might be other
devices in the area that use that same channel beyond our control, and
it could be a warehouse, and the example was in a warehouse. There were
three other 80211 devices running. So, I\'m trying to give guidance to
say \--

MALE: Mr. Chairman?

MR. CHAIRMAN: Yes.

MALE: I hear our staff\'s words, and I think what he\'s referencing here
is this is unexplored territory. And perhaps this could be better served
as an information piece or a white paper piece on an addendum section
for this particular area because, you know, it\'s really uncharted \--
thank you \-- territory. And as you \--

MR. CHAIRMAN: So the motivational \-- let me let you finish. Sorry.

MALE: \-- of these three sections. So it\'s an information piece that we
need to explore this because we can\'t really \-- we\'re not in a good
position to regulate it well. So let\'s identify it as one of those high
risk areas, as we\'ve already articulated, and leave it at that, because
we don\'t want this to be a show stopper here for 06.

MALE: Well, I think equally we don\'t want to put something here because
of our current time pressure and then find it starts to propagate
because that was in version one and, you know, you get \-- start setting
precedence.

MR. CHAIRMAN: I think we have a motion on the floor to delete and then
\-- which was seconded. Is that correct?

MALE: Yes, it is.

MR. CHAIRMAN: In which case, is there more discussion on that motion per
se?

MALE: (indiscernible) informational piece. (indiscernible)

MR. CHAIRMAN: I think we\'re talking about deleting the section 60326.
Is that correct? The motion on the floor is to delete \-- so the general
\-- certainly, the resolution in the past saying that use of wireless
introduces severe risk and should be approached with extreme caution is
on the record and available \-- and deleting the sections wouldn\'t do
that \--

FEMALE: Yeah. I mean, I think you\'re going to a step further, which is
to say \-- I\'m not sure that conveying information to voting officials
about how to best use wireless technology ought to even be in a should,
but that seems to be the only available instrument we have to work with,
but we certainly have other places where there\'s informative text that
aren\'t phrased as one of the requirements.

MALE: Right.

MR. CHAIRMAN: So it sounds like to me there are two separate issues on
the table here. One is what to do with 60326 as drafted and the other is
to whether we should add an informative piece, which would further
elaborate on some of the risks involved in wireless.

MALE: Right.

MR. CHAIRMAN: So maybe if we could treat those as two separate motions,
if you like and proceed with the first one.

MALE: (indiscernible)

MR. CHAIRMAN: I\'m ready to call the question. Okay. Should we do it
voice vote, or do we want to have a \--

MALE: Take a voice vote and then if it\'s unclear then we\'ll call the
roll call.

MR. CHAIRMAN: Voice vote. All in favor?

PARTICIPANTS: Aye

MR. CHAIRMAN: All opposed? Okay, so that passes. So we have deleted
60326.

MALE: (indiscernible) informational piece (indiscernible).

MALE: I\'ll second that.

MR. CHAIRMAN: This would be to be placed where? At the beginning of the
section 603, or somewhere else, or don\'t you care?

FEMALE: I think we have a body of text at the beginning of 603 that
would be easy enough to redraft the sense of these three things into a
paragraph that would be added to that, I mean, without creating whole
new structures and \--

MR. CHAIRMAN: Yes? Was somebody on the dial in?

CALL-IN FEMALE: Yes, Mr. Chairman, could the motion be repeated? We
couldn\'t hear it. The microphone wasn\'t on.

MR. CHAIRMAN: My apologies. The motion that was just passed, and if you
didn\'t hear it and you want to express a \--

CALL-IN FEMALE: The motion that was passed, I heard it.

MR. CHAIRMAN: Sorry. The new motion was to \-- needs to be precisely
stated. Thank you for correcting \-- was to have an additional \-- if I
can try to phrase it \-- was to have an additional section added to the
introductory portion of 603, which would be informational in content,
which would convey the motivation for the detect section 60326.

CALL-IN FEMALE: Thank you.

MALE: Ask somebody to make that motion and somebody to second it.

FEMALE: I so move.

MR. CHAIRMAN: Move seconded?

MALE: I\'ll second.

MR. CHAIRMAN: Seconded, okay. Further discussion?

MALE: I would just say I think this is a very important point and I look
forward to the contribution.

MR. CHAIRMAN: Other discussion? Anybody in the dial-in? So the voice
vote then? All in favor?

PARTICIPANTS: Aye.

MR. CHAIRMAN: All against? Motion passes. So let\'s move on to 6033.

MALE: This section is trying to identify the wireless usage. Wireless
can be hidden anywhere and this is the point to call out, if you have a
device, you know, it\'s wireless, and you know how to deal with it from
there. So, it\'s just again trying to identify that whoever is using it
knows that the wireless is there and available. So that\'s 331. You
should have the capability of turning wireless there. It\'s there.

332 is you have to have a capability to know that it\'s on, when
wireless is on and when it is not on. And the sub-bullet item there is
we hoped the indication would be visual, but it\'s not a requirement.

333 we need to label the system to make sure what wireless it\'s using.
So if you do have the knowledge to know that there\'s other
interferings, you know what\'s going to be interfered with.

Okay, that completes 6033.

On to 34, protecting the data \-- transmitted data. This is the critical
information that almost everybody is concerned about for using wireless.
It\'s the actual data. Listed here as the examples are those
informations that are being currently used by wireless. So, first
requirement is to make that all information transmitted by wireless
communications shall be encrypted. The only exception to that is the
wireless coupling for the T coil because that is in the section 227 for
usability and accessibility requirement. The term wireless is again used
there. And so I had to \-- since I couldn\'t change the text, because
that\'s what they call it, I had to accommodate it. So that\'s the only
exception to encryption.

MR. CHAIRMAN: So we\'re talking about 60341 now?

MALE: Correct.

MR. CHAIRMAN: I had a proposed change to that \-- I\'m not sure how \--
does the chair make motions on \--

MALE: You can state it and have somebody adopt it.

MR. CHAIRMAN: (indiscernible) shall be encrypted and authenticated to
the cryptographer. Encryption and authentication are different
techniques, and encryption by itself does not provide any message
integrity. So that I would add the word and authenticated after
encrypted in 60341 and 603412.

MALE: Okay. Except for the integrity, we\'re only looking at
authentication right now. Are you counting digital signage as an
encryption? If individual ballots (indiscernible) counts or passwords
are transmitted that\'s confidentiality and integrity if valid
definition (indiscernible) \--

MR. CHAIRMAN: Authentication is an integrity mechanism, yes.

MALE: Okay.

MR. CHAIRMAN: Encryption provides the confidentiality \-- exactly.
Encryption is the common technique for providing confidentiality, a
message authentication code or a digital signature is the common
cryptographic techniques for providing authentication. The section as it
is just talks about confidentiality as encryption and neglects the very
important concern about integrity. And so I suggest that we add the word
and authentication there, leaving the technique again up to the vendors
that it has to be provided.

MALE: Do you need somebody to make that motion?

MR. CHAIRMAN: Yes, please.

MALE: Okay. With your permission, I\'d like to add one change to it. And
that is I suggest we change wireless coupling to wireless T coil
coupling so that it\'s absolutely clear what that means.

MR. CHAIRMAN: Where does that appear?

MALE: Second line \-- line 39 on page 655. So, I would move adding and
authentication, as you proposed, and wireless coupling to wireless T
coil coupling.

MR. CHAIRMAN: So we have a \--

FEMALE: Second.

MR. CHAIRMAN: \-- motion on the floor seconded for \--

MALE: (indiscernible)

MALE: I have a comment to address to that. We would have to update
section 227 to reflect the same terminology so there\'s no confusion
because that was the terminology used from that section.

MALE: Good point. And I think that probably should be done in the
reference standards that are incorporated. You will find a technical
definition of T coil. So we can point to that.

FEMALE: (indiscernible) and it\'s a section we\'re already
(indiscernible).

MR. CHAIRMAN: So we have a motion on the floor for an update to 60341
and the revision to 227, I guess, we can look at later or \-- I\'m not
sure where that is.

FEMALE: That\'s a section we\'re already revising in any event to
reflect one of the standards. So we can \--

MR. CHAIRMAN: Corresponding change there as appropriate.

FEMALE: I think we can take that as an edit for simple consistency in
editing.

MR. CHAIRMAN: Yeah. It\'s not uncommon in the literature to have the
word encryption used in a way that implies that it\'s being used for
integrity purposes as well. But it\'s a bit of a misuse and I think that
we should be clear here and use encryption when we\'re talking about
confidentiality and just authentication. We want authentication as well.

FEMALE: I think we\'re all there. Let\'s vote on it.

MR. CHAIRMAN: Yeah. All in favor?

PARTICIPANTS: Aye.

MR. CHAIRMAN: Any opposed? The motion passes. So that\'s 60341 with
those two changes, adding the word and authentication and adding the
word T coil there. There was a similar change, I think, for 603412 that
should follow. I think we just propose that as an edit.

FEMALE: We add authentication to that paragraph?

MALE: 412 is \--

MR. CHAIRMAN: 603412, yeah, where it says encrypted \--

**\[End of Audiotape 7, side A\]**

MR. CHAIRMAN: \-- be encrypted and authenticated shall not be present
would be the motion that I understand. So we have a proposal, a second.
All in favor?

PARTICIPANTS: Aye.

MR. CHAIRMAN: All against? Motion passes. So we have those changes. Are
we ready to move on to 6035?

MALE: Actually in that sub point 4121, I think for consistency we may
want to change the subject to wireless T coil coupling. That\'s what you
intended there, isn\'t it David?

MALE: Yeah, again, that\'s the text extracted from 227. Yeah, 2272, I
actually \--

MALE: For consistency, let\'s just use the same term and \--

FEMALE: I think we can take that as an edit and not as an amendment.

MALE: Okay, very good.

MR. CHAIRMAN: 6035?

MALE: 6035 that\'s protecting the wireless path, which I discussed
earlier to try to give what I meant by wireless path. Again, some of
these wireless technologies you cannot protect the path. It\'s not like
protecting cable. So if I cannot protect the path, I have to be prepared
for denial of service attack for that access and that\'s what this
section tries to make the system and users aware of. If you can\'t
protect the path, you cannot guarantee delivery. So \--

MR. CHAIRMAN: 6035 doesn\'t enter the period. I\'m not sure what the \--

MALE: Doesn\'t what?

MR. CHAIRMAN: \-- the (indiscernible) construction is there.

FEMALE: I just have a question. I don\'t quite understand 60352 at the
top of A675. Do you mean shall function even if \-- if the wireless goes
down then it still functions properly?

MALE: (indiscernible)

FEMALE: It just says shall function as if the wireless capability were
never available for use. Oh, I see. You\'re seeing this as a series of
clauses.

MALE: If you cannot guarantee the path \--

FEMALE: No, I just \-- I\'m not questioning it. I just didn\'t
understand it.

MALE: Okay. So the first comment was there\'s a missing period in 60351.

FEMALE: And the reason that paragraph is missing is because you\'ve
taken a complex sentence and broken it into clauses.

MR. CHAIRMAN: 60351, if we just add a period, it doesn\'t make a lot of
sense.

FEMALE: Right.

MR. CHAIRMAN: The main \-- it just says the voting system \--

FEMALE: I think if we all agree on the sense of these together, I think
we could take this as an edit comment for clarity and not have to debate
the exact wording and let someone clear it up. I think this is a
paragraph that was broken up into clauses. And it \--

MR. CHAIRMAN: (indiscernible)

FEMALE: \-- it\'s all three or four of them in a row that\'s really one
big sentence. If you read them together, they make sense. If you read
them separately, they don\'t.

MR. CHAIRMAN: I think that\'s a useful suggestion. If we read them
together, do we have comments?

FEMALE: I\'m just saying \--

MR. CHAIRMAN: Yes.

FEMALE: \-- if we agree on them, we can just \--

MR. CHAIRMAN: We can do the editing later, yes.

FEMALE: \-- let (indiscernible) handle this as an edit.

MR. CHAIRMAN: No motions? Shall we move on and consider that an edit?

MALE: It\'s just an editing note, right?

FEMALE: Yeah.

MR. CHAIRMAN: 60354 is a new sentence.

FEMALE: Yup.

MR. CHAIRMAN: Okay. 60355? Do we have \--

MALE: (indiscernible)

MR. CHAIRMAN: 55 comments?

MALE: Okay. Can we go onto protecting the voting system from wireless
based attacks?

MR. CHAIRMAN: 6036?

MALE: Okay, the concern here is, as I made mention and left it up here,
there\'s another aspect to having wireless added to the system. You are
no longer just worried about protecting the data you transmit. You now
have to worry about another door, another window of opportunity for that
system to be potentially hacked from another device. And so that\'s what
this section is for. Now, all of the requirements in the section are the
same requirements that are in DSS 202.

FEMALE: Okay. So you\'ve just moved these forward and called them out
specifically as also applying to wireless?

MALE: Correct.

FEMALE: Sounds great.

MALE: The only additional was the one extra leaf about 3621, which was
to make a good design \-- we\'re not doing design specs here. We don\'t
want to be putting wireless communication in there that screws up your
system.

FEMALE: Okay.

MALE: Okay. Last page, 6-59. The log requirement, the leaf added here is
what we want to be added to the log and then 365 is authentication. We
want the devices authenticated that are in the system and we want the
user who is using those systems authenticated because you don\'t want
systems coming in that aren\'t supposed to be in the system. Okay.

FEMALE: Sounds good.

MR. CHAIRMAN: Any further comments? Are we done with wireless? What\'s
the procedure?

MALE: (indiscernible)

FEMALE: (indiscernible) changes. There\'s only one that\'s moving it to
an informational section. (indiscernible)

MALE: So we can go ahead and go with the motion then?

FEMALE: (indiscernible)

MALE: (indiscernible) this here.

MR. CHAIRMAN: Start here?

MALE: Uh-huh (affirmative).

MR. CHAIRMAN: So are there any more motions or requests for unanimous
consent to change the content of the overview of security requirements
\-- no, this is not the right section. \[laughs\] It\'s the wireless we
just did. Right here. To change the content of the wireless requirements
for VVSG, version 1, that we have just reviewed? There being no further
motions to change VVSG, version 1, volume 1, section 603, I will now
entertain a motion for the TGDC to adopt this draft of section 603 as
part of its first set of recommendations to the executive director of
the AAC, subject to changes expressed and any motions we have adopted
today expressly applied to section 603, which changes shall be made
pursuant to TGDC resolution number 3705.

MALE: (indiscernible) after discussion.

MR. CHAIRMAN: So it\'s moved and seconded, okay. Please call a roll
call, Mr. Green.

MALE: Berger.

BERGER: Yes.

MALE: Craft?

PRATT: Yes.

MALE: Davidson?

DAVIDSON: Yes.

MALE: All three voted yes. Eliquise?

ELIQUISE: Yes.

MALE: Eliquise votes yes. Harding? Harding has stepped out. Miller?

MILLER: Yes.

MALE: Miller votes yes. Purcell?

PURCELL: Yes.

MALE: Purcell votes yes. Quesenbery?

QUESENBERY: Yes.

MALE: Quesenbery votes yes. Rivest?

RIVEST: Yes.

MALE: Rivest votes yes. Schutzer?

SCHUTZER: Yes.

MALE: Schutzer votes yes. That\'s nine votes in favor. The motion
passes.

MR. CHAIRMAN: The motion passe. Thank you. So we\'re not finished with
the wireless section. Before we move on to the next section, notice from
our parliamentarian.

PARLIAMENTARIAN: Yes. I just need to make a statement of the record.
This is for the benefit of our audience members, both via Internet, as
well as those present. There\'s been reference to conversations which
took place over lunch, these being one-on-one conversations between
members of the TGDS and perhaps members of the audience, as well as
among themselves. Since we are a federal advisory committee, I want to
assure the audience members that no decision making has taken place
outside the public confines of this meeting. All decisions which have
been made by the TGDC are being made and fully discussed on the record.
So despite those references to those legally conducted one-on-one
conversations, I want to assure everybody we\'re in compliance with the
federal advisory law.

MR. CHAIRMAN: Thank you, Mr. (indiscernible). So I propose we proceed on
with the next section.

MALE: Mr. Chair?

MR. CHAIRMAN: Yes.

MALE: We have two issues that I\'d like to go back to and verify a paper
audit trail section, if we may.

MR. CHAIRMAN: We do have a time set aside later, I think, for going over
that, or not \--

MALE: Oh do we? Okay. Okay.

MR. CHAIRMAN: So there will be an opportunity to do that. So at this
time, we can move on to section 604, distribution of voting systems
software and set up validation.

FEMALE: (indiscernible) finish up the (indiscernible) first before going
on to that? (indiscernible)

MALE: (indiscernible)

MR. CHAIRMAN: Let\'s wait a little bit. Let\'s do the \-- so Nelson
Hastings can lead us through this section.

MALE: Okay. Good afternoon, everybody. I was hoping to say good
afternoon yesterday to you guys, but we have fallen a little bit behind.
But so \-- I\'m going to talk about software distribution and set up
validation requirements.

We\'ll start off with a little bit of background. There\'s two slides
there. And then we\'ll just start going through the requirements. I\'ve
got summaries on the slides with references to the requirement numbers
in there. So we\'ll just start doing that.

This section is to respond to the resolutions 1505, software
distribution, and 1605, set up validation. And so the goals of those are
to determine whether the identified voting software has been distributed
without modification for software distribution and for set up validation
to ensure that the system only contains authorized voting software and
no unauthorized voting software is installed and the systems are in
proper initial state.

Just a little bit of changes from last time that we met. The two
original documents were combined to form the one section. The detailed
analysis and scope that was in the previous two documents were removed
or reduced to include readability. Some refinance in addition to the
original requirements that were proposed at the last meeting and finally
the correspondence between the requirements in VSSA and IEEE that were
included last time have been removed to reduce complexity of the
document. However, those relevant sections in the VSS and IEEE were
considered during the development of these requirements.

So, we can start off \-- I guess we\'re on 660 \-- is where the
requirements begin in the draft that you have. And the first
requirements in software distribution requirements are just essentially
documentation requirements to enumerate all software that\'s supposed to
be on the system, including third party software.

The sub \-- the first sub requirement basically just says you need to
enumerate some of the things that should be found in the documentation,
such as file names, locations, possibly memory and those types of
things.

The second sub requirement basically wants to designate \-- to filter
the files to show whether it\'s a static file that doesn\'t change from
election to election or if it\'s a file that changes based on the
different election or if it\'s a file that changes continuously while
the system is in operation. So \-- basically so you can determine what
pieces of software you can actually provide a hash value for a digital
signature for later on.

The next requirements basically relate to the testing authorities,
witnessing the build of the final qualified system. The first sub
requirement basically says a complete record of the final build should
be created in details some things, such as the time, location, who was
present, the configuration of the compiler, those types of things.

The second sub requirement basically says that the source code that was
used and the executables that resulted from that compilation or that
build would be placed on the right once media is uniquely labeled. So
you could say this is the origin of the software. And those records
should be kept by the testing authorities until disqualification of the
voting system.

The next one talks about testing authorities \-- the next requirements
relate to testing authorities distributing a subset of final record of
the build. So places such as (indiscernible) or all other repositories
can use that software to generate hash values, digital signatures, those
types of things.

This first bullet, sub requirement basically says that the executables
and installation programs will be placed on the right once media \-- so
no source code would be included in that distribution. Vendor \-- okay.
Okay.

MALE: We actually require source code so that when we evaluate future
revisions to the system and we\'re going through the vendors release
notes, we can actually tell where the original source was. We\'ve got
the original application that was compiled out of that source and we can
go forward into our next round of certification with a fair amount of
efficiency. So yeah, the \-- I absolutely am dependent on the labs
providing me with not only the object code that came out of the
(indiscernible) compiled but with a source code that is compiled and
with a description of the compilation environment in which they
witnessed it being compiled.

MALE: Could that be addressed by putting in a sub requirement at that
same level, basically as a should?

MALE: No. Basically, there can be no prohibition against putting source
code on this particular record. No source code going out to be installed
on sites is a problem.

MALE: Okay.

MALE: I would prohibit that. As far as going to the National Software
Reference Library, any copies back to the vendor, states that require
it, there can be no prohibition of putting source code on that media.

MALE: So, just adding say source code in addition to the executables and
the installation programs, just to add that in?

MALE: Right. Yeah.

FEMALE: (indiscernible) Where do you want to add what (indiscernible)?

MALE: Only build executables, installation programs, and the source code
from which the executables, installation programs were compiled, are
placed on right once media with unique labeling.

MR. CHAIRMAN: I\'m not sure where we\'re talking about. Do you have the
slides that \--

MALE: Okay.

MALE: I\'m on the slide.

MALE: 662.

MALE: Top of the page.

MALE: Top of the page.

MALE: So we have \--

MALE: 604124.

MALE: 604124 is good. Okay.

MR. CHAIRMAN: So we have a proposal to modify 604124 and the particular
language again?

MALE: Well, I want to get the source code in the (indiscernible)
\[laughter\] I don\'t care what we call it.

MR. CHAIRMAN: So this is \--

MALE: Just put source code as an \-- to the left.

FEMALE: (indiscernible)

MALE: Yeah. Well, I want this disk to contain both the source code use
for the bill and the file resulting from the bill.

FEMALE: That\'s already required, isn\'t it?

MALE: Not in the subset. Remember?

FEMALE: (indiscernible)

MR. CHAIRMAN: So 604124 is talking about the testing authorities and
what they retain and not something that\'s distributed yet. This is all
under 60412, which is talking about the testing authority shall witness
the final build. And then they have a record that\'s created. So I think
that your comment may be addressed to a later section, Paul?

MALE: Say that \--

FEMALE: (indiscernible) 604122, Paul, on 661. That\'s what you want a
copy of, right?

MALE: That\'s what I want but I\'m not seeing where that flows then to
the National Software Reference Library.

FEMALE: Well the National Software Reference Library doesn\'t want that
since we don\'t accept source code. We only want the executables.

MR. CHAIRMAN: There\'s several versions of \-- if I may speak, there are
several versions that we need to create, right? One is for state
officials or election officials to use to monitor updates and so on,
which is what you\'re concerned about. There\'s the records set, which
is used to check installation, which may be a subset of that or
different anyway. And then there\'s.

MALE: There\'s the actual release media that goes to buyers in the
system.

MR. CHAIRMAN: Release media. There\'s also those that go to the NSRL,
which may be somewhat different in character as well. So there\'s a
number of different copies that are created here. So this copy of 604121
is the master copy that contains everything \--

MALE: Right.

MR. CHAIRMAN: \-- and that\'s maintained by the testing authorities. And
60412 is only talking about what\'s maintained by the testing
authorities. Is that correct, or is that talking about a distribution?

MALE: Okay, wait. 121 is able to create it.

MALE: 121 is the complete master. The 124 is the subset.

MALE: So 22 is basically requiring that 121 to be on right once media
and 123 they\'ll retain it, and then 124. Okay.

MR. CHAIRMAN: So the difference between 124 and 121 is what, Nelson?

MALE: The difference between 121 and 124 is really \-- rather there is
source code on the Write Once media, is the way I read it.

MR. CHAIRMAN: And the intention of 124 is to be used for what purposes?

MALE: For people such as the NSRL that do not wish to have the source
code available to them.

MR. CHAIRMAN: Okay. Can you continue then?

MALE: Yeah. So far.

MR. CHAIRMAN: So let\'s continue with 60413.

MALE: Okay, so back up a second, the record created under 4124 can only
be sent to the National Software Reference Library and any other
repository named by the Election Assistance Commission, but the record
in 4121, which should be all of that plus source code is sitting there
pretty much available without restriction.

Now, in the current environment what we are looking for under 421 is
proprietary / trade secret as a vendor and is released to groups such as
me or other test and review labs based on specific (indiscernible).

MR. CHAIRMAN: So 604121 does not mandate or prohibit any particular
pattern of distribution is my understanding. Is that correct?

FEMALE: Uh-huh (affirmative)

MALE: You should probably clarify that there is no pending motion.

MR. CHAIRMAN: That\'s true. There is no pending motion right now. Yes.

MALE: Okay. So where are we at now?

MALE: I think we\'ve cleared 4126, for me at any rate.

MALE: And the next subset, the next sub requirement, is basically saying
that the subset \-- the record will be kept by the testing authority
until it\'s \-- the systems default \-- disqualified. The next
requirement is that the vendors are responsible for providing the
repositories with a copy of all required third party software in order
to generate the reference hash values and digital signatures.

The next requirement \--

MALE: Let\'s go by the requirement numbers because we\'re getting lost
already.

MALE: Okay. Let\'s see. So, I\'m going to give you \--

MR. CHAIRMAN: Excuse me. Did someone just join on the dial in?

MALE: Yeah, this is Britt.

MR. CHAIRMAN: Britt, thank you.

MALE: Hey Britt, welcome back. We\'re on software distribution. I missed
you.

MR. CHAIRMAN: (indiscernible) just joined us.

MALE: So I believe we\'re at 414, is that \--

MR. CHAIRMAN: We\'re at 60414, I believe.

MALE: Okay. So, it\'s basically the same programs we distributed on our
Write Once media such as a CD. The next requirement says that the
software be received from the system vendor, an EAC testing authority or
a voting official.

The next one talks about vendors documenting the process used to verify
the software on the Write Once media, using the reference information
provided by the NSRL or an accredited repository.

When election officials receive the software, that next requirement
basically says that they\'ll check it \-- check to make sure that the
software hasn\'t been modified using the reference information.

MALE: Whoa. Whoa. Whoa. I\'m looking through the software that I receive
from the \--

FEMALE: Paul, you\'re not going to get much help from Britt if he can\'t
hear you.

MALE: Okay. So I\'m looking at that point \--

MALE: Okay.

MALE: \-- at 4143. I\'m receiving my gold copy of the witness compile
software from the lab and yet I\'m to verify that the software is a
qualified software by comparing it to the reference information produced
by the NSRL or other EAC accredited repository.

MALE: Correct.

MALE: The reason being that in transit from \-- to verify that disk
hasn\'t been substituted or something like this.

MALE: So the NRSL then is going to have to maintain two different sets
of hashes, one for this disk and another for in-style systems.

MALE: For in-style systems?

MALE: Uh-huh (affirmative). I mean the NSRL is going to have to
basically have a hash value for a system that\'s actually sitting on a
server with all of its directory structure and as it would appear once
it\'s installed but they\'re also going to have to a hash for this
particular disk because they\'re not going to (indiscernible).

MALE: That\'s correct.

MR. CHAIRMAN: There may be other techniques for achieving the same goal
and maybe we\'re getting a little low level here. I mean, a digital
signature on the information may suffice as well as you (indiscernible)
to guarantee that you\'ve received something properly from the ITAs and
they\'re digitally signing it. So perhaps I would not worry much
(indiscernible) TGDC members at here, if I may. I\'m not quite sure what
the proper procedures are. So, verify that the software installed is the
qualified software and we have a mechanism here by comparing it to
reference information produced by the NSRL or other EAC accredited
repository and maybe other techniques which are also suitable or \-- so
I\'m just trying to think of the appropriate wording.

MALE: Okay, I guess I finally figured out what\'s bothering it. The
voting system equipment shall verify that the software is a qualified
software by comparing it to the reference information produced by the
NSRL or other accredited repository before installing the equipment. So
we\'ve got the equipment now \--

MALE: So that\'s (indiscernible) one \--

MALE: \-- installing its own \--

MALE: That\'s in 4 \-- 144.

MALE: I think the system administrator should verify that the software
is a qualified software by comparing it to the reference information
before installing \--

MALE: Before he begins his installation process?

MALE: Hardware is not going to install the software itself, particularly
before the software is installed.

MR. CHAIRMAN: The voting software could check a digital signature on the
software before loading it (indiscernible) \--

MALE: Yeah, but the responsible person is a system administrator and I
don\'t want to create an environment where system administrators stand
by and say, \"Oh, it looks like it installed just fine. Okay we\'re
good.\" I want the system administrator taking responsibility for that
and since we\'re not going into election procedures here, that should be
probably a should and the system, you know, has to be configured so as
to allow that.

MR. CHAIRMAN: If a system administrator wants to install improper
software, I guess, my question would be what\'s the check? So, is there
any way to detect or prevent that?

MALE: In some states, going to jail.

MR. CHAIRMAN: So there\'s deterrents, right, but do we have a technical
means for either detecting or preventing a system administrator from
installing improper software?

MALE: No. The only thing that you can do is provide tools for the system
administrator to verify that the software is a qualified software before
installing software on the system.

MR. CHAIRMAN: So the system administrator can do that, but it could also
be the case that the system itself would check an appropriate signature
and install software without having an appropriate signature on the
software from the Secretary of State or whomever might be authorized to
approve the software for that \--

MALE: That\'s a nice theory, Ron, but (indiscernible) could be
difficult, particularly on a new box that hasn\'t had the software
installed. And somebody is going to compromise \-- if somebody is going
to compromise the software and it\'s got a self-authentication piece,
they\'ll probably compromise the self-authentication piece as well,
particularly if they\'re sophisticated enough to grab a Write Once CD at
out of the U.S. mail and manage to rewrite it and put it back in the
mail without showing any sign they did it.

MR. CHAIRMAN: Was there a comment from somebody in the dial in?

MALE: Britt.

MALE: Yeah, you don\'t really want a (indiscernible) want a system to do
a self-check. I think you want your validation software to be external,
a separate part of the system.

MR. CHAIRMAN: I\'m sorry, Britt. You\'re talking through a tunnel full
of water, it sounds like.

MALE: Okay. I\'m sorry. I\'m on a cell phone in the airport.

MR. CHAIRMAN: Just speak a little more slowly, please, and repeat
yourself.

MALE: Can you hear me now?

MR. CHAIRMAN: Yeah.

MALE: Okay, what I said was that I don\'t think you want the system to
be self-checking. I don\'t think you want that validation to come from
the vendor. You want the self-checking to be external from the system
and you want to be able to run it on command. You want the election
administrator to be able to run that anytime they want to because, you
know, you\'re not just talking about the bad guys here. You could have a
lightning strike on the tree outside that can cause your system to
hiccup. Now, did that damage it? You\'d like to know.

MR. CHAIRMAN: I think you\'re referring actually to the section that is
coming up, which is the set up validation part, which is a check on
that. Secretary Davidson?

FEMALE: Basically I think Britt was covering what I was thinking also is
not only \-- I mean, in our state, not only are we having them \-- and
this is the vendor themselves certify the software that they have in
their equipment, but it has to be on file with our office, and anytime
it\'s changed, it has to be on file. That way we\'re trying to keep more
of a permanent immediate file of software being used in the state
because we have found in the past that we didn\'t know.

MR. CHAIRMAN: So just to clarify your \-- your office actually has a
repository then of what\'s being used, or are you asking of a
distribution of cold, standard copies?

FEMALE: They are depositing with us.

MR. CHAIRMAN: Okay.

MALE: Okay, I\'d like to introduce a motion to reword 4144 to read: The
voting system equipment shall be designed so as to allow the system
administrator to verify that the software is a qualified software by
comparing it to reference information produced by the NSRL or other EAC
accredited repository.

MR. CHAIRMAN: Is there a second?

MALE: Second.

MR. CHAIRMAN: Comments? Point of clarification, Paul. Is the intent that
\-- of this motion that the voting system itself will be doing the
comparison that should be done on other systems?

MALE: No. The intent of this is that nothing in the system design shall
preclude and perhaps it will even facilitate the system administrator in
their task of validating their system at any time they want to do it.
And my hope \--

MR. CHAIRMAN: (indiscernible)

MALE: My hope is the NSRL application will be come sufficiently mature
and user friendly enough that this is a task that at that point we can
require voting system jurisdictions to do before a reelection. And if
there\'s an easily usable application out there to do that with, I think
they will. But the system must be designed to facilitate that. I\'m not
interested in a self-checking.

MR. CHAIRMAN: There\'s three steps here in my mind. Right? There\'s the
distribution of the software to the \-- and polling site or whatever,
the warehouse. There\'s the loading phase and then there\'s the check
after the loading phase, if you want to check the things have been done
properly.

MALE: Well for firm ware, basically, with current state-of-the-art,
Firmware is going to have to be validated before loading and you\'re
going to have to control getting certified Firmware on your DREs through
physical custody and access restriction. There is not really any way
with the current DREs that I\'m aware of to actually validate software
once it\'s been loaded in the DRE.

MR. CHAIRMAN: May I me interject, if nobody else had a \-- the gambling
industry has addressed the same issue too. Slot machines, they do have
procedures for routing out Firmware and comparing that the Firmware is
\--

MALE: If you want to make this a should and you want to make it a
requirement for O8 \--

MR. CHAIRMAN: I\'m just commenting that the technology exists.

MALE: I know. I know. The technology exists and there are many
technologies that exist that are not currently integrated into voting
systems. And if you\'ll make that an O8 should then that\'s something
that can be looked at, but it\'s not viable for O6.

MR. CHAIRMAN: So we have a motion on the floor, seconded. Do we have any
other comments on the motion? All right, shall. Can somebody read back
the motion as it was made and seconded?

MALE: The voting system equipment shall be designed so as to allow the
system administrator to verify the software is a qualified software by
comparing it to reference information produced by the NSRL or other EAC
accredited repository.

MR. CHAIRMAN: Period. So I\'d like to motion the question then, if I
may. Should we do a voice vote on this one?

MALE: Yeah.

MR. CHAIRMAN: All in favor?

PARTICIPANTS: Aye.

MR. CHAIRMAN: All against? Motion passes.

FEMALE: (indiscernible)

MALE: So the next requirement is basically documenting who the vendors
and testing authorities give their Write Once media to?

MALE: Yeah.

MALE: So that\'s the end of the \--

MALE: Who are they are going to provide that to?

MALE: Who will they provide what to?

MALE: Well, they\'re going to document who they provided the voting
system software at Write Once Media II for what purpose?

MALE: Just for the records.

FEMALE: We \--

MALE: To be used \--

FEMALE: We do have them certify it to us, and they have to sign a
statement under oath and I mean we do hold their feet to the fire,
trying to anyway. And we even had some, I believe, even some offenses go
with it that they haven\'t certified it to us.

MALE: The reason I put that in there is let\'s say something happens and
they burn a bunch of CDs that have a rogue file on it or something like
that. They could then trace back who they gave those specific CDs to and
clean up the mess that way.

MALE: Okay.

MALE: That\'s really what that\'s \--

MALE: Okay.

MR. CHAIRMAN: Okay, moving on to 6042.

MALE: So, 6042 is a generation of reference information requirements.
The first requirement basically says that the NSRL or repository shall
generate reference information using the qualified voting system binary
images that they receive from testing authorities. And if an election
specific software from jurisdiction.

MALE: Okay. Do you mean election specific software as, I think, my
office has provided you as samples for the hashing or are you
anticipating some other \--

MALE: I\'m anticipating possibly jurisdictions may want to put their
ballots \-- give their ballot formats to the NSRL for \-- to generate
reference information. That\'s why that specific line is in there.

MALE: Okay.

MALE: Okay. So the first sub bullet basically says that complete \-- the
reference information can take the form of complete binary images,
cryptographic hash values, or digital signatures.

The next sub bullet underneath that talks about documenting recording
\-- creating a record of the creation of the reference information. So
who created it, what type is it, what files were covered by that.

The next requirement says that the repository \-- repository \-- sorry
about that \-- shall retain the Write Once media that they generate
until the system ceases to be qualified.

The next requirement basically says that if a digital signature or a
hash value is created, that a fixed approved algorithm for hashing and
signing of the software will be used.

The next requirement basically says that when the NSRL or repository
creates a hash value or digital signature or cryptographic keys to be
used with digital signatures that they\'ll use a Phipps 140-2, level one
or higher validated module.

MALE: Okay.

MALE: The next requirement \-- oh, the next requirement basically says
that with sets of hash values or digital signatures that are used as
reference information will be a hash value or digital signature that
covers that set of hashes or digital signatures essentially.

MALE: Okay.

MALE: It\'s a little complicated. \[laughs\]

MALE: Yeah, I\'m not sure where you\'re going with that, but it\'s your
responsibility so I\'m going to leave it to you.

MALE: The next requirements actually are if public key technology is
used to create a digital signature. The first sub requirement underneath
that says a 20/48 bit key or greater will be used to do that.

The next sub requirement underneath that says that the keys will only be
used to sign \-- to create digital signatures for a period of no more
than three years and then you\'d have to change to another key.

MALE: This is within the library?

MALE: Yeah.

MALE: Okay.

MALE: The next one talks about public \-- oh, the next requirement talks
about public keys that are used to generate digital signatures shall be
put on a Write Once media or \-- oh yeah, if not contained in a signed,
non-proprietary format for distribution, such as a digital certificate.
So that\'s \--

And the next requirement basically talks about making copies of the
public key Write Once media and that data should be uniquely identified.

The next requirement talks about documenting who they provided the
public keys to. And basically the reason that requirement exists is the
next requirement so that if a private key does become compromised, they
know who they need to tell that that took place.

MR. CHAIRMAN: Let me pause here for just a second to ask if anyone on
the dial-in has any comments on what we\'ve just been over? Any
questions, suggestions?

MALE: Nope.

MR. CHAIRMAN: Okay. I\'d like to add a short one on 6042-1161, which is
the one about 20/48 bit keys. That\'s clearly an algorithm dependent
kind of parameter if you\'re using existing signature schemes. That\'s
probably fine that over time we may find that we have other algorithms
with other significant things. So, just note it in our revision for
version 2, and I\'m sure we can take care of that.

Let\'s proceed with 60422.

MALE: 60422 basically says that the NSRL and repositories will make
reference information available on the Write Once media as well as its
associated documentation so that people can know how it was created and
know what they\'re getting.

The next requirement says that the reference information \--
(indiscernible)

MR. CHAIRMAN: 6043 now, another major section.

MALE: 6043? Oh, okay. I was just down to the reference information, just
the 4221 about storing of reference information in a secured container
when it\'s not being used, if it doesn\'t have a digital signature
associated with it.

DIAL-IN MALE: I think that would need to be moved to (indiscernible)
appendix on S practices.

MALE: Okay. Continuing on. We\'re into set up validation methodology
requirements. The first one \-- the first requirement basically talks
about checking that no one authorized software is present on the voting
equipment. The first sub requirement there basically says that the
vendor shall have a process to verify that the correct software is on
the system and no one authorized software is there using the reference
information from the NSRL or other repositories.

MR. CHAIRMAN: If I could ask a question. Is there a requirement here
that this process should be disclosed to the election officials?

MALE: Well we\'ve already required that the system be designed so as to
facilitate the system administrator\'s validation of the software. I
think it\'s appropriate if you want to move to a best practices part of
the document, that set of validation should verify that no one
authorized software is present from the voting equipment, but I \--

MR. CHAIRMAN: This is a documentation requirement is my understanding.
The vendor shall specify at least one process to the submission process
and for use by the election officials.

MALE: Well this is the vendor shall have a process \--

MR. CHAIRMAN: That\'s why I was noting that \--

MALE: So, let\'s say vendor shall \-- user documentation shall include a
process to verify.

MALE: Actually, let me point out that if you go down to 3112 there is a
vendor documentation requirement at that point.

MR. CHAIRMAN: Oh good. Okay.

MALE: Then we just need to strike 311 \--

DIAL-IN MALE: I would prefer to a see a requirement that the vendor be
able to provide you with a list of every file on that system, including
all of the files that come in from other, you know, software that he\'s
included in the system.

MR. CHAIRMAN: I think we have that already.

MALE: We don\'t have that in the user documentation. I think we have it
in a technical data package and the information provided, the NSRL.

MR. CHAIRMAN: So we have what sounds like an additional question to be
added. Are you making a motion?

MALE: I\'ll make a motion. I\'d like to see 60431 in its entirety.

**\[End of Audiotape 7\]**

MALE: \-- the system, additional files that would be created during
system use and basically any steps and process, I mean, I don't want to
re-write the whole thing at the table right now. But, yeah. I think they
have to present their users with a process that has to be documented.
The information has to be there.

MALE: Is that a full \-- is that a motion that you're making or is that?

MALE: It's kind of a half-baked one. \[laughing\]

MALE: It sounded like a wish list or something.

MALE: Britt, jump in 'most any time. \[laughing\] We lose Britt?

MALE: J.R., what page are we on?

MALE: We're on page 6-67.

MALE: (indiscernible)

MALE: 6.0.4.3. We're \-- we're addressing the setup validation which is
a response to one of the resolutions we passed earlier. Technically,
this is a challenging problem because you're talking about validating
the system to set up properly in a situation we don't know the system
has the correct software so you can't trust the software that's running
on the system to help you with a check much when you're starting off and
so I think some of the detail that went into this section actually
reflects the technical challenges there of adjusting that difficulty.

MALE: Well, actually, it ain't that hard. You do an f-disk if you've got
any doubt about what's on the machine. You reinstall the operating
systems, the supporting Cott's (phonetic sp.) elements, you get the
vendor's actual release disk, you take steps to authenticate that back
against what was qualified, and do an install \--

MALE: That's (indiscernible).

MALE: \-- and then you put it under a password and put it in a locked
room.

MALE: If I may, that's solving a different question. That's \-- that's
how to do a install with confidence if you got the right system \--

MALE: That \--

MALE: \-- but what the resolution is for \--.

MALE: \-- doing an install better include sy \-- setup validation. Setup
begins with your install and that goes through security and maintenance.

MALE: Absolutely. What you're doing should be part of the process.
Absolutely. But we have a requirement based on our previous resolution
that it be possible for an election official to validate that the
machine he's got in front of him contains all and only the proper
software. And that's something you don't want the election official
re-installing all of the system after it's delivered. If you pull a
machine out of \--.

MALE: Exactly, Ron. That's where I'm going. Validation of your software
is not setup. Validation of the software was back a couple of pages \--

MALE: Setup validation.

MALE: \-- where we, in 4.1.4.4, where we passed a resolution, the voting
system equipment shall be designed so as to allow the system
administrator \-- or to verify the software is qualified. Now, we're
talking about setup validation.

MALE: Yes.

MALE: And setup validation involves making sure you do it right,
basically. It ain't rocket science.

MALE: Secretary Davidson?

FEMALE: I just wanna make sure, this is \-- at the time you receive the
equipment or at the time it's \-- any maintenance is gone on \--

MALE: Right.

FEMALE: \-- a vendor has been in and worked on the equipment at all, you
want to be able to verify the software.

MALE: Yeah. Or any time \--

FEMALE: Or the firmware.

MALE: \-- or any time that you've lost custody of some passwords or
security of your computer room.

FEMALE: Okay.

MALE: You want to be able to do that without re-installing everything.

MALE: Right.

FEMALE: And I just want to make sure it covered everything.

MALE: Yeah. And one of them back on the prior motion, is the ability to
walk in there any time and validate what you've got. And now we're
talking about software distribution and how to validate that you've
properly installed the system.

MALE: No, I think we've changed sections, Paul. We're down to 6.0.4.3
which is a new major section.

MALE: Right. Which is validation methodology requirements.

MALE: Yep. So now I believe we're responsive to a different \-- there
are two resolutions we passed in January. One was having to do with
software distribution; one was having to do with setup validation. They
were different. The prior sections that we've been discussing up to now
have to do with software distribution. We've now made a major change in
our focus. 6.0.4.3 is talking about setup validation, the ability to
take a machine and check that the \-- its configuration is entirely
proper without having to \-- to re-install the software.

MALE: Then you can strike that 'cause you've already covered it in
4.1.4.4.

MALE: John, can I say a word about this?

MALE: Please!

MALE: Please!

MALE: This is Britt.

\[laughing\]

MALE: I missed part of Paul's discussion so this may be out of place a
little bit. But in \-- in the area of best practices, generally, you
want the vendor to install the system. And the reason for that is
because of warranties. If you install the system or anybody other than
the vendor installs the system and you got problems, they're gonna come
back and say well, you didn't install it right. So our practice is to
let the vendor install the system. And then when they get through, we go
out with our validation tools and validate what they've installed is, in
fact, what it's supposed to be.

MALE: That sounds entirely consistent with what the goal is here, yes.
Good!

So if I may comment to your suggestion, Paul, unless somebody else wants
to speak. I'm wearing two hats here, both as a member of that chair, so
I apologize to the members. I hope everybody's getting a chance to speak
when they want to.

But I wanted to comment to Paul's suggest that 6.0.4.1.4.4 addresses
that. I believe it does not because it says the voting system equipment
shall verify and I think we need to have \--.

MALE: No, it doesn't. It says the voting system equipment shall be
designed so as to allow the system administrator to verify. That
resolution passed.

MALE: Oh, this is a change.

MALE: 4.1.4.4. That passed.

MALE: Yes, I guess I don't have that written down in my notes here. That
was \-- read it to me again?

MALE: The voting system equipment shall be designed so as to allow the
system administrator to verify the software is a qualified software by
comparing it to reference information produced by the NSRL or other
EAC-accredited repository. Period.

MALE: And the process for doing such needs to be specified somehow,
right, so there's something missing there.

MALE: Yes.

MALE: And that \-- so this adds \-- this adds a requirement.

MALE: I think there's already \-- vendor shall document the process in
4.1.4.2. Vendor shall document the process used to verify the software
distributed on write-once media is a qualified software using the
reference information provided by the NSRL or other EAC-accredited
repository.

MALE: So I don't think we're quite covering all the bases there, myself.
There's \-- there's an issue when you're veri \-- doing setup validation
of checking that the software you want is the correct software, which is
partly what you've got covered. But then there's also the issue of
making sure that there's no \-- nothing unauthorized on the machine.

MALE: Right.

MALE: And that's not covered by the previous resolution.

MALE: And that can be covered if you have any doubts by doing f-disk on
the machine and re-installing the Cott's environment for the system and
re-installing the software.

MALE: It could be done (indiscernible) way. I don't believe that's
consistent with our previous resolution which asks for a way of doing
that without running or modifying the software in the system. That's my
(indiscernible).

MR. CHAIRMAN: If I \-- if I may \--

MALE: I came in the middle of this.

MALE: It would be great if you would please resume this chair
(indiscernible). I've been wearing (indiscernible).

MR. CHAIRMAN: I thought the whole idea was not to re-install anything.
And by doing what you suggest is, you're sort of going back to square
one.

MALE: No, sir. 4.1.4.4 handles do \-- validation without re-installing
anything. And then Dr. Rivest asked the what if you don't know. Well,
what if you don't know you've lost custody and you don't have time to
audit the entire system, then you do an f-disk and it re-installs
everything. It's your choice.

MALE: There's two different goals. One is making sure that you've got it
in the correct configuration. And the other's checking to see if it's in
the correct configuration.

MALE: Right.

MALE: Those are different operations. The resolution we passed asked to
solve the second. We're proposing a mechanism for the first. So if
you're just re-installing, you're just wiping out any evidence of
tampering. That's all.

MALE: I would only advocate re-installing as a last resort. If you're
incapable of following the vendor's instructions in 4.1.4.2 and
following whatever methodology is brought forth in 4.1.4.4. But \--

MALE: I believe \--.

MALE: Yeah, and if you can't do that, then your only real option is to
re-install.

MALE: Ron.

MALE: Let me see if I can \-- what I understand going on is \-- is the
previous section was dealing more with the initial installation process.
And what I've understood is that this section 6.0.4.3 is at some point
in the future, when you need to go back and re-validate \-- I think the
different types of occurrences, you've lost control of the system or
something, your passwords, whatever \--

MALE: Validation \--.

MALE: \-- (indiscernible) to them, simply say, "We have a system here.
It's been installed. We think it's done incorrectly. We want to do a
re-validation."

MALE: Validation is identical in steps and goal whether you do it during
your install, five minutes after your install, or five years after your
install. You have to be able to walk up to a system, sit down, and do an
analysis and validate the code on it. That should be done as part of the
acceptance testing when a system is purchased and installed. It should
be done any time there is a question as to a loss of custody or
corruption of the software. It should be done anytime there's an upgrade
to the software. Validation is validation.

MALE: Okay. But 6.0.4.3 is simply going into a little more detail than
what was covered in the previous sections. Then move it to the best
practices section where it belongs.

MALE: This requires documentation on the part of the vendor so it's
specific information about what the vendor needs to supply. You know,
for example, the process shall not modify the voting system software and
the voting system during the verification (indiscernible).

MALE: Well, let's concentrate \-- let's concentrate on what we want the
vendor to design, publish, and provide to the user. And get away from
this vendor shall have a process da, da, da, da.

MALE: That's a high-level requirement. We have a \-- Nelson led us
through these, but we have a requirement that the vendor have a process
for doing this setup validation, that it doesn't require execution of
software on the target machine. Shall document it. Shall not modify
things on the target machine. Those are the three leaf bullets there.

MALE: Right. Good.

MALE: Those are pretty clear.

MALE: How are you going to validate the system or target machine without
running something if nothing more than a directory command on the target
machine?

MALE: You need to have access to the memory. There \-- there's a, you
know, standard practice for doing these kind of things where you look at
the memory without executing. A directory listing is the first place a
hacker will target \--

MALE: (indiscernible)

MALE: \-- if you try to modify it, so, I mean. Right. So you know that.

MALE: So you want an application that will give you direct access to a
memory on a server?

MALE: I think it's one \-- one of the approaches that you could use for
this \-- this is used in the gambling industry all the time. You have an
approach for examining the memory of a computation system without
running any processes on the computation system. It's essentially what
you want to do. Right? You've got a question as to what are the bits on
that machine \--

MALE: Uh-huh. (affirmative)

MALE: \-- and you wanna do that \-- what are the bits on the machine?
\-- without running any processes on that machine. So you have to have
access to the bits in the way that doesn't change any of the bits or run
any processes on that machine. That's the essential requirement for
doing this properly. So it may involve a second memory port or something
like that that you have access to for this process.

MALE: Ron, I just don't see how you are going to, with any confidence,
examine the bit map of a machine's memory which changes continually in
use at every state, changes during its history, changes every time you
boot up \--

MALE: It's a separate validation.

MALE: \-- and reach any kind of conclusion.

MALE: That \-- that's standard practice in the gambling industry, as I
said. You know, they take that machine, they can walk up to it and do
it. I don't think this is something you'd wanna do during the voting
process. We're talking about setup here and \-- and being able to tell
at the beginning of the day if you've polled a machine, is it in the
right initial configuration which is well defined and reasonably static
or static. Except for maybe the clock or something if you're running a
clock.

FEMALE: Well, I wonder if this is an appropriate point to ask whether
this is stuff that can be done on existing machines or whether this is
shoulds for the future.

MALE: I think it is at least stuff for the future.

FEMALE: I mean \--.

MALE: I think if you \-- if you verify the CD that you've got is, in
fact, the qualified system, you verify that you have the proper
environment for it, and you install it, I don't think you need to go in
and tap into the machine's memory and do an analysis to make sure it's
installed properly.

FEMALE: I mean \-- I mean I hear a very interesting conversation, but
I'm also hearing that this is something (indiscernible).

MALE: I think that \-- that you're right. The (indiscernible) machines
are not designed by and large to support \--

FEMALE: Right, so.

MALE: \-- they \-- they may support something close to this with \--
with executing processes on the machine, but not \-- not what
corresponds to the resolution passed. So maybe it should \--

FEMALE: (indiscernible) mindful of time a little bit.

MALE: \-- for that if we want to do that. But I think the resolution we
got now is in certainly the right direction. The phase in question is,
you know, what you're addressing there in terms of (indiscernible).

MALE: Hey, Paul and Ron, this is J.R. again.

MALE: Yes.

MALE: This is one of those issues back with, like, the wireless. Making
it too complicated.

MALE: I agree 'cause I don't understand it, J.R.

FEMALE: \[laughing\]

MALE: The equ \-- the basic situation is, I hope, clear J.R. that you
want to be able to tell that a voting system \-- election officials
should be able to tell at the beginning of the election day whether a
voting system is, in fact, loaded with the proper software and ready to
run the election as expected or whether there's something funny going
on.

MALE: And J.R., my position \-- my position is that there is a very
simple way of doing that you and pretty much anyone in this room could
follow through, understand, and Dr. Rivest is suggesting that the only
way to do it is with some memory spinal tap situation which I don't
actually understand.

MALE: I'm saying that's what, you know, an approach in that direction. I
haven't specified that fully. The vendor \-- the burden would be on the
vendor to do this, but the requirements that we set forth in our
previous resolution is that it should be a process where \-- which
election official can run that the vendor specifies and may involve
other procedures that's. Yes, Secretary Davidson.

FEMALE: Well, believe it or not, I oversee bingo raffle in the state of
Colorado. So I'm a little familiar with the gambling industry and \--
and we make sure that we don't have any certain types of equipment in
our bingo halls such as slot machines. But to be able to do that, we
have to call in really very professional people that are \-- are on
staff with the \-- the gaming industry. And does this require that type
of technology? If Britt doesn't understand it and Paul doesn't
understand it, I'm beginning to get a little worried that what am I
going to have to hire to be able to do what you're talking about?

MALE: Sorry. If I could respond to that, I might. The proposal that is
drafted here by the NIST staff says that, you know, the vendor shall
provide a mechanism and so this will be part of the package they specify
and the difficulty of implementing that package is part of what you
evaluate when you look at the voting systems. So hopefully the vendors
would provide reasonably simple process. I have no reason to think that
this needs to be a complicated process.

MALE: No, it doesn't. And you don't need to go into 3.1.1.1 saying that
it shall not require the execution of software installed in the voting
system. Let's see.

MR. CHAIRMAN: Well, is the \-- is the question 3.1.1 or 3.1.1.1? Because
what I'm hearing, actually, is that you agree on the major heading. The
question is does this have to be without execution or with?

MALE: So I think that \-- that is the question \-- is one of the major
questions here.

MALE: I think it is \-- I think it is being made more complicated than a
local election official and their system manager can deal with and I
think it, basically, is more complicated than anything needed to
mitigate the risk that we're trying to mitigate. We've got the National
Software Reference Library piece set up, we've got the ITAs, we've got a
chain of custody from the witness compile to the end user, there has to
be documentation, and it has to be verified in the system testing piece
by the ITAs to verify that, in fact, following the users documentation,
you can properly install this system, and I'm just \-- I'm not sure that
we need to make it any more complicated than that.

MALE: I think there's \-- there's a need for having some complexity here
in the sense that, you know, any computer security fellow will tell you,
or woman, will tell you that you can't have a system test itself. If the
system has been hacked, it cannot test itself. You can't do a directory
listing and trust the results and so on, too, so the complexity we're
talking about is intrinsic to the issue a bit. You know, every \-- every
piece of software that's on that machine could be. So the question is,
you know \--.

MALE: Well, I use \-- I use directory listing as an indication or
basically an analogy on the issue of running software on the computer.
We do a binary file compare. And we either do a binary file compare by
copying off the software to another machine, or by running the compare
on the machine that's the object. Either way, you can't do it without
running some application, even if it's a low-level DOS command on the
target machine.

MALE: I've got a question for Ron.

MALE: Yes.

MALE: Ron, are you there?

MALE: Yes.

MALE: Can you hear me?

MALE: Yes.

MALE: What \-- what do we gain over what you're talking about that we
don't get from the hashing algorithms. They're not intrusive and the
ones that we use in Georgia that are based on fifth algorithms, it's
estimated that you couldn't modify that system without us detecting it
and with odds something like 10 billion to 1. So what \-- what \-- what
\--

MALE: Yeah, there's a whole 'nother subject there with the hashing out
\--

MALE: \-- I need?

MALE: \-- in fact, there, a conference running in parallel with ours in
hashing algorithms and some of the recent advances there, and if you're
using the Shaw 1 (phonetic sp.) algorithm, I recommend you change your
algorithm for it because that's no longer as collision-resistant as it
was once believed to be. But by and by, even putting that aside, there
is a significant difference here. When \-- when you're running a hashing
algorithm, that hashing check is worthless if the hash check computation
you're doing is compromised, so you're trusting the integrity of the
hash re-computation algorithm and, you know, if you're running a hash
computation on a compromised machine, you have no confidence of what
you've got there is correct, so there's a big qualitative difference
between trying to run something on a potentially-compromised machine or
not.

We've had a lot of go 'round here. I'd like to, you know, this is a
topic that clearly dear to my heart, too, and one that I think is
important to us, but I think we need to make progress on all of these,
too, so I'd like to.

MR. CHAIRMAN: May I \-- may I suggest something?

MALE: Yeah.

MR. CHAIRMAN: What I'm hearing is the issue we're struggling is 3.1.1.1.
Would it \-- we could either propose to delete 3.1.1.1 if we are
comfortable with the rest of it, or we can make that a should or could
say the process used to verify software should \-- should preferably
require the execution, or something like that, for future reference.
Would that accomplish?

MALE: Let me \-- let me make a motion, Mr. Chair. If you're \-- are you
back in the chair?

MALE: I'm just \--.

MR. CHAIRMAN: No, I'm \-- I'm acting as a member at this point.

MALE: Okay.

MALE: Is that a motion then or is that just a suggestion?

MR. CHAIRMAN: Well, I was asking whether that's.

MALE: So that's a statement from (indiscernible).

MALE: Let me make a motion that we revise 4.3.1.1 to read, system user
manuals shall provide users with a process to verify \-- well, with a
process to correctly \--.

MR. CHAIRMAN: This is a brand new text or are you reading?

MALE: This is brand new text. I'm making it up. \[laughter\] System user
manuals shall provide users with the process to correctly install the
system and verify that the system has been correctly installed and that
the software has not been modified using the reference information from
the NSRL or other EAC-named repository.

MR. CHAIRMAN: What is different in that from what's here?

MALE: The fact that I'm going to suggest to strike everything else in
4.3.1.

MR. CHAIRMAN: You mean 1.1.1 et cetera? What do you mean strike
everything else?

MALE: Yeah. Replace 4.3.1.1 with that, which we said in 4.3.1, "System
validation method shall verify that no unauthorized software is present
on the voting equipment. System user manual shall provide users with a
processes to properly install the system and verify the correct software
is loaded. There's no unauthorized software and the sys \-- the
equipment has not been modified using the reference information from
NSRL or other EAC-named repository." And I understand that I changed
that slightly that time around, but that's what I'm trying to get to.
And then strike the rest of this.

MALE: So, anybody wish to speak? If not, I will. And I think that what
we've got here essentially says that you want the vendor to supply the
appropriate information and procedures to do that \--

MALE: Yeah.

MALE: \-- and so I think that's what you've got and so I would recommend
over what Paul suggested that we just stick with what we've got. So you
proposed a motion. So there's a motion on the floor.

MALE: Motion on the floor to re-word 4.3.1.1 somewhat close to \--

MALE: So (indiscernible)

MALE: \-- what I got out and to strike 4.3.1.1.1 through 4.3.1.2.4.

MALE: So you're proposing \-- you had some language which I didn't
capture, but I hope somebody did. Yeah.

FEMALE: I got it.

MALE: Which would replace all the sub leaves of 6.0.4.3.1.1. Is that
correct?

MALE: Correct.

MALE: Okay. Does anybody need that to be re-read or wish to comment on?

MR. CHAIRMAN: Do we have a second?

MALE: Further discussion?

MALE: Okay, I would speak against the motion. The \-- trying to look
through here, what I see some of the stumbling blocks is one, the \--
the use of shall and I think maybe we can take a \-- go back through
here and see if should would be another alternative to that. Secondly,
where \-- where it said shall or where \-- where 4.3.1.1.1 is worded, it
basically says that any process must do this. So therefore, it's an
inline requirement that if you're validating, you must go through this
step. And yet what I hear from \-- and again, I'm not an expert on the
practical aspects here \-- but what I hear is that there may be times
when that is stated and there may be times when it's not needed \--

MALE: Uh-huh. (affirmative)

MALE: \-- in terms of the kind of degree of risk they think has gone on
and therefore, making 4.3.1.1.1 more of an option in terms of the
process, but that the vendors should provide documentation on how to do
it is one of the things I keep hearing is it's our job to provide, you
know, guidelines and recommendations and so one of the guidelines is \--
and here is the best practice, that there are occasions when you need to
be able to, you know, test the system in a resting state, not running
anything on that system, with an external kind of device or whatever
that's needed.

MALE: Uh-huh. (affirmative)

MALE: But not a requirement that it's always done. In order to do a
validation, you don't always have to do that. You may not have the
capabilities or whatever. So wording it such that vendors should
document a process that can be used to verify, et cetera, et cetera,
would be a proposal alternative.

MALE: I think that's consistent with what's actually here, isn't it?
Because it says that they shall specify and it shall not require, et
cetera, but it doesn't say when it has to be done, so this \-- this
procedure at the discretion of the election officials, in fact, well,
this section right here does not need to be performed. I think there may
be a later section that talks about that that we can talk about. But
when it needs to be performed. But I think we're consistent with that.

We have a motion on the floor and a second. Further comments?

Call a motion. I think there's apparently going to be disagreement, so
should we do a roll call? Parliamentary, do we have a recommended
procedure here? Why don't I ask for a roll call vote since I suspect
this will be a divided vote?

MALE: This is voting on the motion to \-- to leave 6.0.4.3.1.1.1 et cet?
And to re-write \--?

MALE: Yes. Maybe we should re-read the motion in its entirety.

MALE: Okay, as I understand my motion at this point, \[laughter\] I \--
I was suggesting a re-write of 4.3.1.1, the spirit of the re-write to
require system user manuals to provide users with the necessary
information to do the task \--

MR. CHAIRMAN: Just a point of clarification.

MALE: \-- and striking every.

MR. CHAIRMAN: Just a point of clarification. We cannot hold user manuals
responsible for anything. They're not entities. I mean, who generates
users manuals?

MALE: Okay.

MR. CHAIRMAN: That's why we have vendors.

MALE: Vendors shall \--.

MR. CHAIRMAN: And that's why I didn't understand because the rest of it,
it sounded very much like what you have here. I don't think standards
should say "user manual". I mean, who is going to do the user manual?
Who \-- who is responsible?

MALE: The vendor produces it.

MALE: (indiscernible) process was concluded.

MALE: Uh-huh. (affirmative)

MR. CHAIRMAN: Yes, of course. That's part of documentation.

FEMALE: Want me to read you a (indiscernible)?

MALE: Yeah.

MALE: Do we want to have a \--? \[laughter\]

FEMALE: Paul's motion is "Vendor shall provide user manuals with the
process to correctly install the system, to verify that the system has
been correctly installed, and has not been modified using the NSRL" and
I'll add a few more words. And to strike 3.1.1.1. 3.1.1.2, and 3.1.1.3.

MALE: I thought it went further than that. Was the (indiscernible)?

MALE: Yeah, it was \-- it was through \--

MALE: (indiscernible)

MALE: \-- all the way through 4.3.1.2.4.

FEMALE: All the way through what, Paul?

MALE: All the way through 4.3.1.2.4.

MALE: 4.3.1.2.4.

MALE: Line 35.

FEMALE: Okay, all right.

MALE: Through line 35, yes.

MALE: Yes.

MALE: So the motion's been read. Any questions about what it said?

FEMALE: (indiscernible)

MALE: You wanna ask any questions on? If not, then why don't we move for
a vote. I suggest a roll call vote.

MALE: Roll call vote. Williams? Williams? Williams is absent. Berger?

MALE: Yes.

MALE: Berger votes yes. Craft?

MALE: Yes.

MALE: Craft votes yes. Davidson?

FEMALE: Yes.

MALE: Davidson votes yes. Elekes?

MALE: Yes.

MALE: Elekes votes yes. Gannon?

MALE: No.

MALE: Gannon votes no. Harding?

MALE: Yes.

MALE: That's a yes?

MALE: Yes!

MALE: Harding votes yes. Miller?

FEMALE: Yes.

MALE: Miller votes yes. Purcell?

FEMALE: Yes.

MALE: Purcell votes yes. Quesenbery?

FEMALE: No.

MALE: Quesenbery votes no. Rivest?

MALE: No.

MALE: Rivest votes no. Schutzer?

MALE: No.

MALE: Schutzer votes no. Semerjian?

MR. CHAIRMAN: No.

MALE: Semerjian votes no. We have 7 in favor.

MALE: Motion fails.

MALE: Motion fails. The majority would've been \-- would've been 8
votes; we only had 7.

MALE: Thank you, Mr. Greene (phonetic sp.). So the motion failed, did
not pass. We still have before us, then, 6.0.4.3.1 as \-- as given in
the section here and \--.

MR. CHAIRMAN: May I make a motion?

MALE: Yes.

MR. CHAIRMAN: That we modify 3.1.1.1 to read "The process used to verify
software should require \-- should not require execution." Basically,
make that shall a should.

MALE: Is there a second?

MALE: I'll second that.

MALE: Discussion? Any discussion online?

MALE: No.

MALE: Shall we have a voice vote on this or?

MALE: Yeah.

MALE: Yeah.

MALE: Let's do a voice vote. Voice vote, all in favor?

MALE: Aye.

MR. CHAIRMAN: Aye.

FEMALE: Aye.

MALE: All against? The motion passes. So now we're on to 6.0.4.3.2.
Maybe Nelson can lead us through that, then?

MALE: 6.0.4.3.2?

MALE: 6.0.4.3.2 at the bottom of page 668.

MALE: Okay. This is the setup validation method shall verify the
registers and variables of the voting system and train the proper static
and initial values. The next req \-- sub requirement underneath there
basically states that a vendor shall supply a method to query the system
to determine those values. The next requirement underneath that says
that the vendor shall document the initial starting values of all
dynamic and registers and variables. That needs to \-- that's gonna need
to be expanded to include static variables and \-- and \-- and \-- and
registers as well. Then the next requirement basically says prior to \--
election officials shall query the voting system to determine that those
values are \-- are \-- are the documented values. And the next
requirement says that any anomalies will be analyzed and resolved before
the election.

MALE: Okay, are y'all trying to say that you're going to print a zero
report before each election?

MALE: It's \-- it's a little bit more than \-- oh, go ahead.

MALE: No, go ahead.

MALE: Okay. It's a little bit more than a zero report. If there's other
static variables that's in there, in the system, such as a plus 1, you
wanna make sure that it's plus 1 and not plus 2 or 3. That's \-- that's
the essence of this. But it's based on \-- on the zero report concept.

MALE: And you envision doing this both on the DRE machines and the
central machines? Crap.

FEMALE: (indiscernible)

MALE: I'm not \-- I'm not sure that can be done by us six.

FEMALE: Is \-- I was going to say, isn't it \-- are you intending that
to be done by the judges before they open up the polling location? Is
that where you're having it done?

MALE: The way it is written, that's what we're \-- where it is.

MALE: (indiscernible) polling location.

MALE: Wait. It says \--.

MALE: Polling place workers doing that.

MALE: It just says election official, so before the election, so it
doesn't specify at the polling place. Could be at the warehouse, I
guess.

FEMALE: If that could be part of your public test or something like
that, but I see some issues when you get to your judges at the polling
place to even know what they're doing.

MALE: But the way I \-- I read it, it doesn't \-- doesn't necessarily
say at the polling place. Says before the election.

MR. CHAIRMAN: So before the election could be a week before, could be
three days before, or \-- is that correct? I mean, it doesn't have to be
that morning of the election.

FEMALE: No. It can be several days before.

MR. CHAIRMAN: Right.

FEMALE: And the only thing is is I think that should be a should so that
\-- that it's done by the 2008.

MALE: Yeah.

FEMALE: Instead of shall because I'm not sure that that can be
accomplished by 2006.

MALE: If I could comment. I think there's several places for shalls and
shoulds here. I think \--

FEMALE: I think so.

MALE: \-- one of the things that concerns me the most is \-- is
6.0.4.3.2.3 \--

FEMALE: Right.

MALE: \-- prior to election, voting officials shall query the voting
system. If \-- if there's, you know, 100,000 static variables in the
program, that's quite a few to query \--

FEMALE: \[laughing\]

MALE: \-- and I think we should give the election officials some
discretion to \-- to skip that step in that case. So I \-- I would move
that \-- entertain a motion that at least 6.0.4.3.2.3 should be made a
should.

FEMALE: Do you want to add to those some of the other places that should
be shoulds instead?

MALE: As far as I understand the hierarchy, if we take Secretary
Davidson's recommendation and made 4.3.2 a should and everything
underneath it becomes a should.

FEMALE: Right.

MALE: I'm personally not unhappy with others being shall, myself, so.

FEMALE: Are you \-- do you really wanna make 3.2.2 which is "shall
document initial starting values" a should? I \-- I \-- I would assume
that that's actually being done already.

FEMALE: If you're considering about our zero tape that we run \--

FEMALE: No. This is "vendors shall document". So, the question is shall
we make this a blanket should and I wonder whether that ought to be a
should. We could \-- if we leave the top \-- if we leave the top level a
shall and make sub point 1.3 and 4 shoulds and leave number 2 a shall,
then we sort of left it in the realm of possibility while still
preserving the text.

MALE: (indiscernible)

FEMALE: So 1, 3, and 4 become shoulds.

MR. CHAIRMAN: Mi \-- microphone, please.

MALE: Okay. 1, 3, and 4 under 4.3.2. Okay.

MALE: Do we have a motion on the floor to \--?

MR. CHAIRMAN: Microphone.

MALE: Oh, sorry. 1, 3. We \-- believe \-- do we have one motion? Did you
make a motion, Secretary Davidson?

FEMALE: No, I \-- I.

MALE: That was a comment.

FEMALE: (indiscernible)

MALE: So, so.

FEMALE: I move that we modify sub \-- section 6.0.4.3.2 sub sections 1,
3, and 4 to change them from shalls to shoulds.

MALE: So 1, 3, and 4 from shalls to shoulds. Is there a second?

MALE: I'll second.

MALE: Discussion? Patrick?

MALE: Question: Is it just the sub ones or should 6.0.4.3.2, will that
still remain a shall or a should?

FEMALE: Let's leave that a shall (indiscernible).

MALE: (indiscernible) shall and shoulds requires that that be a shall.
Further discussions?

MALE: Ron, J.R. I think you outta make it clear and maybe break down
into two motions or something just doing the 4.0.3.2 and then going into
the .1, .2, .3 and 4.

MALE: There's a specific proposal on the floor to leave 4.0.3.2 the same
because it needs to be the same because the rest of the motion leaves
one of the shalls standing.

MALE: Okay.

MALE: And then the specific motion, if I can repeat it is to change the
shalls in 3.2.1, 3.2.3, and 3.2.4 to shoulds and not make any other
changes.

MALE: All right.

MALE: It is a bundled motion, I understand, but they go together sort
of.

FEMALE: See if we can do it. \[laughing\]

MALE: Further discussion? All in favor?

MALE: Aye.

FEMALE: Aye.

MALE: Aye.

FEMALE: Aye.

MALE: All against? The ayes have it.

MR. CHAIRMAN: Okay.

MALE: Motion passes. And the final section of this part, then is
6.0.4.3.3.

MALE: And basically, it just says that voting officials shall run the
verification process before the election. The last \-- the sub bullet to
that just says they shall document the results of that verification. And
then the next sub bullet after that just says that the anomalies should
be analyzed and resolved before the election. So. And that concludes
that section.

MALE: Comments on that? That would be moved into the best practices
section (indiscernible).

MALE: (indiscernible) going on there? Any major changes?

FEMALE: Did we have \-- I \-- as I recall, we had a lot of discussion
but not a lot of changes and in the interest of not having to come back
while this is fresh in our mind, I wonder if we could handle the
accepting of this discussion \--

MALE: Yes.

FEMALE: \-- while we're right here.

MALE: So there's a \-- there's a magic script which I can read here.
Which is right here. Are there any more motions or requests for
unanimous consent to change the content of the software distribution
setup validation requirements for VVSG version 1 that we've just
reviewed?

There being no further motions to change the VVSG version 1, volume 1,
section 6.0.4, I will now entertain a motion for the TGDC to adopt this
draft of section 6.0.4 as part of the \-- its first set of
recommendations to the Executive Director of the EAC subject to changes
expressed in any motions we have adopted today that expressly apply to
section 6.0.4 which changes shall be made person to TGDC Resolution
3705.

MALE: Hey, Ron, this is J.R.

MALE: Yes.

MALE: If I heard you right, we're about to take a vote on the whole
section 1, correct?

MALE: On section 6.0.4. That's correct, yes.

MALE: Oh, no, just section 6.0.4. Okay. No, I'm fine. Go ahead.

MALE: Yes, just \-- just the part on the distribution of voting system
software and setup validation.

MALE: Right. That's fine. Go for it.

MALE: So. Okay. I need to think. I need somebody to actually \--

FEMALE: I'll second.

MALE: \-- second with the motion and second the motions.

FEMALE: I'll make the motion.

MALE: Do we have a second?

MR. CHAIRMAN: I guess I can second that.

FEMALE: (indiscernible)

MALE: (indiscernible) all in favor?

PARTICIPANTS: Aye.

MALE: All opposed? The rest of this by roll call?

MALE: Can I \-- can I raise one point? I just want to clarify. Over the
last couple of days in our minds, we understood what should and shall
mean. I'm a little concerned about 6.0.4.3.1.1.1. Page 6-67. It's where
we use it with a modify \-- with the word "not" after it. I wonder if
that is going to mean something else to the rest of the world. The
process used to verify software should not require. Is that?

MALE: Oh, I think you're right there.

MALE: That concerns me that it's not that should not and shall not maybe
will be viewed as being the same thing whereas should and shall are two
different things, at least in our minds the last two days.

MALE: Excuse me. Shall not is \-- is actually defined in our conformance
clause as being prohibited. So it's \-- it's at least clear what shall
not is.

MALE: Should not might be prohibitive whereas \--

FEMALE: Well, can I \-- can I \--

MALE: \-- should means encouraged.

FEMALE: \-- let me just suggest a re-wording that would be very quick.
The process used to verify software should make it possible to perform
this verification without requiring the execution of software, et
cetera.

FEMALE: (indiscernible)

FEMALE: Should make it possible to perform without requiring.

MALE: Yeah, I think putting the "not" later in the sentence \--

FEMALE: Okay, so.

MALE: \-- I think it makes it \--.

FEMALE: Does someone \-- does someone have that whatever I just said?
\[laughing\]

MALE: I think that's \-- okay.

MALE: Should and not being next to each other.

FEMALE: Yeah, it (indiscernible) the way you want and it makes it clear
that you should perform and that in performing, you should not \-- yeah.

MALE: Can we table that as an editing change?

MALE: Yes.

MR. CHAIRMAN: Yeah.

MALE: Thank you, Mr. (indiscernible).

MALE: All right. So we'll take a roll call vote on 6.0.4. Williams?
Absent. Berger?

MALE: Yes.

MALE: Berger votes yes. Craft?

MALE: Yes.

MALE: Craft votes yes. Davidson?

FEMALE: Yes.

MALE: Davidson votes yes. Elekes?

MALE: Elekes votes yes. Gannon?

MALE: Yes.

MALE: Gannon votes yes. Harding?

MALE: Yes.

MALE: Harding votes yes. Miller?

FEMALE: Yes.

MALE: Miller votes yes. Purcell?

FEMALE: Yes.

MALE: Purcell votes yes. Quesenbery?

FEMALE: Yes.

MALE: Quesenbery votes yes. Rivest?

MALE: Yes.

MALE: Rivest votes yes. Schutzer?

MALE: (indiscernible) lost.

MALE: Absent at the moment. Semerjian?

MR. CHAIRMAN: Yes.

MALE: Semerjian votes yes. It's 11 votes in favor; the motion passes.

MALE: Thank you. The motion passes. We should now take a short break.
Any announcements from?

MALE: Mr. Chairman, can I just ask some clarification for editing
instructions for NIST?

MALE: Yes.

MALE: I brought up the question before about voting officials and best
practices and \-- and \-- and reminded everyone that they were not
mandatory in the best practices. I spoke to Britt Williams and he said
yes, we \-- we want to keep them as best practices, so I \-- I have a
couple of questions. Number 1, then, I want to make sure that all the
voting official removals in the main body, we still want to keep as best
practices. Is that \-- is that agreed upon when we do our editing? Best
practices for voting officials is a specific appendix. That's
question 1. Question 2 is what do we do about the main body? Again, we
have a little bit of an inconsistency that we remove voting officials
sometimes from the main body. We could remove voting officials
throughout the main body, or we could say them differently. We purposely
put them in the main body so it \-- to maintain the flow of the
functionality of the standard. We could, in fact, change all the
references to voting officials to say something like in the main body,
best practices, voting officials do this without a shall or a should.
That's one suggestion. Another suggestion is \-- is being consistent
about voting officials in the main body. We could, for instance, change
them to all shoulds or we could remove them. Or we could follow the
specific editing instructions, which I fear will leave us to be a little
bit inconsistent in the main body in the sense that sometimes we leave
them and sometimes we remove them.

FEMALE: Mr. Chair?

MALE: Will the committee \--?

FEMALE: Did we actually take a vote to remove voting official
references? I don't believe so.

MALE: In some cases, we did.

FEMALE: No. In some cases, we specifically removed them from here, but I
think those were often because no one wanted them anywhere.

MALE: Well, Britt's (indiscernible) was that he thought they ought \--
they belonged in best practices even though we removed them
(indiscernible).

FEMALE: But that's not what we said and that's not what we voted on. I
would like to speak in favor of leaving them somehow in the section. I
realize that leaving infor \-- sort of semi-informational material in
the body of the standards document poses some structural problems from
the point of view of well-formed standards; however, I think that in
this \-- in the case of this type of standard, the standard for this
material, and especially in 2.2.7 in the accessibility and usability
sections, there are times when the actions of voting officials following
the best practices that we're prescribing whether with shoulds or shalls
is really integral to the living up to not just the letter but the
spirit of the standards that we're creating. I would be happy to vote on
something that said we would somehow mark them, we would find a
different semantic device to \-- to identify them, or anything of the
kind, but I really don't want to see them removed from the main section.

MALE: And although I would really like to see them removed, I have to
agree with Whitney; we did not vote a resolution to remove them at all.

MALE: So do \-- do I hear a sense that we want to re-word them in the
main section to call them best practice and take out shalls and shoulds?

FEMALE: I \-- I think it at \-- at minimum, they should be clearly
identified.

**\[End of Audiotape 8, Side A\]**

FEMALE: \-- as they say, there was \-- the voting officials are
responsible for them \-- I mean, I have \-- I have talked to a number of
you. I have some information design issues with the entire document in
general. I know this is a draft, I know that it's hard to format a
document while you're trying to write the document, but we in this
committee have \-- had some clarity issues with reading the nested
levels, so I think there's two issues that we've faced that could be
addressed either through information design or through some clear
wording. One is the top-level shalls that are general statements which I
understand their structural purpose and I understand their semantic
purpose. And the other are the best practices where, again, we've gotten
\-- it's a slightly funny document and yet the oddity of that doc \--
the oddity of \-- of what you've done with regard to general standards
practices actually meets the need for this context. So I \-- I don't
quite have the answer, but I do think that we need to address that
somehow.

MALE: And again, the sec \-- the second part of the question is, I think
that we need to achieve consensus as well. Britt's sense was he told me
when he specifically said take them out, he did not mean take them out
from best practices. He meant take them out from the main body, so we
need guidance on when we were told to take them out from the main body
whether they stay in the appendix as best practices.

FEMALE: Britt may have told you to do that, but the committee didn't.

\[laughter\]

MALE: I don't \-- I don't think the committee spoke to that issue. They
said take them out of the main body.

FEMALE: I \-- we did address it. We specifically looked at places where
we felt that it was inappropriate to have a specific clause of any kind.
We removed many of them, we did not take any blanket thing. In the case
of 2.2.7, we would have to go back through that very carefully to look
at that. I think that might be true in some other cases as well.

MALE: Secretary Davidson.

FEMALE: What have we \-- if it's not removed, we do have to come up with
a \-- I think, give guidance to NIST on how we want it. I mean, because
as you said, we had the shalls; we had the shoulds, and then we maybe
identify someway else and say this was left in but no decisions were
made or something. FEMALE: Actually \-- actually, I do have a suggestion
which is that we leave them in in the position where they are now, but
we remove them from the numbering order. I \-- but I think this is
probably like some of the editing things. I'd be happy to work with you
guys on this. I think there's some other information designers available
to work on it, but I \-- so one solution is to make them boxed call outs
rather than numbered clauses.

FEMALE: And then I think that definitely needs to be a footnote or a
statement someplace of what those mean.

MALE: One slight complication. Sometimes we have more than one
responsible entity, so we may have vendor and voting official. So in
that case if we take that out of the numbering scheme, we lose the
requirement for the vendor.

FEMALE: If they're \-- if they're a requirement for the vendor, they
stay there. And as I understood the best practices section, that was an
appendix that was a useful guide that saved people from having to go
through and highlight things to find ven \-- voting official sections.

MALE: If I could make a comment to respond to your question. I think
that \-- at this stage of the game, simplicity is important, so I would
be happy with leaving, personally, with leaving them in the text as
numbered even and maybe with square brackets, best practices and the
reference to the appendix where they appear also and then some text up
front sort of saying that we have left in the main body of the text some
of the \-- in \-- in the position the committee considered them, some of
the best practices that are collected together at the end of the
document and \-- and because they seem integral to the intent of that
section as well for reference purposes.

MALE: Is that \-- is that the sense of the committee?

MALE: The people want to comment.

FEMALE: Would \-- would you actually like a motion on this?

MALE: That would be helpful. \[laughing\]

MALE: Would you like to make a motion?

FEMALE: Yeah, I'd like to offer a motion that where requirements that
are \-- that are \-- where the only responsible party is a voting \-- is
a voting official have been left in \-- are still part of the standard,
that they be identified with some clear statement with like bracket,
best practices, bracket or some other device that you come up with so
that readers of this document, no matter where they begin in the
document, can be very clear of the intent of the inclusion of those
materials.

MALE: Does the motion have a second?

MALE: Second.

FEMALE: Sorry. That was way more than anybody wanted me to say in one
sentence. \[laughing\]

MALE: Any other discussion?

MALE: So may I assume from that that if we have a responsible entity
which is two things, a voting \-- a vendor, for instance, and a voting
official, we break them separately, take out the \--?

FEMALE: If you have two things of voting \-- a vendor and a \--

MALE: We haven't quite (indiscernible).

FEMALE: \-- voting official, I would just leave it. The voting official
can be treated as informative in that case.

MALE: Okay. That's many \--.

FEMALE: Whether you pull that out into best practices as a du \-- as a
duplicate reference.

MALE: Well, yeah. We'll leave it as it is. (indiscernible) read in place
for the vendors as a requirement, can be with the square brackets, it
can be read in place also as a best practices, is copied in the end as a
best practices. I think in that \-- in that second location, the vendor
part would be informative only, so.

Any further discussion? All in favor?

PARTICIPANTS: Aye.

MALE: All against? The ayes have it.

MALE: Thank you.

MALE: So if there's no further business, let's adjoin for a short break.

MR. CHAIRMAN: Let's come back quarter after and finish up. Thank you.

MALE: (indiscernible) is that even though I double-checked it, Word went
ahead and underlined a number of things that.

FEMALE: Oh. (indiscernible) Word is evil. They all know that.

MALE: Yeah so there are a lot of things there was no change.

FEMALE: Okay.

MALE: But.

FEMALE: I don't think (indiscernible) simple. I mean, for. \[laughing\]

MR. CHAIRMAN: Let's see. I think we're \--.

MALE: If anybody can hear me out in the hallway, we'd like to get
started, please.

MR. CHAIRMAN: I think \-- I think the members are here.

MALE: Well, you got one on the phone.

MR. CHAIRMAN: I saw \-- I saw Berger come in. What happened? Oh, here he
is. And Secretary Davidson. So I think all the folks who are here and
can we hear who \-- who is on the phone?

MALE: J.R.

FEMALE: This is Alice (indiscernible).

FEMALE: (indiscernible) Rachelle.

MR. CHAIRMAN: Is Mr. Elekes with us? Okay, we have \-- we have 3, 7, and
309. We have 10 so we continue to have a quorum.

Okay, so the first task at hand is approval of the VVPAT requirement
section, section 6.0.1 \-- 6.0.1, yes. Security overview. And you have a
new document in front of you which has not only the changes from
yesterday, but also changes from this morning, so this is the final
document. I had asked the \-- the changes this morning were pretty
simple editorials or take outs, so those are all done, and from
yesterday, you had a chance to look them over, so I assume that you've
had a chance to do that.

FEMALE: Mr. Chair, I suggest that we take 2 ½ minutes to look them over
quickly and then, perhaps, take a motion to vote on this section and see
if we can and use any \--.

MR. CHAIRMAN: Well, let me \-- let me say, just go through my formal
script. Are there any motions at this point or \-- or \-- or request for
unanimous consent to change the content of the gloss \-- of the security
standard, section 6.0.1?

MALE: Mr. Chairman, I think I'll have a motion in a moment on two of
these. Let me get to it in the document.

MR. CHAIRMAN: Do you wanna take a few minutes?

FEMALE: Mr. Chairman, were the changes from this morning e-mailed to
those of us who are on the phone?

MALE: We can do that (indiscernible).

MALE: (indiscernible) on that token (indiscernible).

MR. CHAIRMAN: We're checking on it. Just a minute.

FEMALE: Thank you.

MALE: (indiscernible) pull up it \-- pull up those changes on the screen
for me, would you, put up (indiscernible) this morning?

MALE: Alan!

MALE: Yeah. 6.0.1. Put 'em on my refreshable Purcell. An e-mail comes in
from Alan Eustis, pump it right to the Purcell system.

FEMALE: Would you like a mint?

MR. CHAIRMAN: No, thank you.

FEMALE: 6.0.2.

FEMALE: The other guys are looking at the 6.0.2, okay?

FEMALE: That's not what I just copied. (indiscernible)

FEMALE: Huh? Recycle bins.

MALE: At the request of the Chairman, I'd like to resume chairing, well,
I hope Dr. Semerjian will be back with us in the near future to resume
chairing, but I think we need to make progress here, so I've received a
request to proceed as Chair.

Do we still have a quorum?

MALE: How many do we have on the phone?

MALE: How many do we have on the phone?

MALE: Three of us, but the lady \--.

FEMALE: Yep. I'm still here.

MALE: And, James, are you still here?

MALE: That's three, four, five, six, seven, eight, nine.

FEMALE: (indiscernible) nine.

MALE: Yep. We're fine, I think.

FEMALE: Mr. Chair, I noted an edit that didn't make it into the current
draft.

MALE: Yes, so let's look at edits that didn't make it in or edits that
need to be made to the draft of 6.0 security standards.

FEMALE: Yep. This is on page 6-12. Thank you. I'd like to thank Stephen
Berger (phonetic sp.) for pointing this out.

The final line 19 of that page has a very short statement that says,
"The privacy and anonymity of voters unable to mail or handle paper
shall be maintained." The sense of that is still correct, but there was
a longer, slightly more explanatory note which John will now read to
you. \[laughing\]

MALE: The requirement should read, "When the voter is responsible for
depositing a paper record in a ballot box, the accessible voting station
shall maintain the privacy and anonymity of voters unable to manually
handle paper."

MALE: That is \-- that is clear, yes. Shall we take that as an edit?
Any?

FEMALE: Uh-huh. (affirmative)

MALE: Okay. Next suggestion, comment, whatever.

MALE: Okay, 6.0.2.6.1 as written implies that all cryptographic \--
actually, it's says all cryptographic software in the voting station
shall been approved by the U.S. government's crypto module validation
program. We understand the intent of that is if the voting station makes
use of one of the validation modules approved by the U.S. government
crypto module program, the implementation chosen will be the specific
one approved by the program.

MALE: There \-- there may be more than one approved so it would be one
of the a \--

MALE: A one of these specific.

MALE: \-- one of these (indiscernible). So, if I can \--.

FEMALE: Perhaps it should say any cryptographic software in the voting
station.

MALE: No because there \-- there are cryptographic softwares that are
appropriate that are not in this program, but it would say this will
have the Acme \-- the Acme algorithm and there's versions 1, 1.5, and
1.7 approved, but we don't want 'em using 1.2. \[laughing\]

FEMALE: Is your \-- is your point that it should be \-- have been \-- is
it any cryptographic software used in the VVPAT?

MALE: No, no. I think the intention was the original intent which is
that if \-- if the voting system uses cryptographic algorithms, that \--
whose implementations are approved by the U.S. government's crypto
module validation program, then the vendor's required to use one of the
implementations approved by the CMVP.

FEMALE: So how would you change it?

MALE: Just what I said.

MALE: Can I \-- just what he just said.

MALE: Yeah.

FEMALE: \[laughing\]

MALE: I'll make what he said a motion.

FEMALE: I'll second it.

MALE: So, did somebody write that down?

FEMALE: I think we can take that as an edit, actually.

MALE: Yeah.

FEMALE: And not as \-- not have to take a motion on it.

MALE: I think it captures the intent we had originally \--

FEMALE: Yeah.

MALE: \-- as well there, so we'll take that as an edit. Okay. Other
changes, comments, suggestions, motions? Anybody online, on the phone,
have a comment on this section, 6.0, security standards?

MALE: Just finishing reading.

FEMALE: No.

MALE: Shall I give you a little more time?

MALE: I just need about \-- about a minute.

MALE: Okay.

MALE: Takes a little bit longer to read the Braille copy.

MALE: I understand. You're doing remarkably well. It's a lot here.

MALE: Nope. No comments or changes.

MALE: So I'm not sure what vote we need at this stage to clear this.
Turn to the parliamentarian for advice?

FEMALE: I think this is that long script.

MALE: Do I need to do that long script again, or?

FEMALE: Yes.

MALE: Yeah.

FEMALE: You need that script.

FEMALE: \[laughing\]

MALE: Thank you.

FEMALE: You can read the first one. Just substitute VVPAT.

MALE: Are there any more motions or requests for unanimous consent to
change the content of glossary \-- sorry, the content of 6.0 security
standards?

FEMALE: 6.8.0.2.

FEMALE: 6.8.0.2. Requirements for verified voter paper audit trails.

MALE: I'm sorry. Did I get the wrong one?

FEMALE: It's the second page. There you go.

MALE: 6.8.0.2. Yes, you're right. 6.8.0.2 requirements for
voter-verified paper audit trails for voting VVSG version 1 that we have
just reviewed. There being no further motions to change VVSG version 1,
volume 1, section 6.0.2, I will now entertain a motion for the TGDC to
adopt this draft. 6.0.2 requirements for voter-verified paper audit
trails, as part of its first set of recommendations to the Executive
Director of the EAC subject to the changes expressed \-- do we need that
part in?

FEMALE: Yep.

MALE: Subject to the changes expressed. Any motions we've adopted today
that expressly apply to this section, which changes shall be made person
to TGDC Resolution number 3705.

FEMALE: So moved.

MALE: Second.

MALE: Do I have a second? All in favor?

PARTICIPANTS: Aye.

MALE: Do we need a roll call voting?

FEMALE: Roll call.

MALE: Sorry. Okay. Roll call vote.

MALE: Roll call vote on 6.0.2. Williams? Absent. Berger?

MALE: Yes.

MALE: Berger votes yes. Craft?

MALE: Yes.

MALE: Craft votes yes. Davidson?

FEMALE: Yes.

MALE: Davidson votes yes. Elekes?

MALE: Yes.

MALE: Elekes votes yes. Gannon?

MALE: Yes.

MALE: Gannon votes yes. Harding?

MALE: Yes.

MALE: Harding votes yes. Miller?

FEMALE: Yes.

MALE: Miller votes yes. Purcell? Purcell? Purcell is not responding.
Quesenbery?

FEMALE: Yes.

MALE: Quesenbery votes yes. Rivest?

MALE: Yes.

MALE: Rivest votes yes. Schutzer? Schutzer's not responding. Semerjian?
Semerjian votes yes.

MALE: Mr. Parliamentarian, I just heard a beep. I think we have someone
else sign on in the process (indiscernible).

MALE: Did Purcell rejoin us?

MR. CHAIRMAN: Did anyone join us?

MALE: Perhaps someone signed off.

MALE: At least we got their vote.

FEMALE: There's somebody.

MALE: Is someone joining us?

FEMALE: Yes, Mr. Chairman, this is Helen Purcell. I was momentarily
offline.

MALE: We're now voting on section 6.0.2. Have you had a chance to review
that?

FEMALE: Ye \-- that's a yes.

MALE: You're voting yes?

FEMALE: Yes.

MALE: Thank you. Purcell votes yes. That's 11 votes in favor; the motion
passes.

MALE: Motion passes so we've approved that section. At this point, I'd
like to return the chair back to Dr. Semerjian.

MR. CHAIRMAN: Thank you, Dr. Rivest. At this point, the remaining
sections that we need to vote on are the glossary section \-- the
glossary which is Appendix A, the error-rate qualification testing which
is part of Appendix C. Are those the only sections that?

FEMALE: Uh-huh. (affirmative)

MR. CHAIRMAN: So these are lengthy sections, but the changes are
basically simple editorial changes. I suggest that on this, somebody
needs a clarification on these and I would entertain a motion to approve
them.

MALE: Summative? Well, got a problem. \[laughter\]

MR. CHAIRMAN: Mr. Craft.

MALE: The definition of absentee ballot really is inaccurate. It
provides an absentee ballot is a ballot prepared or cast by the voter
prior to election day because the voter will be unable to vote in person
or polling place on that day. That is written includes advanced voting
ballots. And absentee ballot, legally, is different from a early voting
ballot or a polling place ballot in that there's a actual higher duty on
the voter to go through a process and present his ballot, get it
postmarked at a certain time. And the real definition of a kind of
varies from state-to-state. So I think you might just let that be,
"Absentee ballots are ballots designed for absentee voters as defined in
individual states' elections codes." I can't think of any set of words
that's going to solve the problem.

MALE: Is there a lot of variety in the definitions between the states?

MALE: Yeah. Yeah, quite a bit.

MALE: So \-- so a broad definition like that's \--

MALE: Yeah.

MALE: \-- approp \-- important.

MALE: Well, I \-- Mr. Elekes \-- just was wordsmithing. Would it be more
appropriate to say, "\-- in the states' respective codes" or "in state
codes, respectively"?

MALE: That would be fine, yeah.

MALE: I'm just kind of wordsmithing here.

MALE: Yeah. That'd be fine. I \-- I need wordsmithing. \[laughing\]

FEMALE: Could we actually leave this entire thing and just add a comment
following appropriate state guidelines or regulations?

MALE: Well, it's \-- it's \--.

FEMALE: I mean, this is \-- this is right out of VSS.

MALE: Well, things have changed since VSS, including HAVA. I mean, a
ballot prepared or cast by a voter prior to election day does not
necessarily make an absentee ballot anymore. So.

FEMALE: And I do agree with the \-- the statement of "unable to vote in
person". That's not really always true. They may choose not to vote and
a lot of laws have been changed that has no reason to voting absentee.

FEMALE: If I may, it's perfectly okay at this point if we delete this
\-- this \-- if this is really contentious and a problem, to basically
leave the term name in there and say "to be defined later" or something
like that or just take it out?

MR. CHAIRMAN: Or how about \-- how about "ballot prepared or cast by a
absentee voter". Period.

MALE: Yeah.

MR. CHAIRMAN: Definition.

FEMALE: (indiscernible)

MR. CHAIRMAN: Yes, I understand. But then I would say \-- then I would
say the definition of absentee ballot is jurisdiction-dependent. Would
that do it?

MALE: Excellent \--

FEMALE: Absolutely!

MALE: \-- excellent!

MR. CHAIRMAN: Because that's \--. Other than that, any other comments on
Appendix A? Appendix C? I guess we did not have any changes in Appendix
B. Is that correct?

FEMALE: (indiscernible) to Appendix C.

FEMALE: Appendix B is simply a compilation of sections from elsewhere,
so.

MALE: (indiscernible)

FEMALE: Well, perhaps since we're looking at Appendix A, that we could
\-- and I'm sure we have to vote on these separately, that we could take
a vote on accepting the glossary as it \-- with the one modification?

MALE: I'll second.

MR. CHAIRMAN: I believe I heard a motion to vote on Appendix A. Any
further discussion?

There being no further motions to change VVSG version 1, volume 1,
Appendix A, I'll now entertain \-- well, I guess we did this, but I will
read that anyway for the record. I will now entertain a motion for the
TGDC to adopt this draft of Appendix A as part of its first set of
recommendations to the Executive Director of the EAC subject to changes
expressing any motions we have adopted today that expressly apply to
Appendix A, which we did make one change. Which changes shall be made
pursuant to TGDC Resolution 37-05.

We have a motion and a second. Any other discussion? Not hearing any
discussion, I will call for a roll call.

MALE: Roll call vote on App \-- on Appendix A. Berger?

MALE: Yes.

MALE: Berger votes yes. Craft?

MALE: Yes.

MALE: Craft votes yes. Davidson?

FEMALE: Yes.

MALE: Davidson votes yes. Elekes?

MALE: Yes.

MALE: Elekes votes yes. Gannon?

MALE: Yes.

MALE: Gannon votes yes. Harding?

MALE: Yes.

MALE: Harding votes yes. Miller?

FEMALE: Yes.

MALE: Miller votes yes. Purcell?

FEMALE: Yes.

MALE: Purcell votes yes. Quesenbery?

FEMALE: Yes.

MALE: Quesenbery votes yes. Rivest?

MALE: Yes.

MALE: Rivest votes yes. Schutzer? Schutzer's not responding. And
Semerjian.

MALE: Yes.

MALE: Semerjian votes yes.

MALE: Mr. Chairman?

MR. CHAIRMAN: (indiscernible)

MALE: 11 votes for. Sorry.

MALE: I'll let \-- I'll let him finish the votes.

MR. CHAIRMAN: Okay.

MALE: 11 votes in favor; the motion passes.

MR. CHAIRMAN: Thank you. Yes, Mr. (indiscernible)?

MALE: Yes, on A-2 (phonetic sp.) for sources under Definitions and
Glossary, I just noticed that on page 39 where it referenced section
5.0.8, we have that as amended section 5.0.8. Might wanna put in 1998
and thereby it being consistent with like the ADA 1990 and so forth
because as amended, it's been amended a few times, 5.0.8 came in during
'98.

FEMALE: Yeah, there's actually (indiscernible) \-- see if our citation
that needs to be here.

MALE: Right.

FEMALE: Which we've got lots of other places.

MR. CHAIRMAN: Duly noted. The change will be made. Thank you.

Are there any motions or requests for unanimous consent to change the
contents of Appendix \-- volume 2, Appendix C?

FEMALE: (indiscernible)

MALE: I move for a request for unanimous consent.

MALE: So which section are we talking about?

FEMALE: Volume 1 or volume 2?

FEMALE: (indiscernible)

MALE: Wait a minute.

MALE: (indiscernible) voting officials? (indiscernible)?

FEMALE: No. Qualification test design criteria. It's the last
(indiscernible).

MR. CHAIRMAN: The last 3 or 4 pages. Qualification test design criteria.
We have a motion and second. Any discussion? Not hearing any, call for a
roll call.

MALE: Roll call vote, volume 2, Appendix C. Berger?

Berger votes yes. Craft?

MALE: Yes.

MALE: Craft votes yes. Davidson?

FEMALE: Yes.

MALE: Davidson votes yes. Elekes?

MALE: Yes.

MALE: Elekes votes yes. Gannon?

MALE: Yes.

MALE: Gannon votes yes. Harding?

MALE: Yes.

MALE: Harding votes yes. Miller?

FEMALE: Yes.

MALE: Miller votes yes. Purcell?

FEMALE: Yes.

MALE: Purcell votes yes. Quesenbery?

FEMALE: Yes.

MALE: Quesenbery votes yes. Rivest?

MALE: Yes.

MALE: Rivest votes yes. And Semerjian.

MR. CHAIRMAN: Yes.

MALE: Semerjian votes yes.

MR. CHAIRMAN: The motion is carried. Appendix C, volume 2 has been
adopted as modified.

The final motion I will call for is a motion to adopt all of the
sections that we individually approved. I would like to make sure that
we have a complete list of these. Mark, will you please help me?

We are talking \-- we are talking about 2.2.7 \--.

MALE: If I may, would it be more appropriate to have a motion to adopt
the total document because it's not just the sections we've \--

MR. CHAIRMAN: Yes.

MALE: \-- the flow of the total document.

MR. CHAIRMAN: Yes. Very good point.

MALE: VVSG 1 in its entirety.

MR. CHAIRMAN: We \-- this \-- this actually goes back to the point that
I believe Dr. Williams made yesterday, that indeed, we're not only
approving the parts that were modified, but implicitly, we are approving
the entire document, both the parts that were modified and the parts
that were left intact. So.

I now entertain a motion for the TGDC to adopt this draft of the VVSG
version 1 in its entirety. Do I have a motion? Do I have a second?

MALE: Second.

MR. CHAIRMAN: Any further discussions?

MALE: Yes, Mr. Chairman. J.R.

MR. CHAIRMAN: Yes.

MALE: When we deliver this document next week, will we have a
transmittal letter or preamble to emphasize a few things like including
persons with disabilities with the setup and the verification and
training and those kinds of things?

MR. CHAIRMAN: We will welcome any input the committee members would like
to make on specific points that you would like to have included in the
transmittal letter. If you send an e-mail directly to me as well as copy
Mark Scull (phonetic sp.) and Alan Eustis, my e-mail address is Hratch,
h-r-a-t-c-h, \@nist.gov.

MALE: Right. I'll get it there. No problem.

MR. CHAIRMAN: I will be pleased to take your input into account in
drafting of the transmittal letter.

MALE: Great! Thank you.

MR. CHAIRMAN: Not hearing any further comments.

MALE: Question.

MR. CHAIRMAN: Yes.

MALE: Says we're approving the entire documents. I did have one note of
something missing that I think should be added into the Appendix B which
was Reference Information. There were a couple of citations in the
documents that referred to the (indiscernible) markup language
specification? And there's not a reference in here that would allow
(indiscernible) from this guidance documents is where I think it would
be inserted. We could ask to have that added \-- that reference added in
there?

MR. CHAIRMAN: If you could provide \--

MALE: Yes.

MR. CHAIRMAN: \-- that to us, we'll be \-- make the appropriate
addition. Any further comments? If not, I call for a roll call to adopt
the volume \-- volumes 1 and 2 of the Voluntary Voting System
Guidelines, version 1.

MALE: Roll call vote. Berger?

MALE: Yes.

MALE: Craft?

MALE: Yes.

MALE: Davidson?

FEMALE: Yes.

MALE: I'm sorry. Berger voted yes. Craft voted yes. Davidson voted yes.
Elekes?

MALE: Yes.

MALE: Elekes voted yes. Gannon?

MALE: Yes.

MALE: Gannon votes yes. Harding?

MALE: Yes.

MALE: Harding votes yes. Miller?

FEMALE: Yes.

MALE: Miller votes yes. Purcell?

FEMALE: Yes.

MALE: Purcell votes yes. Quesenbery?

FEMALE: Yes.

MALE: Quesenbery votes yes. Rivest?

MALE: Yes.

MALE: Rivest votes yes. And Semerjian?

MR. CHAIRMAN: Yes.

MALE: Semerjian votes yes. It's 11 votes in favor; motion passes.

MR. CHAIRMAN: Well, with this motion, we have adopted the Voluntary
Voting System Guidelines version 1, volumes 1 and 2. I think this
committee and the NIST staff that supported their activities ought to be
congratulated for your outstanding work and dedication. I thank
everybody especially for still staying here at this hour. Everybody
deserves applause.

We did not obviously have time to start the review of version 2, but as
I stated at the very beginning, that the most important task at hand for
this meeting was the approval of version 1. And I think that's a major
undertaking and major accomplishment. But that actually emphasize \--
emphasizes the fact that the work of this committee is not finished, not
complete and I would entertain a proposal that the work of the three
subcommittees continue and they continue to work in the development \--
on the development of VVSG version 2, and we have passed out a sheet to
begin selection of suitable dates for the next meeting of TGDC in early
September time frame. And I open the floor for any further discussion of
this topic at this time.

MALE: Yes, Mr. Chairman?

MR. CHAIRMAN: Yes, J.R.

MALE: Thank you. I would move that the three (indiscernible) committees
continue their labors on version 2. I would also ask us and you,
Chairman, to consider our next face-to-face meeting to be outside of the
Washington, D.C. community in another state.

MR. CHAIRMAN: Do you have any particular suggestion at this time or is
this something for us to deliberate on?

MALE: Well, I believe the Secretary from Colorado mentioned she'd
welcome us in her state. \[laughter\]

FEMALE: We have a NIST \--.

MR. CHAIRMAN: Yes, I have never been to Colorado \[laughter\], so I \--
I would \--.

MALE: I was kidding.

FEMALE: And we even \-- we even have a NIST facility there, so.
\[laughing\] I was surprised because we do have the NIST location there
outside of Boulder, in between Boulder and Denver.

MR. CHAIRMAN: Certainly Boulder area, Colorado in general, is a very
fine place to visit, and we appreciate the invitation from Secretary
Davidson, and I'm sure NIST will be delighted to host such a meeting at
our facility, so we \-- we will take that under advisement and make
appropriate arrangements. Thank you for the suggestion, Mr.
(indiscernible).

Any other comments?

MALE: Yes, Mr. Chairman. It's Jim Elekes.

MR. CHAIRMAN: Yes.

MALE: So as not to conflict with Mr. Harding and our scheduled U.S.
(indiscernible) is scheduled to meet in September on Monday, Tuesday,
and Wednesday, the 12^th^, 13^th^, and 14^th^. So if we \-- if we could
just ask consideration of the NIST staff that we don't have to conflict
with board business, it would be greatly appreciated.

MR. CHAIRMAN: Yes, we will certainly take that under consideration. We
actually have \-- I know I have other commitments that particular week,
so. In fact, we \-- you probably have not seen it, but a sheet was
passed and two proposed weeks were September 5-9 or September 26-30^th^.
So that doesn't mean that we're ruling out other dates, but those were
first offers, so to speak, so.

MALE: Mr. Chairman, just for those members of the committee who may be
of the Jewish faith, to make sure that staff does not schedule in
conflict with the Jewish holidays during the month.

MR. CHAIRMAN: We are quite aware of that. Thank you.

MALE: I have a question of clarification on these dates. Is this
proposed for the next plenary meeting of the TGDC then? There'd be
nothing in between now and then. Is that the proposal?

MR. CHAIRMAN: Well, do you have any \-- that \-- I think that is the
proposal on the table, but I'm open, certainly, to other suggestions.

MALE: Well, if I could, Mr. Chairman, I would think that EAC would want
us to move version 2 somewhat expeditiously so it was ready come January
as opposed to next, say, summer, and perhaps maybe we could get together
in June or July or August as opposed to September, you know. I'm just
thinking to keep this mojo moving. \[laughter\]

FEMALE: Well, I agree with you, J.R. This is Whitney \-- that we need to
move on up, but perhaps the next time we meet in plenary, we should have
completed a little more work on the \-- at the subcommittee level. I'm
particularly aware that in the Human Factors and Privacy committee, we
have a certain amount of research to do before we will be ready to draft
our next version, so it would be nice to allow a little bit of time to
get that work done.

MR. CHAIRMAN: My suggestion will be let's pick a date in September,
let's see how much progress we have made. If we think that we will have
a fruitful meeting long before that, we can certainly poll the committee
members and set another date and still use the September date as a
second meeting, but let's at least identify a date that we know we're
going to meet and then if we can arrange something earlier than that, we
can think about that depending on how much how fast progress is made. Is
that acceptable to everyone?

MALE: (indiscernible)

MR. CHAIRMAN: But I appreciate, certainly, your comments and I agree
with you that we need to maintain the momentum of this work. Are there
any other issues? Any other business?

MALE: Are we ready for new business?

MALE: (indiscernible) to enable the three subcommittees to begin work by
telephone on their \-- on the second version?

MR. CHAIRMAN: I couldn't catch the first part of your question, J.R.

MALE: Well, Paul \-- Paul asked if this was new business and I just
thought we still needed to vote on the fact that the three subcommittees
would continue their work on the second \-- second version.

MR. CHAIRMAN: Well, we \-- we \-- I thought there was general agreement.
I mean, do we need to put a motion forward for that? I assumed that was
a given unless there's an objection.

**\[End of Audiotape 8\]**

MR. CHAIRMAN: \-- so then we will wait for a formal resolution, formal
instructions from the EAC? Is that?

FEMALE: Yes.

MR. CHAIRMAN: Okay. All right.

Well, I \-- I would say that our assumption should be that, you know,
since it's \-- we're only done with the first part of the job, that
certainly, the expectations on the Hill is to continue this work. But,
certainly, it's a formal understanding, a formal instruction from EAC
would be useful.

Did you have some other new business, Mr. (indiscernible)?

MALE: Yes, sir, I have three new resolutions that I would like to \--
and this is only one. \[laughing\] I got 'em separate.

MALE: Was my \-- was my understanding when we discussed that that was
the only one you were going to bring up.

MALE: No, sir. I'd like to bring up all three. Can you put 'em on the
screen?

MALE: Yeah, we can do that.

MALE: Okay.

MALE: (indiscernible).

MALE: Please read them for us, Paul.

MALE: Pardon?

MR. CHAIRMAN: Yes, we \-- will put it on the screen here and we'll also
read them.

MALE: Okay. The first one entitled "Safe Harbor for Voting Systems
Purchased Under HAVA" and actually, it's got a typo on it so I'll read
off my screen. "The Technical Guidelines Development Committee
recommends that the EAC take steps to immediately publish a safe harbor
list of voting systems qualified by NASAID or the EAC under the 1990 or
2002 voting systems standards which can be purchased in a configuration
which will meet the requirements of HAVA for use after January 1, 2006.
And we recommend \-- and the EAC should recommend that jurisdictions
purchasing systems off the safe harbor list create purchasing contracts
that include mandatory upgrades to their voting systems as new revisions
of the Voluntary Voting System Guidelines become effective. They remind
election jurisdictions that the presence of the system on the safe
harbor list only indicates compliance with HAVA but does not address
compliance with individual state and local requirements and does not
override any state or local requirements for voting systems. And update
the safe harbor list weekly or as new systems become qualified."

MR. CHAIRMAN: Do I have a second?

MALE: Second for purpose of discussion.

MR. CHAIRMAN: I'd just like to add that according to the legal opinion
from our general counsel is the last three items are outside the
jurisdiction of authority, however you want to say it, of the TGDC.

MALE: Well, all four items, Mr. Chairman, are aimed at answering a
question which we have brought up in discussions here several times in
the last 2 days and which a number of people have been asking members of
this committee, which is how do you transition to the new systems? How
do you transition to the new standards? What are these jurisdictions out
there waiting to buy equipment to do? And, you know, basically, we are
providing a suggestion to the EAC as to how they might do this. And I
don't really find that it's inappropriate for them \-- us to give them a
recommendation.

MALE: In short, Paul, would that be considered like a cheat sheet to
help out those 600-some jurisdictions who need to buy new equipment?

MALE: Exactly, J.R. It is \-- I mean, there are \-- I think we have
discussed at length the fact that Congress intended that the current
state of the art systems and current accessibility be available nation
wide with an accessible device in each precinct by January 1. There are
systems out there that meet that now. Unfortunately, there are
jurisdictions out there that are waiting on the work of this committee
to find out that they can really buy those systems or not. They're
looking to the EAC for guidance and I think the EAC is looking to the
committee here for guidance.

FEMALE: Paul, I just want to be clear about the intention. I'm probably
beating the dead horse a little bit.

MALE: Okay.

FEMALE: But the idea is not to say that there are systems that were
qualified under 1990 and 2002 VSS which are acceptable in their current
form, but that there are systems that the EAC believes with it purchased
in an appropriate configuration, would meet the spirit if not the letter
of the VVSG 1.

MALE: Correct. And that's why I said purchased in a configuration.

MALE: You said it appropriately, Whitney.

MALE: Do we need to change the way it's saying? Stated?

FEMALE: I don't think so.

MALE: Okay. Okay.

FEMALE: I just wanted to double-check.

MALE: Yeah. Yeah. And then obviously, the second part since these \--.

FEMALE: Actually, I guess I get \-- well, let me just raise the
question. I'm not sure. But we do say "meet the requirements of HAVA".
Are we also saying "believe will meet the requirements of VVSG 1"? So
that's \-- that's a question. They are two slightly different things.

MALE: I'm saying HAVA. Basically, the jurisdictions out there have a
part of HAVA money that they \-- they need to spend. They're looking for
guidance on what they should spend it on.

FEMALE: Yeah. And as much as I would like to say the second, I think
that it's probably impractical for any governmental body to do.

MALE: Yeah.

MALE: So I have two questions, clarifications. What exactly are you
expecting that would be published? What's on this list?

MALE: I'm expecting that a list would be \-- include the system name,
the NASAID or EAC qualification number, and be supplemented with any
additional optional features such as an audio ballot station that would
be required to meet the requirements of HAVA.

MR. CHAIRMAN: Now \--.

MALE: It would be a very specific specification of what they could buy.

MALE: Are \-- are these systems that have gone through a testing
authority?

MALE: Yes. These would be systems that are already either recently EAC
or NASAID qualified, so what are commonly referred to as
NASAID-certified systems.

MALE: So, you're saying a list exists today?

MALE: No. A list does not exist today. I am suggesting that the EAC
compile such a list and publish it.

MALE: You mean NASAID doesn't have a list of qualified companies?

FEMALE: It isn't \-- it isn't actually very hard to find the
information.

MALE: NASAID \-- NASAID has a list of qualified systems under the 2002
standards. They have not, and neither has the EAC, published a list of
which of those 2002 and 1990 systems will actually be acceptable under
HAVA.

MALE: And how would that determination be made?

MALE: The EAC will have to possibly huddle with their lawyers and make
some decisions. I would suggest that they consult with knowledgeable
persons at NASAID such as a NASAID technical advisory board. I am sure
there will be issues of vendors wanting to be included that the EAC
feels that they cannot include. But this guidance is desperately needed
by jurisdictions that are trying to make decisions with a very
rapidly-eroding timeline.

MALE: Okay, so by us recommending that they meet the requirements of
HAVA, how does that, if at all, relate to any of the work this committee
has done?

MALE: This, I think, gives the EAC a recommendation on transitioning to
the work this committee has done. Much of the work this committee has
done, particularly in the areas of accessibility, there's not going to
be anything new before the '06 election. By the time this work can be
completed and some sort of certification evaluation of these systems
done against this, we're \-- we're going to be in September and October,
much too late for these jurisdictions to start making purchase
decisions. There are some very definite definitions of systems that are
out there right now that will work and I think the EAC just needs to
identify those to the people who are waiting on the information.

MALE: Okay, by \-- by referencing meeting the requirements of HAVA, is
there some implication that the \-- the VVSG version 1 is then gets
adopted by EAC and by the Election Assistance Commission and therefore
once they adopt our recommendations on those guidelines, that then means
that they're part of HAVA? That our guidelines then mean \--

FEMALE: No.

MALE: \-- if you meet those guidelines, you're qualified under \-- I'm
trying to understand what the leakage is kind of behind the words here.
It's not explicit in the words.

MALE: Basically a system that today meets the 2002 voting systems
standards and has the accessible device, the audio ballot that you can
put one of in each polling place, that meets the requirements of HAVA.

FEMALE: Paul, I feel \-- I \-- I hear how strong the need you're
expressing is and I suspect that this is a wonderful piece of work, but
I wonder if it's a piece of work for this committee and might not be
something better suited for the EAC Standards Board or even for NASAID
to make such a recommendation. I just \-- I don't \-- I just don't quite
understand how it fits with our work, and that's \-- that's my only
problem with it. I mean, as a \--

MALE: Okay.

FEMALE: \-- as a piece of important advice and guidance, it sounds like
it would be something very helpful and wonderful, but I \-- I don't even
know that I'm qualified to vote on whether some \-- on what would meet
\-- \[laughing\] sorry. I just disintegrated there.

MR. CHAIRMAN: If I may, I would like to have the legal opinion experts
by the \-- by our attorneys, so.

MALE: It's apropos what Whitney was just saying. We were concerned that
we were dictating to EAC in too specific or too detail a level of what
they should then do toward industry. And we did not have an objection
with the spirit of \-- of the proposal, the resolution. The first two
bullets are fine. In general, you're instructing, or you're recommending
\-- excuse me \-- the \-- the concept of a safe harbor list. We were
concerned that the final three bullets went beyond that and went into
great detail where we were telling the EAC what the \-- the list would
be and \-- and the impact and \-- and it just goes into greater detail.
And I think we were \-- we believe that that was beyond the scope of
HAVA which \-- which is more bare bones, shall assist the Executive
Director of the Commission that the TGDC shall assist the Executive
Director of the Commission in development of voluntary voting system
guidelines and that this goes beyond that, the final three bullets.

MALE: Actually, well, probably the final two bullets.

FEMALE: Yeah, when you say three bullets, there's actually a \-- there's
a typo on this form.

MALE: Well, beginning with "recommend that jurisdictions purchase these
systems off of the safe harbor list" and then on down from there.

MALE: Okay, I'll \-- I'll amend the resolution if the second is in
agreement to strike everything below "remind election jurisdictions".

MALE: Actually, the objection comes in one bullet above that. And I
apologize. I was going off the pre-typo version, but "recommend that
jurisdictions purchase these systems off the safe harbor list" that's
the beginning of \-- of where we have concern. If it ended at "January
1, 2006", that would be \-- that would not be objectionable.

MALE: Well, I think the second piece is \-- it is not a requirement; it
is a recommendation for the EAC to make a recommendation which they can
then determine, but I think in the best interest of the voters and the
people who are going to rely on this information, that would be very
sound advice and I just \-- I don't see the problem with giving that
advice.

FEMALE: I'd love to hear from some of our election officials on this.

FEMALE: Well, I think I'm the only on here and I don't know if there's
some on the telephone.

FEMALE: Actually, I'm here, Jeanetta (phonetic sp.).

FEMALE: I \--.

FEMALE: And this is Caroline here, also.

FEMALE: Okay, great! My opinion is I see where I would love to have
something like this. Obviously. But in my \-- in my \-- thinking it
through, we are asking the EAC to put themselves in where maybe the
Justice Department feels like a system doesn't meet the requirements or
somebody else and that they have it on the list or they don't have it on
the list, I think you're setting the EAC up for possibly until the
standards can be met and \-- and everything is certified and they can
print a list up that has been met to these new standards, I wonder if
you're setting the EAC up or \-- for court battles. And HAVA is very
clear that you can't spend any money that is federal underneath HAVA to
fight any law \-- court cases. So I \-- I definitely understand where
you're coming from; I love the idea, but I'm not sure we can do that.

FEMALE: I would agree with Secretary Davidson. I feel that the EAC has
not only appointed an advisory board but also a standards board and they
will make recommendations to the EAC on things, and I believe things of
this nature. And I would \-- if our legal counsel is saying \-- if they
feel it's a little bit out of our purview, I'm not sure that I don't
also.

FEMALE: Yeah, let me just say for the record also, we do need to be
cognizant of the fact that the Standards Board also has to get these
recommendations before it goes any further so maybe, while I think,
Paul, that's an excellent idea for most jurisdictions out there that
haven't purchased, we may want to be a little bit careful with how we
proceed to do that. A list would be great. It's just a matter of who
generates that list, where it comes from, and how it gets to where it
needs to go.

MALE: Okay, well, Mr. Chairman, I think I can no longer count to eight,
so \[laughter\] if there are no objections, I think I will withdraw the
motion. And the other two resolutions are supportive of the first, so.

FEMALE: But it sounds like a great letter to write. \[laughing\]

MALE: Okay.

MALE: Yeah, Whitney, on that \-- on that point, Mr. Chairman, perhaps
that could be included in your transmittal. During our debate and our
discussions of our draft guidelines, these are issues that should be
considered by the EAC and their Advisory Boards, et cetera.

MR. CHAIRMAN: Would that be a reasonable approach? Do we agree with
that? A softer language that says this is something that we have
discussed and most committee members feel that this would be a useful
tool?

FEMALE: Certainly the whole issue \--

MR. CHAIRMAN: Or something to that effect?

FEMALE: \-- certainly, we've been extremely cognizant of the
rapidly-moving calendar, you know, through no fault of anybody's here,
2006 hasn't changed when it's going to happen. And I think, you know, we
have spent a certain amount of time trying \-- trying to resolve that
issue and I think if \-- if this is a suggestion that people think is a
great idea, it would be a shame not to do something with it.

FEMALE: I \-- I think that's a great idea. I like the suggestion of a
letter and maybe we should do that.

MALE: Mr. Chairman, James Elekes.

MR. CHAIRMAN: Yes.

MALE: I understand that next week, you'll be appearing before us at the
Board of Advisors. I would heartily recommend that you bring the
sentiments from the TGDC in, specifically Mr. Craft, and perhaps we can
then hold that into our agenda, and where the TGDC cannot make a
recommendation, perhaps our chairman, Mr. Lewis, would entertain such
action next week.

MR. CHAIRMAN: Is that consistent with the sense of the committee?

MALE: Yes.

FEMALE: Yes.

MR. CHAIRMAN: Okay, I will surely take that under advisement. I may
include it in my comments.

MALE: Thank you, sir.

MR. CHAIRMAN: So does this mean, Mr. Craft, that you've withdrawn the
others?

MALE: Yes.

MR. CHAIRMAN: Motions? \[laughter\]

Any other business?

FEMALE: Did we have an open resolution that we never cleared up? I think
there was one that we deferred voting on. I hate to say this.

FEMALE: We came back. We \-- we got it already.

MALE: Yeah, we got it.

FEMALE: We got it. Okay.

MALE: Yeah.

MR. CHAIRMAN: I believe we voted on all the items and we voted on the
entirety of the document. So, I thank all of you for your time, effort,
dedication, and we look forward to continuing this effort. And I declare
this session adjourned. Thank you.

**\[End of Audiotape 9\]**

\* \* \* \* \*

[CERTIFICATE OF AGENCY]{.underline}

I, Carol J. Schwartz, President of Carol J. Thomas Stenotype Reporting
Services, Inc., do hereby certify we were authorized to transcribe the
submitted cassette tapes, and that thereafter these proceedings were
transcribed under our supervision, and I further certify that the
forgoing transcription contains a full, true and correct transcription
of the cassettes furnished, to the best of our ability.

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

CAROL J. SCHWARTZ

PRESIDENT