EAC Decision on Request for Interpretation 2008-07

2002 VSS Vol. I, Sections, 2.3.4, 2.3.5, 2.3.6, 2.4.1, 4.4.3, 9.4 

2002 VSS Vol. II, Sections, 3.3.1, 3.3.2 

2005 VVSG Vol. I, Sections, 2.2.4, 2.2.5, 2.2.6, 2.3.1, 5.4.3 

2005 VVSG Vol. II, Sections, 1.3, 3.3.1, 3.3.2 

Date: 

August 27, 2008 

Question(s): 

Should a voting system warn and report the existence of votes that may be retained in memory or 

on disk at the start of an election? If so, how must this condition be reported? 

Section of Standards or Guidelines: 

2002 VSS Vol. I, Section 2.3.4, Readiness Testing 

2005 VVSG Vol I 2.2.4, Readiness Testing 

2002 VSS Vol. I, Section 2.3.5, Verification at the Polling Place 

2005 VVSG Vol. I, Section 2.2.5, Verification at the Polling Place 

2002 VSS Vol. I, Section 2.3.6, Verification at the Central Location 

2005 VVSG Vol. I, Section 2.2.6, Verification at the Central Location 

2002 VSS Vol. I, Section 2.4.1, Opening the Polls 

2005 VVSG Vol. I, Section 2.3.1, Opening the Polls 

2002 VSS Vol. I, Section 4.4.3, In-process Audit Records 

2005 VVSG Vol. I, Section 5.4.3 In-process Audit Records 

2002 VSS Vol. I, Section 9.4, Testing Scope 

2005 VVSG Vol. II, Section 1.3, Testing Scope 

2002 VSS Vol. II, Section 3.3.1, Functionality Testing in Parallel with Hardware 

Testing for Precinct Count Systems 

Background: 

There have been several instances of equipment in the field where memory or disk locations were 

not cleared prior to the start of an election resulting in erroneous tabulation of results. The 

Sections listed above state that: 
VSS Volume I 

2.3.4.1.a - Verify that voting machines or vote recording and data processing equipment, precinct 

count equipment, and central count equipment are properly prepared for an election, and collect 

data that verifies equipment readiness; 

2.3.4.1.f - Segregating test data from actual voting data, either procedurally or by 

hardware/software features. 

2.3.5.e - The contents of each active candidate register by office and of each active measure 

register at all storage locations (showing that they contain only zeros); 

2.3.5.g - Other information needed to confirm the readiness of the equipment, and to 

accommodate administrative reporting requirements. 

2.3.6..b - The contents of each active candidate register by office and of each active measure 

register at all storage locations (showing that they contain all zeros); 

2.3.6..c - Other information needed to ensure the readiness of the equipment and to accommodate 

administrative reporting requirements. 

2.4.1.1 - To allow voting devices to be activated for voting, the system shall provide: 

 

a. An internal test or diagnostic capability to verify that all of the polling place 

tests specified in Section 2.3.5 have been successfully completed; and 

b. Automatic disabling any device that has not been tested until it has been tested. 

 

2.4.1.2.2 - In addition to the above requirements, all paper-based precinct count equipment shall 

include a means of: 

 

a. Activating the ballot counting device; 

b. Verifying that the device has been correctly activated and is functioning 

properly; and 

c. Identifying device failure and corrective action needed. 

 

2.4.1.3 - To facilitate opening the polls, all DRE systems shall include: 

a. A security seal, a password, or a data code recognition capability to prevent 

the inadvertent or unauthorized actuation of the poll-opening function; 

b. A means of enforcing the execution of steps in the proper sequence if more 

than one step is required; 

c. A means of verifying the system has been activated correctly; and 

d. A means of identifying system failure and any corrective action needed. 

4.5.3b.2 - The “zero totals” check conducted before opening the polling place or counting a 

precinct centrally; 

9.4 - The qualification test process is intended to discover errors that, should they occur in actual 

election use, could result in failure to complete election operations in a satisfactory manner. 

2
2005 VVSG Vol. I, 5.4.2 – (d) The software shall check and record the status of all data paths 

and memory locations to be used in vote recording to protect against contamination of voting 

data; (e) Upon the conclusion of the tests, the software shall provide evidence in the audit record 

that the test data have been expunged 

VSS Volume II 

3.3.1. a3 - Verify program memory device content; 

3.3.1. c2 - Obtain "zero" printout or other evidence that data memory has been cleared; 

Conclusion: 

The standards require more than a simple pre-election “zero report” for the voting system. Both 

VSS and VVSG require all memory locations be reset before the election. The VSS Volume II 

3.3.1.c2 should be applied so that any system component (including central count) which stores 

votes or consolidate results must provide a visual (screen) warning to the election officials if 

memory locations (including data on disk) contain votes or consolidate results as part of the 

readiness check of the system before counting results. This includes verifying that no residual 

votes from the Logic and Accuracy test or other tests conducted as part of the pre-election process 

are present and capable of being added to the election totals. . A report (with a time stamp) must 

be produced indicating the status of the votes/results memory and disk storage locations. The 

report(s) will be part of the official audit trail records to be retained showing the readiness of the 

system for voting. If a unit or system has a non-zero counter or residual votes this is considered a 

failure to activate correctly under the requirements of VSS 2.4.1/VVSG 2.3.1. The requirements 

of VSS 2.4.1/VVSG 2.3.1 should be interpreted to mean that such a failure to active correctly is a 

device or system failure and therefore requires both that the device be disabled from use in the 

system and that election officials are advised of the proper corrective action. 

Given the potential impact of an election being started with non-zero counters or residual votes it 

is not sufficient to only enter a note in the device audit log. The occurrence shall be recorded in 

the device audit log. In addition, a clear, unambiguous warning must be passed to the system 

level where an election official will be clearly notified that an attempt has been made to initiate 

an election with non-zero totals. 

The certification testing of the components and system readiness by the VSTL shall include 

attempts to initiate an election with non-zero totals on counters or residual ballots, validating that 

the ‘zero’ report procedure will correctly identify and warn the election officials of the presence 

of any previously stored results which are in a form that may be deliberately or accidentally 

processed. 

Effective Date: 

Immediate- for all voting systems not having an approved test plan as of the date of publication. 

3