The Help America Vote Act of 2002 (HAVA, P.L. 107 - 252 ) established the federal Election Assistance Commission (EAC) and gave it the responsibility to develop and update a set of Voluntary Voting System Guidelines ( VVSG ). It established the Technical Guidelines Development Committee (TGDC), chaired by the director of the National Institute of Standards and Technology (NIST), to develop recommended guidelines for consideration by the EAC. The VVSG are a set of technical standards for voting systems that use computers to assist in recording or counting votes. Systems covered include most used in the United States—not only DREs (direct recording electronic systems) such as touchscreen voting machines, but also optical scan and punch card systems. Hand-counted paper-ballot and lever-machine systems, which do not involve computers, are not covered. However, they are used by a small and decreasing number of election jurisdictions. The first version of the VVSG was approved in 2005 and is therefore called the 2005 VVSG in this report. It went into effect in December 2007. A draft of the completely rewritten second version was made available for public comment on October 31, 2007, at http://www.eac.gov/vvsg . That comment period closed in May 2008. The VVSG replaced the federal voluntary VSS originally developed under the auspices of the Federal Election Commission (FEC). The VSS , which remained in effect until the end of 2007, were developed in response to concerns raised in the 1970s and 1980s about the then largely unregulated voting technology industry. Congress directed the FEC to study the matter but did not establish the VSS specifically by statute (see CRS Report RS21156, Federal Voting Systems Standards and Guidelines: Congressional Deliberations , for more detail). The first version of the VSS was released in 1990, and a testing and certification program began in 1994 under the auspices of the National Association of State Election Directors (NASED). The VSS and the NASED certification program are widely credited with having greatly improved the performance of voting systems in several areas, such as reliability and accuracy. The FEC began a project to update the VSS in 1997 and approved the second version in May 2002, while Congress was debating HAVA. Enacted in October 2002, HAVA provided a statutory basis for the VSS , which the act renamed guidelines, to distinguish them from the act's voting system requirements, which it called standards. HAVA also provided an administrative structure under the EAC for promulgating the guidelines and certifying systems, and also directed NIST to assist in the certification process. Most sections of the 2005 VVSG are virtually identical to those in the 2002 update of the VSS . Major revision focused on usability, accessibility for persons with disabilities, and security; those sections were completely rewritten. The decision to limit the scope of revision resulted from a desire to meet urgent needs while creating a version that could be used in preparation for the 2006 election cycle. HAVA's accessibility requirements went into effect in January 2006, and many states have adopted new security requirements for voting systems, including paper-audit-trail requirements, in the wake of controversies that emerged subsequent to the passage of HAVA (see CRS Report RL33190, The Direct Recording Electronic Voting Machine (DRE) Controversy: FAQs and Misperceptions ). The 2007 draft VVSG have been completely rewritten. The 2005 VVSG provide a set of specifications and requirements to be used in the development of computer-assisted voting systems and their certification-testing by independent laboratories. The guidelines include descriptions of functional requirements and performance standards, as well as requirements for vendors in quality assurance and in configuration management, which involves ensuring that a system functions in specified ways under various modifications and throughout its life cycle. They provide details of the testing process for certification of voting systems, and also include suggested practices for election officials in some areas covered by the guidelines, and discussion of verification concepts for future design of voting systems. The guidelines are aimed at a broad audience, but most specifically at vendors, testing laboratories, and election officials. Their use is voluntary at the federal level, but many states require that any new voting systems used in the state adhere to them or to state standards that incorporate similar specifications. The practical effect of such state requirements is that voting system vendors can successfully market systems only if they are certified under the VSS or VVSG . In this sense, the provisions have acquired some of the force of regulation, in that they are treated by manufacturers as requirements. Nevertheless, HAVA specifically exempts states from being required to adhere to the VVSG as a condition for receipt of payments to meet HAVA requirements. Consequently, when a company develops a new voting system, it typically uses the VVSG as a source of specifications to which the system must adhere. When the vendor submits the system to an independent laboratory for certification, the laboratory uses the VVSG as a source of standards against which it tests the system. The system may also need to be certified against state standards to the extent that they differ from the federal guidelines. State officials may then use the VVSG in their state-level certification tests of systems they are considering for acquisition. Private citizens who might wish to test voting systems cannot ordinarily do so because of contractual restrictions imposed by the vendors. While adherence to some specifications can be assessed by knowledgeable citizens when they vote, many provisions can be assessed only in a laboratory. HAVA does not specifically direct the EAC to include any particular issues in the guidelines. However, in the debate on the House floor before passage of the HAVA conference agreement on October 10, 2002, a colloquy ( Congressional Record, daily ed., 148: H7842) stipulated an interpretation that the guidelines specifically address the usability, accuracy, security, accessibility, and integrity of voting systems. Also, the act requires NIST to provide support to the TGDC for development of guidelines relating to security, voter privacy, human factors, remote voting, and fraud detection and prevention. HAVA establishes specific requirements for voting systems, but leaves methods of implementation to the states. The EAC is required to provide guidance for implementing the requirements, but the guidance is not a technical standard and its use is also voluntary. The act is largely silent on the relationship between the VVSG and those requirements, which stipulate that voting systems must provide for auditability, accessibility, and ballot verification and error correction by voters, that states must set standards for what constitutes a vote on a given system, and that machine error rates of voting systems must conform to the standards set in the guidelines. This last is the only direct connection in the act between the requirements and the VVSG , but in practice, the specifications in the guidelines clearly need to conform to the HAVA voting system requirements. The VVSG cover largely the same topics as did the VSS. They include the following: The functional capabilities a voting system is expected to have. These fall into several categories, including security, accuracy, error recovery, system integrity, auditing, election management, human factors, vote tabulation and reporting, telecommunications, data retention, ballot preparation and control, voting, maintenance, transportation, and storage. Performance, physical, design, construction, and maintenance requirements for hardware , from printers to voting devices to paper ballots to back-office computer equipment. Requirements for software , including design and coding, data and document retention, audit record data, and vote secrecy for DREs. Telecommunications requirements for operation and reporting election results, including performance, design, and maintenance characteristics. Essential security capabilities, including controls to minimize errors and accidents, protect from malicious manipulation, identify fraudulent or erroneous changes, and protect voting secrecy. Requirements for voter-verified paper trails (VVPAT) used in conjunction with DREs (this is new in the VVSG ). Requirements for quality-assurance programs and configuration management throughout a voting system's life cycle. Suggested best practices for election officials with respect to usability and security requirements. Suggested specifications for a class of vote-verification systems (which includes VVPAT) that produce at least two separate, independent ballot records that voters can verify before casting and that can be compared in a post-election audit. The certification testing process, including planning, testing sequence, specific tests required, exemptions (such as unaltered commercial off-the-shelf software), and vendor requirements. Several issues have been raised about the VVSG that may require congressional attention. Among them are the following: The degree to which the guidelines are voluntary. HAVA makes the standards voluntary at the federal level and did not give the EAC regulatory authority, but vendors have usually treated the VSS as mandatory because of state requirements. Nevertheless, some observers believe that adherence should be mandatory or at least a condition of receiving any federal grants for voting equipment. Others state that mandatory standards would give too large a role to the federal government and reduce the flexibility of state and local governments to respond to their specific needs. What standards can and cannot do. Standards can address only issues that were considered by the developers of those standards, and the way that they are developed and implemented can also affect the way issues are addressed. The VSS and its certification process were criticized for not anticipating the kinds of security weaknesses with DREs that have been discovered in some certified systems, and for limiting testing of systems to controlled laboratory conditions rather than realistically simulated election conditions. The 2005 VVSG strengthened the security requirements, and the 2007 draft completely rewrote them. The 2005 version did not address the second criticism, but the 2007 draft would require more realistic testing. Development and implementation of the VVSG. The development of standards can involve lengthy deliberations under the best of circumstances, and HAVA may have exacerbated that characteristic by creating a complex process for the development of the VVSG .