Upload
clare-fletcher
View
216
Download
0
Tags:
Embed Size (px)
Citation preview
NIST HAVA-Related Work:Status and Plans
June 16, 2005National Institute of Standards and
Technologyhttp://vote.nist.gov
6/10/2005 - page 2
Voluntary Voting System Guidelines (VVSG)
Implementation Strategy Develop best long-term voting systems guidelines
possible Build on strengths of 2002 VSS Significantly enhance areas needing improvement Reorganize for clarity and testability
Provide guidance to states in time for 2006 election cycle
Implied need to minimize changes to 2000 to VSS while filling in 2002 VSS gaps
Implied need to require only what is possible by 2006 Thus, two guidelines developed:
VVSG Version 1 – augmented 2002 VSS for 2006 VVSG Version 2 – new, redesigned guideline
6/10/2005 - page 3
Overview of NIST Work NIST worked with Technical Guidelines
Development Committee (TGDC) to augment 2002 VSS
NIST/TGDC developed augmented version of Voluntary Voting System Guidelines (VVSG Version 1) in open process, Sep ’04 – May ’05
NIST delivered VVSG Version 1 to EAC on May 9 NIST now vetting outline for VVSG Version 2
with TGDC NIST will work with TGDC subcommittees on
VVSG Version 2 development, plan future meetings (next is Sep ’05)
6/10/2005 - page 4
VVSG Version 1 Overview Two volumes
Volume I, the performance provisions of the guidelines Volume II, how conformance is to be tested
Improves the 2002 VSS by addressing Human Factors VVPAT (Voter Verified Paper Audit Trails) Wireless Software Distribution and Setup Validation Conformance, Glossary, Error Rates
Sets stage for VVSG Version 2 (under development)
Expanded Human Factors Independent Dual Verification
6/10/2005 - page 5
VVSG Version 2 A comprehensive standards guideline A complete rewrite of 2002 VSS with updated and
expanded material 4 Volumes:
Product requirements Terminology Requirements for data from vendor to be provided to
testing lab Testing requirements
Will draw from VSS, IEEE P1583, Federal and other standards
Will include material from VVSG Version 1 and other material as directed by TGDC resolutions from Jan ’05
6/10/2005 - page 6
VVSG Version 1 and 2 Current Status
VVSG Version 1 delivered to EAC May 9, 2005 NIST will monitor public comments on VVSG
Version 1 while working on VVSG Version 2 VVSG Version 2 outline has been developed;
NIST and TGDC working to create final version of outline
Research underway: Meetings with vendors Working with usability and accessibility experts Threat analysis development Preliminary requirements development
6/10/2005 - page 7
Detailed Presentation Outline
NIST HAVA Responsibilities Current status of voting work at NIST Overview of Voluntary Voting Systems
Guidelines Version 1 (VVSG Version 1) Plans for VVSG Version 2 Comments/Questions
6/10/2005 - page 8
NIST HAVA Responsibilities Chair the Technical guidelines development
committee (TGDC) Provide technical support to the TGDC in the
development of Voluntary Voting System Guidelines (VVSG) including:
Security Methods to detect and prevent fraud Human factors, including technologies for individuals
with disabilities Deliver initial VVSG to EAC 9 months after
TGDC appointments (May 9, 2005)
6/10/2005 - page 9
Voluntary Voting System Guidelines (VVSG)
Implementation Strategy Develop best long-term voting systems guidelines
possible Build on strengths of 2002 VSS Significantly enhance areas needing improvement Reorganize for clarity and testability
Provide guidance to states in time for 2006 election cycle
Implied need to minimize changes to 2000 to VSS while filling in 2002 VSS gaps
Implied need to require only what is possible by 2006 Thus, two guidelines developed:
VVSG Version 1 – augmented 2002 VSS for 2006 VVSG Version 2 – new, redesigned guideline
6/10/2005 - page 10
NIST/TGDC Activities - 1 July 2004: 1st TGDC meeting
Organizational, divided into 3 subcommittees: Human factors and privacy Core requirements and testing Security and transparency
Sep 2004: information gathering meeting for the TGDC
Heard public input from voting officials, vendors October 2004: posted voting software hashes
For use by state and local officials Used NIST national software reference library
http://www.nsrl.nist.gov
6/10/2005 - page 11
NIST/TGDC Activities - 2 January 2005: VVSG Version 1 organization
Discussed, adopted 35 resolutions affecting development of VVSG Version 1 and VVSG Version 2
EAC requests NIST develop VVPAT requirements March 2005: VVSG Version 1 preliminary drafts
Commented on presentations, materials from NIST staff EAC requests additional security material for VVSG
Version 1 April 2005: final draft and VVSG Version 1
adoption Commented on final materials from NIST staff NIST directed to make final edits and deliver to EAC
May 9, 2005: VVSG Version 1 delivered to EAC
6/10/2005 - page 12
Current Status NIST presented the VVSG Version 1 to the
TGDC during April 20-21 meetings NIST updated VVSG Version 1 with TGDC edits,
delivered to EAC on May 9 NIST now vetting outline for VVSG Version 2
with TGDC NIST will work with TGDC subcommittees on
VVSG Version 2 development, plan future meetings (next is Sep’05)
NIST planning to monitor public comments on VVSG Version 1 while writing VVSG Version 2
6/10/2005 - page 13
VVSG Version 1 Overview Two volumes
Volume I, the performance provisions of the guidelines
Volume II, the testing specification Improves the 2002 VSS by addressing
Human Factors VVPAT Wireless Software Distribution and Setup Validation Conformance, Glossary, Error Rates
Sets stage for new version under development Expanded Human Factors Independent Dual Verification
6/10/2005 - page 14
Major Organizational Changes in VVSG Version 1
1. Best Practices for Voting Officials
2. Voting Process3. Structure of Requirements
6/10/2005 - page 15
Best Practices for Voting Officials
VSS 2002 contained requirements for voting systems and testing entities
Requirements in VVSG Version 1 for wireless, VVPAT, human factors, etc. depend on voting officials developing and carrying out appropriate procedures
VVSG Version 1 contains best practices for voting officials
These are not testable and conformance can not be determined
Best Practices for Voting Officials are contained in Appendix C of Volume I
6/10/2005 - page 16
Voting Process VSS 2002 defined three major stages of
voting Pre-voting Voting Post-voting
New sections designate which stage the requirements pertain to
VVSG Version 2 will contain a more detailed voting process model
6/10/2005 - page 17
Structure of Requirements New sections of the VVSG Version 1 contain
a more structured approach Each requirement is numbered according to a
hierarchical scheme Higher level requirements are supported by
lower level requirements Higher level requirements may not be
directly testable but can be “indirectly” tested via their lower level requirements
6/10/2005 - page 18
New Material in VVSG Version 1
1. Conformance Clause2. Human Factors3. Security Overview – IDV Systems4. VVPAT5. Wireless6. Software Distribution/Setup Validation7. Glossary8. Error Rates
6/10/2005 - page 19
Conformance Clause VSS-2002 did not include a conformance clause Conformance: the fulfillment by a product,
process, or service of requirements as specified in a standard or specification
The conformance clause of a standard specification is a high-level description of what is required of implementers and developers
Refers to other parts of the standard Specifies minimal requirements for certain functions and
implementation-dependent values Specifies the permissibility of extensions, options, and
alternative approaches and how they are to be handled
6/10/2005 - page 20
Human Factors The VSS-2002, Volume 1 Section 2.2.7,
addressed Accessibility; Section 3.4.9 addressed Human Engineering—Controls and Displays; Appendix C addressed Usability
VVSG Version 1 replaces these items with a new Section 2.2.7 that addresses Human Factors including accessibility, usability, and limited English proficiency
Incorporates the two NASED Technical Guides (Guide #1 and Guide #2)
VVSG Version 2 will contain performance-based requirements (specifies how voting systems must perform)
6/10/2005 - page 21
Human Factors 4 Areas:
Accessibility Usability Limited English Proficiency Privacy
Based on current state of the art Require more advanced accessibility but still in
industry state of the art Synchronized audio and video
Performance measures for usability
6/10/2005 - page 22
Security Overview New security Section 6.0, with 4
parts: Overview of Independent Dual Verification
(IDV) voting systems (informative only, not required for 2006)
VVPAT Requirements Wireless Requirements Software Distribution/Setup Validation
Requirements
6/10/2005 - page 23
Independent Dual Verification
Requires voting systems to produce 2nd record of votes for ballot record integrity and auditability
Required as part of standard computerized record-keeping practices
Current approaches include Split process systems Witness systems – recently marketed Cryptographic-based systems – available today VVPAT, modified Op Scan – available today
New Appendix D contains in-depth IDV discussion IDV systems expected to evolve significantly in
VVSG Version 2
6/10/2005 - page 24
VVPAT The VSS-2002 contained no requirements for voter
verified paper audit trails (VVPAT) Vendors, most States in need of consistent,
common guidance TGDC directed by EAC to produce VVPAT guidance
for States requiring VVPAT VVPAT a form of IDV VVSG does not require or endorse VVPAT Methods other than VVPAT can provide ways to
achieve IDV, as explained in Security Overview NIST used CA State, IEEE standards, and enacted
State legislation as initial basis
6/10/2005 - page 25
Wireless Technology TGDC concluded that use of wireless technology
introduces risk and should be approached with caution
VVSG Version 1 includes new section on wireless that augments the general telecommunications requirements in Volume 1, Section 5
Requires that wireless transmissions be encrypted to protect against a variety of security problems
Requires wireless to be turned on/off under controlled conditions
Requires backup procedures in case wireless fails
6/10/2005 - page 26
Software Distribution Helps to ensure correct version of voting
software is used Helps to ensure voting software is set up
correctly Uses NIST’s National Software Reference
Library at http://www.nsrl.nist.gov This section of VVSG Version 1 builds on the
VSS-2002 to include use of this repository and other validation mechanisms
6/10/2005 - page 27
Glossary Common terminology forms basis for
understanding requirements and for discussing improvements
This glossary contains terms from the VSS-2002 and additional terms needed to understand voting and related areas, e.g., security, human factors, testing
Terms in glossary include a definition and its source, and an association as to the domain for which the term applies
Also available in a web-based on-line version at http://www.nist.gov/votingglossary.
6/10/2005 - page 28
VVSG Version 2 A comprehensive standards guideline,
a complete rewrite of 2002 VSS with updated and expanded material
Will draw from VSS, IEEE P1583, Federal and other standards
Will include material from VVSG Version 1 and other material as directed by TGDC resolutions from Jan ’05
6/10/2005 - page 29
Major Goals for VVSG Version 2
Provide complete and comprehensive guideline for vendors and test labs
Provide clear, usable requirements discussion with associated test methods
Address security and human factors developments since 2002 VSS
Respond to all TGDC Jan’05 resolutions
6/10/2005 - page 30
VVSG Version 2 Overview 4 major sections:
A product standard, containing general and voting-activity related requirements (e.g., setup, cast, count, …)
A terminology standard (NIST glossary) A standard on data to be provided by testing
authorities or the vendor A testing standard including all test
methods, testing requirements, evaluation guidelines, test cases, etc.
6/10/2005 - page 31
VVSG Version 2 Current Status
Detailed outline has been developed; NIST and TGDC working to create final version of outline
Research underway: Meetings with vendors Working with usability and accessibility experts Threat analysis under development Preliminary requirements development
underway
6/10/2005 - page 32
Comments/Questions