NIST releases suite of e-voting system tests for comment
Connecting state and local government leaders
The National Institute of Standards and Technology has released a draft suite of tests to verify compliance with the Election Assistance Commission's new set of voluntary guidelines for voting systems.
The Election Assistance Commission (EAC) is developing a new set of voluntary guidelines for voting systems, and the National Institute of Standards and Technology has released a draft suite of tests that independent laboratories will use to verify compliance with those guidelines.
NIST is seeking public comments on the draft suite, which will replace proprietary tests that accredited labs use to test the current generation of standards — the Voluntary Voting System Guidelines (VVSG) of 2005. The commission is in the process of developing the VVSG Next Iteration (VVSG-NI), for which NIST developed the tests.
The guidelines must undergo an extensive review process, and EAC has said that their adoption is still years away. But the new guidelines and tests are expected to provide a greater level of transparency and confidence in the voting process.
“These new tests will ensure that everyone is on the same page for testing electronic voting systems,” said Lynne Rosenthal, manager of NIST’s voting project. “This will not only benefit the general public and the government but also help manufacturers” of systems.
The NIST tools would provide precise test specifications to which developers and manufacturers could design and build systems.
EAC was created under the Help America Vote Act of 2002, which Congress passed in the wake of the disputed 2000 presidential election. Among other duties, the commission has assumed responsibility for ensuring compliance and certification with voting system standards, an activity previously handled by state election officials. Because elections are administered by states rather than the federal government the federal guidelines are voluntary, but a majority of states require compliance with some version of them for their voting systems.
The reliability and security of voting systems have come into question in the past decade, but electronic systems are of particular concern. Jurisdictions have more widely adopted them to avoid the confusion of the 2000 election, but critics say computer-based voting systems are subject to the same security vulnerabilities and failings as other information technology systems.
EAC is revising VVSG 2005 to produce VVSG-NI, which will apply to the next generation of voting systems. To update the guidelines before the Next Iteration is complete, the commission is releasing an interim revision, which will likely be adopted in 2010. NIST has said that the new test suite is not necessarily applicable to that revision, but EAC has said it plans to use the tests for portions of the revision.
The suite will be freely available to accredited testing labs and is expected to produce more consistent results and reduce the cost of testing because labs will no longer have to develop their own tests. Experts inside and outside NIST and EAC have already reviewed the draft suite.
The EAC guidelines cover a broad range of technologies, and each requires its own suite of uniquely designed tests. Therefore, NIST’s tools address a variety of issues, including hardware, usability and security.
“In order to build a test suite, each and every requirement in the VVSG is scrutinized,” according to NIST’s Web site. “Often times, a single requirement results in many unique tests.”
Reviewers are advised to read the relevant standards, available at www.eac.gov/vvsg, before commenting on a test. “The test suites are highly technical in nature and assume some knowledge of testing, voting standards and many other voting system-related issues,” NIST’s site states.
The agency is accepting comments until July 1. Reviewers can include them in the body of an e-mail message, attach a Microsoft Word or PDF document, or annotate NIST’s PDF documentation. “In general, please tell us the features you like and provide us with comments, corrections and suggestions on how to improve the test suites,” NIST’s Web site states.
The agency provides links to individual test suites, including notes to readers and reviewers and e-mail addresses for comments, at vote.nist.gov/voting-system-test-suites.htm.
NEXT STORY: Cisco's Stewart: IT security has become top-of-mind issue