	Historical Context of the Guidelines

The VSS were developed in response to concerns raised in the 1970s and 1980s about thethen largely unregulated voting technology industry. Thesecond version was approved by the FEC in May 2002. 107-252 ), was signed into law in October 2002. Also, Sec. (4) They willgo into effect two years after being adopted. HAVA does not specify whether the guidelines it establishes areto be used as the standard against which voting systems are tested and certified, but that is how the VSS have been used, and it is how the EAC intends to use the VVSG . A more extensive revision is reportedly underway. Volume I provides performanceguidelines for voting systems and is intended for a broad audience. Volume II provides details of the testing process for certification of voting systems. They alsopoint out that most states have adopted the VSS in whole or in part -- many require that any newvoting systems purchased adhere to the VSS or VVSG . Drafts are posted online andcomments incorporated. (25) Some observers argue that product standards such as theCommon Criteria (ISO/IEC 15408), which provides a set of evaluation criteria for the securityof information technology, (26) would be more appropriate. As described in the section above summarizing the guidelines, the TGDC decided toproduce only a partial revision of the VSS as the first version of the VVSG . The two major areas of revision are arguably the most important for immediate action,since usability and accessibility are major focuses of HAVA voting system requirements, andsecurity concerns have been prominent in recent public debate about voting systems,especially DREs. Until that time, federal certification of voting systems willpresumably continue to be based on the 2002 VSS, although state or local jurisdictions maychoose to require vendors to meet some or all of the VVSG requirements sooner, and the EACplans to issue guidelines to assist states in implementation. Among the reasons are worries about acquiring newsystems in time for the January 2006 deadline that might later be deemed not to be incompliance with the requirements, or not obtaining systems of as high a level of quality aswould be possible once the VVSG go into effect. Other observers believe that delaying the implementation of the VVSG meansthat the 2006 federal election will need to be conducted with voting systems that are notdesigned to conform to HAVA requirements. Integrated versus Component Certification

The VVSG focus on voting systems rather than on individual components. Legislative Proposals in the 109th Congress

Several bills introduced in the 109th Congress could affect the scope or other aspectsof the VVSG . None of the above bills have received committee or floor action in either chamber. This section also describes application of the guidelines and test specifications, pointing outthat commercial off-the-shelf (COTS) products are exempt from some aspects of certificationif they are not modified for use in a voting system. Voting Functions. (58) Topics covered include
access control, including general access control and individualprivileges, and specific measures such as passwords and encryption; 
equipment and data security , including physical security for pollingplaces and ballot-counting locations;
software security , including installation requirements and testing offirmware, protection against malicious software, (59) and software distribution and validation requirements toensure that no unauthorized modifications have been made (this is a new set of detailedrequirements) (60) ;
telecommunications and data transmission , including access control,integrity of transmission, use of encryption to protect data from interception, use of intrusiondetection methods, protection against external threats to COTS software, and specificrequirements for DREs that transmit data over public networks and for wirelesscommunications (this latter subsection is new), including the caution that the use of wirelesscommunications should be approached with "extreme caution" (61) ;
optional requirements for voter-verified paper trail (VVPAT), includingrequirements for handling spoiled and accepted paper records, preserving voter privacy andvote secrecy, audit and election data such as linking electronic and paper records, machinereadability of paper records, tamper protection, printer reliability and maintenance, anddurability of the paper record, as well as usability and accessibility requirements (thissubsection is new). The Help America Vote Act of 2002, which, among other things, established theEAC, required it to develop the VVSG , and established a mechanism for that. The federal voluntary Voting Systems Standards ( VSS ) developed by the FEC. VVPAT.
The Help America Vote Act of 2002 (HAVA, P.L. 107-252 ) gave the federal ElectionAssistance Commission (EAC) the responsibility to develop a set of Voluntary Voting SystemGuidelines ( VVSG ) to replace the current voluntary Voting Systems Standards ( VSS ). The VVSG areto provide a set of specifications and requirements to be used in the certification of computer-assistedvoting systems, both paper-based and fully electronic. That was also the purpose of the VSS, whichwere developed in response to concerns raised about voting systems in the 1970s and 1980s. Moststates have adopted the VSS in whole or in part, and most are expected to adopt the VVSG, which arescheduled to go into effect two years after approval.
The draft VVSG, a partial revision of the VSS, was released in June 2005 for a 90-daycomment period. Volume I provides performance guidelines for voting systems and is intended fora broad audience. It includes descriptions of functional requirements and performance standards,and requirements for vendors. The most extensive revisions are to the section on usability andaccessibility and the section on security of voting systems. Standards are also included for the useof voter-verified paper audit trails (VVPAT), a recent security measure developed in response toconcerns that electronic voting machines are vulnerable to tampering that might otherwise bedifficult to detect. Volume II provides details of the testing process for certification of votingsystems and has few revisions.
Some issues associated with the VVSG have been controversial. Among them is the questionof timing. Some vendors claim that there needs to be more time for technology development beforethe new guidelines become effective; some activists argue that problems with voting systems, andHAVA provisions, demand more rapid implementation of the VVSG . In any event, it is generallyconsidered unlikely that the guidelines will have much direct impact on voting systems used in 2006,when HAVA requirements for voting systems go into effect. One exception may be the VVPATprovisions, since the VSS, under which most current voting systems are certified, have no provisionsrelating to this innovation. The VVSG will be voluntary, but some observers believe that a regulatoryapproach would be more appropriate given the importance of elections to the democratic process. However, since many states require that voting systems be certified, vendors are expected to treatthe VVSG in the same way they have treated the VSS -- as effectively mandatory.
Among the other issues being debated about the guidelines are whether they should beexpanded to include voter registration systems, whether they impede innovation by focusing onintegrated systems rather than components, how to treat commercial off-the-shelf (COTS) productsthat are incorporated in voting systems, and whether a graded certification would be more effectivethan the current pass/fail approach. Several bills introduced in the 109th Congress could affect thescope or other aspects of the VVSG by requiring VVPAT or other security provisions, addressingconcerns about conflict of interest, and other measures. None have received committee or flooraction in either chamber during the first session. This report will be updated in response to majordevelopments.