1/ MUST READ for anyone who cares about voting tech (esp. wonks):

In 3 days, there's a big vote coming up at @EACgov, the federal agency responsible for testing & certification of voting systems, about new standards #VVSG.

Here's an "explainer" thread: WHAT and WHY it matters. https://twitter.com/EACgov/status/1358794478518210563

2/ PART I:

What are the Voluntary Voting System Guidelines?
Where did they come from?

Here we go...

3/ The US has a *de*-centralized system of elections; each state has its own laws & rules. And w/in that framework, the closest the federal govt comes to laying down any uniformity about voting tech is through a set of federal standards: the "Voluntary Voting System Guidelines."

4/ The first word is important: VOLUNTARY. The federal government does not compel any states to follow the federal standards for voting technology. But in practice, the vast majority of states DO care about whether the voting tech they will use conforms with federal standards.

5/ Approx. 40 states require, in some way, conformance w/ federal VVSG standards before voting tech can undergo state-level testing. It's like "table stakes" for the manufacturers.

6/ Even though they are "voluntary," the reality is that the federal guidelines effectively set the bar for what manufacturers of voting systems will make in the future. If their products don't conform with fed standards, they simply won't have many states where they can sell.

7/ The Voluntary Voting System Guidelines are an outgrowth of the 2002 Help America Vote Act, which was itself a response to the contested 2000 Bush v. Gore Presidential election. HAVA created the EAC and the broad outlines for testing and certification of voting tech in the US.

8/ PART II:

Why are so many people watching this vote about VVSG "2.0" so closely?

Short answer: VVSG 2.0 has a long & rocky history that carries an enormous amount of pent-up demand. It's the best -- if imperfect -- hope for "moving forward" in a glacially-slow environment.

9/ A big part of the reason so much attention is being paid to the upcoming vote on VVSG 2.0 is because it's *only the second time since HAVA* that a major revision of the federal standards for voting tech is being considered for adoption.

10/ Since HAVA, the EAC has adopted two versions of the federal guidelines: v. 1.0 in 2005, and a minor version change, v. 1.1, in 2015. Believe it or not, every single voting system sold in the US today -- even the newest stuff -- is certified only to the old 2005 federal std.

11/ All this contributes to a strange US mktplace for voting tech

- The fed standards essentially "make the market;" they shape what manufacturers will build

- The EAC hasn't made wholesale changes in the standards since 2005

- So, voting tech is very much "behind the times."

12/ All of this means that part of the reason so many are watching the upcoming vote for VVSG 2.0 is because there is a sense/hope that perhaps a logjam might FINALLY be breaking...the hope is that, at last, there can be some movement forward...?

Now, about that logjam....

13/ PART III - Recent controversies

The process to arrive at a VVSG 2.0 vote has been rocky.

- It has taken longer than anticipated.

- There are substantive debates about what VVSG 2.0 does/does not allow for tech.

- Some have expressed concern about maintaining transparency

14/ Regarding the long slog: The timeline to actually arrive at a vote for the EAC Commissioners to adopt 2.0 has been far more drawn out than many would prefer -- about three years longer than the original goal, which was early 2018.

15/ The name and structure for VVSG 2.0 was agreed upon all the way back in Sept 2016. There are two parts: High-level "Principles and Guidelines," which are pretty short...only about 5 pages. And then there are detailed "Requirements," which are long, over 300 pages.

16/ NIST's Technical Guidelines Dev Cmte, which serves the EAC, recommended adoption of the 5-page high-level Principles all the way back in September 2017. And the EAC's Standards Board, which includes election officials, passed a resolution recommending adoption in April 2018.

17/ The Principles & Guidelines went out for Public Comment in February 2019. We at @OSET sent our detailed input, below. https://twitter.com/eddieperezTX/status/1133903114682191872?s=20

18/ It's now approx 3 years since NIST and the Standards Board recommended adoption, but the "Principles and Guidelines" have not been adopted yet. Commissioners will finally vote on those at the Feb 10 mtg.

19/ The EAC also put out for Public Comment the draft version of the more complex and detailed VVSG 2.0 "Requirements," in March 2020. We at @OSET sent our detailed input, below. https://twitter.com/eddieperezTX/status/1275490822537064448?s=20

20/ Last year, @EACgov had a number of public meetings related to VVSG 2.0. My live-tweets are below:

May 6 on VVSG 2.0 Status
https://twitter.com/eddieperezTX/status/1258092154544627712?s=20

May 20 w/Vendors and Test Labs
https://twitter.com/eddieperezTX/status/1263160050639650817?s=20

Aug 12 Tech Guidelines Dev Cmte https://twitter.com/eddieperezTX/status/1293646477324058624?s=20

21/ Another recent VVSG 2.0 controversy: wireless communication.

Unlike earlier VVSGs, which allow wireless connections, VVSG 2.0 makes a significant change: it *prohibits* voting systems from establishing wireless connections.

So what's the controversy? Read on...

22/ Since VVSG 2.0 prohibits voting systems from being capable of establishing wireless connections (Reqs Sec. 14.2-C), the simplest way to describe the current debate is over HOW to implement the prohibition: IOW, do the Requirements go far enough?

23/ One camp interpreted the draft's prohibition on wireless communication to be based on a prohibition of wifi-capable hardware. They argue that voting systems shouldn't be allowed to even include such components, at all. (Call this the "hardware restriction" camp.)

24/ Another camp finds acceptable the proposed VVSG 2.0 reqs, which permit the prohibition on wireless connections to be implemented by using software, configuration, or some other means to remove the wireless capability. (Call this the "software or other restriction" camp.)

25/ Paraphrasing for brevity, the "HW restriction camp" believes the EAC made an inappropriate change in the reqs, and should prohibit use of wifi-potential HW. In contrast, the "SW restriction camp" believes a ban on HW would drive up costs & make it harder to source parts.

26/ The last recent controversy: transparency. Since the VVSG 2.0 Requirements were put out for Public Comment in March 2020, some question whether the EAC has done enough to clarify the changes from the draft version before the vote, b/c the redlines were posted only recently.

27/ For your convenience, here are the relevant links to what will be voted upon:

VVSG 2.0 (Clean version, no edits)
https://www.eac.gov/documents/vvsg-20-clean-version

VVSG 2.0 (Redline version, with edits since Feb 29.2020 version)
https://www.eac.gov/documents/vvsg-20-redline-version

28/ It's unclear whether, in addition to voting on the VVSG 2.0 document itself, the Commissioners will also be taking a vote to adopt the "Testing and Certification Program Manual, v. 3.0" or the "Voting System Test Laboratory Program Manual, v. 3.0." (See event page for links)

29/ The Program Manuals are tremendously important -- arguably, even more important than the requirements themselves, because they promulgate the policies that are central to the incentive structures for manufacturers. A discussion of those is beyond the scope of this thread.

30/ We @OSET believe it would be HIGHLY beneficial for the EAC to officially put out for Public Comment the "Testing and Certification Program Manual, v. 3.0" and the "Voting System Test Laboratory Program Manual, v. 3.0."

31/ PART IV

What's actually IN the VVSG 2.0 document, and why does it matter?

Not surprisingly, I can't easily summarize a 330-page document. But here are some highlights of what we @OSET think are most noteworthy...

32/ Benefit #1: Simply updating the VVSG is an accomplishment. Updated standards to address the need for greater security, cybersecurity, usability and accessibility are important. The country will benefit from updated requirements -- and they are also far from a panacea.

33/ Benefit #2: VVSG 2.0's new requirements for auditability (Principle 9) are a very important step to keep driving manufacturers to design equipment that can efficiently support evidence-based elections.

34/ Benefit #3: VVSG 2.0's new requirements for interoperability (Principle 4) and support for standard, publicly-available formats for data import, exchange & export are also welcome. @OSET has long been a proponent of open standards to catalyze new market players and innovation

35/ Benefit #4: VVSG 2.0's new reqs for software independence are a great step forward. In practice, this requires paper-based systems or verifiable cryptographic architectures. (I am a fan of paper ballots because they are easy voters to understand, which bolsters confidence).

36/ And finally, here are some concluding thoughts...

37/ Wrap-up #1: The list of professionals that have provided inputs to VVSG 2.0 is vast, and they deserve our thanks: election officials; usability & accessibility specialists; computer scientists; election security experts; tech manufacturers; too many to name here.

38/ Wrap-up #2: @EACgov and its partners (local election officials; state election directors; EAC Standards Board and Board of Advisors; NIST, DHS, CISA; and others) also deserve recognition for the work accomplished--but also a respectful push to continue improvement (below).

39/ Wrap-up #3: The current federal standards-setting process for voting tech is in need of significant re-assessment and improvement. Taking almost 5 years to arrive at a vote on Requirements is simply too long. Tech changes fast, and the US cannot afford the risk of lagging.

40/ Wrap-up #4: This is a moment for voting system manufacturers to step up. Assuming that new VVSG 2.0 standards are adopted, don't take the easy way out and simply keep modifying your 1.0 (2005)-compliant systems. The US deserves better. Innovation is the patriotic thing to do.

41/ Everyone should temper their expectations. VVSG 2.0 is a meaningful step forward, but it will likely be years before we see any 2.0-compliant systems in the field (2023?). And @EACgov has much to do to improve the agility of its program and close loopholes for manufacturers.

42/ In the past, @OSET has offered recommendations for programmatic improvements @EACgov, apart from topics related to voting system requirements per se. We recognize and earnestly support a strong, effective, U.S. Election Assistance Commission. /END http://bit.ly/OSETpaper211219 

CC: The following accounts may find this thread of interest...
@NASSorg
@NASEDorg
@C_C_Krebs
@mastersonmv
@grace_panetta
@ericgeller
@nicoleperlroth
@kevincollier
@DianneG
@AlexaCorse
@Bing_Chris
@snlyngaas
@HowellONeill
@LarryNorden
@mattblaze
@hodgesmr