111:3-9-18. Standards for voter verified paper audit trail

(A) These standards have been developed by the secretary of state pursuant to Substitute House Bill 262, and shall regulate and govern the use of the voter verified paper audit trail system in direct recording electronic (DRE) voting machines in all elections governed by the Ohio Revised Code. These standards shall only apply to DRE systems for which an electronic record of the vote is created by the DRE. The standards in this document constitute a minimum standard of performance.

(B) Direct recording electronic voting machine means a voting machine that records votes by means of a ballot display provided with mechanical or electro-optical components that can be actuated by the voter, that processes the data by means of a computer program, and that records voting data and ballot images in internal or external memory components. Only for the purpose of complying with the accessibility requirements of section 3506.19 of the Revised Code, optical scan marking devices determined by the secretary of state to provide the same or substantially similar levels of accessibility, including non-visual accessibility, shall be considered direct recording electronic voting devices. A direct recording electronic voting machine produces a tabulation of the voting data stored in a removable memory component and a printed copy.

(C) "Voter verified paper audit trail" means a physical paper printout on which the voter's ballot choices, as registered by a direct recording electronic voting machine, are recorded. The voter shall be permitted to visually or audibly inspect the contents of the physical paper printout. The physical paper printout shall be securely retained at the polling place until the close of the polls on the day of the election. After the physical paper printout is produced, but before the voter's ballot is recorded, the voter shall have an opportunity to accept or reject the contents of the printout as matching the voter's ballot choices. If a voter rejects the contents of the physical paper printout, the system that produces the voter verified paper audit trail shall invalidate the printout and permit the voter to recast the voter's ballot. On and after the first federal election that occurs after January 1, 2006, unless required sooner by the Help America Vote Act of 2002, any system that produces a voter verified paper audit trail shall be accessible to disabled voters, including visually impaired voters, in the same manner as the direct recording electronic voting machine that produces it.

(D) General description

(1) Components: the voter verified paper audit trail (VVPAT) system shall minimally consist of:

(a) A voter verified paper audit trail writer (VVPAT-W): a device attached, built into, or used in conjunction with a direct recording electronic (DRE) unit. Such a device must minimally consists of:

(i) Printer: a device that will duplicate a voter's selections on the DRE onto a paper record copy.

The system shall include one VVPAT printing device attached to or built into each DRE.

(ii) A paper record display unit: a unit that will allow a voter to view his or her paper record copy while preventing the voter from directly handling the paper record copy.

(iii) Paper: the paper used to produce the voter verified paper audit trail shall be sturdy, clean, and resistant to degradation.

(b) A voter verified paper audit trail record storage unit (VVPAT-S): a device that stores cast and spoiled paper record copies.

(c) These devices may be integrated as appropriate to their operation.

(d) A VVPAT may not be used with any voting equipment that contains any radio frequency (RF) transmit or receive capability or any other wireless communication device that transmits information point to point at a distance greater than one inch.

(e) A VVPAT may not be used with any voting equipment beyond the physical confines of the polling place, except when used outside a polling place in a self-contained manner to allow for curbside or functioning similar voting.

(2) Operation:

(a) VVPAT systems may be designed in various configurations. In all such devices, prior to casting the ballot, the voter shall have the ability to verify his or her selections on a paper record copy. Before final verification, the voter shall either accept or reject the choices represented on the paper record copy. Upon the completion of verification and casting the ballot, both the electronic record and the paper record copy shall be stored and retained.

(b) Any system that produces a voter verified paper audit trail shall be accessible to disabled voters, including visually impaired voters, in the same manner as the direct recording electronic voting machine that produces it.

(3) Maintenance: VVPAT system design shall permit routine maintenance in a manner that prevents the risk of undetected tampering or unauthorized altering of certified system components during routine system maintenance.

(E) Design requirements

(1) General

(a) Use of electronic and paper ballot records

(i) Every electronic record must have a corresponding paper ballot record copy.

(A) The paper ballot record copy must be printed and the voter must have the opportunity to verify that record prior to the final electronic record being recorded.

(B) A unique DRE identifier must appear on each individual paper ballot record produced, without revealing the identity of the voter who cast the ballot.

(ii) For any recount of an election in which ballots are cast using a direct recording electronic voting machine with a voter verified paper audit trail, the voter verified paper audit trail shall serve as the official ballot to be recounted.

(iii) In the case of a difference between the electronic record and the paper record copy, the paper record copy shall govern, unless there is clear evidence that the paper record copy is inaccurate, incomplete or unreadable as defined in the system procedures.

(iv) The voter verified paper audit trail shall be preserved in the same manner and for the same time period as paper ballots are preserved under section 3505.31 of the Revised Code.

(b) Privacy: The VVPAT system shall be designed to allow every voter to review, accept or reject his/her paper record copy privately and independently and shall comply with federal and state privacy requirements.

(c) Secrecy: The VVPAT system shall be designed to ensure secrecy of votes so that it is not possible to determine which voter cast which paper record copy and shall comply with federal and state secrecy requirements.

(d) Readability:

(i) The VVPAT system shall be designed to maximize the ease in which the voter may review, accept or reject his/her paper record copy and shall comply with federal and state readability requirements.

(A) The headline should be printed in no smaller than twenty-five point font, however, if the vendor cannot print the headline in at least twenty-five point font then they have the option of using a typeface of not less than nine point font and the VVPAT machine must include magnification capability to read the font as if it were thirty point font.

(B) The ballot language, explanation and arguments must be printed in no smaller than nine point font and no larger than eighteen point font and the machine must include a magnification capability read the font as if it were thirty point font.

(C) The ballot typeface must be times new roman, arial, myriad, or its equivalent.

(ii) On and after the first federal election that occurs after January 1, 2006, unless required sooner by the Help America Vote Act of 2002, the voter verified paper audit trail shall be capable of being optically scanned for the purpose of conducting a recount or other audit of the voting machine and shall be readable in a manner that makes the voter's ballot choices obvious to the voter without the use of computer or electronic codes.

(e) Accessibility: The VVPAT system shall be designed to allow access for disabled and limited literacy voters to privately and independently use the VVPAT and shall comply with federal and state accessibility requirements.

(f) Language accessibility: The VVPAT system shall be designed to allow each voter to verify their vote on a paper record copy in the same language they voted in on the DRE and shall comply with federal and state requirements.

(g) Security: The VVPAT system shall be designed to prevent tampering with either the VVPAT system or the paper record copy, and shall comply with federal and state security requirements.

(h) Capacity: The VVPAT system shall be designed with a combined capacity to ensure that an adequate amount of all the paper record, ink, toner, ribbon or other like supply units in a precinct will accommodate all voters using the DRE's with VVPAT-W within the precinct.

The VVPAT system shall be designed to ensure that poll workers will not be required to add paper record, ink, toner, ribbon or other like supply units to the VVPAT-W, more than once, during the polling hours.

(i) Integrity:

(i) The VVPAT system must be designed to prohibit the production by any direct recording electronic voting machine of anything that legally could be removed by the voter from the polling place, such as a receipt or voter confirmation.

(ii) The VVPAT system must provide a low supply warning to provide a poll worker the opportunity to add paper, ink, toner, ribbon or other like supply before the supply item runs out.

(A) In the event a supply warning occurs as a voter is casting a ballot, the VVPAT must safeguard the secrecy of the ballot by preventing the poll worker from reading the VVPAT ballot.

(B) After the poll worker has filled the supply, the system shall allow the voter to review their VVPAT ballot without having to recast their ballot.

(j) Capability: The VVPAT device should draw its power from the DRE or the same electrical circuit the DRE draws its power from.

(i) When not plugged into an AC power source, the battery used to power the DRE must also power the VVPAT. However, a separate battery can be used to power the VVPAT as long as the voting process cannot continue if the VVPAT is not operational.

(ii) The battery must provide sufficient power to supply both the DRE and VVPAT device for at least two hours, or federal and state standards, which ever is more stringent.

(2) Paper record copy

(a) Security: Security protections shall be built into the paper record copy and/or VVPAT-S to prevent tampering. This provision shall apply to paper record copies before, during and after printing.

(b) Readability: The paper shall be designed so as to make the paper record copy readable by voters and election officials and shall comply with state readability requirements.

(c) Retention: The voter verified paper record copy shall be retained by the elections official for the same period of time as mandated by state law for the retention of paper ballots for that election.

(3) Printer

(a) Security: The printer shall be physically secure from tampering. The paper record copy and the image created by the VVPAT-W on the paper record copy shall be designed to withstand storage requirements as outlined in these standards and state requirements.

(b) Readability: The image created by the printer shall be designed to allow a voter to review his or her paper record copy privately and independently.

(i) The headline should be printed in no smaller than twenty-five point font, however, if the vendor cannot print the headline in at least twenty-five point font then they have the option of using a typeface of not less then nine point font and the VVPAT machine must include magnification capability to read the font as if it were thirty point font.

(ii) The ballot language, explanation and arguments must be printed in no smaller than nine point type and the machine must include a magnification capability read the font as if it were thirty point.

(iii) The VVPAT must be printed using black ink, toner, or chemical agent on white paper.

(iv) The VVPAT must be printed using typeface/font of times new roman, arial, myriad, or its equivalent.

(v) The VVPAT must be printed using a paper weight of no less than fifteen pounds.

(c) Printed information

(i) Offices/issues: The image created by the VVPAT-W shall include every contest that is displayed to the voter on the DRE review screen including write-ins and undervotes.

(ii) Provisional ballot: The image created by the VVPAT-W shall be clearly identifiable in the case of a provisional ballot.

(iii) Spoiled ballot

(A) The image created by the VVPAT-W shall be clearly identifiable in the case of a spoiled paper record copy. The clearly identifiable spoiled paper record copy shall be shown in the paper record display unit to allow the voter to acknowledge the paper record copy has been spoiled. The VVPAT system shall be designed to prevent a paper record copy from being spoiled after the voter has verified that paper record copy and has cast his/her ballot.

(B) The voter shall have the opportunity to affirmatively spoil their paper record copy no more than two times. An error in recording or printing a paper record copy not caused by the voter shall not be counted as a spoiled paper record copy.

(C) Upon spoiling their paper record copy the voter shall be able to modify and verify selections on the DRE without having to reselect all of their choices.

(D) Before the voter causes a third and final paper record copy to be printed, the voter shall be presented with a warning notice that the selections made on screen will be final and the voter will see and verify a printout of their vote, but will not be given additional opportunities to change their vote.

(d) Language accessibility

(i) The VVPAT-W shall be capable of producing an image in all alternative languages for which the DRE is certified.

(ii) The paper record copy shall be printed in English and in the alternative language when used by a voter to cast their vote on the DRE.

(4) Paper record display unit

(a) Security: The paper record display unit shall allow the voter to inspect the paper record copy without physically handling the paper record copy and shall be physically secure from tampering.

(b) Readability: The paper record display unit shall provide adequate visual space to allow the voter to privately and independently inspect the paper record copy. A paper record copy shall be readable from the same position and posture used for voting on the DRE. The voter shall have the ability to view both the review screen on the DRE and the paper record copy in the display unit simultaneously. If the paper record copy cannot be viewed in its entirety in the paper record display unit at one time, then the voter shall have the opportunity to verify the entire paper record copy prior to either the electronic record or the paper record copy being stored and recorded.

Covering: Any protective covering intended to be transparent shall be in such condition that it can be made transparent by ordinary cleaning of its exposed surface.

(c) Accessibility: The VVPAT components must conform to federal and state accessibility requirements.

This shall include, but is not limited to, an audio component.

The audio component must accurately relay the information printed on the paper record copy to the voter.

(5) Paper record storage unit

(a) Security: The paper record storage unit shall be designed to prevent tampering.

(b) Secrecy: The VVPAT system shall be designed and proper procedures put in place to ensure the printed ballot audit trail is stored in a manner to ensure secrecy of votes so that it is not possible to determine which voter cast which paper record copy.

(c) Capacity: The combined capacity of all the paper record storage units in a precinct must be enough to accommodate all voters using the DREs within the precinct.

(F) Procedure requirements

(1) Update: Testing and certification, pre-election, election and post-election procedures for each DRE voting system shall be updated to reflect the use of the VVPAT. These updates include, but are not limited to:

(a) Testing and certification

(i) Testing: The VVPAT system shall conform to federal and state testing requirements. Required testing shall include, but not be limited to, functionality, security, durability, longevity and accessibility testing.

(ii) Certification: The VVPAT system must be certified for use by the state of Ohio in conjunction with the rest of the voting system with which it is intended to be used.

(iii) Configuration: The VVPAT system shall not, at any time, contain or use undisclosed hardware or software. The only components that may be used in the system are components that have been tested and certified for use in the state of Ohio.

(b) Pre-election procedures: The VVPAT system components must be integrated into existing local logic and accuracy testing requirements.

(c) Election procedures

(i) Malfunctions

(A) The vendor shall provide written recommendations for how to investigate and resolve malfunctions including, but not limited to, misreporting votes, unreadable paper records, paper or ribbon jams, low-ink, low paper, misfeeds and power failures.

(B) The vendor shall include written recommendations for how to recover votes in the case of malfunction to assure a ballot is properly recorded and stored.

(ii) The vendor shall include written recommendations for if the voter does not complete the verification process for their paper record copy.

(iii) The system shall prevent any further attempt to cast a ballot until an election judge has reset the VVPAT/DRE after correcting a malfunction.

(d) Post election procedures

(i) Written procedures shall reflect the use of the paper record copies in the required full manual recount as defined under state requirements.

(ii) The vendor shall include written recommendations for how the secrecy of votes will be ensured.

(iii) The vendor shall include written recommendations for how a discrepancy between an electronic record and its corresponding paper record copy shall be identified, investigated and resolved.

The vendor shall include written recommendations for determining what constitutes clear evidence that a paper record copy is inaccurate, incomplete or unreadable.

(G) In order to provide the secretary information pertinent to the implementation of the voting machines and the security of the voting machines, the individual voting machine vendors must meet the following requirements:

(1) Vendors shall produce all documentation describing materials, equipment, programs, and procedures, including source codes, scripts, and data files, required to develop, install or operate any software, firmware or hardware used in the voting system.

(2) Vendor shall produce the following documents submitted to or resulting from the federal testing and qualification or re-qualification process regarding voting systems:

(a) The technical data package as defined in voting systems standards 2002 (VSS-2002), Volume II, Section 2, or the current voting systems standards.

(b) Within thirty days of testing, Vendor shall furnish secretary with all test reports in the vendor's possession, both published final and intermediate statue reports showing discovered deficiencies and resolution steps.

(3) Vendor shall produce the following documents relating to each hardware, software and firmware version for any component of the voting system: detailed change logs, hardware change records or logs, test records relating to the changed components, and documents describing the effects of the changes.

(4) Vendor shall execute and deliver to the secretary of state an authorization in a format reasonably acceptable to vendor and independent testing authorities, to enable the secretary of state to obtain information about the status of federal testing and qualifications of vendors voting systems proposed to be used in Ohio.

(5) Vendor shall notify, within two business days, the secretary of state of problems encountered in Ohio and other jurisdictions, whether upon completion of testing or in an actual election, which vendor concludes would reasonably create an impediment to obtaining certification.

(6) Vendor shall maintain in good working order, provided the following are subjected only to normal wear and tear and proper usage, one working version of vendor's voting system, a server containing election management system and peripherals proposed to be used in any Ohio election.

(7) Vendor shall provide the secretary a statement identifying the voting system supplied and affirming that each voting system is state certified at the time of vendor's statement.

(8) Vendors shall implement the following security measures:

(a) Replace hard-coded supervisor passwords with dynamic passwords, and provide directions and training to enable election officials to change these passwords if election officials choose to do so.

(b) Use secure data transmissions between touchscreen terminals and the server.

(c) There shall not be vendor controlled security keys and the encryption code shall be programmable by county.

(9) Vendor shall notify secretary of state and the counties, where the vendors system is in use, of any security patches or other software upgrades that vendor recommends to be installed on the server. Vendor shall notify the secretary of any security patches which vendor recommends not be used.

Replaces: 111:5-1-01

Effective: 1/25/2016
Five Year Review (FYR) Dates: 01/15/2021
Promulgated Under: 119.03
Statutory Authority: 3506.01
Rule Amplifies: 3501.05, 3501.10, 3501.28, 3506.01 , 3506.05, 3506.06, 3506.10, 3509.07, 3513.052, 3517.109, 3517.1010, 3519.16, 3506.17, 3506.18, 3506.19
Prior Effective Dates: 4/28/05