1. TGDC Meeting, July 2010 Report of the UOCAVA Working Group John Wack National Institute of Standards and Technology http://vote.nist.gov DRAFT

2. TGDC Meeting, July 2010 Page 2 Outline Presentation Charge to the working group The MOVE Act and EAC roadmap Plans for the WG post this meeting

3. TGDC Meeting, July 2010 Page 3 Charge to the working group In a broad sense, to arrive at testable guidelines for remote voting systems to serve the needs of overseas military and other overseas citizens Testable guidelines for an approach involving personal computing devices may take years, but in the meantime there are a variety of intermediate steps and approaches to be discussed, analyzed, and specified Potential activities suggested: Examine guidelines developed for the EAC’s manned kiosk pilot certification program and assist in developing further guidelines for additional pilots Deal with issues involving a common data format for use in UOCAVA remote voting systems, e.g., a blank ballot distribution system Discuss what can be accomplished with today's technology and where additional research should be directed

4. TGDC Meeting, July 2010 Page 4 Combined UOCAVA Resolution The TGDC requests that NIST develop testable guidelines for UOCAVA. NIST should consider identifying the maximum amount of accessibility, privacy, security, and usability possible within these guidelines, while still achieving the goals set forth by Congress regarding remote electronic voting. The TGDC requests that NIST address accessibility, privacy, security, and usability issues in all UOCAVA pilot projects as well as in investigative work pertaining to remote voting systems. These four issues must be addressed together from the beginning to avoid the need to retrofit capabilities later on. Specifically, the TGDC requests that NIST commission a short term (several months) research study, similar to the 2nd quarter expected release of the research document on "Security Considerations for Remote Electronic UOCAVA Voting," on Accessibility and Usability considerations for remote electronic UOCAVA voting. This should be done in coordination with the TGDC’s Accessibility and Usability Research update to the VVSG 2.0. In addition, NIST should develop a framework for UOCAVA that considers the following: 1. Define accessibility, privacy, security, and usability objectives for remote electronic voting. 2. Collect an inventory of existing and applicable standards on accessibility, privacy, security, and usability. 3. Identify perceived accessibility, privacy, security, and usability issues that can or cannot be solved with existing technology. 4. Identify issues that can or cannot be solved between conflicting accessibility, privacy, security, and usability requirements (e.g., voting on paper ballots while accommodating voters with limited dexterity/hand use). 5. Identify trends and outlooks regarding when possible technologies may improve or solve accessibility, privacy, security, or usability issues. 6. Identify trends and outlooks regarding when future main stream technologies may be employed in remote electronic voting that will need new accessibility, privacy, security, and usability requirements and standards. In addition, the TGDC requests that any guidelines developed by NIST regarding assisting election officials in providing print ballots to overseas and military voters include accessibility standards for the file format of those ballots.

5. TGDC Meeting, July 2010 Page 5 The EAC Roadmap A response to the MOVE Act: EAC and NIST to provide “best practices or standards in accordance with electronic absentee voting guidelines…” If not possible to supply these within 180 days of enactment, then a “detailed timeline for the establishment of such guidelines.” Roadmap lays out a series of steps and deliverables, including pilots, with ultimate goal of testable requirements for voting systems to serve UOCAVA voting population

6. TGDC Meeting, July 2010 Page 6 Roadmap elements Initial research and guidance - technical information regarding challenges and potential solutions Electronic blank ballot delivery projects – can be implemented now Kiosk pilot project – will provide valuable lessons learned Phased, iterative approach for successive pilot projects Development of final guidelines

7. TGDC Meeting, July 2010 Page 7 Nearer-term TGDC items in Roadmap December 2010 - EAC UOCAVA Best Practices: EAC and the TGDC, with technical support from NIST, will update their existing document on UOCAVA best practices for election jurisdictions to use in their efforts to better serve UOCAVA voters. Spring 2011 - High-Level Guidelines: EAC and the TGDC, with technical support from NIST, and input from FVAP, will identify high-level, non-testable guidelines for remote electronic absentee voting systems. This effort will focus on the desirable characteristics of such systems and serve as a needs analysis for future pilots and research; and for the purposes of driving industry to implement solutions. Spring 2011 - Risk Management: EAC will coordinate with its advisory boards (Board of Advisors, Standards Board, and Technical Guidelines Development Committee), and get technical input from NIST (coordinating with the Department of Defense and the National Intelligence Community, where possible), to apply the NIST Risk Management Framework and other methods in identifying security controls and technologies to mitigate security concerns. EAC will use this information to compare the current process UOCAVA voters use to vote with potential remote electronic absentee voting processes and assess the desired security protocols for both. This analysis will be used to guide future pilots and guidelines development. Fall 2011 - Common Data Format Development: For electronic transmission of blank ballots to be successful, they should be implemented in a manner that allows multiple states to participate. To assist in this the TGDC, with technical support from NIST, will develop common data format specifications for ballots and ballot definition that can be used by FVAP and the states. FVAP is also planning on assisting States in 2010 with data conversion services and tools to Common Data Formats.

8. TGDC Meeting, July 2010 Page 8 Plans over the next year Best practices guide is important for 2012 elections; lessons learned from 2010 elections will be incorporated Plans to address the high-level guidelines and risk mgmt discussed over next two days CDF work being coordinated with IEEE, plans to coordinate with FVAP with regard to electronic ballot distribution

9. TGDC Meeting, July 2010 Page 9 UOCAVA-related presentations to follow UOCAVA Roadmap overview – Matt Masterson, EAC Security Considerations for Remote Voting – Andy Regenscheid, NIST Usability and Accessibility Considerations for Remote Voting – Sharon Laskowski, NIST Kiosk pilot program requirements, testing and certification – Matt Masterson, EAC