What is a voter verified paper ballot?

The voter uses an electronic voting machine to complete race selections.  After the `selections have been completed and reviewed by the voter, a paper ballot is printed.  The voter reviews the printed ballot and if they feel it is correct, the ballot header information is then added to the ballot.  The ballot is then cut from the printer and the voter deposits the verified paper ballot in a secure ballot box.

Is the TruVote Software available for public review?

Access to the TruVote software source will be freely granted to all qualified reviewers under a disclosure agreement.  The software cannot be modified or changed without TruVote’s approval.  All data interface formats are public and data can be read using normal interface tools.  All data is digitally signed with private and public keys unique to each election.  Any changes, additions or deletions of the data are detected using the digital signatures.

What protects the TruVote Software?

TruVote does not use trade secret or confidential processes to protect its system.  Instead, TruVote has been issued a patent, United States Patent Number US 6,865,543 – Vote Certification, Validation and Verification Method and Apparatus.  The patent covers the methods of creating and the voter verifying paper ballots and validating the accuracy of an election.  TruVote includes a license to use its patent with each license of its software.  Voting equipment manufactures who elect to create their own voter verified paper ballot software will be required to license access to the TruVote Patent.

What does TruVote Provide?

TruVote provides its version 2.0 software combined with a Dell commercial off-the-shelf ultra compact computer system and a commercial quality ballot printer.  Where requested, TruVote will also port its software to other voting equipment hardware.  For vendors who do not elect to use the TruVote software, they can license access to the TruVote patent.

Is the TruVote software EAC certified?

The TruVote Software will be certified by the end of summer 2007.  The full system will be available for use in the 2008 federal election.  TruVote provides the master certification of the system.  Incremental certification by licensed vendors will be at minimum cost and supported by TruVote.

Do I have to purchase a new system?

No, TruVote software converts new or existing electronic voting machines into a voting system where the voting machine is used to present the ballot and assist the voter in making accurate race selections.  The voting machine then presents a paper ballot to the voter for their verification.  As the voter approves the ballot, the ballot is endorsed as being the legal record of the voters’ intention. The voter receives the ballot as it is cut from the printer and casts the ballot into the ballot box

Our voting system has VVPAT printers.  Can we use these?

Existing “VVPAT” printers are not compatible with new legislation requirements and have not been certified to the 2005 Guidelines.  Existing DRE printers also use take up reels, which are not allowed with the new legislation.  The existing printers are not reliable, do not have sufficient capacity for voter verified paper ballots and do not insure voter secrecy.

TruVote Printers

The TruVote printer replaces existing voting machine printers.  It is an industrial quality printer that uses archival quality thermal paper.  The printer is attached via a simple USB cable and can be used as a replacement printer for existing electronic voting machines, attached to the TruVote/Dell voting machine or used with any existing windows based computer system.

The TruVote printer generates a cut form ballot where the voter verified paper ballot is cut from a continuous paper reel and cast by the voter into a secure ballot box.

Individual cut form voter verified ballots are necessary to meet the ADA requirements where the ballot can be independently read to a disabled person.  In addition, audit and recount processes included in new legislation requires each ballot audited to be randomly selected.  The TruVote cut form printer provides this capability.

What flexibility does the voting jurisdiction have in the programming of the election and paper ballots?

Considerable flexibility is built into the TruVote election data base where a full range of options as defined in the 2005 voting system guidelines is provided including provisional voting.  Presentation of the ballot and race selection is standardized with a well-designed and tested human interface design.  Using this well-defined interface eliminates voter confusion from poorly designed race presentation.

Ballot and report formats can be tailored to meet the specific requirements of the jurisdiction.  Ballot formatting is performed outside of the normal TruVote Software and does not need to be recertified.

What are the components of the TruVote System?

The TruVote system consists of four components.  Each component can use low cost commercial computer hardware.

Election Central

The election central system provides interactive graphical interface support for the definition of races, ballot, and polling place configuration and manages the security keys for the election.  The election central system is also used to tally votes as the polling places close.  Interface modules are available at election central to transfer data to and from existing election management systems.

Polling Place

The polling place system is a small system, which manages security and processes at the polling place.  It manages security keys in the polling place and generates smart cards which are used to activate a voting machine.

Electronic Voting Machine

The electronic voting machine is a new machine such as the TruVote/Dell voting machine or it is an existing voting machine.  The TruVote software replaces software on existing voting machines.  TruVote provides software installation tools to assist in upgrading the software on existing voting machines.

Election Audit System

The election audit system provides the ability to manually audit paper ballots and compare them with their corresponding electronic ballot image.

How secure is the TruVote software?

TruVote implements and security and accuracy requirements for the 2005 Voluntary Voting System Guidelines.  Click here to view the Guidelines. 

The TruVote system uses industry standard public/private keys such as used for legal and financial information to digitally sign all date in the system.  Election officials have direct management and control of the private keys to insure all voting transactions are authorized and when signed, any attempts to change the records are immediately detected.  In addition, a voter verified paper ballot of the voter’s race selections is also generated by the TruVote system.  This paper ballot is cast by the voter into a secure ballot box and is the legal record of the vote.  The TruVote audit system assists election officials in the audit processes required by voting legislation.  The TruVote provides a Direct Independent System as defined in the 2005 Voting System Guidelines.

Guidelines Volume I section C.1.2.4 describes Direct Independent Systems which provide the highest level of security and accuracy for elections.  Direct independent verification systems have as their primary objective the production of independent records of the voter ballot selections. Direct Independent Verification systems produce a record the voter may verify directly which is then preserved for auditing.  The TruVote system completely implements these requirements

A voter would use the TruVote system as follows:

A voter is guided through the ballot and makes race selections as they are presented on the TruVote Screen.  As the voter indicates his or her selections the electronic image voter’s ballot is generated on the screen.  After the voter has been guided through the race selection he or she indicates the selections are complete.  The electronic ballot summary screen is presented to the voter where they can review and/or change their selections.  After the voter is satisfied with their selections on the TruVote system they press a button to causes a paper record of their vote to be printed.

The voter inspects and verifies the paper record is a match the summary screen.

If the voter desires to make changes as the summary is printed, the voter presses a not accepted button on the TruVote system and the printed record is marked as void

The voter makes any changes desired on the summary screen and causes a new paper ballot to be printed.

The voter approves the paper record.  The record is endorsed by the voting system by printing ballot header information such as the voting machine used, precinct and most importantly a ballot index number.  The ballot index number is secret to the voter but used to link the paper and electronic records when performing an audit or recount.  A barcode is also printed on the completed ballot.  This barcode contains all of the information in the ballot, which will be compared with information in the electronic record during the audit process

The barcode can be read at the TruVote polling place using a low cost hand scanner if desired to assure the voter the information in the barcode matches the printed information on the ballot.

The above process is further described in Volume I; section C.1.2.4 of the 2005 Voting System Guidelines.  The format for the voter verified paper ballot is described in section 7.9 of the Guidelines.  TruVote conforms to these requirements.

How does the voter confirm that his or her ballot has been counted?

The TruVote system issues to the voter a Voter Validation Receipt.  This receipt contains information such as the precinct where the voter cast their ballot.  In addition, the validation receipt contains the ballot index, which the voter can enter into a web site to determine if their vote has been counted. Only the voter thus preserving the secrecy of the vote knows this association of the ballot index and the voter.

Can the TruVote System assist in managing election procedures?

The TruVote system is state driven.  Standard processes are programmed as default processes.  Jurisdiction specific procedures can also be programmed into the state definitions.  This automation of election procedures significantly reduces the need for extensive polling place training and minimizes any errors resulting from polling place worker actions.