Voter Verified Paper Ballots
The fundamental requirements for Voter Verified Paper Ballots are defined in the
2005 Voluntary Voting System Guidelines as authorized by the United
States Election Assistance Commission as the requirements for a Voter Verified
Paper Audit Trail (VVPAT). The intention of the Guidelines was to
establish a set of requirements which allowed for accurate recording and audit
of elections. The Guidelines define a system of independent verification
as a requirement for accurate recording of votes. The Voter Verified Paper
Ballot as implemented as a VVPAT is a referenced example of independent
verification..
The Guidelines define an independent verification system as one where:
Independent Verification is the top-level categorization for electronic voting systems that produce multiple records of ballot selections that can be audited to a high level of precision. For this to happen, the records must be produced and made verifiable by the voter, and then subsequently handled according to the following protocol:
The content of the two records can be checked later for consistency through the use of identifiers that allow the records to be linkedAt least two records of voter selections are produced and one of the records is then stored such that it cannot be modified by the voting system, e.g., the voting system which creates a record of voter selections and then copies it to some unalterable media
The voter must be able to verify that both records are correct, e.g., verify his or her selections on the voting system’s display and also verify the second record of selections stored on the unalterable storage media
The verification processes for the two records must be independent of each other and (a) at least one of the records must be verified directly by the voter, or (b) it is acceptable for the voter to indirectly verify both records if they are stored on independent systems
An assumption is made that at least one set of records is usable in an efficient counting process such as an automated tabulator, and the other set of records is usable in an efficient process of verifying its agreement with the other set of records used in the counting process. The sets of records would preferentially be different in form and thus have more resistance to accidental or deliberate damage.
Given these conditions, the multiple records are said to be distinct and independently verifiable; that is, both records are not under the control of the same processes. As a result of this independence, one record can be used to audit or check the accuracy of the other record. Because the storage of the records is separate, an attacker who can compromise one of the records still will face a difficult task in compromising the other.
Voting machines offered for purchase by election officials do not meet these requirements. Election officials, understanding the need for accurate and auditable elections, placed requirements for their systems to be provided with VVPAT as defined in the 2005 Guidelines. Voting machine vendors had not implemented VVPAT to meet the 2005 Guidelines but claimed VVPAT capability. The result was the purchase of electronic voting machines which did not meet the 2005 Guidelines and need to be upgraded and/or replaced The Voter Verified Paper Ballot as defined in H.R.811 provides a mandate for all voting machines to meet the requirements of the 2005 Guidelines. Funding is provided to the States for this upgrade. The TruVote system meets the 2005 Guidelines requirements and is uniuqe in that it will be be available to the States to be used in the 2008 General Election.
The table below compares some of the requirements for VVPAT in light of H.R. 811 and shows areas of deficiency of existing voting machines and how the TruVote system meets the requirements of H.R.811 and the 2005 Guidelines.
| VVPAT Requirements from the 2005 Voting System Guidelines and current legislation | Typical Existing DRE Products | TruVote |
| Display and print a paper record before the final casting of the ballot | Narrow paper width and small font size makes this difficult | Wide paper width and large font do not require reading assistance |
| The voter can approve or void the paper record | Voter is not allowed to view the entire ballot but must view the ballot as a series of smaller pages | The voter can view the entire ballot as one page |
| The voting machine shall in the presence of the voter mark the ballot as accepted or voided | Paper record is marked as approved or rejected | Paper ballot is clearly marked as accepted or rejected. An accepted ballot is machine readable with a bar code while a rejected ballot is not. |
| The electronic and paper records shall include information about the election to include voting site and voting machine | Election and other information is contained on the header for the roll, not for each paper record | Each paper ballot, when approved by the voter, is clearly marked with information about the election, polling place and ballot face. |
| The electronic and paper records shall include a unique identifier in each record that allows the electronic and paper records to be matched | This is not provided | Identifier is clearly shown and linked between the paper ballot and the electronic image |
| The voting machine shall generate and store a digital signature for each electronic record | Unique digital signatures are not provided | All electronic and paper records contain digital signatures. |
| The voting machine vendor shall provide documentation as to the structure of electronic ballot records and how they shall be read and processed by software | This information is proprietary and not available | Complete documentation for the electronic record structure is provided. Security is maintained by the use of independent paper and electronic records. Each paper and electronic record is digitally signed to guard against forgery |
| The voting system vendor shall provide full documentation and procedures for reconciling paper and electronic records | Reconciling paper and electronic records is not possible | A complete reconciliation of paper and electronic records is provided and supported by machine readable paper ballots for comparison with electronic ballot images. |
| The paper record shall be created so it is machine readable with OCR or bar codes such as PDF417 | Not provided | PDF 417 bar codes are printed on an approved ballot which contains all ballot information |
| If a take up reel is used for paper records voter privacy must be ensured including the order in which they voted | Take up reels do not maintain voter secrecy as they record ballots in the order in which the voters used the machine. | Cut ballots are used which when deposited in a ballot box randomize the order in which voters voted |
| Visually impaired voters shall have the ability to determine the content of the ballot for prior to approval using a system which is not the voting machine. | Not possible with take up reels | Cut ballot can be easily scanned and read back to the visually impaired voter |
| Paper ballots must meet archival requirements | Paper used is flimsy and easily damaged | Paper is heavy and robust and certified to meet archival requirements. |
| Random audits to compare paper ballots and electronic records is required | Not possible | Randomly selected ballots can be chosen and each ballot can be manually compared with its corresponding electronic record |