Technical Guidelines Development Committee

C/O National Institute of Standards and Technology

100 Bureau Drive, Stop 1070

Gaithersburg, MD 20899-1070

April 17, 2005

Dear Technical Guidelines Development Committee:

In their letter dated April 7, 2005, the U.S. Election Assistance Commission (EAC) advised the states that the National Institute of Standards and Technology (NIST) and the EAC Technical Guidelines Development Committee will issue its first set of recommendations at the TGDC Plenary Meeting on April 20-21, 2005. According to the EAC, among the recommendations will be guidelines for testing a voting systems with a Voter Verified Paper Audit Trail (VVPAT). The VVPAT guidelines will be directed to those states that have already legislated the use of a VVPAT and are intended to provide guidelines so that the VVPAT products can be adequately tested.

The elections community welcomes the involvement of NIST and looks forward to improved voluntary voting system standards. Improved standards are needed as the direct recording electronic voting system (DRE) technology represents the next generation of voting system technology and traditional methods of testing and auditing voting systems are based on paper systems. NIST can help the elections community develop public trust and confidence with this technology by issuing new procedures for logic and accuracy testing, audits, voter verification, and recounts. We believe that state legislatures need technical guidance from you and the TGDC regarding these new policies and procedures. However, we are concerned that by issuing VVPAT standards to the exclusion of any other standards, it will appear that NIST tacitly endorses VVPATs as THE solution to public confidence and trust in electronic voting systems.

We understand that VVPAT standards are necessary in light of several states' mandates for them. However, all states are required to employ accessible voting systems by January 1, 2006, and the only federally certified voting systems that are considered accessible are DREs. Although a handful of states have mandated VVPATs, most states have not mandated VVPATs and are waiting on guidance from NIST and TGDC for comprehensive standards for DRE use. For many, the VVPAT represents a cumbersome, expensive, and partial answer to questions about DRE security and voter verification. In addition to being able to verify that their vote was cast properly, voters need confidence that their vote will be recorded correctly BEFORE they cast their ballot.

Before any VVPAT standards are released, we strongly encourage you to clearly state:

1. VVPAT is not the only solution for voter verification;

2. NIST will continue to explore alternative voter verification solutions, which may include private receipt audit trail technologies;

3. NIST will issue guidelines for comprehensive logic and accuracy testing for DRES;

4. NIST will issue guidelines for parallel testing;

5. NIST will issue guidelines for HASH code monitoring by the states; and

6. NIST will issue these guidelines by a date certain.

NIST provides technical leadership for vital components of the nation’s technology infrastructure. Because of your well- deserved reputation throughout the nation and the world, any guidelines you issue will be compelling. When you issue the VVPAT guidelines please clarify that VVPAT is a partial solution and the guidelines are being issued in response to the demands from a handful of states. Please clarify that NIST has only begun its work to develop standards for Security and Transparency, Human Factors and Privacy, and Core Requirements and Testing. Strong public trust and confidence in the nation's voting systems is essential to our democracy, and the public needs to know that VVPAT is certainly not the only solution, and probably not the best solution.

Sincerely,

Linda Lamone

President, National Association of State Election Directors

Administrator of Elections, Maryland State Board of Elections