Open Source Voting System Project Recommendations

(Approved by OSVTAC on March 14, 2019.)

Last posted: June 9, 2019

Note: these recommendations are a work in progress and not yet complete.

This document contains the recommendations of San Francisco’s Open Source Voting System Technical Advisory Committee (OSVTAC, or TAC) for the City and County of San Francisco’s open source voting system project, as of the version date that appears above.

The committee started this document on August 30, 2017 and will continue to work on it over time. Substantive updates to this document occur by a vote of the committee at a committee meeting. Meetings occur approximately once a month.

To learn more about the committee, visit the committee’s website at https://osvtac.github.io. To learn how to suggest changes to this document, view the “Project Recommendations” section of the About page of the committee’s website.

• Single-page version (long, can be used for printing)

This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License. For copyright and attribution information for this work, see this section. The source files for the text can be found on GitHub here.

Contents

• 1. Copyright and Attribution
  • 1.1. Copyright
  • 1.2. Contributors
• 2. Goals
  • 2.1. Scope
  • 2.2. Priorities
  • 2.3. Non-goals
• 3. Background
  • 3.1. History of Open Source Voting in San Francisco
  • 3.2. Voting System
  • 3.3. Other Voting System Projects
  • 3.4. Resources
• 4. Facts & Assumptions
  • 4.1. Facts
  • 4.2. Assumptions
• 5. Components
  • 5.1. Component Listing
  • 5.2. Component Details
• 6. Recommendations
  • 6.1. Interim Voting System
  • 6.2. Requirements-gathering
  • 6.3. Requirements
  • 6.4. Project Management
  • 6.5. Open Source
  • 6.6. Procurement
  • 6.7. Software architecture and design
  • 6.8. Software development
  • 6.9. Hardware design
  • 6.10. Documentation
  • 6.11. Security
  • 6.12. Testing
  • 6.13. Certification
  • 6.14. Hardware manufacturing or assembly
  • 6.15. Deployment
  • 6.16. Software maintenance
  • 6.17. Hardware maintenance
• 7. Recommended Implementation Order
  • 7.1. Recommended First Components
  • 7.2. Rationale
  • 7.3. Results Reporter Rationale
  • 7.4. Vote Totaler Rationale
  • 7.5. Central Ballot Scanner Rationale
  • 7.6. Deployment Strategies
  • 7.7. Central Ballot Scanner Phases
• 8. Equipment (“Product”) Decisions
  • 8.1. Will vote centers be used for early and/or election day voting?
  • 8.2. Should precinct polling and vote centers use the same paper ballots as those used in vote-by-mail?
  • 8.3. Should ballots to be hand-marked be preprinted or printed on demand?
  • 8.4. Should voting at a precinct or vote center be primarily based on paper ballots hand-marked with a pen, or voting machine with a printer?
  • 8.5. If voters use machines to mark ballots, should the machine store CVRs of the marked selections?
  • 8.6. Should a machine-marked ballot contain a bar code with a digital signature and/or CVR?
  • 8.7. If voting machines are used at a precinct, should there be one printer per voting station?
  • 8.8. If voters at precincts use hand-marked ballots, should ballots be scanned centrally or at the precinct/vote center?
  • 8.9. If a precinct scanner is used, does the scanner need to be integrated with a ballot collection bin?
  • 8.10. If a precinct scanner (or central scanner) is used, does it need to include an imprinter to record a ballot/scan ID?
  • 8.11. If a voting machine is used to print all precinct ballots and possibly save CVRs, does the ballot collection box need to have an integrated scanner?
  • 8.12. Is voting equipment required to run off a battery (without outside AC power) for a set outage duration or all day?
  • 8.13. What kind of printing technology should be used at a poll site or vote center?
  • 8.14. What size paper should be used for precinct voting and vote by mail?
  • 8.15. What options should be provided to people with disabilities?
  • 8.16. Should “remote accessible vote-by-mail” (RAVBM) printing used by voters with disabilities to vote by mail using home computers also be used for accessible precinct voting?
  • 8.17. Does ballot collection order or CVR recordings need to be randomized to protect voter privacy (be disassociated by order of appearance at a precinct)?
  • 8.18. Should scanned ballot images or compiled CVRs be an open public record, possibly electronically accessible?
  • 8.19. End-to-end verifiability
• 9. FAQ
• 10. Glossary

This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License. For copyright and attribution information for this work, see this section. The source files for the text can be found on GitHub here.