2.3 Conformance Designations

A voting system conforms to the product standard if all stated requirements that apply to the voting system and its constituent devices are fulfilled. The implementation statement (see Part 1: 2.4 “Implementation Statement”) declares the capabilities, features and optional functions that have been implemented and are subject to conformity assessment.

There is no concept of partial conformance—neither that a voting system is x % conforming, nor that a device that is not a complete voting system by itself is conforming. Individual devices of voting systems are not tested except as parts of complete systems. ^[3]

• Device Certification

  Richard Carback (Academic, Computer Science) on 01.25.08 at 3:15pm

  This draft has given an architecture and taxonomy of voting systems and the devices
  they use. It also goes into device specific requirements. I find it absurd and
  protectionist that there is not, at least, limited device-level certification.
  
  In other words: If I am a printer company, and I make great printers, there is no
  facility for me to get my VVPAT printer certified under the VVSG as meeting all the
  requirements. Instead, I have to contract with a company making a voting system to
  have my device included.
  
  The problem with this situation is that it is in the best interest of the voting
  company to find the cheapest printer that passes certification. Election officials
  may never get the choice to buy my superior product, because I cannot get it
  certified under the VVSG without a voting company.
  
  Likewise, it discourages a voting company from offering multiple kinds of VVSG
  compliant printers, because for each printer they offer, they must bundle it with
  their larger voting system(s) for it to be considered "certified".
  
  Lack of device level certification severely limits the usefulness of federal
  certification of voting equipment for states. I find the footnote explaining this
  away unconvincing. Lets take a look at it in pieces:
  
  "[3] A prerequisite for device-level certification would be
  prescribing a system architecture so that the responsibilities of each device and
  the interfaces between those devices could be well-specified."
  
  An architecture is not necessary when specific devices are already identified
  (e.g. printer). Even if this statement were true, the VVSG already gives various
  system architectures and a taxonomy for voting systems. The interfaces between
  devices, however, is something that is necessary to specify, but in many cases,
  standard interfaces exist, and it would be worthwhile to define them if they did
  not exist (The document already requires common industry data format support).
  
  "Such prescription is undesirable."
  
  Why?
  
  "More importantly, even with a prescribed architecture, a
  device-level certification would provide no assurance that any particular system
  that included that component would function as specified."
  
  Again, why is this true? Note that, using my preexisting example, if I know my
  printer conforms to the VVSG (assuming a specified interface), and that my larger
  system conforms to the VVSG, why shouldn't they work?
  
  "That assurance can only be obtained by evaluating the complete
  system in the configuration in which it is to be deployed."
  
  In other words, I can only be assured my new CDROM drive will work if I can find a
  computer exactly like mine with that CDROM drive in it, and not because I know my
  computer supports IDE drives, and the CDROM drive is an IDE drive?
  
  Perhaps, in some special case, these statements are true, but not as they are
  presently presented in the VVSG.

  Reply to this Comment