[Comment 1 of 4] Live auditing techniques are crucial to verify voting system accuracy during the live election. The following proposed addition to the VVSG describes the use of statistical live auditing techniques to verify that paper ballots or paper audit trails match the cast vote records created by the scanning process. 6.9 Requirements for Statistical Live Auditing of Optical-Scan and VVPAT Records When machine-scanned paper records include a unique identifier, strong auditing of the vote interpretation process is possible during the live election via well-known statistical quality control techniques. The technique described here is applicable to optical-scan ballots and voter-verified paper audit trails. To use this audit technique, a unique identifier is imprinted on the election's paper vote records, either at record creation time or during machine scanning. (The latter approach is considered superior, as it avoids anonymity concerns.) When the records are machine-interpreted, the resulting cast vote record is electronically associated with the paper record's unique identifier. A small portion of the paper records are then randomly selected for auditing, and that subset is hand-interpreted by one or more hand-count teams, resulting in a second human-compiled set of cast vote records. The human-compiled cast vote records are compared to the machine-compiled cast vote records, and any discrepancies are investigated. Since the individual paper records are linked to the electronic cast vote records by the unique identifier, this auditing method is very efficient. Medium-to-large counties can be 99% confident that the electronic cast vote records differ from the results of a hypothetical full hand count by less than 1%, by only hand-counting 1,000 ballots. The number of ballots to randomly select to achieve a particular confidence level can be determined by reference to [1], below. The unique identifier may be applied when the paper record is scanned by a scanner equipped with an imprinter. The unique identifier also may be printed on the paper record when the record is initially created. 6.9.1 The paper record interpretation function should be decoupled from other voting system functions to facilitate auditing. 6.9.2 In paper ballot systems, it is desirable that the unique identifier is applied to the ballot when the ballot is scanned. Discussion: This is intended to preserve voter anonymity, and can be implemented by use of scanners with imprinters. This will not apply to VVPAT systems. 6.9.3 The list of record unique identifiers to hand-count shall be determined in a manner that is extremely difficult to predict prior to the audit, yet which generates a repeatable and publicly verifiable list of record unique identifiers. Discussion: This can be done by cryptographically hashing several subseeds, provided by election judges, lottery results, party observers, election officials, and other sources[2], and using the resulting number to seed a PRNG. 6.9.4 Any algorithms used to generate the list of record unique identifiers shall be FIPS-approved. 6.9.5 Any algorithms, input data, and output data used to generate the list of record unique identifiers shall be published openly. Discussion: This includes the pseudocode of the algorithms, source code of the algorithms, the individual subseeds, the hashed seed, the PRNG output, and the derived list of record unique identifiers to count. 6.9.6 The number of paper records to hand-interpret and any necessary process details shall be determined by a peer-reviewed statistical quality control method. Discussion: One such procedure is the Lot-Sensitive Sampling Plan (LSP) [1]. 6.9.7 The confidence intervals of the plan should be set such that it can accurately audit very close elections where the margin of victory is 1% or less. Discussion: If LSP is used, p*, the maximum percent of ballots allowed to be inaccurately interpreted, should be 1% or less. pa, the probability that the audit would miss an inaccurately interpreted ballot, should be 1% or less. 6.9.8 The hand-count teams shall interpret the paper records and create a set of cast vote records by hand to compare with the subset of machine-generated cast vote records. References [1] Schilling, Edward G. _A Lot Sensitive Sampling Plan for Compliance Testing and Acceptance Inspection._ Journal of Quality Technology, Vol. 10, No. 2 (April 1978), pp. 47-51. [2] Eastlake, D. E. _RFC 3797 - Publicly Verifiable Nominations Committee (NomCom) Random Selection._ Internet Society, June 2004. Bibliography Jones, Douglas W. _Auditing Elections._ Communications of the ACM, 47, 10 (October 2004) 46-50. Walmsley, Paul and Johansson, Margit. _How to effectively audit ballot interpretation machines._ April 8, 2005. Walmsley, Paul and Johansson, Margit. _Example ballot interpretation report._ April 8, 2005. Walmsley, Paul. _Overview of Live Auditing Procedures for Incorporation in the Voluntary Voting System Guidelines._ September 30, 2005.