How the EAC Resolved the VVSG 2.0 CDF Version Question

The U.S. Election Assistance Commission (EAC) has an official answer to a specific version-citation problem in its Voluntary Voting System Guidelines: when VVSG 2.0 cites a Common Data Format (CDF) publication that is later revised, manufacturers do not have to wait for the guidelines themselves to be updated. In its November 3, 2023 decision on Request for Interpretation (RFI) 2023-06, the EAC said manufacturers should declare which version of each CDF they have implemented. It also said future CDF changes will run through NIST’s public community development process rather than through a frozen citation in VVSG 2.0.

This original record-reading guide is a general reading aid, not cited evidence. It does not depict a source record; the article text and source links provide the facts.

Key points

• The question was formally logged as RFI 2023-06, against VVSG 2.0 requirements 3.3-B and 4.1-F, dated 11/03/2023: “2023-06 | VVSG 2.0 | 3.3-B, 4.1-F | 11/03/2023 | Extensions to the VVSG 2.0” (EAC Requests for Interpretation).
• The underlying problem is that VVSG 2.0’s appendix names specific CDF publications by version, and some of those publications have since been revised: “VVSG 2.0 Appendix C calls out specific CDF publications, however, some have been revised since VVSG 2.0 was adopted. Which version of the CDF publications are required for implementation?” (EAC Requests for Interpretation).
• The EAC’s decision does not lock in a single required CDF version. Instead: “Manufacturers should declare the version of each CDF implemented in their system.” (EAC Decision on RFI 2023-06).
• Going forward, CDF evolution is meant to happen through NIST’s open process, plus guidance still to come: “Future developments of common data formats will be mediated through a community discussion and development process (see https://github.com/usnistgov/Voting). Through such processes real world use of common and manufacturer data formats will provide pathways by which CDFs can evolve. A forthcoming lifecycle policy will provide additional guidance.” (EAC Decision on RFI 2023-06).

The logged request

The EAC’s public interpretations register records this exact request under its own title: “EAC Decision on Request for Interpretation 2023-06 Common Data Format (CDF) Extensions” (EAC Decision on RFI 2023-06). The register entry ties it to two specific VVSG 2.0 requirements, 3.3-B and 4.1-F, and dates it 11/03/2023 (EAC Requests for Interpretation).

The underlying question

The trigger for the request is stated plainly in the EAC’s own register: VVSG 2.0’s Appendix C names specific CDF publications, but some of those publications have been revised since VVSG 2.0 was adopted, raising the question of which version manufacturers must actually implement — “VVSG 2.0 Appendix C calls out specific CDF publications, however, some have been revised since VVSG 2.0 was adopted. Which version of the CDF publications are required for implementation?” (EAC Requests for Interpretation).

The decision text

The decision document itself carries the same date shown in the register: “Date: November 3, 2023” (EAC Decision on RFI 2023-06). On the version question, the EAC’s resolution puts the declaration burden on the manufacturer rather than freezing one CDF edition in the guidelines: “Manufacturers should declare the version of each CDF implemented in their system.” (EAC Decision on RFI 2023-06).

Future CDF process

Rather than amending VVSG 2.0’s appendix every time a CDF publication is revised, the decision points manufacturers and the public toward an open, ongoing process: “Future developments of common data formats will be mediated through a community discussion and development process (see https://github.com/usnistgov/Voting). Through such processes real world use of common and manufacturer data formats will provide pathways by which CDFs can evolve. A forthcoming lifecycle policy will provide additional guidance.” (EAC Decision on RFI 2023-06).

When the decision took effect

The decision document states its own effective date directly, tied to its publication: “Effective Date: As of the date this document is published.” (EAC Decision on RFI 2023-06).

What this article does not answer

This article does not report on whether manufacturers have, in practice, complied with the instruction to declare their implemented CDF version; that is a compliance question outside the scope of the decision text itself. The decision references a “forthcoming lifecycle policy,” but this article has not independently verified whether or when that policy has since been published.

Nor does it address whether the EAC’s reasoning here has been formally extended to any other interpretation request, how any state or non-federal certification authority treats CDF version citations outside the EAC’s own VVSG 2.0 program, or the technical substance of the Common Data Format specifications beyond the versioning and declaration point quoted above.

Source links

• https://www.eac.gov/voting-equipment/requests-for-interpretation
• https://www.eac.gov/sites/default/files/2023-11/EAC_Decision_on_RFI_2023-06_CDF_Extensions.pdf