Privacy. The tabulators shall store digital ballots images randomly to preserve the secrecy of the digital ballot images. Each ballot marking device shall include a voting booth. Auditability. The tabulators shall provide a vote cast record of all ballots cast and audit log of alerts provided to voters and tabulator events and errors. Memory Device. Each precinct tabulator and high speed tabulator shall have a memory device that stores ballot images and reads selections marked or printed on a ballot. Each ballot marking device shall have a memory device that identifies the ballot style to display. Each memory device shall have both a human-readable label and an electronically recognizable identifier. The label and identifier shall match before the memory device is used in any operation related to vote counting. Ballot Selections. Ballot selections shall be made directly on a ballot using a marking instrument approved by the system’s manufacturer or by using the ballot marking device. Public and Protective Counters. Public Counter. Each tabulator shall have a public counter that: Is visible from the outside of the voting unit; and During any period of voting, shows the total number of voters who used the voting unit during that period. The public counter shall: Be set at zero at the beginning of each election; and Register once each time a ballot is scanned and tabulated during that election. Protective Counter. Each tabulator shall have a protective counter that shows the total number of voters who have operated the voting unit since it was first put in service. The protective counter shall: Not be reset; and Register once each time a voter marks or casts a ballot during any election. Changes to Software and Logic. After preelection testing of the system, as prescribed by Regulations .14 and .15 of this chapter, any hardware, software, or firmware changes shall be completely documented in each component’s internal audit log and be capable of being printed. Actions Taken to Change Conditions. The system shall be capable of printing from its audit trail: Actions taken by operators to change conditions; and The time of occurrence. System operators shall record in a logbook all actions to change conditions that cannot be printed from the audit trail. That logbook, as well as all reports produced by the printer, shall be retained by the local board.