While the federal U.S. Election Assistance Commission provides voluntary guidelines and certifies voting systems, individual states have authority over election activities and voting methods and procedures vary greatly from state to state.
The science is clear: a voter verifiable paper trail is critical to protect the voter’s intent. Voting machines that directly record votes without creating a paper record are not secure.
Paper ballots marked by hand and then hand-counted or fed into a scanner offer the highest level of security because voters make their choices directly and the paper ballots can be audited to verify the results. Of any potential voting method, hand-marked paper ballots provide the fewest opportunities for undetected tampering or computer errors.
“Paper ballots form a body of evidence that is not subject to manipulation by faulty software or hardware and that can be used to audit and verify the results of an election.” Securing the Vote: Protecting American Democracy, 2018 report by the National Academies of Sciences, Engineering, and Medicine
But hand-marked paper ballots may not be practical for all U.S. voters. Electronic voting increases access to the polls for individuals with disabilities and others that may encounter difficulty using paper ballots. The Help America Vote Act mandates at least one accessible voting machine per precinct but advocates argue that such separate voting systems discriminate against the people who need them. Many districts have used electronic voting systems for decades with voters, administrators, poll workers, and other stakeholders familiar and comfortable with such voting methods, an important factor in voter confidence.
In the 2016 election, the majority of Americans voted using hand-marked paper ballots. Approximately two-thirds of U.S. counties used hand-marked paper ballots and the remaining one-third of counties used ballot marking devices or direct recording electronic systems.
There are many models of ballot marking devices, most use a touchscreen interface for voters to make their selections. Ballot marking devices frequently offer a number of assistive features that allow voters with disabilities or who may have difficulty marking paper ballots to make their vote selections. Voters are able to check their selections for accuracy and then cast their votes by placing their printed paper ballot in an optical scanner. The ballots are stored and can be used by election officials for audits.
Ballot marking devices may be vulnerable to mechanical errors such as printer malfunctions as well as coding errors. Some experts question how frequently voters check the accuracy of their vote, correctly remember their electoral choices for every race, or notice errors when they verify their ballot. More research is needed on this issue.
Ballot marking devices also vary widely in design and configuration. Some devices offer “all in one” or “hybrid” modes that cast and tabulate votes in one device increasing risk, as compromised code can affect both the cast ballot and the tabulated result. Some ballot marking devices have features that permit the voter to skip viewing and manually scanning their paper ballot, these ‘auto-cast’ features are less secure.
Some designs may make it more difficult for voters to verify their ballot. For example, some ballot marking devices keep ballots under glass, preventing voters from using assistive tools to examine their choices or making it difficult to see the text because of glare. The use of barcodes on paper ballots also presents additional risk as barcodes containing vote selections could potentially differ from the human-readable portion of the paper ballot. Officials should adopt rigorous audit procedures to mitigate the risk from barcodes.
Direct recording electronic (DRE) systems record a voter’s selection directly to the machine’s memory and automatically tabulate votes. Many leave no physical record of the cast vote. Some newer direct recording electronic systems may come equipped with printers for voter-verifiable paper audit trails, but voters cannot verify that their electronically recorded vote matches the vote on the paper. These direct recording systems feature numerous vulnerabilities, from malicious hacking to coding errors. Computer scientists have demonstrated the speed and ease with which an individual can alter these machines undetected. The National Academies of Sciences, Engineering and Medicine recommended that these machines be removed from service as soon as possible. In February 2021, the U.S. Election Assistance Commission released updated voluntary guidelines that establish stricter standards for voting systems to be auditable, and include additional security, privacy, and accessibility provisions. Direct recording electronic systems do not meet the updated guidelines.
When considering electronic election systems, officials should consider:
- Does the system provide an auditable, human-readable paper ballot
- Can voters easily review and verify their selections in print before submitting their ballot?
- Is the system used to mark the ballot distinct and separate from the system used to record the results?
- Does the system allow for ballot designs that follow best practices set forth by the U.S. Election Assistance Commission and the National Institute of Standards and Technology?
- Does the system have design flaws that introduce opportunities for unobservable ballot changes that violate the principle of “software independence,” such as printers that are part of the same mechanism where cast ballots are collected?
Last updated June 17, 2021
