Chain of custody: a documented record of who held what, and when

Chain of custody is the documented record of every transfer of a material, such as a ballot box, a memory card, or a dataset, from one person or place to the next. The U.S. Election Assistance Commission (EAC) calls it “the processes, or paper trail, that documents the transfer of materials from one person (or place) to the next.” Audits depend on it: if no one can show the records were kept intact, checking them proves little.

Definition

The EAC’s Chain of Custody Best Practices (version 1.1, July 12, 2021) gives the definition quoted above and adds that “every state and local jurisdiction has its own controls,” which “may include locks, seals, audit logs, witness signatures, or other security measures”.⁠¹ The document stresses that it offers “voluntary best practices” to be implemented “only after reviewing federal, state, and local laws and regulations”.⁠¹

A complete chain answers, for each transfer, the questions the EAC lists: where the item is, who has access, what makes it unique (description, serial number, condition), when and where it is transferred, who transfers it, who witnessed it, and what condition it is in on arrival.⁠¹

Origin and history

Election offices apply chain of custody to ballots, equipment, and data. The EAC’s 2021 document covers “physical election materials, voting systems, and the use of third-party auditors for conducting audits and electronic discovery”.⁠¹ Its introduction sets a public standard: “every election office should have written chain of custody procedures available for public inspection prior to every election,” and once a process starts, “it must be followed with every step documented”.⁠¹ The document also addresses third-party examinations of equipment, warning that during such work clear procedures are “critical” so “the chain of custody is not broken”.⁠¹

How chain of custody is maintained and checked

Election offices maintain custody with physical and procedural controls. The EAC defines a security seal as a mechanism using “serialized or tamperproof evident materials that alert officials if a device used in the elections process has potentially been altered or accessed without authorization”.⁠¹ Its checklists ask workers to confirm that “all seal and serial numbers have been verified” and recommend logs recording “when seals are broken and replaced” with date, time, and reason.⁠¹ Each transfer form records the date and time and the “name and signatures of employees or volunteers who are attesting to the event”.⁠¹

Custody is checked through procedural audits. The National Conference of State Legislatures describes procedural audits as including “a review of security and chain-of-custody procedures”.⁠² Statisticians who designed risk-limiting audits make custody a precondition: Lindeman and Stark write that if a compliance audit “does not generate convincing affirmative evidence that the ballots have not been altered and that no ballots have been added or lost, a risk-limiting audit may be mere theater”.⁠³

Common confusions and neighboring terms

• Chain of custody vs. audit. Custody protects the evidence; an audit examines it. A tabulation audit of tampered ballots confirms the tampering.
• Chain of custody vs. ballot manifest. A manifest describes how ballots are stored and counted into batches, which RLAs need for sampling.⁠³ Custody records show the batches were not disturbed.
• Chain of custody vs. secrecy. Custody tracks containers and devices, not which voter cast which ballot.
• Chain of custody vs. data provenance. Provenance records the origin and processing of a dataset. It is the digital analogue and follows the same logic.

How My Vote Forward uses the term

My Vote Forward applies custody thinking to its own outputs. A published release carries its version, method, consent basis, and corrections, so that anyone can trace what was released, when, and how it was produced. For official elections, the framework’s Audits and verification chapter treats preserved custody as one of the conditions that make audit evidence trustworthy. The demo’s data is simulated, and no custody claim is made about it as election evidence.

Unresolved questions

• What is the digital equivalent of a tamper-evident seal for a dataset, and who should hold the record of it?
• How much of an election office’s custody documentation should be published, given security concerns about revealing procedures?
• How should a third-party examination be structured so that it does not itself break the chain it is meant to check?