A voter-verified paper record (VVPR) is a paper document that a voter can review before officially casting their ballot. It gives auditors a record of the voter’s choices that does not depend on the voting system’s software being correct. Hand-marked paper ballots are the strongest form; machine-printed records are useful but weaker, because voters may not check them.
Definition
The Voluntary Voting System Guidelines 2.0 (VVSG 2.0) define a voter verified paper record as “a paper document that the voter can review before officially casting their ballot”.1 They define “voter verifiable” as a feature that “provides the voter an opportunity to verify that their contest selections are being recorded correctly before the ballot is cast”.1 The U.S. Election Assistance Commission defines a related device-specific term, the Voter Verified Paper Audit Trail (VVPAT): a “paper document containing evidence of a voter’s contest selections as cast on a DRE voting device,” which voters “are able to review” before casting.2
The word “verifiable” describes an opportunity. A record is voter-verifiable if the voter could check it; whether a given voter did is a separate fact.
Origin and history
The paper record became central as electronic voting spread. Federal law under the Help America Vote Act requires voting systems to produce “a permanent paper record with a manual audit capacity” that “shall be available as an official record for any recount”.3 VVSG 2.0, adopted February 10, 2021, went further: every conforming system must be software independent, through either “independent voter-verifiable paper records” or cryptographic end-to-end verifiable systems, and VVSG 2.0 notes that the paperless direct recording electronic (DRE) machine “is now non-conformant”.1 The National Academies recommended in 2018 “human-readable paper ballots by the 2020 presidential election”.4
How paper records are used and judged
Paper records are the material that audits and recounts examine. Their value as evidence depends on how they were made:
- Hand-marked paper ballots. Lindeman and Stark write that “the best audit trail is voter-marked paper ballots”.5
- Ballot marking device (BMD) printouts. A BMD lets a voter make selections on a screen and “produces a human-readable paper ballot,” with no other lasting record of the selections, under the VVSG 2.0 definition.1
- VVPAT rolls on DRE machines. Lindeman and Stark note that such records “are not as good”: “voters might not actually inspect VVPRs,” “printers can jam or run out of paper,” and the records “can be fragile and cumbersome to audit”.5
They add a firm limit: “records of cast votes printed after the voter has left do not confer software independence, because voters had no chance to verify them”.5 Paper also needs protection after it is made; see Chain of custody.
Common confusions and neighboring terms
- VVPR vs. ballot. A hand-marked paper ballot is both the ballot and the record. A VVPAT is a copy of selections made on a machine.
- Voter-verifiable vs. voter-verified. The first is an opportunity; the second means a voter actually checked.
- VVPR vs. ballot image. VVSG 2.0 defines a ballot image as an archival digital image of a paper ballot.1 An image is produced by the system and does not provide independent evidence the way paper does.
- VVPR vs. end-to-end verifiable voting. Both satisfy software independence under VVSG 2.0 by different means.
How My Vote Forward uses the term
My Vote Forward treats a voter-verified record as a requirement for any trustworthy vote count, and its Audits and verification chapter explains why. The framework’s demo does not produce paper records and does not claim to provide software independence; it shows simulated data only. Any future real voting would need an approved method of software independence, independent evaluation, and legal authority, none of which exists for this project.
What My Vote Forward can and cannot do here
My Vote Forward can explain what makes a paper record good evidence and why its absence matters. It cannot produce or preserve official records, and it cannot make up for a voting method that leaves voters nothing to check.
Unresolved questions
- How can voters be encouraged to actually review BMD printouts, and how much does review rate matter to security?
- If ballots are cast remotely, what record could play the role of voter-verified paper?
- How should jurisdictions weigh the accessibility benefits of BMDs against the evidence value of hand-marked paper?
Sources
- U.S. Election Assistance Commission, Voluntary Voting System Guidelines Version 2.0, February 10, 2021. eac.gov/…
- U.S. Election Assistance Commission, “Chain of Custody Best Practices,” version 1.1, July 12, 2021 (definition of VVPAT). eac.gov/…
- 52 U.S.C. 21081, Voting systems standards (Help America Vote Act section 301). law.cornell.edu/uscode/text/52/21081
- National Academies of Sciences, Engineering, and Medicine, “Securing the Vote: Protecting American Democracy,” news release, September 2018. nationalacademies.org/news/securing-the-vote-new-report
- Mark Lindeman and Philip B. Stark, “A Gentle Introduction to Risk-limiting Audits,” IEEE Security and Privacy, 2012. stat.berkeley.edu/~stark/Preprints/gentle12.pdf
