Audits and verification: evidence without exposing the vote

In plain words

Two goals seem to pull in opposite directions. We want everyone to be able to check that the votes were counted right. We also want nobody to know how any one person voted.

Elections solve this with evidence that is about the ballots, not about the voters. A common method is to keep a paper ballot that each voter has checked, then pull a random sample of those papers after the count and compare them to the machine results. If the sample agrees closely enough, there is strong evidence that the winner is right. If not, people count more, up to a full hand count.

Another approach uses cryptography so voters can check that their ballot was included without being able to prove to anyone what it said.

Both only work if the records are protected from the moment they are made until the audit is done, and if there is a fair process when someone says something went wrong.

Defined terms

• Audit trail. Records that let someone check an outcome. Lindeman and Stark describe the best audit trail as "voter-marked paper ballots" ¹.
• Software independence. "An undetected change or error in voting system software should be incapable of causing an undetectable change or error in an election outcome" ¹. VVSG 2.0 states the same idea: "an error or fault in the voting system software or hardware cannot cause an undetectable change in election results" ³.
• Risk-limiting audit (RLA). "A method to ensure that at the end of the canvass, the hardware, software, and procedures used to tally votes found the real winners." RLAs "do not guarantee that the electoral outcome is right, but they have a large chance of correcting the outcome if it is wrong" ¹.
• Ballot-polling and comparison audits. Two kinds of RLA. Ballot-polling audits examine randomly selected ballots; comparison audits compare hand counts to the voting system's counts for batches or individual ballots ¹.
• Compliance audit. A check that the procedures protecting the audit trail were actually followed ¹.
• Chain of custody. Documented control of ballots and records from creation to final retention, so that additions, losses, or alterations would be detected.
• End-to-end (E2E) verifiability. A property of cryptographic voting protocols covering "cast as intended," "recorded as cast," and "tallied as recorded" ⁴.

See also the glossary.

Evidence

Risk-limiting audits

Lindeman and Stark's 2012 introduction, published in IEEE Security and Privacy's special issue on electronic voting, explains that RLAs "involve manually examining portions of an audit trail of (generally paper) records that voters had the opportunity to verify recorded their selections accurately" ¹. They add a hard limit: "Systems that do not produce voter-verifiable paper records, such as paperless touchscreen voting systems, cannot be audited this way," and records "printed after the voter has left do not confer software independence, because voters had no chance to verify them" ¹.

The National Academies' 2018 report recommended that "states should mandate a specific type of audit known as a 'risk-limiting' audit" before results are certified, and noted that an audit of an election with tens of millions of ballots may require hand examination of only several hundred randomly selected paper ballots ². Lindeman and Stark explain that sample size "depends on the margin (or diluted margin) and the luck of the draw," but "only weakly on the size of the contest" ¹.

Audits depend on custody

Lindeman and Stark state that "preserving the audit trail complete and intact is crucial." If a compliance audit "does not generate convincing affirmative evidence that the ballots have not been altered and that no ballots have been added or lost, a risk-limiting audit may be mere theater" ¹. The 2020 federal assessment makes the same point from the other direction: a physical attack on mailed ballots "is limited to low-volume attacks and mitigated by proper chain of custody procedures by election officials," while electronic attacks can operate at scale ⁵. For remote ballot marking, it calls a printed, voter-verified ballot "an important compensating control for detecting a compromise of security in remote voting" ⁵.

Audits and secrecy

Audits examine ballots, not voters, which is how they coexist with secrecy. But Lindeman and Stark note that "ballot-level auditing elevates privacy concerns," because the most efficient audits require locating and identifying individual ballots, and labeling ballots "is prohibited in some jurisdictions" ¹. Audit design has to be checked for new ways to link a ballot back to a voter.

Voting system requirements

VVSG 2.0's Principle 9 requires that a voting system "is auditable and enables evidence-based elections," that it "produces readily available records that provide the ability to check whether the election outcome is correct," that records be "resilient in the presence of intentional forms of tampering and accidental errors," and that it "supports efficient audits" ³. The EAC explains that software-independent systems either produce voter-verifiable paper records or "implement an approved cryptographic end-to-end (E2E) verifiable voting protocol" ⁴.

End-to-end verification and dispute resolution

The EAC's E2E evaluation process, published in December 2025, requires protocols to let voters confirm, "while in the polling place via a receipt," that selections were interpreted correctly; to let voters "verify that their cast ballots were accurately recorded" and included in public records; and to "provide a publicly verifiable tabulation process" ⁴. Protocols "must facilitate dispute resolution of claims of a flaw or error," and "the receipt must not display any ballot selections made by the voter or otherwise enable the voter to prove their selections on the cast ballot to others" ⁴. No protocol approval is reported on that page.

Other jurisdictions use verification in remote voting. Switzerland's Federal Chancellery states that cantons running trials use "Swiss Post's e-voting system with complete verifiability," and that "the system and its operation are examined in independent examinations commissioned by the Federal Chancellery" ⁶. Estonia offers a separate smart device application with which "the voter can check if their vote has been forwarded and received correctly" ⁷.

International expectations

General Comment 25 calls for "independent scrutiny of the voting and counting process and access to judicial review or other equivalent process so that electors have confidence in the security of the ballot and the counting of the votes," and says votes "should be counted in the presence of the candidates or their agents" ⁸. The Venice Commission's Code requires that observation "must always be possible during vote counting" and that final appeal to a court be possible ⁹.

Competing interpretations

Paper-based audits versus cryptographic verification. One school holds that voter-verified paper plus RLAs is the most robust, understandable evidence ^{1 2}. Another holds that E2E protocols can give individual voters direct evidence and could eventually support remote voting. VVSG 2.0 accepts both routes to software independence for polling place systems ⁴. Critics of E2E point to usability: verification only helps if enough voters actually check, and if disputes can be resolved.

Individual verification versus coercion. The more a voter can confirm, the greater the risk that confirmation becomes proof for a coercer. The EAC's receipt rule addresses this directly ⁴. See intimidation.

Interpretation, this site's reading. Verification is a chain. A perfect audit of tampered records proves nothing, and a perfect cryptographic receipt that no one checks proves little. The chain is only as strong as its least-checked link.

Application to this framework

1. The demo has nothing to audit as an election. It stores no ballot choices and produces no official results. Simulated collective priority rankings are labeled as fixtures.
2. Published releases are verifiable in a different sense. Each published release carries a manifest, methods, a checksum, and a correction history so that readers can confirm they hold the same immutable package as everyone else. That is integrity of a publication, not an election audit.
3. Future official layer, requirements only. A future system would need: voter-verifiable records or an approved E2E protocol ⁴; documented chain of custody and compliance audits ¹; risk-limiting audits or an equivalent outcome check before certification ²; audit designs reviewed for secrecy risks; independent scrutiny and judicial review ⁸; and a dispute resolution procedure with published outcomes. The framework does not propose its own protocol.
4. Operator audits. Separately from election audits, privileged actions on the website and demo are logged as metadata only, without political answer payloads. See governance.

Unresolved questions

• Can a remote voting channel produce an audit trail that voters genuinely verified, without a printer and without creating a coercion receipt?
• What share of voters must check an E2E receipt for verification to provide meaningful assurance? This page offers no figure because none was verified for this review.
• How should audits handle overlapping jurisdictions and contests on one ballot? See jurisdictions.
• Who audits the auditors, and how are audit procedures themselves published and corrected?