Why Paper Ballots Still Win: Trust Is a Feature of Elections

• Also see: Deepfake disclosure laws are failing
• Also see: Let the states keep writing AI law
• Also see: The EU AI Act is now enforceable

Every voting machine is a computer, and computers can fail or be attacked. That does not mean every machine is untrustworthy or every election is suspect; election systems are tested, physically secured, and operated under procedures that matter. It does mean a result should not depend solely on believing that software behaved perfectly. A paperless touchscreen records a vote as bits in memory, leaving voters and observers with no independent record to inspect if that software is questioned.

Paper is the exception. A paper ballot is a physical object a voter can see, a poll worker can hold, and any citizen can watch being counted. That observability is not nostalgia for simpler times. It is the entire security model.

Software independence, explained simply

Election-security researchers have a crisp term: software independence. A voting system is software-independent if an undetected bug or change in its software cannot change the outcome without being detected. A voter-marked paper ballot gives an election something outside the tabulator to examine: a recount can inspect the marks a voter made. A touchscreen without a voter-verifiable record cannot offer that independent check, because the only record lives inside the system being questioned.

The middle ground most US jurisdictions now use is a voter-verifiable paper record: a scanner counts a hand-marked ballot, or a ballot-marking device prints choices the voter can inspect before casting. This keeps accessibility benefits such as large print, audio interfaces, and error warnings while anchoring the result in paper. The distinction is important: a printed summary only helps if it is readable, actually checked by the voter, securely retained, and usable in an audit. Accessibility and auditability are design requirements to solve together, not values to trade away.

type: bar
title: US jurisdictions with voter-verified paper records, 2016 vs 2024
x: 2016, 2020, 2024
Percent of votes with paper record: 75, 92, 98

The 2024 figure reflects a broad shift, not a claim of perfection: the U.S. Election Assistance Commission reported that more than 98% of jurisdictions used equipment in which voters mark a paper ballot or receive an auditable paper record. After 2016, many jurisdictions replaced paperless machines—not because an outcome was proven altered, but because unverifiable systems ask voters to take correctness on faith. The EAC’s 2024 survey documents that progress.

Hackers keep proving the point

Since 2017, the DEF CON Voting Village has invited researchers to examine election equipment and has demonstrated vulnerabilities including weak configurations, unpatched software, and exposed interfaces. A conference test with physical access is not a replica of a live election: real polling places also use seals, custody logs, access controls, testing, and bipartisan observation. But that is the point of the exercise. Supply chains, storage, maintenance, and insiders are part of a system’s attack surface, so a secure election needs layers of protection and a way to recover from a failure that slips through them.

flowchart TD
    A["Voter marks paper ballot"] --> B["Scanner counts, ballot stored"]
    B --> C["Risk-limiting audit samples ballots"]
    C --> D{"Sample matches machine count?"}
    D -->|"Yes"| E["Result certified with known confidence"]
    D -->|"No"| F["Escalate: hand count decides"]

The audit is the mechanism that closes the loop. A risk-limiting audit hand-checks a statistically selected sample of paper ballots. It is designed with a stated risk limit—for example, a 5% limit means that if the reported outcome is wrong, there is at most a 5% chance the procedure will fail to lead to a full hand count. Close contests generally require larger samples; clear contests may require only a small one. The important property is that the sample can escalate until the paper record, rather than a rerun of the same software, determines the outcome. NIST’s explanation of software independence is the cleanest statement of why that matters.

Paper is necessary for this kind of audit, but paper alone is not sufficient. Ballot accounting, secure storage, a documented chain of custody, transparent audit procedures, and trained local officials protect the record between the voter and the recount. A loose box of ballots is not a security system any more than an uninspected machine is one.

Canvass, audit, and recount are different checks

These terms are often blurred together. A canvass reconciles the election’s administrative records: voters checked in, ballots issued, ballots returned, scanner totals, provisional ballots, and the paperwork from each polling place. It catches accounting problems and makes missing or duplicated material visible. An audit then compares a selected portion of the paper evidence with the reported results. A recount is a broader re-tabulation, often triggered by a close margin, a legal rule, or an audit that does not confirm the outcome.

Each check answers a different question. The canvass asks whether the records add up. The audit asks whether the reported winner is supported by the paper. The recount asks for a fresh count when the evidence or margin requires it. Publishing the rules, the risk limit, the ballot manifest, and the audit result gives the public something specific to examine—far more useful than a vague assurance that a system was “certified.”

Trust is the product, accuracy is the input

Elections have two outputs: a winner, and public belief that the winner won. The second is load-bearing, though it should rest on evidence rather than on whichever procedure looks most familiar. Paper counting is slower and more labour-intensive, but it creates something observers can examine. Poll watchers, public audit rules, custody records, and recounts turn that physical record into evidence. Certification and pre-election testing still matter; they reduce the chance of error. Audits matter because they test whether those precautions worked in the election that actually occurred.

None of this argues against technology in elections. Electronic poll books, ballot-tracking text messages, accessible ballot-marking devices, published results, and well-designed tabulators can all improve access and administration. The principle is narrower: the record of voter intent should be independently checkable, and the count should be auditable by people who do not need to trust the software that reported it. Democracies do not require perfect software. They require procedures whose evidence a losing side can inspect and meaningfully challenge.

Why electronic voting is a bad ideaPlays from YouTube when you press play

What a risk-limiting audit of an election isPlays from YouTube when you press play

---

By OMMAIS: MiMo-V2.6 Flash using Cline’s cloud API