Election audit

In jurisdictions that tabulate election results exclusively with manual counts from paper ballots, or 'hand counts', officials do not need to rely on a single person to view and count the votes. Instead, [https://www.insidescience.org/news/even-careful-hand-counts-can-produce-election-errors valid hand-counting methods] incorporate redundancy, so that more than one person views and interprets each vote and more than one person confirms the accuracy of each tabulation. In this way, the manual count incorporates a confirmation step, and a separate audit may not be considered necessary.

However, when votes are read and tabulated electronically, confirmation of the results' accuracy must become a separate process.

Within and outside elections, use of computers for decision support comes with certain IT risks. Election-Day electronic miscounts can be caused by unintentional human error, such as incorrectly setting up the computers to read the unique ballot in each election and undetected malfunction, such as overheating or loss of calibration. Malicious intervention can be accomplished by corrupt insiders at the manufacturer, distributor or election authority, or external hackers who access the software on or before Election Day.[https://www.npr.org/2016/10/26/499450796/some-machines-are-flipping-votes-but-that-doesnt-mean-theyre-rigged Some Machines are Flipping Votes, but That Doesn't Mean They Are Rigged], Pam Fessler, National Public Radio, October 26, 2016. Accessed May 12, 2017[https://www.brennancenter.org/sites/default/files/publications/Machinery%20of%20Democracy.pdf The Machinery of Democracy: Protecting Democracy in an Age of Electronic Voting], Brennan Center Task Force for Voting System Security, 2006.

Computer-related risks specific to elections include local officials’ inability to draw upon the level of IT expertise available to managers of commercial decision-support computer systemsBrave New Ballot: The Battle to Safeguard Democracy in the Age of Electronic Voting, Aviel David Rubin, Broadway, 2006 and the intermittent nature of elections, which requires reliance on a large temporary workforce to manage and operate the computers.Broken Ballots: Will Your Vote Count? Douglas W. Jones and Barbara Simon, CSLI Publications, 2012 Voting machines are usually air-gapped from the internet, but they receive updates from flash drives which do come from the internet, and in any case air-gapped computers are regularly hacked{{Cite news |url=https://www.utilitydive.com/news/russian-hackers-infiltrated-utility-control-rooms-dhs-says/528487/ |title=Russian hackers infiltrated utility control rooms, DHS says |last=Bade |first=Gavin |access-date=2019-07-01 |language=en-US}}{{cite web|author1=Steven Cherry |author2=with Ralph Langner |title=How Stuxnet Is Rewriting the Cyberterrorism Playbook|url=https://spectrum.ieee.org/podcast/telecom/security/how-stuxnet-is-rewriting-the-cyberterrorism-playbook|archive-url=https://web.archive.org/web/20101017091105/http://spectrum.ieee.org/podcast/telecom/security/how-stuxnet-is-rewriting-the-cyberterrorism-playbook/|url-status=dead|archive-date=October 17, 2010|publisher=IEEE Spectrum|date=13 October 2010}}{{Cite news |url=https://www.cnn.com/2014/11/20/politics/nsa-china-power-grid/index.html |title=Govt: China could take down U.S. power grid |last=Crawford |first=Jamie |work=CNN |access-date=2019-07-01}}{{Cite news |url=https://www.nytimes.com/2019/06/15/us/politics/trump-cyber-russia-grid.html |title=U.S. Escalates Online Attacks on Russia's Power Grid |last1=Sanger |first1=David E. |date=2019-06-15 |work=The New York Times |access-date=2019-07-01 |last2=Perlroth |first2=Nicole |language=en-US |issn=0362-4331}} through flash drives and other means. Besides traditional security risks such as lock-picking and phishing attacks, voting machines are often unattended in public buildings the night before the election.{{Cite web |url=https://freedom-to-tinker.com/2010/11/02/e-voting-links-election-day/ |date=2010-11-02 |title=E-Voting Links for Election Day |last=Felten |first=Ed |website=Princeton's Center for Information Technology Policy |access-date=2020-11-17}} This physical access lets outsiders subvert them.{{Cite news |url=https://www.newyorker.com/news/dispatch/election-hacking-lessons-from-the-2018-def-con-hackers-conference |title=Election-Hacking Lessons from the 2018 Def Con Hackers Conference |last=Halpern |first=Sue |magazine=The New Yorker |date=2018-08-23 |access-date=2019-07-01 |language=en |issn=0028-792X}}

To reduce the risk of flawed Election-Day output, election managers like other computer-dependent managers rely on testing and ongoing IT security. In the field of elections management, these measures take the form of federal certification of the electronic elections system designs,[https://www.eac.gov/voting-equipment/system-certification-process/ Voting Equipment Certification Process], US Election Assistance Commission. though there is no way to know the certified software is what is actually installed; security measures in the local election officials’ workplaces; and pre-election testing.{{cite book |chapter-url = https://www.eac.gov/sites/default/files/event_document/files/Election_Management_Guidelines_-_Chapter_6_Pre-election_and_Parallel_Testing.pdf.pdf |chapter = Pre-election and Parallel Testing |publisher = U.S. Election Assistance Commission |title = Election Management Guidelines |access-date=2020-11-17}}

A third risk-reduction measure is performed after the computer has produced its output: Routinely checking the computers' output for accuracy, or auditing. Outside elections, auditing practices in the private sector and in other government applications are routine and well developed. In the practice of elections administration, however, the Pew Charitable Trusts stated in 2016, “Although postelection audits are recognized as a best practice to ensure that voting equipment is functioning properly, that proper procedures are being followed, and that the overall election system is reliable, the practice of auditing is still in its relative infancy. Therefore, a consensus has not arisen about what constitutes the necessary elements of an

auditing program.”[https://www.pewtrusts.org/~/media/assets/2016/08/epi_methodology.pdf Elections Performance Index Methodology], Pew Charitable Trusts, August 2016. Accessed May 12, 2017.

Routine results audits also support voter confidence by improving election officials' ability to respond effectively to allegations of fraud or error.Confidence in the Electoral System: Why We Do Auditing, Michael W. Trautgott and Frederick G. Conrad, in Confirming Elections: Creating Confidence and Integrity Through Election Auditing, R. Michael Alvarex, Lonna Rae Atkeson, and Thad E. Hall, eds., Palgrave MacMillan, 2012.

In 2012 in Palm Beach County, FL, a routine audit which hand-counted a sample of precincts, changed the outcomes in two Wellington City council contests. Votes in each contest were reported for a different contest. The problem did not occur in the county's other 15 municipalities.{{Cite news |last=Bennett |first=George |date=2012-03-19 |title=Recount shows wrong winners declared in two Wellington election races |work=Palm Beach Post |url=https://www.palmbeachpost.com/article/20120319/NEWS/812037658 |access-date=2022-09-20 |archive-url=https://web.archive.org/web/20210418033950/https://www.palmbeachpost.com/article/20120319/NEWS/812037658 |archive-date=18 April 2021 |url-status=dead}}{{Cite news |last=Bennett |first=George |date=2012-03-31 |title=Wellington election results tossed out, but legal ground uncertain |language=en-US |work=Palm Beach Post |url=https://www.palmbeachpost.com/story/news/2012/03/20/wellington-election-results-tossed-out/7250418007/ |access-date=2022-09-20}}

{{main|Electoral fraud#Tampering with electronic voting systems}}

Computers which tally votes or compile election results are known to have been hacked in the US in 2014{{Cite web |url=https://www.courtlistener.com/recap/gov.uscourts.gand.240678/gov.uscourts.gand.240678.699.10.pdf |title=Supplemental Declaration of Logan Lamb|last=Lamb |first=Logan |date=2020-01-14 |website=CourtListener |access-date=2020-02-03}}

{{Cite web |url=https://coaltionforgoodgovernance.sharefile.com/d-s0dce50c25084f0da |title=Coalition Plaintiffs' Status Report, pages 237-244 |date=2020-01-16 |website=Coalition for Good Governance |access-date=2020-02-03}}

{{Cite news |url=https://apnews.com/39dad9d39a7533efe06e0774615a6d05 |title=Expert: Georgia election server showed signs of tampering |last=Bajak |first=Frank |date=2020-01-16 |work=Associated Press |access-date=2020-02-03}}

and 2016,{{Cite news |url=https://theintercept.com/2017/06/05/top-secret-nsa-report-details-russian-hacking-effort-days-before-2016-election/ |title=Top-Secret NSA Report Details Russian Hacking Effort Days Before 2016 Election |last1=Cole |first1=Matthew |date=2017-06-05 |work=The Intercept |access-date=2020-02-03 |last2=Esposito |first2=Richard |language=en-US |last3=Biddle |first3=Sam |last4=Grim |first4=Ryan}}

{{Cite web |url=https://www.justice.gov/file/1080281/download |title=United States of America v. Viktor Borisovich Netyksho, et al, Indictment, paragraph 77b |date=2018-07-13 |access-date=2020-02-03}}

Ukraine in 2014,{{Cite news |url=https://www.csmonitor.com/World/Passcode/2014/0617/Ukraine-election-narrowly-avoided-wanton-destruction-from-hackers |title=Ukraine election narrowly avoided 'wanton destruction' from hackers |last=Clayton |first=Mark |date=2014-06-17 |work=Christian Science Monitor |access-date=2020-02-03 |issn=0882-7729}}

and South Africa in 1994.{{Cite web |url=http://penguin.bookslive.co.za/blog/2010/10/25/excerpt-from-birth-the-conspiracy-to-stop-the-94-election-by-peter-harris/ |title=Excerpt from Birth: The Conspiracy to Stop the '94 Election by Peter Harris |date=2010-10-25 |website=Penguin SA @ Sunday Times Books LIVE |language=en-US |access-date=2020-02-03}}

{{Cite book |title=Birth : the conspiracy to stop the '94 election |last=Harris |first=Peter|publisher=Umuzi |year=2010 |isbn=978-1-4152-0102-2 |edition=1st |location=Cape Town |oclc=683401576}}

{{Cite news |url=https://www.telegraph.co.uk/news/worldnews/africaandindianocean/southafrica/8084053/Election-won-by-Mandela-rigged-by-opposition.html |title=Election won by Mandela 'rigged by opposition' |last=Laing |first=Aislinn |work=Daily Telegraph |date=2010-10-24 |access-date=2020-02-03 |issn=0307-1235}}

Only the Ukraine hack was disclosed immediately, so regular audits are needed to provide timely corrections.

Confirming that votes were credited to the correct candidates’ totals might seem to be a relatively uncomplicated task, but election managers face several audit challenges not present for managers of other decision-support IT applications. Primarily, ballot privacy prevents election officials from associating individual voters with individual ballots. This makes it impossible for election officials to use some standard audit practices such as those banks use to confirm that ATMs credited deposits to the correct account.

Another challenge is the need for a prompt and irrevocable decision. Election results need to be confirmed promptly, before officials are sworn into office. In many commercial uses of information technology, managers can reverse computer errors even when detected long after the event. However, once elected officials are sworn into office, they begin to make decisions such as voting on legislation or signing contracts on behalf of the government. Even if the official were to be removed because a computer error was discovered to have put that official in office, it would not be possible to reverse all the consequences of the error.

The intermittent nature of elections is another challenge. The number of elections managed by an election authority ranges from two per year (plus special elections) in five US states to one every 4 years (plus by-elections) in parliamentary systems like Canada{{Cite web |url=https://www.elections.ca/content.aspx?section=ele&dir=pas&document=index&lang=e |title=Past elections |website=www.elections.ca |access-date=2019-07-13}} where different election authorities manage national, provincial and municipal elections. This intermittency limits the development of a full-time, practiced workforce, for either the elections[https://web.mit.edu/supportthevoter/www/files/2013/08/Front-Lines-of-Democracy-Who-Staffs-Polling-Places-and-Does-it-Matter-Glaser_Mac-Donald-2007.pdf The Front Lines of Democracy: Who Staffs our Polling Places and Does it Matter?] Bonnie E. Glaser, Karin MacDonald, Iris Hui, and Bruce E. Cain; Election Administration Research Center, University of California at Berkeley. October 2007 or the audits. Turning election audits over to an independent, disinterested professional accounting firm is another option not available to election officials. Because election results affect everyone, including the election officials themselves, truly disinterested auditors do not exist. Therefore, audit transparency is required to provide credibility.

No governing body or professional association has yet adopted a definitive set of best practices for election audits. However, in 2007 a group of election-integrity organizations, including the [https://www.verifiedvoting.org/about/ Verified Voting Foundation], Common Cause, and the Brennan Center for Justice at NYU School of Law collaborated with the American Statistical Association to produce a set of recommended best practices for post-election results audits:

• [https://www.electionaudits.org/bp-transparency.html Transparency]: The public must be allowed to observe, verify, and point out procedural mistakes in all phases of the audit. This requires that audit procedures and standards be adopted, in written form, and made available before the election.
• [https://www.electionaudits.org/bp-independence.html Independence]: While the actual work of post-election audits may be best performed by the officials who conduct the elections, the authority and regulation of post-election audits should be independent of officials who conduct the elections.
• [https://www.electionaudits.org/bp-paper.html Paper Records]: Vote-counting in the audit should be performed with hand-to-eye counts of voter-marked, voter-verified paper ballots.
• [https://www.electionaudits.org/bp-accounting.html Ballot Accounting] (chain of custody, or internal control): The records used in the audit must be verified to be true and complete records of the election.
• [https://www.electionaudits.org/bp-risklimiting.html Confirmation of the correct winners]: The audits must reach statistical confidence that the computer-tabulated results identified the correct winners.
• [https://www.electionaudits.org/bp-discrepancies.html Addressing Discrepancies]: When discrepancies are found, investigation is conducted to determine cause of the discrepancies.
• [https://www.electionaudits.org/bp-comprehensive.html Comprehensive]: The ballot-sample selection process includes all jurisdictions and all ballot types (e.g., absentee, mail-in and accepted provisional ballots).
• [https://www.electionaudits.org/bp-target.html Additional Targeted Samples]: The audit includes a limited non-random sample selected on the basis of factors useful for building voter confidence or improving election management, such as Election-Day problems or preliminary results that deviate significantly from historical voting patterns.
• [https://www.electionaudits.org/bp-bind.html Binding on Official Results]: Post-election audits must be completed before election results are declared official and final, and must either verify or correct the outcome.

India has designed and uses voting machines with one button per candidate. The button, when pressed, prints the selected candidate on a slip of paper (VVPAT), displays it to the voter, drops the slip into a box and tallies a vote for the candidate. The VVPAT is easy for voters to check, since voters only have one vote to cast, for one member of the lower house of Congress. However, there is no way to correct the vote if the VVPAT shows an error.{{Cite news |last=Agarwal |first=Poonam |date=2021-01-31 |title='Redesign EVMs, Facilitate Audits': Experts' Recommendations to EC |work=The Quint |url=https://www.thequint.com/news/india/redesign-evms-vvpats-facilitate-audits-expert-panels-recommendations-to-ec |access-date=2021-11-12}} The software is encoded on the machines' chip in a way that it cannot be examined. Brookings found that India's adoption of voting machines cut paper ballot stuffing noticeably in states with the most election prosecutions, and led to more voting by disadvantaged populations.{{Cite web |last=Somanathan |first=Madhavan |date=2019-04-05 |title=India's electoral democracy: How EVMs curb electoral fraud |url=https://www.brookings.edu/blog/up-front/2019/04/05/indias-electoral-democracy-how-evms-curb-electoral-fraud/ |access-date=2021-11-12 |website=Brookings}}{{Cite web |last=Ravi |first=Shamika |date=2019-12-06 |title=How electronic voting machines have improved India's democracy |url=https://www.brookings.edu/blog/techtank/2019/12/06/how-electronic-voting-machines-have-improved-indias-democracy/ |access-date=2021-11-12 |website=Brookings}} Originally the voting machines lacked a paper trail, and VVPATs were added in 2013-2019 because of doubts about security of unchecked machines.{{Cite news |last=Choudhury |first=Salah Uddin Shoaib |date=2018-08-30 |title=Looking to cheat in Elections! EVM is at your Service |work=Times of Assam |url=https://www.timesofassam.com/articles/looking-to-cheat-in-elections-evm-is-at-your-service/amp/ |access-date=2021-11-12}}

India hand tallies paper VVPATs from a 1.5% sample of election machines on the last evening of voting, before releasing results.Audit procedures start on p.64 of {{Cite web |date=2020-09-29 |title=Manual on Electronic Voting Machine and VVPAT |url=https://old.eci.gov.in/files/file/12297-manual-on-electronic-voting-machine-and-vvpat/?do=download |access-date=2021-11-13 |website=Election Commission of India}} In the April–May 2019 elections, the Election Commission of India hand-tallied the slips of paper from 20,675 voting machines (out of 1,350,000 or 1,730,000 machines) and found discrepancies for 8 machines, usually of four votes or less. Most machines tally over 16 candidates,{{Cite news |date=2019-03-09 |title=What are EVMs, VVPAT and how safe they are |work=Times of India |url=https://timesofindia.indiatimes.com/india/what-are-evms-vvpat-and-how-safe-they-are/articleshow/66969640.cms |access-date=2021-11-08}} and they did not report how many of these candidate tallies were discrepant. They formed investigation teams to report within ten days, were still investigating in November 2019, with no report as of June 2021{{Cite news |last=Nath |first=Damini |date=2019-07-25 |title=ECI sets up teams to probe VVPAT mismatch in Lok Sabha election |work=The Hindu |url=https://www.thehindu.com/news/national/ec-sets-up-teams-to-probe-vvpat-mismatch-in-lok-sabha-election/article28713704.ece |access-date=2021-11-08 |issn=0971-751X}} though the VVPATs themselves were destroyed in September 2019.{{Cite news |last=Agarwal |first=Poonam |date=2020-02-07 |title=Why Did EC Destroy VVPAT Slips of 2019 LS Polls in Such a Hurry? |work=The Quint |url=https://www.thequint.com/news/india/why-did-election-commission-destroy-evm-voting-machine-vvpat-slips-of-2019-lok-sabha-polls |access-date=2021-11-12}} Hand tallies before and after 2019 had a perfect match with machine counts.

Venezuela has direct entry voting machines which tally electronically and also give the voter a printed paper with the votes, a Voter-verified paper audit trail (VVPAT). The voter puts the paper in a ballot box corresponding to that machine.{{Cite news |last=Rogero |first=Tiago |date=2024-08-10 |title=How Venezuela’s opposition proved its election win: ‘A brilliant political move’ |url=https://www.theguardian.com/world/article/2024/aug/10/gonzalez-proof-win-venezuela-election-vote-tally-maduro |access-date=2024-08-12 |work=The Observer |language=en-GB |issn=0029-7712}}{{Cite web |date=2024-07-30 |title=Little-known paper sheets are key to declaring victory in Venezuela's election |url=https://apnews.com/world-news/general-news-24358044cea98b3ce4f6a316bdbd3508 |access-date=2024-09-02 |website=AP News |language=es}}

A bipartisan team of experts certifies the software just before the election, and obtains a hash code to identify the correct software.{{Cite web |date=2021-12-03 |title=PRELIMINARY REPORT THE CARTER CENTER INTERNATIONAL ELECTORAL EXPERT MISSION Regional and Local Elections, Venezuela 2021 |url=https://www.cartercenter.org/resources/pdfs/news/peace_publications/election_reports/venezuela-preliminary-report-120321.pdf |website=Carter Center}}

At the end of election day a random sample of machines is chosen, the paper is counted publicly, compared to the machine totals for each candidate, and an audit report is given to the top two candidates' representatives, and to the military to take to the National Electoral Council (Venezuela).{{Cite web |date=2024-08-09 |title=INTERIM REPORT UN Panel of Experts – Venezuelan Presidential Elections 28 July 2024 |url=https://news.un.org/en/sites/news.un.org.en/files/atoms/files/Interim_Report_PoE_Venezuela_090824.pdf |website=United Nations}} Nationally 30% to 55% of machines are checked in this way on election night.{{Cite web |last=Kronick |first=Dorothy |date=2024-08-22 |title=On the validity of vote counts published by the Venezuelan opposition |url=https://dorothykronick.com/28J.pdf |access-date=2024-09-02}}

In 2024 the opposition was not allowed to be present at many of the voting stations for the audit, and challenged the results.{{Cite web |last=Buschschlüter |first=Vanessa |date=2024-07-29 |title=Venezuela election: Maduro declared winner in disputed vote |url=https://www.bbc.com/news/articles/cz5rj2mzgevo |access-date=2024-07-29 |website=www.bbc.com |language=en-GB}} They said they had won based on results from 83% of polling places. They posted the results online and convinced foreign governments, while the Electoral Council did not post its tallies.{{Cite web |last=Goodman|first=Joshua and Regina Garcia Cano|date=2024-07-29 |title=Venezuela president, opposition in election stand-off |url=https://au.news.yahoo.com/venezuelans-await-results-presidential-election-002519900.html |access-date=2024-07-29 |website=Australian Associated Press |language=en-GB}}

File:State audits.png

Only three US states and parts of three other states audit all contests on all ballots, to have an independent check whether all large and small contests were counted accurately. GA, MD and SC hire a company to re-analyze scans of the ballots. The scans were made by the original election equipment, so the audits have a risk of inaccurate scans. In FL, NH and VT, all ballots are rescanned and reanalyzed in some counties or towns. In these three states, ballots are stored at least briefly before rescanning, so they have a risk that ballots could be altered in storage.

Eight states do not require audits. This number includes IN, KY, OK where audits are optional, LA which has an audit law but lacks paper ballots, and AL, ME, MS, ND, which have no audit laws.

Other states check paper ballots which have been in storage until the audit for days or weeks, so they have a risk of ballots altered in storage. Two US states hand-tally a representative sample of stored ballots, tally all contests on those ballots, and make corrections in official results if needed: PA and WV. Two more states hand-tally all contests on a representative sample of all ballots, so they can check official results, though not necessarily correcting them if that were needed: DE, UT. In PA, UT and WV sample sizes are usually adequate for state-wide contests, but not for close county and local results. All state assembly districts and local governments have a chance of being covered and audited, and they also have a chance of being missed entirely by these random samples of precincts and election machines.

NY checks if election machines performed as expected, not whether they captured voter intent, so circles and checkmarks outside target areas are not checked by the audit.{{Cite web |author=New York State Board of Elections |date=2009-06-22 |title=Audit Procedure for 6210.18 |url=http://www.wheresthepaper.org/SBOEaudit_ver8June22_09.htm |access-date=2022-02-13 |website=www.wheresthepaper.org}} Two other states hand-tally all contests, but the samples exclude significant groups of ballots: AK excludes small precincts; CA excludes ballots processed after election night (a third).{{efn |name=steinberg}} For the two thirds of ballots audited, California does ensure that all contests are covered; they add precincts or machines to the initial sample, to ensure they sample at least some ballots from every contest. Most of the other states check only a few contests, so errors are not measured in most contests.

Considering the recommended best practices above, two states (DC, MA) allow public observation of all steps; several states (MD, NH, NM, RI, SC, VT) have audits done or contracted by the Secretary of State, which is partly independent of election day procedures; 18 states hand-count; six states (CO, MD, NC, NM, RI, VA) have good samples for statistical confidence; no states have ways to recover from discrepancies in the chain of custody; other issues are listed in the table below.

Computerization of elections occurred rapidly in the United States following the presidential election of 2000, in which imprecise vote-counting practices played a controversial role, and the subsequent adoption of the Help America Vote Act (HAVA) of 2002. The rapid switch to computerized vote tabulation forced election officials to abandon many pre-automation practices that had been used to verify vote totals, such as the redundancy included in valid hand-counting procedures.

Other state variations. Only DC requires that observers be able to see ballots being audited well enough to discern voter's marks. Three states have rules for what happens when stored ballots are missing: CO-Missing ballots are treated as being cast for all the losers in risk level calculations; MI and NC-no audit.

File:Colorado 2017 elections.png

{{main|Risk-limiting audit}}

Risk-limiting audits are required in Colorado, North Carolina, Rhode Island and Virginia. These store voting machines' interpretation of each ballot (cast vote record), collect them centrally over the internet, re-tally them with an independent computer to check totals, and hand-check a sample of the stored paper ballots to check voting machines' interpretations. Samples are big enough to be sure results are accurate, up to an acceptable level of risk, such as 9%. For each audited contest, if the original computer interpretations identified the wrong winner, there is a 9%{{Cite web |url=https://www.sos.state.co.us/pubs/elections/RLA/files/2017/round_1/state_report.xlsx |title=State Audit Report |date=2017-11-20 |website=www.sos.state.co.us |publisher=Colorado Secretary of State |access-date=2018-04-09}}

chance in Colorado that the audit will miss it,{{Cite journal |last1=Lindeman |first1=Mark |last2=Stark |first2=Philip B. |date=2012-03-16 |title=Gentle Introduction to Risk-limiting Audits |journal=IEEE Security and Privacy |issue=Special issue on electronic voting |url=https://www.stat.berkeley.edu/~stark/Preprints/gentle12.pdf |via=University of California at Berkeley |pages=1, 3}} and the wrong winner will take office. A lower risk limit would let fewer errors through, but would require larger sample sizes. Close contests also require larger sample sizes. Colorado audits only a few contests, and audits none of the closest contests, which need the biggest samples. Auditing all contests would require several counties to hand-count thousands of ballots each.

If the samples do not confirm the initial results, more rounds of sampling may be done, but if it appears the initial results are wrong, risk-limiting audits require a 100% hand count to change the result, even if that involves hand-counting hundreds of thousands of ballots.{{Cite report |url=https://www.stat.berkeley.edu/~stark/Preprints/RLAwhitepaper12.pdf |title=Risk-Limiting Post-Election Audits: Why and How |editor1=Mark Lindeman |editor2=Jennie Bretschneider |editor3=Sean Flaherty |editor4=Susannah Goodman |editor5=Mark Halvorson |editor6=Roger Johnston |editor7=Ronald L. Rivest |editor8=Pam Smith |editor9=Philip B. Stark |date=October 2012 |via=University of California at Berkeley |pages=3, 16 |access-date=2018-04-09}}

Colorado notes that they have to be extremely careful to keep ballots in order, or they have to number them, to be sure of comparing the hand counts with the machine records of those exact ballots.{{Cite web |url=https://bowencenterforpublicaffairs.org/wp-content/uploads/2017/06/Risk-Limiting-Audit-Presentation.pdf |archive-url=https://web.archive.org/web/20180406103901/http://bowencenterforpublicaffairs.org/wp-content/uploads/2017/06/Risk-Limiting-Audit-Presentation.pdf |url-status=usurped |archive-date=April 6, 2018 |title=Colorado Risk-Limiting Audit:Conception to Application |author1=Jerome Lovato |author2=Danny Casias |author3=Jessi Romero |website=Bowen center for Public Affairs and Colorado Secretary of State |access-date=2018-04-05}} Colorado says it has a reliable system to re-tally the records, but it is not yet publicly documented.{{Cite web |url=https://www.sos.state.co.us/pubs/elections/VotingSystems/riskAuditFiles/NotesOnStatistics-2018ColoradoPrimariesElectionAudit.pdf |title=Comments re statistics of auditing the 2018 Colorado elections |author1=Mark Lindeman |author2=Ronald L. Rivest |author3=Philip B. Stark |author4=Neal McBurnett |date=2018-01-03 |website=Colorado Secretary of State |access-date=2018-04-09}}

In 2010, the American Statistical Association endorsed risk-limiting audits, to verify election outcomes.[https://www.amstat.org/asa/files/pdfs/POL-Risk-Limiting_Endorsement.pdf Statement on Risk-limiting Auditing], American Statistical Association, April 2010. Accessed May 12, 2017 With use of statistical sampling to eliminate the need to count all the ballots, this method enables efficient, valid confirmation of the outcome (the winning candidates). In 2011, the federal Election Assistance Commission initiated grants for pilot projects to test and demonstrate the method in actual elections.[https://www.eac.gov/sites/default/files/eac_assets/1/28/AUDIT%20PILOT%20FINAL%20REPORT%20TO%20EAC%20FINAL.pdf Post-Election Risk-Limiting Audit Pilot Program 2011-2013], Final Report to the United States Election Assistance Commission, California Secretary of State 2013. Accessed November 17, 2020 In 2014, the Presidential Commission on Election Administration recommended the method for use in all jurisdictions following all elections, to reduce the risk of having election outcomes determined by undetected computer error or fraud.[https://www.documentcloud.org/documents/1008230-amer-voting-exper-final-1.html The American Voting Experience: Report and Recommendations of the Presidential Commission on Election Administration], January 2014 In 2017, [https://www.denverpost.com/2017/11/22/colorado-election-audit-complete/ Colorado became the first state to implement] risk-limiting audits statewide as a routine practice during the post-election process of certifying election results.

File:Ballot-foia.png

File:Keepimages.png

Humboldt County [https://electionstransparencyproject.com/ Elections Transparency Project], [https://www.clearballot.com/ Clear Ballot], and [http://www.trueballot.com/trueballot.aspx TrueBallot] scan all ballots with a commercial scanner, so extensive audits can be done on the scans without damaging paper ballots, without hand-counting, by multiple groups, independently of the election software.{{Cite journal |last=Stark |first=Philip B. |date=2010 |title=Super-Simple Simultaneous Single-Ballot Risk-Limiting Audits |url=https://www.usenix.org/legacy/events/evt/tech/full_papers/Stark.pdf |journal=Proceedings of the 2010 Electronic Voting Technology Workshop / Workshop on Trustworthy Elections |via=(EVT/WOTE ’10). USENIX.}}

Clear Ballot is certified by the US Election Assistance Commission for voting,{{Cite web |url=https://www.eac.gov/voting-equipment/clearvote-14/ |title=Voting System, US Election Assistance Commission |website=www.eac.gov |access-date=2018-04-10}}

and they also have an auditing system, ClearAudit. TrueBallot does not currently serve government elections, just private groups. Both use proprietary software, so if it were hacked at the vendor or locally to create false images of the ballots or false counts, then local officials and the public could not check it.

The "Brakey method" is an approach using electronic ballot images already created by most current US election systems.{{Cite web |url=https://blackboxvoting.org/the-brakey-method/ |title=Actions: The Brakey Method |website=BlackBoxVoting.org |access-date=2018-04-06}} These ballot images could be hacked if the election software itself is hacked,{{Cite web |url=https://www.verifiedvoting.org/wp-content/uploads/2020/08/ESS-red-team-CA-2016-1.pdf |last=Stauffer |first=Jacob |date=2016-11-04 |title=Vulnerability & Security Assessment Report Election Systems &Software's Unity 3.4.1.0 |website=Verified Voting |access-date=2020-11-17}} either at the vendor or elsewhere, so for full security, ballot images need to be checked against the paper ballots, to determine if the images are accurate. To enable this one to one ballot-image comparison, the Brakey Method requires that the ballot images be linkable to their paper ballots, either by keeping paper ballots in the same order as the scans, or through a unique identifier that appears on both digital image and physical ballot.

Independent systems to tally ballot images include Audit Engine,{{Cite news |last=Hertz |first=Noah |date=2021-08-28 |title=Ballot auditor: Volusia County supervisor of elections did a good job |work=West Volusia Beacon |url=https://beacononlinenews.com/2021/08/28/ballot-auditor-volusia-county-supervisor-of-elections-did-a-good-job/ |access-date=2021-09-29}}

{{Cite news |last=Stone |first=Ken |date=2021-09-09 |title=El Cajon Democrat Wants Every Election in America Audited, Starts with 4 States |work=Times of San Diego |url=https://timesofsandiego.com/politics/2021/09/08/el-cajon-democrat-wants-every-election-in-america-audited-starts-with-4-states/ |access-date=2021-09-29}}

{{Cite news |last=Rosenfeld |first=Stephen |date=2021-05-12 |title=Election Audit in Arizona Under DOJ Scrutiny |work=LA Progressive |url=https://www.laprogressive.com/election-audit-arizona/ |access-date=2021-09-29}}

Free and Fair,{{Cite web |date=2017-05-17 |title=Open and Free Election Technology |url=https://freeandfair.us/blog/open-free-election-technology/ |access-date=2021-09-29 |website=Free & Fair}}

OSET Institute (under development),{{Cite news |last=Sutner |first=Shaun |title=Voting fraud technology could play role in momentous election |work=Tech Target |url=https://searchcio.techtarget.com/news/252491340/Voting-fraud-technology-could-play-role-in-momentous-election |access-date=2021-09-29}}

{{Cite web |title=Real Results |url=https://www.osetfoundation.org/what |access-date=2021-09-29 |website=OSET Institute - Open Source Election Technology}}

and the Elections Transparency Project, as used in Humboldt County, California, a medium-sized county with 58,000 ballots in the 2016 general election.{{Cite web |url= https://elections.cdn.sos.ca.gov/sov/2016-general/ssov/pres-summary-by-county.pdf |title=California Supplement to the Statement of Vote, Statewide Summary by County for President |website=elections.cdn.sos.ca.gov }}

Humboldt uses a commercial scanner to scan all ballots and puts them in a digitally signed file, so true copies of the file can be reliably identified. Ballots with identifying marks are first hand-copied by election staff, to anonymize them, since they are valid under California law.{{Cite web |url=https://codes.findlaw.com/ca/elections-code/elec-sect-15154.html |title=California Code, Elections Code - ELEC § 15154 |website=Findlaw |access-date=2018-04-24}}

The scanner prints a number on each ballot before scanning it, so the scan can be checked against the same physical ballot later if needed. The project has written open source software (Trachtenburg Election Verification Software, TEVS) to read the files, and they check all contests on all ballots to see if official counts are correct. The first time they scanned and checked, in 2008, they found 200 missing ballots, showing the value of complete checks.{{Cite magazine |url=https://www.wired.com/2008/12/unique-transpar/ |title=Unique Transparency Program Uncovers Problems with Voting Software |last=Zetter |first=Kim |date=2008-12-08 |magazine=WIRED |access-date=2018-04-06}} Other jurisdictions can similarly scan ballots and use Humboldt's software or their own to audit all contests. They need to ensure their in-house counting software is secure and independent of any bugs or hacks in the election software, just as users of risk-limiting audits do.

Reading these scans, with software independent of the election system, is a practical way to audit a large number of close contests, without large hand counts. Scans are also the only practical way to bypass problems of physical security, if paper ballots are scanned, digitally signed, and the resulting electronic records are verified against a sample of paper ballots, as ballots arrive. Scans can be made and digitally signed before ballots are stored, while other audit methods are too slow to do election night. Scanners can process thousands of ballots per hour, and several scanners can operate simultaneously in larger jurisdictions. Once ballots are scanned and a digital signature is published, electronic records can be tallied at any convenient time.

Humboldt and several other jurisdictions have gone beyond this internal approach, and release the digitally signed files of ballot images to the public, so others can use their own software, independent of the election system and officials, to check all contests on all ballots.{{Cite web |url=https://electionstransparencyproject.com/ |title=The Elections Transparency Project |website=The Elections Transparency Project |access-date=2020-11-17}}

{{Cite web|last=Trachtenberg|first=Mitch|title=Humboldt County Election Transparency Project |url=https://sfgov.org/electionscommission/ftp/meetingarchive/www.sfgov2.org/Modules/Humboldt%20Cty%20September%2015-documentid=162.pdf |website=San Francisco Elections Commission |access-date=2018-04-05}}

{{Cite web |url=https://dickatlee.com/issues/elections/evote/pdfs/EAC_Grant_TEVS_Docs_1.pdf |title=The Humboldt County Election Transparency Project and TEVS |last=Trachtenberg |first=Mitch |date=2013-07-29 |website=Report for Elections Advisory Commission |access-date=2018-04-05}} Public release lets losing candidates who mistrust the election officials' security measures do their own checks. Humboldt County believes the scans give their citizens high confidence in the county election results.

{{main|Election recount}}

Recounts may be considered to be a specific type of audit, but not all audits are recounts. The Verified Voting Foundation explains the difference between audits and recounts: Post-election audits are performed to “routinely check voting system performance…not to challenge to the results, regardless of how close margins of victory appear to be", while "recounts repeat ballot counting (and are performed only) in special circumstances, such as when preliminary results show a close margin of victory. Post-election audits that detect errors can lead to a full recount.”[https://www.eac.gov/sites/default/files/eac_assets/1/28/VerifiedVoting-Post-Election-Audits.pdf Post-election Audits], Verified Voting Foundation, undated. Accessed November 17, 2020. In the US, recount laws vary by state, but typically require recounting 100% of the votes, while audits may use samples. Recounts incorporate elements of both results and process audits.

File:Election Samples.png

Hand and machine counts. Current audits in most states involve counting paper ballots by hand, but some states re-use the same machines used in the election. Three states use different machines, to provide some independent check.

Sample sizes. When states audit, they usually pick a random sample of 1% to 10% of precincts to recount by hand or by machine. If a precinct has more than one machine, and they keep ballots and totals separate by machine, they can draw a sample of machines rather than precincts and count all ballots processed by that machine. These samples can identify systematic errors widely present in the election. They have only a small chance of catching a hack or bug which was limited to a few precincts or machines, even though that could change the result in close contests.

Number of contests. In the random sample, most states audit only a few contests, so they can only find problems in those contests.

{{further|Physical security}}

Paper ballots and computer files need to be kept securely in case they are needed for recounts, audits or protests. North Carolina specifies that no audit is done if ballots are missing or damaged.

Ballots are at risk when being transported from drop boxes and polling places to central locations, and may be protected by GPS tracking,{{Cite news |last=Santos |first=Melissa |date=2020-08-19 |title=Security and ballot drop boxes: How it works in WA |work=Crosscut |url=https://crosscut.com/politics/2020/08/security-and-ballot-drop-boxes-how-it-works-wa |access-date=2021-03-03}} guards, security systems,{{efn |Truckers have developed high security systems for valuable shipments.{{Cite news |last=Buckley |first=Thomas |date=2021-03-02 |title=Vaccine Shipments Present a Security Challenge Worthy of a James Bond Film |work=Bloomberg.com |url=https://www.bloomberg.com/news/articles/2021-03-02/covid-vaccine-delivery-gets-extreme-secrecy-and-security |access-date=2021-03-03}}}}

and/or a convoy of the public.{{efn |Experts recommend letting different party members ride in the ballot transport vehicle, letting other observers accompany the vehicle, and using guards when needed.{{Cite web |title=Securing Ballot Boxes During Transportation |website=aceproject.org |url=http://aceproject.org/ace-en/topics/vc/vcf/vcf02/vcf02a |access-date=August 12, 2019}} Ballots have fallen from trucks during transport.{{Cite news |title=South Africa: Most Mpumalanga Ballot Papers Recovered |url=https://allafrica.com/stories/200904220004.html |date=April 22, 2009 |work=AllAfrica |access-date=August 15, 2019}}{{Cite news |last=King |first=Colbert |date=September 9, 2006 |title=A Ballad of the Ballot Follies in D.C. |newspaper=Washington Post |url=https://www.washingtonpost.com/archive/opinions/2006/09/09/a-ballad-of-the-ballot-follies-in-dc/c5352b4b-99ba-4d20-9eff-eb6573184069/ |access-date=August 15, 2019 |issn=0190-8286}}}}

Security recommendations include preventing access by anyone alone, which would typically require two hard-to-pick locks, and having keys held by independent officials if such officials exist in the jurisdiction; having storage risks identified by people other than those who design or manage the system; and using background checks on staff.

Insider threats and the difficulty of following all security procedures are usually under-appreciated, and most organizations do not want to learn their vulnerabilities.{{Cite web |url=http://losspreventionmedia.com/insider/retail-security/physical-security-threats-and-vulnerabilities/ |title=Physical Security Threats and Vulnerabilities{{Snd}} LPM |last=Seivold |first=Garett |date=April 2, 2018 |website=losspreventionmedia.com |access-date=April 24, 2018}} When a contractor found poor security at county buildings in Iowa, the state ordered no more testing of security.{{Cite magazine |last=Greenberg |first=Andy |date=2020-08-05 |title=Inside the Courthouse Break-Ins that Landed 2 White Hat Hackers in Jail |magazine=Wired |url=https://www.wired.com/story/inside-courthouse-break-in-spree-that-landed-two-white-hat-hackers-in-jail/ |access-date=2020-08-09 |issn=1059-1028}}

No US state has adequate laws on physical security of the ballots,{{Cite book |author1=Krimmer, Robert |author2=Volkamer, Melanie |author3=Braun Binder, Nadja |author4=Kersting, Norbert |author5=Driza Maurer, Ardita |author6=Dueñas-Cid, David |author7=Kulyk, Oksana |author8=Schürmann, Carsten |author9=Vinkel, Priit |author10=Pereira, Olivier |author11=Loeber, Leontine |url=https://www.researchgate.net/publication/320618317 |title=Electronic voting: second International Joint Conference, E-Vote-ID 2017, Bregenz, Austria, October 24–27, 2017, proceedings |year=2017 |isbn=9783319686875 |location=Cham, Switzerland |publisher=Springer |pages=122 |oclc=1006721597}}

and few localities do.{{Cite web |quote=RLAs require paper ballots or records, and a degree of chain-of-custody over ballots that few states and local jurisdictions currently require. |author=((Ad Hoc Committee for 2020 Election Fairness and Legitimacy)) |date=2020-04-28 |title=Fair Elections During a Crisis: Bipartisan and Diverse Blue-Ribbon Group of Scholars and Thinkers Releases Report on Urgent Changes Needed for November U.S. Elections |url=https://www.law.uci.edu/news/press-releases/2020/fair-elections-report.html |access-date=2022-05-16 |website=U of California, Irvine}}

During transport ballots are not necessarily locked or accompanied by two people.{{Cite news |last=MacLauchlan |first=John |last2=Taylor |first2=Ivan |date=2024-10-29 |title=Miami-Dade elections worker fired after ballots fall from truck, sparking voter concerns - CBS Miami |url=https://www.cbsnews.com/miami/news/miami-dade-ballots-found-on-the-side-of-a-road-worker-fired/ |access-date=2024-12-06 |work=CBS |language=en-US}}

Emergency evacuations can leave polling places and documents unattended.{{Cite news |last=Winer |first=Tom, Michael Kosnar, Jon Schuppe and Dan De Luce |date=2024-11-06 |title=Hoax bomb threats made to dozens of polling locations in swing states |url=https://www.nbcnews.com/politics/2024-election/hoax-bomb-threats-made-dozens-polling-locations-swing-states-rcna178889 |access-date=2024-12-06 |work=NBC |language=en}}

Auditing in the US is done several days after the election, so paper ballots and computer files need to be stored securely. 2008 guidelines for audits included starting audits as soon as possible after the election.{{Cite web |quote=as soon as possible after the initial tallies |title=Best Practices: Chain of Custody and Ballot Accounting |author1=Mark Lindeman |author2=Mark Halvorson |author3=Pamela Smith |author4=Lynn Garland |author5=Vittorio Addona |author6=Dan McCrea |date=September 2008 |url=https://electionaudits.org/files/bestpracticesfinal_0-2008.pdf |website=ElectionAudits.org |access-date=April 9, 2018}}

2018 guidelines recommend waiting until all ballots are counted, which in the US means one or more weeks until provisional ballots are adjudicated.{{efn |"Starting to audit only when all the audit units have already been counted is the most straightforward method."{{Cite web |date=2018 |url=https://electionaudits.org/files/Audit%20Principles%20and%20Best%20Practices%202018.pdf |title=Principles and Best Practices for Post-Election Tabulation Audits |website=ElectionAudits.org |access-date=August 12, 2019}}}}

A faster start for the audit makes it feasible for independent parties to guard storage sites.{{efn |Organisation for Security and Cooperation in Europe (OSCE) policy calls for independent foreign officials to sleep with ballots, and allows parties to do so.

• {{Cite web |url=https://www.refworld.org/docid/3ae6a6e84.html |title=Municipal Elections in Bosnia and Herzegovina |last=International Crisis Group (ICG) |date=September 10, 1997 |website=RefWorld |access-date=August 12, 2019}}
• {{Cite web |url=http://www.ohr.int/?p=14231&print=pdf |title=OHR SRT News Summary, September 7, 1998 |date=September 7, 1998 |website=Office of the High Representative (Bosnia+Herzegovina) |access-date=August 12, 2019}}

Turkish opposition sleeping with ballots,

• {{Cite news |url=https://ahvalnews.com/local-elections/turkeys-opposition-sleeping-beside-ballots-safeguard-democracy |title=Turkey's opposition sleeping beside ballots to safeguard democracy |date=April 4, 2019 |work=Ahval|access-date=August 12, 2019}}
• {{Cite news |url=https://www.nytimes.com/2019/04/01/world/europe/turkey-erdogan-election-loss.html |title=A Political Quake in Turkey as Erdogan's Party Loses in His Home Base of Support |last=Gall |first=Carlotta |date=April 1, 2019 |work=The New York Times |access-date=August 12, 2019 |issn=0362-4331}}

Republicans guarded warehouse of voted ballots in 2000 in Florida and had state police lock up ballots in New Mexico.

• {{Cite web |url=https://adst.org/2016/10/2000-presidential-election-florida-recount/ |title=The 2000 Presidential Election – The Florida Recount |last=Cobb |first=Sue |date=2016-10-17 |website=Association for Diplomatic Studies & Training |access-date=2020-03-11}}
• {{Cite news |last=Baker |first=Deborah |url=https://www.abqjournal.com/elex/apvotes10-31-04.htm |title=Contentious 2000 Election Closest in N.M. History |date=2004-10-31 |agency=Associated Press |via=Albuquerque Journal |access-date=2020-03-11 |url-status=dead |archive-date=2004-11-09 |archive-url=https://web.archive.org/web/20041109112159/https://www.abqjournal.com/elex/apvotes10-31-04.htm}}}}

Physical security of stored paper ballots is particularly important between the time the random sample is selected and when the corresponding ballots are examined, to prevent adjusting the ballots to match erroneous electronic records. Neither Colorado nor California has any limit on how much time can pass.{{Cite web |date=2020-08-21 |title=2 CCR § 20124 |website=California Code of Regulations |url=https://govt.westlaw.com/calregs/Document/IA23A71F6FD4E4C81A92F242B4DCC656B?originationContext=document&transitionType=StatuteNavigator&needToInjectTerms=False&viewType=FullText&contextData=%2528sc.Default%2529 |access-date=2020-09-03}}

Michigan allows two weeks from the time the sample is identified to the time local election officials must audit them.{{Cite web |title=SOS - Statewide risk-limiting election audit process to begin at 11 a.m. |url=https://www.michigan.gov/sos/0,4670,7-127-93094-549191--,00.html |access-date=2021-01-26 |website=www.michigan.gov}}

Britain,{{Cite news |url=http://theconversation.com/explainer-how-britain-counts-its-votes-41265 |title=Explainer: how Britain counts its votes |last=Game |first=Chris |date=May 7, 2015 |work=The Conversation |access-date=August 16, 2019}} {{Cite news |title=How votes are counted on election night |last=Keaveney |first=Paula |date=June 8, 2017 |url=http://theconversation.com/how-votes-are-counted-on-election-night-78863 |work=The Conversation |access-date=August 16, 2019}} Canada,{{Cite web |url=https://lop.parl.ca/About/Parliament/Education/ourcountryourparliament/html_booklet/elections-e.html |title=Elections, Our Country, Our Parliament |website=lop.parl.ca |access-date=August 16, 2019}} France,{{Cite news |url=https://www.vie-publique.fr/decouverte-institutions/citoyen/participation/voter/bureau-vote/qu-est-ce-qu-depouillement.html |title=Qu'est-ce qu'un dépouillement ?{{Snd}} Comment se déroule une journée dans un bureau de vote ? Découverte des institutions{{Snd}} Repères{{Snd}} vie-publique.fr |date=January 14, 2018 |access-date=August 16, 2019 |language=fr}} Germany,{{Cite web |url=https://wahlhelfer.muelheim-ruhr.de/m%C3%BClheim/wahllexikon/stimmenausz%C3%A4hlung/372 |title=Stimmenauszählung |date=2019 |website=Mülheim an der Ruhr |access-date=August 17, 2019|language=de}} Spain{{Cite news |url=https://www.elconfidencial.com/elecciones-generales/2019-04-28/escrutinio-recuento-votos-urnas-papeletas-28a_1950082/ |title=¿Qué es el escrutinio y cómo se cuentan los votos en las elecciones generales 2019? |date=April 28, 2019 |work=El Confidencial |access-date=August 17, 2019 |language=es}} and Section 14 of the law:{{Cite web |url=http://www.juntaelectoralcentral.es/cs/jec/normativa/estatal?idLeyJunta=1&template=Loreg/JEC_Contenido |title=Ley Orgánica 5/1985, de 19 de Junio, del régimen electoral general. SECCIÓN 14.ª ESCRUTINIO EN LAS MESAS ELECTORALES |website=www.juntaelectoralcentral.es |access-date=August 17, 2019}} and other countries count all ballots on election night, including final decisions on questionable ballots, so final counts happen before ballots go into storage. Canada{{Cite news |url=https://globalnews.ca/news/4197411/electronic-voting-elections-ontario/ |title=Electronic voting machines expected to speed up voting, ballot counting: Elections Ontario |last=Casey |first=Liam |date=May 9, 2018 |work=Global News |access-date=August 16, 2019}} and France{{Cite web |url=https://presidentielle2017.conseil-constitutionnel.fr/tout-savoir/etre-electeur-voter/regles-applicables-bureaux-de-vote-dotes-dune-machine-a-voter/ |title=Quelles sont les règles applicables dans les bureaux de vote dotés d'une machine à voter ? - Conseil constitutionnel présidentielle 2017 |website=presidentielle2017.conseil-constitutionnel.fr |access-date=August 16, 2019}} sometimes use election machines with paper trails. In these cases risk-limiting audits could be done as soon as results are announced on election night.

If audits cannot be done on election night, creating and verifying a paper or electronic backup of the paper ballots on election night, or the next day as in Florida,{{Cite news |url=https://www.wctv.tv/content/news/Leon-County-among-Florida-precincts-to-implement-Clear-Audit-for-elections-480847661.html |title=Leon County among Florida precincts to implement Clear Audit for elections |last=Stofan |first=Jake |date=April 25, 2018 |work=WCTV |access-date=August 17, 2019}} would provide an alternative benchmark if flaws are later discovered or suspected in the primary storage of paper ballots. Electronic copies in particular can be stored in safes or safe deposit boxes and/or distributed widely, with hash codes to ensure reliability.{{Cite journal |last=Burke |first=Paul |date=2018 |title=Scanners, Hashes, and Election Security |url=http://rbsekurity.com/JPS%20Archives/JPS%2011(1).pdf |journal=J of Physical Security |volume=11 |pages=1–19 |via=RBSekurity}}

Election storage often uses tamper-evident seals,{{Cite web |url=https://www.eac.gov/assets/1/6/260.pdf |title=Chapter 3. PHYSICAL SECURITY |website=US Election Assistance Commission |access-date=April 24, 2018 |archive-date=March 27, 2017 |archive-url=https://wayback.archive-it.org/all/20170327214637/https://www.eac.gov/assets/1/6/260.pdf |url-status=dead }} although seals can typically be removed and reapplied without damage, especially in the first 48 hours. Photos taken when the seal is applied can be compared to photos taken when the seal is opened.{{Cite web |url=https://www.stat.berkeley.edu/~stark/Preprints/lhc18.pdf |title=An Introduction to Risk-Limiting Audits and Evidence-Based Elections Prepared for the Little Hoover Commission |last=Stark |first=Philip |date=July 26, 2018 |website=University of California, Berkeley |access-date=August 16, 2019}} Detecting subtle tampering requires substantial training.{{Cite news |url=http://www.alu.army.mil/alog/issues/JulAug12/Choose_Use_Seals.html |archive-url=https://web.archive.org/web/20130224233221/http://www.alu.army.mil/alog/issues/JulAug12/Choose_Use_Seals.html |url-status=dead |archive-date=February 24, 2013 |title=How to Choose and Use Seals |last=Johnston |first=Roger G., and Jon S. Warner |date=July 31, 2012 |work=Army Sustainment |access-date=May 4, 2018}}{{Cite report |author=Coherent Cyber |publisher=Freeman, Craft, McGregor Group |date=August 28, 2017 |title=Security Test Report: ES&S Electionware 5.2.1.0 |url=http://votingsystems.cdn.sos.ca.gov/vendors/ess/evs5210/ess5210-sec.pdf |pages=9 |via=California Secretary of State}}{{Cite report |last=Stauffer |first=Jacob |date=November 4, 2016 |title=Vulnerability & Security Assessment Report Election Systems & Software's Unity 3.4.1.0 |url=https://www.verifiedvoting.org/wp-content/uploads/2017/07/ESS-red-team-CA-2016.pdf |publisher=Freeman, Craft, MacGregor Group for California Secretary of State}} Election officials usually take too little time to examine seals, and the public is too far away to check seal numbers, though they could compare old and new photos projected on a screen. Seal numbers and photos would need their own secure storage.

When seals break, staff do not necessarily retest or replace the sealed items.{{Cite news |date=2024-11-05 |title=Milwaukee recounts 30,000 ballots due to tabulation issue; city workers called in to help |url=https://www.tmj4.com/america-votes/milwaukee-forced-to-recount-30-000-ballots-due-to-tabulation-error |access-date=2024-12-06 |language=en}} Seals over USB ports came open on 13 scanners in Milwaukee in 2024.{{Cite news |last=Wise |first=David |date=2024-11-06 |title=Milwaukee firefighters help re-run ballots after tabulators found unsecured |url=https://www.wispolitics.com/2024/milwaukee-firefighters-help-re-run-ballots-after-tabulators-found-unsecured/ |access-date=2024-12-06 |language=en-US}}

Experienced testers can usually bypass all physical security systems. Locks{{efn |Lockpicking is widely taught and practiced:{{Cite news |last=Vanderbilt |first=Tom |date=March 12, 2013 |url=https://slate.com/human-interest/2013/03/locksport-the-strange-things-that-happen-at-a-lock-picking-convention.html |title=The Strange Things That Happen at a Lock-picking Convention |access-date=August 15, 2019}} Different techniques apply to electronic locks:{{Cite news |url=https://www.reuters.com/article/us-locks-cyber-exclusive-idUSKCN1UW26Z |title=Exclusive: High-security locks for government and banks hacked by researcher |last=Menn |first=Joseph |date=August 6, 2019 |work=Reuters |access-date=August 16, 2019}}{{Cite magazine |last=Greenberg |first=Andy |date=August 29, 2017 |url=https://www.wired.com/2017/08/the-hotel-hacker/ |title=Inside an Epic Hotel Room Hacking Spree |magazine=Wired |access-date=August 16, 2019 |issn=1059-1028}} There are no statistics on how often criminals enter rooms undetected, but law enforcement often does so, so ability to enter rooms undetected is widespread:{{Cite web |last=Tien |first=Lee |date=October 26, 2014 |url=https://www.eff.org/deeplinks/2014/10/peekaboo-i-see-you-government-uses-authority-meant-terrorism-other-uses |title=Peekaboo, I See You: Government Authority Intended for Terrorism is Used for Other Purposes |website=Electronic Frontier Foundation |access-date=August 15, 2019}}}} and cameras{{efn |Security camera flaws have been covered extensively.{{Cite web |url=https://www.ifsecglobal.com/cyber-security/how-to-hack-a-security-camera/ |title=How to hack a security camera. It's alarmingly simple |last=Bannister |first=Adam |date=October 7, 2016 |website=IFSEC Global, Security and Fire News and Resources |access-date=August 16, 2019}}{{Cite news |url=https://www.forbes.com/sites/zakdoffman/2019/08/02/u-s-military-spends-millions-on-dangerous-chinese-tech-with-known-cyber-risks/ |title=Official Cybersecurity Review Finds U.S. Military Buying High-Risk Chinese Tech (Updated) |last=Doffman |first=Zak |work=Forbes |access-date=August 14, 2019}}{{Cite web |last=Schneier |first=Bruce |date=October 8, 2007 |title=Hacking Security Cameras{{Snd}} Schneier on Security |url=https://www.schneier.com/blog/archives/2007/10/hacking_securit.html |website=www.schneier.com |access-date=August 16, 2019}}{{Cite web |last=Dunn |first=John |date=June 11, 2019 |url=https://nakedsecurity.sophos.com/2019/06/11/critical-flaws-found-in-amcrest-security-cameras/ |title=Critical flaws found in Amcrest security cameras |website=Naked Security |access-date=August 16, 2019}}}} are vulnerable before and after delivery.

Since 1850, people have known how to create a master key from any key in a building, such as a borrowed restroom key.{{Cite news |quote=few institutions want to spend the money for robust security... in a battle between convenience and security, convenience has a way of winning. |last=Schwartz |first=John |date=2003-01-23 |title=Many Locks All Too Easy To Get Past |work=The New York Times |issn=0362-4331 |url=https://www.nytimes.com/2003/01/23/business/many-locks-all-too-easy-to-get-past.html |access-date=2021-02-20}}{{Cite web |last=Blaze |first=Matt |title=Cryptology and Physical Security: Rights Amplification in Master-Keyed Mechanical Locks |url=https://eprint.iacr.org/2002/160.pdf |access-date=2021-02-20 |website=International Association for Cryptologic Research}} Attackers who cannot find key blanks can 3D-print them from a photo of the lock.{{Cite conference |last1=Burgess |first1=Ben |last2=Wustrow |first2=Eric |last3=Halderman |first3=J. Alex |last4=Shields |first4=Clay |last5=Iyer |first5=Ravishankar K. |last6=Rossow |first6=Christian |date=2015 |title=Replication Prohibited: Attacking Restricted Keyways with 3D-Printing |url=https://www.usenix.org/system/files/conference/woot15/woot15-paper-burgess.pdf |conference-url=https://www.usenix.org/conference/woot15/workshop-program |conference=9th USENIX Workshop on Offensive Technologies}}

In the 2024 general election in Bedford County, PA, staff's keys could not open some tabulators. Other staff found ways to open them.{{Cite news |date=2024-11-05 |title=Widespread voting machine issues reported in Cambria, other counties |url=https://wjactv.com/news/local/widespread-voting-machine-issues-reported-in-cambria-other-counties |access-date=2024-12-07 |work=WJAC TV |language=en}}

Breaches of election security which have been identified, have primarily been done by insiders.

• 2017 Broward County, FL (Fort Lauderdale) elections staff erroneously destroyed paper ballots from an August 2016 primary. A court case was pending to gain access to them.{{Cite web |last=Singhal |first=Raag |date=2018-05-11 |title=Order on Plaintiff's Motion for Summary Judgment." Circuit Court of the 17th Judicial District. CACE17-010904(21) |url=http://www.hollerbackfilm.com/s/00_2018_0511-CanovaRuling.PDF |website=Hollerback film}}{{Cite news |last=Friesdat |first=Lulu |date=2017-12-12 |title=Was the Heated 2016 Democratic Primary Rigged for Debbie Wasserman Schultz? |work=Truthout |url=https://truthout.org/articles/was-the-heated-2016-democratic-primary-rigged-for-debbie-wasserman-schultz/ |access-date=2022-05-13}}
• 2017 In Georgia, elections were centrally programmed by Kennesaw State University. Four days after a lawsuit over election records was files, they erased the election records from their server. Later, the day after this case moved to federal court, they erased their backup.{{Cite news |last=Gumbel |first=Andrew |date=2018-08-13 |title=Why US elections remain 'dangerously vulnerable' to cyber-attacks |work=The Guardian |url=http://www.theguardian.com/us-news/2018/aug/13/us-election-cybersecurity-hacking-voting |access-date=2022-05-13}}
• 2016 Clark County (Las Vegas), NV, Registrar of Voters opened ballot boxes in secret, did a secret recount before the public one, and hid the results. The Registrar said, "You're asking what my results were when we practiced? I can't tell you that.".{{Cite web |url=http://votewell.homestead.com/clark_county_report.pdf |archive-url=https://web.archive.org/web/20190812144903/http://votewell.homestead.com/clark_county_report.pdf |url-status=dead |archive-date=August 12, 2019 |title=Report on the 2016 Presidential Recount in Clark County, Nevada. Page 20. |last=Recount Now |date=January 11, 2017|website=Internet Archive |access-date=August 17, 2019}}
• 2010 Saguache County, CO Clerk and two judges hand-tallied ballots without public notice. They were discovered on security cameras.{{Cite web |last=Weeks |first=Luther |date=2011-01-26 |title=CO Chain of Custody |url=http://www.ctvoterscount.org/foreign-policy-transparent-chain-of-custody/ |access-date=2022-05-16 |website=CTVotersCount}}
• 2010 Detroit, MI, all 44,000 absentee ballots could not be recounted because seal numbers on bottom of containers did not match seal numbers recorded in election.{{Cite news |last=Murray |first=Gregory |date=2013-08-05 |title=Murray: Detroit Clerk Warrants Election Scrutiny |work=Oakland Press}}{{Cite web |last=Vortkamp |first=Jean, and Jan BenDor |date=2016 |title=Looting Detroit – Elections – Looting Detroit |url=http://lootingdetroitthemovie.com/elections |access-date=2024-03-07 |language=en-US}}
• 2007-2009 Cudahy, CA, city officials threw away, uncounted, ballots for candidates running against city council members.{{Cite news |last=Gottlieb |first=Jeff , Hector Becerra and Ruben Vives |date=2012-07-13 |title=Feds detail scale of graft in Cudahy |work=Los Angeles Times |url=https://www.latimes.com/local/la-xpm-2012-jul-13-la-me-cudahy-20120713-story.html |access-date=2022-05-13}}
• 2007 Cuyahoga County (Cleveland), OH election workers were convicted of going through locked ballots to ensure an audit would not find errors in the election. They testifiecf "that the board had always done things that way - with the knowledge of its attorney," .{{Cite news |url=https://www.cleveland.com/metro/2007/11/elections_board_workers_to_tak.html |title=Elections board workers take plea deal |last=Turner |first=Karl |date=November 5, 2007 |work=Cleveland Plain Dealer |access-date=August 17, 2019}}
• 2002-2007 Clay County, KY, election officials falsified election results and destroyed forms which showed they helped voters, since the voters they helped were being paid to vote certain ways.{{Cite web |date=2009-03-03 |title=US District Ct, ED KY, Indictment 09-16-Art US v. Maricle, et al. |url=http://media.kentucky.com/smedia/2009/03/19/17/clayindict.source.prod_affiliate.79.pdf |access-date=2022-05-13 |archive-url=https://web.archive.org/web/20210803095444/http://media.kentucky.com/smedia/2009/03/19/17/clayindict.source.prod_affiliate.79.pdf |archive-date=3 August 2021 |url-status=dead}}{{Cite web |date=2018-03-19 |title=Docket for United States v. Maricle, 6:09-cr-00016 |website=CourtListener |url=https://www.courtlistener.com/docket/7603372/united-states-v-maricle/ |access-date=2022-05-13}}
• 1993 Philadelphia, PA, election board did not keep absentee ballots which had been rejected, from unregistered voters, and turned them over to the campaign which collected them.{{Cite web |last=Stapleton |date=1994-03-16 |title=MARKS v. STINSON 19 F.3d 873 (1994) |website=Leagle |url=https://www.leagle.com/decision/199489219f3d8731759 |access-date=2022-05-13}}

{{notelist}}

{{Reflist}}

• [https://electionverification.org/ Election Verification Network]
• [https://www.verifiedvoting.org/ Verified Voting]
• [https://www.electionaudits.org/principles/ Principles and Best Practices for Election Auditing]

Category:Elections