Catching bad code · Open Voting Project

All of the code is public.

Every line of software that touches a ballot is published before an election. Anyone can read it.

count.js · public

function countBallot(ballot) {
  if (ballot.mark === "A") totals.A += 1;
  if (ballot.mark === "B") totals.B += 1;
}

Every program has a fingerprint.

Run the code through a fingerprint formula and you get a short code. Change anything, even one character, and the fingerprint comes out completely different.

Try it. This is real math, running in your browser right now.

count.js · public

function countBallot(ballot) {
  if (ballot.mark === "A") totals.A += 1;
  if (ballot.mark === "B") totals.B += 1;
}

Fingerprint (SHA-256)

…

Anyone can rebuild it.

Universities, newspapers, both parties, you: anyone can turn the public code into a program and check the fingerprint. Everyone gets the same one.

Approved fingerprint91a0…5c3e

State universitybuilding…
Local newspaperbuilding…
Party Abuilding…
Party Bbuilding…

Every machine reports its fingerprint.

Before accepting a single ballot, every machine proves which fingerprint it’s running, for its hardware, firmware, operating system, and software.

Precinct 12 · opening checkApproved 91a0…5c3e

Scanner 1checking…
Scanner 2checking…
Scanner 3checking…
Scanner 4checking…

Spot the bad one.

Scanner 3 is running something else. Maybe it was hacked, maybe someone swapped a file. Either way, it doesn’t match.

Precinct 12 · opening checkApproved 91a0…5c3e

Scanner 1checking…
Scanner 2checking…
Scanner 3checking…
Scanner 4checking…

What happens next.

The machine can’t take ballots. Everyone is alerted. It’s swapped for a certified spare, and the investigation is public.

If a mismatch shows up at closing instead, every paper ballot that machine read gets counted by hand.

1Machine can’t accept ballots
2Alert sent to every watchdog
3Swapped for a certified spare
4Investigated in public