- High
A receipt can be used to show a buyer how a ballot was marked
- What could happen
- Anyone holding a receipt can open the ballot it points to. A voter who takes one could hand it to a vote buyer, and someone at the polling place exit could demand or grab it.
- What limits it today
- Buying votes is already a federal crime, and a crime in every state. Taking a key is optional, and nothing records whether you did, so a voter can always say they left it behind. Receipts carry no name, signature, or time, so they never show who cast the ballot. Mail ballots can’t be looked up at all. Voter-intimidation and polling-place buffer-zone laws also apply.
- What could fix it
- A way for voters to produce a convincing key for a different ballot, as in research designs like Selene. Decoy receipts printed by the booth were considered and removed, because they would have required the booth to know other voters’ real keys. This needs a better idea.
- High
Ballot pictures can be used to prove a bought vote
- What could happen
- A vote buyer tells someone to mark their ballot in an unusual way, like an X instead of a filled oval, then searches the public ballot pictures to confirm the vote was delivered.
- What limits it today
- Buying votes is already a federal crime. Write-ins and everything outside the vote areas are blacked out. The seller has to cooperate, and the buyer can only confirm a vote, never identify a voter who didn’t agree to it.
- What could fix it
- Show the public a standardized picture of each vote area, with the raw pictures available to observers from both parties. Not adopted, because full public pictures let anyone recount every ballot themselves.
- Medium
Long ranked-choice ballots can act as a signature
- What could happen
- With many candidates, there are thousands of possible rankings. A vote buyer can assign someone a unique order and look for it in the published rankings.
- What limits it today
- Buying votes is a crime. It only matters in long ranked contests, and some cities already publish full rankings today.
- What could fix it
- Publish only each ballot’s top choices, or group rare orderings. Not adopted, because full rankings let anyone re-run every round of the count.
- Medium
A mail ballot can be filled in while someone watches
- What could happen
- At home, someone can stand over a voter as they mark their ballot, just as they can today.
- What limits it today
- Mail voters can track that their ballot was counted, but can’t look up what it says, so there is no way to prove a mail vote remotely.
- What could fix it
- No system fully solves this for mail voting. In-person voting remains the private option.
- Medium
Scanner software stays closed until Stage 3
- What could happen
- Until machines run open, fingerprinted software, nobody outside can see what a scanner does internally. A tampered one could secretly note the order ballots went in.
- What limits it today
- The result is protected by the paper: a second scan by another company, public pictures, ballots matched to voters, and hand audits. Keeping ballot order is forbidden, every record is rebuilt and shuffled before posting, and memory cards stay sealed.
- What could fix it
- Stage 3: open-source scanner software that proves its fingerprint. Certified open-source voting systems already exist, so this is a rollout question, not an invention.
- Medium
Paper still has to be kept safe by people
- What could happen
- Tampering with paper before polls close, or collusion by workers from both parties, still depends on physical security.
- What limits it today
- The closing record is sealed and sent out before the ballot box leaves, so paper swapped afterward won’t match. Seals, logged seal numbers, and bipartisan custody apply, as today.
- What could fix it
- More eyes, not more technology: published custody logs and open observation of every transfer.
- Medium
Some overseas and military ballots arrive electronically
- What could happen
- Many states let overseas and military voters return ballots by email, fax, or web portal. Those can’t be checked the way paper can.
- What limits it today
- They are copied onto paper in front of both parties, published as their own category, and counted separately, so everyone can see how many there are.
- What could fix it
- Expand fast, tracked paper return for overseas voters so electronic return can be phased out.
- Medium
Fake check-ins in the names of people who stayed home
- What could happen
- An insider could mark real voters who didn’t vote as having voted, to cover extra ballots. The numbers would still match.
- What limits it today
- Voter lists are frozen before voting, check-ins are posted hourly, anyone can look themselves up or opt in to an alert, and a random sample of voters are asked to confirm they voted.
- What could fix it
- Sampling catches padding at scale, not a handful of names. Wider use of opt-in alerts closes more of the gap.
- Medium
Mail signature checks are left to each state
- What could happen
- How mail envelopes are verified varies by state, and that’s where many mail disputes start.
- What limits it today
- Every county publishes how many envelopes it accepted and rejected, and why. A random sample of signature decisions gets a bipartisan review. Voters can opt in to be told when a ballot is counted in their name.
- What could fix it
- Envelope rules stay with the states; the standard only makes them visible.
- High
No cost estimate yet
- What could happen
- Without a credible price, adoption stalls.
- What limits it today
- The funding model is set: HAVA-style federal grants per registered voter with a 5% state match, and a funded, vendor-independent maintainer for the open-source tools.
- What could fix it
- A per-stage cost estimate, in progress.
- Low
Not every polling place has workers from two parties
- What could happen
- Hourly counts and custody steps assume workers from different parties, which some areas can’t staff.
- What limits it today
- Any two workers can relay the counts, and the shortfall is published. Signed counts can’t be altered on the way, whoever carries them.
- What could fix it
- Party and civic-group observer programs to fill the gaps.
Found in review, and fixed
Weaknesses we caught in our own plan and fixed in the standard.
- A hand count can’t remove stuffed ballots.→✓Unexplained extra ballots are published next to the winning margin. If they could change who won, a court or election board decides, and can order a new vote.
- Decoy receipts would have required the booth to know other voters’ keys.→✓Decoys removed. The vote-selling risk they targeted is listed as open above.
- Your code alone might have found your ballot.→✓The machine’s part of the key is never published, so a code alone finds nothing.
- Mail voters looking up ballots by code would have enabled remote vote-selling.→✓Mail voters track that their ballot counted, without seeing its contents.
- A fake device could sign fake counts.→✓Every scanner’s signing key is registered publicly before testing.
- An offline machine could replay an old “clean” report.→✓Opening reports must include a random value published that morning.
- The standard cited a security level that no longer exists.→✓Updated to SLSA Build Level 3 plus independently reproducible builds.
- Vote centers and early voting broke per-precinct matching.→✓Ballots are matched to voters both per location and per precinct.
- Federal authority and funding weren’t addressed.→✓Binds federal contests; HAVA-style grants for states that apply it to the whole ballot.
- Rescanning and pictures couldn’t finish in 24 hours.→✓Records and counts in 24 hours; pictures and rescan results before certification.
- Blind voters couldn’t use code cards or read keys.→✓Tactile and audio code cards, and an audio read-out of the key.
Found one we missed?
We want to hear it. The best way to make this plan stronger is for more people to try to break it.