In plain English
- The problem: once your paper ballot enters a machine, the counting happens in software nobody outside can check.
- The fix: a federal rulebook every election system must pass for federal contests, the way FedRAMP sets one standard for federal cloud software.
- What it requires: every ballot posted on a public list with no names attached, a personal key so you can find yours, a public list of who voted that must match the ballot count, open software, and tamper-proof machines.
- What you get: 16 rights to verify the election yourself, while nobody can ever tie a ballot back to you.
- The ask: Congress adopts it as binding law.
The Problem: Lack of Enforceable Standards in Election Technology
Current U.S. election systems rely on proprietary software and firmware with no mandatory cryptographic auditability. While paper ballots provide a physical record, the digital scanning, tabulation, and reporting layers remain black boxes. Without enforceable federal standards, jurisdictions and the public cannot independently verify:
- ✕That ballots were recorded and counted exactly as cast
- ✕The integrity of software, firmware, and machine access logs
- ✕Protection against man-in-the-middle attacks or insider tampering
- ✕That any vendor or administrator cannot silently alter results
Executive Summary
The Open Voting Project Framework is a proposed mandatory federal standard, borrowing FedRAMP’s model of a single shared standard, that every election software vendor, tabulation system, and jurisdiction must comply with. It enforces cryptographic verifiability, open-source transparency, and public auditability across all U.S. election technology.
Compliance requires that all systems issue anonymous voter ballot keys, publish every cast vote record to a public ballot log that anyone can recount, maintain reproducible builds, and provide TPM 2.0 machine attestation. Every reporting unit must publish its voter roll and participation list, and the ballot count must reconcile to them. All software must be open source, and a free public verifier must let anyone re-run the entire election from public records. Independent Overwatch monitors and a full second scan of every paper ballot catch tampering without relying on voters to check. Every ballot entry is published with its image beside the machine’s interpretation, along with the attested hardware and software that read it. No system may ever link a ballot to the voter who cast it. Existing vendors and systems can continue to operate provided they meet these auditable standards.
This is not a product or vendor solution. It is a binding compliance framework that restores public confidence through mathematics and enforceable standards.
Mandatory Compliance Requirements
Ballot Scanning & Cryptographic Commitment
All scanners must compute a SHA-512 hash of the ballot image, record its cast vote record, construct a Merkle tree leaf, and sign it with a TPM 2.0 attested Ed25519 key before any further processing. Voting and tabulation devices must never connect to any network; data leaves them only as signed, displayed machine-readable codes or on sealed removable media under chain of custody. Devices must not retain or emit the order or time in which ballots were cast. Ballots printed by ballot-marking devices must be tabulated from their human-readable text, never from barcodes or other encodings the voter cannot read.
In plain English: The moment your paper ballot is scanned, the machine seals a digital fingerprint of it. Change one mark later and the fingerprint no longer matches. Scanners never connect to any network, never keep track of the order ballots went in, and count machine-printed ballots from the words you can read, never a barcode.
Anonymous Voter Ballot Key
Every system must issue each voter a unique, randomly generated ballot key at the moment of casting, and file the ballot under that key. No system may record, transmit, or retain any association between a ballot key and a voter’s identity, check-in record, or time of casting. Taking the key is optional; an unclaimed key must be destroyed at the booth.
In plain English: Every voter gets a personal key that finds their ballot on the public list. Nothing ever records whose key is whose. Don’t want to check? Leave it behind.
Public Ballot Log
Every cast vote record must be published, with its choices in the clear, under its ballot key to a public, append-only Merkle-tree transparency log. Entries must be published in randomized order without timestamps. All transmissions must use dual signatures and forward-secure session keys to prevent man-in-the-middle attacks.
In plain English: Every ballot is posted to a public list under an anonymous key instead of a name. Anyone can read and count them, and nobody can quietly add, remove, or edit an entry.
Public Recount Verification
Official results must be exactly reproducible by any member of the public by running the open-source tally engine over the published ballot log. Ballot-level risk-limiting audits must compare randomly sampled paper ballots against their public log entries.
In plain English: Anyone can add up the public ballots and confirm the official total. Ballots carry no names, so counting them never reveals who voted for what.
Reproducible Builds & Machine Attestation
All election software and firmware must be published as open source before certification and built to SLSA Build Level 3 with independently reproducible builds, so anyone can rebuild it byte-for-byte from source. Builds must be Cosign-signed, and every machine must perform TPM 2.0 attestation against the published build hashes before accepting ballots. Because voting devices are offline, each attestation must include the state’s election-day random value (published that morning from a public drawing and entered at opening), proving the report was produced that day and not replayed.
In plain English: All election software must be open source, and every machine must prove it is running exactly that software, unmodified, before it accepts a single ballot.
Plain, Optional Receipts
Receipts must show only the ballot key, with no signature, serial number, time, or other feature linking the receipt to a voter, so a receipt identifies a ballot but never who cast it. Taking a key is optional; a declined key must be destroyed at the booth, and no system may record whether a voter took a key. Mail voters may track receipt and acceptance of their ballot but may not look up its contents. Paying for a vote, or demanding proof of one, remains a crime under existing federal and state law. Because a receipt lets its holder view the ballot it points to, a voter who takes one could show it to a vote buyer; this is an acknowledged weakness pending a coercion-resistant key mechanism.
In plain English: Your receipt is plain paper with only your key on it: no name, signature, serial number, or time, so it never shows who cast the ballot it opens. Taking one is optional, and nothing records whether you did. Anyone holding a receipt can open its ballot, so keep it to yourself. That limit is listed on our Known weaknesses page.
Public Voter Roll & Participation List
For each reporting unit, jurisdictions must commit a snapshot of the voter roll to the public log before voting opens, and log every later addition or removal (including same-day registrations) as a public change. After polls close they must publish a participation list recording which registered voters cast a ballot and by what method (in person, mail, or provisional), without timestamps. Only fields already public under state law may be released. Voters in address-confidentiality programs are counted but not named. Every voter may look up their own record, and may opt in to be notified when their record is marked as having voted; per-unit counts and pseudonymous voter IDs must be open to all, and full name lists remain available under each state’s existing access rules. After polls close, each county must audit a public random sample of participation records, with bipartisan teams confirming with each sampled voter that they voted; a record the voter disputes is a tripwire. Each county must also publish counts of mail ballot envelopes accepted and rejected, by reason, and a bipartisan review of a public random sample of signature decisions.
In plain English: For every area, the list of registered voters and the list of who voted (never how) are published. Anyone can look themselves up, the list can’t be quietly padded once voting starts, and a random sample of people marked as voting are asked to confirm they did.
Ballot Reconciliation & Automatic Audit
For each reporting unit, jurisdictions must publish a reconciliation report comparing registered voters, participating voters, and ballots on the public log, itemizing every difference by cause (spoiled ballots, rejected provisionals, voters who checked in but did not cast). Where voting takes place at vote centers or over multiple days, reconciliation must be performed both per voting location (ballots scanned there against check-ins there) and per reporting unit (ballots by ballot style against check-ins by home precinct, across all locations). Ballots returned electronically under UOCAVA must be duplicated onto paper under bipartisan observation, published as a separate category, and reconciled separately. Any unexplained surplus of ballots over participants is a tripwire and must be published alongside the margin of every affected contest. Because a hand count cannot tell which ballots are illegitimate, a contest whose total unexplained surplus is smaller than its margin may be certified with the surplus referred for public investigation; where the surplus equals or exceeds the margin, the contest must be referred to the state’s election-contest process, which may order a new election in the affected units. Reporting units with fewer than 100 participating voters must be combined with an adjacent unit before publication so no result can reveal how an individual voted.
In plain English: In every area, the number of ballots must match the number of people who voted. Any gap has to be explained in public. Extra ballots that can’t be explained are published next to the winning margin, and if they could change who won, a court or election board decides, and can order a new vote.
Voter-Contributed Keys & Paper-Linked Entries
Each ballot key must be derived from both machine-generated randomness and a random code supplied by the voter (a card drawn face-down at check-in from a shuffled, sealed deck, or a code generated on the voter’s own device). The machine randomness must never be published, so a voter code alone can never locate a public entry. The booth must show the voter that their code is bound into the key, and accessible alternatives (tactile or audio code cards and an audio read-out of the key) must be provided. Mail ballots are keyed at central scanning after separation from their identifying envelopes and are covered by the same rescan, reconciliation, and audits; to prevent verifiable remote vote-selling, mail voters confirm receipt and acceptance through ballot tracking but cannot look up their ballot’s contents. The ballot key must be printed on the anonymous paper ballot. Any public log entry without a matching paper ballot, or any paper ballot without a matching entry, is a reconciliation failure that blocks certification pending a full hand count.
In plain English: Part of your key comes from you, not the machine, so a rigged machine can’t hand two people the same key. Your code alone can never find your ballot. Mail ballots get the same checks, and you can track that yours was counted. Your key is also printed on your paper ballot, so every entry on the public list must match a real piece of paper.
Open-Source Election Replay
A reference verifier, free for anyone to download and run, must be published and maintained independently of any vendor. Using only public data, it must: verify every log signature and Merkle root; confirm the voter roll snapshot and its logged changes; reconcile ballots to participation per reporting unit; recount every ballot; and reproduce the certified result exactly. Jurisdictions must publish ballot records, counts, and reconciliation data in an open, documented format within 24 hours of polls closing, and ballot images and rescan results as they are produced and before certification, through a standardized, read-only public interface requiring no account or key (latest signed checkpoint, entries, inclusion and consistency proofs, hourly counts, per-unit voter summaries, and alerts) and as bulk downloads, and must permit unlimited independent mirrors. Data not published by the deadline is itself a tripwire. Certification may not proceed if any independent replay fails.
In plain English: Anyone can download open-source software and re-run the entire election on their own computer, from the raw public records to the final result. The records come through one open feed with no sign-up, which anyone may copy.
Overwatch: Continuous Public Tamper Monitoring
During voting, each machine must display, at least hourly, a signed, sequence-numbered running ballot count (counts only, never ballot contents) as a machine-readable code, relayed to the public log by two poll workers, of different parties where available (any shortfall is published); a missing, repeated, or out-of-sequence count is itself a tripwire. Poll books must publish per-unit check-in counts on the same schedule. At poll close, each machine must sign its final count and log root, relayed the same way before ballot containers leave the polling place; every subsequently published log root must be cryptographically consistent with it. Jurisdictions must support any number of independent public monitors that archive every signed root, cross-compare roots with one another to detect split views, and continuously evaluate the published tripwire rules. Tripwire rules must be deterministic and publicly specified; judgments by machine-learning or other non-reproducible systems may not trigger or clear any tripwire. Any tripped rule must raise a public alert and hold certification of the affected units until resolved. An alert holds certification only if it is reproducible from public records by any independent monitor; an irreproducible alert must be publicly dismissed with the evidence.
In plain English: Watchdog computers, run by anyone, watch the public records around the clock. If a single ballot changes, appears, or disappears, an alarm goes off for everyone at once. No AI: just fixed rules anyone can check, and an alarm only counts if anyone can reproduce it.
Independent Full Rescan & Key-Based Disputes
Every paper ballot must be rescanned by equipment from a vendor independent of the primary tabulation vendor, and each ballot’s printed key and marks compared to its public log entry. Any mismatch is a tripwire. Any person may file a dispute citing a ballot key; the jurisdiction must retrieve the corresponding paper ballot and publish the comparison result within 48 hours, without any record of the filer’s identity being associated with the key.
In plain English: After the election, a second scanner from a different company rereads every paper ballot and checks it against the public list, so a flipped vote is caught even if the voter never looks. If your lookup looks wrong, report your key and they pull that exact paper ballot.
Ballot Images, Machine Provenance & Pattern-Voting Protection
Every published entry must publicly include (a) the image crop of that contest’s vote-target area on the ballot, with write-in text, margins, and all other regions masked, alongside the machine’s interpretation of each mark, so that any member of the public may independently re-interpret every mark; and (b) the scanner’s attestation record: hardware identity and TPM 2.0 quote, firmware, operating system image, election software build, and ballot definition hashes, each resolvable to its reproducible open-source build. To prevent pattern-voting identification, each contest must be published as a separately shuffled list, with entries filed under per-contest keys derived from the ballot key, so that only the key holder can reassemble a full ballot and its complete set of images. Ranked-choice contests are published with full rankings so that every round can be independently re-run. Write-in names receiving fewer than 5 votes in a reporting unit are aggregated in public views. Full unmasked images are retained under seal for hand counts and disputes.
In plain English: Every ballot on the public list comes with a picture of the paper right next to how the machine read it, plus fingerprints of the exact hardware, firmware, operating system, and software that counted it. Anyone can open any ballot, and anyone can recount from the pictures. Each race is published as its own list, so nobody can spot a ballot by its unusual combination of choices.
Polling-Place Certification Lifecycle
Equipment may be deployed only if its build fingerprints appear on the state’s public registry of approved builds, following independent laboratory testing and public reproducible rebuilds. Each device’s public signing key must be registered in the public log, bound to its serial number and approved build, before its logic-and-accuracy test; any count or record signed by an unregistered key is a tripwire. Every device must pass a public logic-and-accuracy test with a published test deck and results before each election. At opening, each device must attest (including the election-day random value) and publish a zero-count report; the voter roll snapshot and the serial seal of voter code cards must be logged. At closing, each device must re-attest and sign its final count, and paper ballot containers must be sealed under a published chain-of-custody log with bipartisan custody. A reporting unit may be certified only when every tripwire defined under Requirement 11 is clear, reconciliation, rescan, independent replay, and risk-limiting audit have passed, and the results are published. Any count failure (a tripped tripwire, rescan mismatch, failed replay, or failed audit) requires a public full hand count of that unit’s paper ballots, which then becomes the certified result; an unexplained ballot surplus is resolved under Requirement 08. The state may certify only when every reporting unit is certified.
In plain English: A polling place is certified only after passing every public check: approved equipment, a public test run, a zero report at opening, sealed counts at closing, and independent checks afterward. If any count check fails, its paper ballots are hand counted, and the hand count is what gets certified. Unexplained extra ballots follow the margin test in Requirement 08.
16 Verifiable Rights Enforced by the Standard
Compliance with this framework grants every voter and citizen the following enforceable rights through cryptography and open standards. Every voter and citizen may:
Independently verify their own ballot was recorded exactly as cast by looking up their ballot key on the public log
Check that your ballot was recorded exactly as you marked it.
Download, rebuild, and independently audit the complete open-source compliant software stack
Download and rebuild the exact software used to run the election.
Confirm hardware and firmware integrity of every voting machine via mandatory TPM 2.0 attestation
Confirm every voting machine is running untampered hardware and software.
Access immutable, cryptographically signed logs of all machine access and modifications
See a tamper-proof record of everyone who accessed or changed a machine.
Review the full cryptographic audit trail of every software update and deployment
Review the full history of every software update.
Examine the complete source code and submit publicly verifiable bug reports or improvements
Read the source code, and publicly report bugs or improvements.
Cryptographically confirm or publicly expose any non-compliance or flaw in the election infrastructure
Prove it publicly, with evidence, when something doesn’t comply.
Track their ballot end-to-end, from scanner to certified result, through the mandatory public Merkle-tree ballot log
Follow your ballot from the scanner to the final count.
Locally replay the complete election with the free reference verifier, from raw public records to the certified result
Re-run the whole election on your own computer with open-source software.
View exactly which choices their ballot records, with no record anywhere linking that ballot to their identity
See exactly what you voted for, and know nobody can tell that ballot is yours.
Independently recount the complete public ballot log and confirm it matches the certified result
Count the overall election totals yourself from the full public list of ballots, none of which can be tied to a voter.
Verify their own registration and participation record, and publicly report any ballot cast in their name
Look yourself up: confirm you’re registered, and that you’re marked as having voted only if you did.
Access per-reporting-unit counts of registered voters, participating voters, and logged ballots, with an itemized public reconciliation of every difference
See how many people are registered, how many voted, and how many ballots were counted in your area, and check they line up.
Detect duplicate participation across reporting units and voting methods using published pseudonymous voter IDs
Check that nobody voted twice, in two places or two different ways.
View the masked vote-area image of every published ballot entry alongside the machine’s interpretation, and independently re-interpret every mark
See a picture of every ballot, including yours, right next to how the machine counted it, and recount from the pictures yourself.
Inspect the attestation record and component hashes of the scanner that read their ballot, each traceable to a reproducible open-source build
See the exact hardware, firmware, operating system, and software that read your ballot.
Mandatory Cryptographic Security Guarantees
All log entries and transmissions must carry dual Ed25519 signatures over forward-secure channels.
SLSA Build Level 3 with independently reproducible builds + Cosign attestations are mandatory.
TPM 2.0 measured boot + remote attestation required before any ballot processing.
No system may store or transmit any link between voter identity and ballot key. Check-in and voting systems must be separated, ballots are published in randomized order without timestamps, and reporting units under 100 voters are merged before publication.
Flipped votes are caught by independent full rescan and voter lookup; added ballots by participation reconciliation; fabricated entries by paper-to-log matching; shared keys by voter-contributed randomness; post-close edits by Overwatch monitors; altered totals by independent public replay. Paper ballots remain the authoritative record for hand counts.
Contests are published as independently shuffled lists under derived per-contest keys; public images are limited to masked vote-target crops; rare write-ins are aggregated.
Voter roll snapshots are committed before voting opens; ballots must reconcile to participation records per unit and per location, and any unexplained surplus is published against the margin and, if it could change the outcome, referred to the state’s election-contest process.
Receipts show only the ballot key, with no signature, serial number, or time; taking a key is optional and leaves no record; mail voters cannot look up ballot contents. A receipt does reveal the ballot it points to, so receipt-based vote selling is listed as a known weakness.
Merkle-tree transparency log + ballot-level Risk-Limiting Audits comparing paper ballots to their public log entries.
Ed25519 base with documented migration path to quantum-resistant algorithms.
Compliance Roadmap for Vendors and Jurisdictions
- NowProposal
The standard’s text is published under CC BY 4.0 (the system it describes is patent pending) and open for review by lawmakers, election officials, and the public.
- Step 1Congress adopts it
The standard becomes binding law for federal contests, with HAVA-style grants for states that apply it to the whole ballot.
- Phase 1Certification
Vendors submit systems for SLSA Build Level 3 and reproducible-build verification and TPM 2.0 attestation testing.
- Phase 2Integration
Jurisdictions implement the mandatory ballot key, public ballot log, and voter roll publication interfaces.
- Phase 3Public audit
Run a parallel public recount and ballot-level Risk-Limiting Audit, and publish proof of compliance within 48 hours of certification.
Scope, Authority & Funding
The standard binds federal contests directly, under the Elections Clause and Congress’s existing power to protect federal elections. It sets no rules for who may vote, voter ID, or registration; those stay with the states.
Federal and local contests share one paper ballot and one set of machines, so in practice states apply the standard to the whole ballot. Federal grants are conditioned on doing so.
Where state law treats ballot images or cast vote records as confidential, the standard overrides it for federal contests only.
Modeled on the Help America Vote Act, which sent more than $3 billion to states after 2002: grants per registered voter for scanner upgrades, second-vendor rescanning, publishing, and poll-worker time, with a 5% state match.
The reference checker and publisher are maintained in public by an independent nonprofit on a multi-year federal grant. It accepts no vendor funding and publishes its roadmap and security reviews.
A per-stage cost estimate is still being prepared, and is listed on the Known weaknesses page until it is published.
Known Weaknesses
These weaknesses still lack a full remedy. Each is listed with what limits it today on the Known weaknesses page.
- HighA receipt can be used to show a buyer how a ballot was marked
Buying votes is already a federal crime, and a crime in every state. Taking a key is optional, and nothing records whether you did, so a voter can always say they left it behind. Receipts carry no name, signature, or time, so they never show who cast the ballot. Mail ballots can’t be looked up at all. Voter-intimidation and polling-place buffer-zone laws also apply.
- HighBallot pictures can be used to prove a bought vote
Buying votes is already a federal crime. Write-ins and everything outside the vote areas are blacked out. The seller has to cooperate, and the buyer can only confirm a vote, never identify a voter who didn’t agree to it.
- MediumLong ranked-choice ballots can act as a signature
Buying votes is a crime. It only matters in long ranked contests, and some cities already publish full rankings today.
- MediumA mail ballot can be filled in while someone watches
Mail voters can track that their ballot was counted, but can’t look up what it says, so there is no way to prove a mail vote remotely.
- MediumScanner software stays closed until Stage 3
The result is protected by the paper: a second scan by another company, public pictures, ballots matched to voters, and hand audits. Keeping ballot order is forbidden, every record is rebuilt and shuffled before posting, and memory cards stay sealed.
- MediumPaper still has to be kept safe by people
The closing record is sealed and sent out before the ballot box leaves, so paper swapped afterward won’t match. Seals, logged seal numbers, and bipartisan custody apply, as today.
- MediumSome overseas and military ballots arrive electronically
They are copied onto paper in front of both parties, published as their own category, and counted separately, so everyone can see how many there are.
- MediumFake check-ins in the names of people who stayed home
Voter lists are frozen before voting, check-ins are posted hourly, anyone can look themselves up or opt in to an alert, and a random sample of voters are asked to confirm they voted.
- MediumMail signature checks are left to each state
Every county publishes how many envelopes it accepted and rejected, and why. A random sample of signature decisions gets a bipartisan review. Voters can opt in to be told when a ballot is counted in their name.
- HighNo cost estimate yet
The funding model is set: HAVA-style federal grants per registered voter with a 5% state match, and a funded, vendor-independent maintainer for the open-source tools.
- LowNot every polling place has workers from two parties
Any two workers can relay the counts, and the shortfall is published. Signed counts can’t be altered on the way, whoever carries them.
A Binding Federal Standard for Election Integrity
This framework mandates that all election software and systems meet enforceable cryptographic and transparency standards for every federal contest, with federal funding for states that apply it to the whole ballot.
This text is published under CC BY 4.0 so lawmakers, officials, and the public can read, quote, and adapt it. That license covers the text only. The system and methods it describes are patent pending, and publishing this paper grants no license to make, use, sell, or deploy them. Anyone may download and run the reference verifier to check an election. Vendors, jurisdictions, and others seeking to implement the system should contact the Open Voting Project about licensing.