†† 31 July 2022

Comments & questions:


Trust Your Election Results?




Election officials don't check many results. Candidates and the public can monitor the election process and check results:


A. Get electronic copies of all ballots, by public record requests (more)

       Election machines already scan and make anonymous ballot images.

       Ask election officials to preserve these ballot images

       File public record request for ballot images from a recent election.


B. Print and count these images of ballots, or get programmers to count them, to check official results. (more)

       Report any discrepancies. If there's an argument, courts decide.

       This one step will catch most errors in election results, caused by mistakes, dishonesty, or foreigners.

       This step also shows each candidate who else their voters chose, leading to alliances in the next campaign.


C. To be sure copies are reliable, compare a good sample of paper ballots to the electronic copies. (more)

       If copies aren't right, re-scan ballots with better scanners, release again, check again.

       If ballots are missing, so you can't check, it's a management failure. Inves≠ti≠gate and fix management.


A. When many contests are on the ballot, machine-counting[1] is common, for accuracy and speed. Counting machines are computers. Even when they are offline, staff and contractors hand-carry annual updates to every machine, which can introduce errors and hacks, so their results need to be checked.


1.    Officials do very limited checks: onlya few contests, or omitting many ballots.[2] You can read details for your state.[3]


2.    The most powerful step in election security is getting copies of ballots to count independently. Ballots are anonymous, so they cannot be tied to particular voters.


3.    Getting copies depends on good relations with election staff, and/or requesting copies of the ballots or the electronic images under the relevant state Open Records Law or Freedom of Information Act (FOIA). Many states forbid copying ballots, but only a few forbid copying the electronic images, as shown on the yellow, black and green map above. A 2007 survey by the National Association of Secretaries of State identified policies then.[4] Lawyers regularly analyze each state's Open Records or FOIA Law for the Reporters' Committee for Freedom of the Press. [5] There have also been some court decisions.[6]All these are summarized in the yellow, black and green map at the top of the page.


4.    In states which have not had court decisions, it is important to ask lawyers for the best strategy. In the states which do not release ballot images, you may need a new state law.


5.    Tallying ballots independently of election machines has led to new results and insights in Michigan, Pennsylvania, California, and Florida.


6.    Copies can be electronic or paper. Election machines make electronic copies of ballots, which are inexpensive to copy so candidates and the public can check results. If a jurisdiction does not save its electronic copies, you can ask officials and candidates to start doing this.


7.    Audit Elections USA lists which jurisdictions use vote-counting machines which can make electronic images of the ballots.[7] These are mapped in the green and gray map here.


8.    It is also possible to scan ballots, especially in smaller jurisdictions with modest numbers of ballots. Scanners are inexpensive, and can handle uncommon formats used in some jurisdictions.[8] Various laws have been interpreted to allow scanning of ballots.[9]


9.    When election machines create copies in unreadable proprietary formats, you can still request copies, then find another machine which can read them.


10. Sample FOIA letters[10] are available. Requests can be sent directly or through a service like FoiaMachine, free, or MuckRock, $20 for up to 4 requests, which submits, follows up, and posts results online. Muckrock also shows the cumulative success rates of requests to each jurisdiction.[11] States usually charge copying costs, which can be low for electronic copies.


11. States vary in how long they store local election ballots. Federal law[12] requires that when any federal official is on the ballot, all ballots and other records must be kept for 22 months after each primary, general and special election.


12. An alternative of trying to check vote counting software directly is usually stopped by trade secrets laws.[13] The alternative of using national exit polls is stopped by adjustments they do to match official results.[14] Local groups have tried this approach.[15] Exit polls do try to include mailed ballots as well as polling places.[16]

13. Many states have groups working for better elections, which may help you.


B. Ballot images are easy to copy to thumb drives or portable hard drives, depending on file size. People can print and hand-count,[17] or electronically count these scans to check official counts. Citizens Oversight, Humboldt County CA and FreeandFair offer software to count ballot images.[18]


1.    The election staff or first recipients of the files need to calculate a digital signature or hash value to identify true copies of the scan. The hash value is a several-digit number, calculated from the ballot images, so any change in the file gives a different hash value, revealing that the file is not the same as the original. The hash value needs to be short enough to store and compare on paper, so it does not depend on computer storage, which can fail.


2.    Humboldt County, CA, has scanned and counted ballots with open source software since 2008, several days after each election. Humboldt releases the ballot images with a digital signature or "hash value" for each file of ballot images.[19]


3.    There are several ways independent counts can differ from official counts and each other. Software has adjustable tolerances for partly filled ovals next to candidate names, and even for finding the ovals on the page.[20] It can miss voters who marked an X or check-mark. If one set of software just checks for black ovals, it will miss votes where the voter circled the name instead, or wrote it in the write-in box. When circling or writing in counts as a vote under local and state law, the differences matter in close elections.[21] Advanced software can also look for crossed-out votes where voters changed their minds, and their intent is clear.


4.    Many jurisdictions use Ballot Marking Devices, a touchscreen where voters select choices, and the computer prints the choices on paper to put in the ballot box. The goal is to avoid letting voters mark ambiguous circles and X's, and to avoid the high costs and potential errors of commercially pre-printing blank ballots in multiple languages. The paper usually has a bar code or QR code summarizing the voter's choices, which is counted on election night. Errors in the code will be found if someone counts the printed names. Any error in the printed names is supposed to be found by each voter, but is caught only 7% of the time on a ballot with multiple contests.


5.    Checking copies also lets people see if there are black or white lines or pale areas on the ballots caused by faulty scanning.[22] Finding such problems may convince officials to conduct step C, or convince a court to order new better scans.


6.    Legal structure stays the same, where county and city clerks and recorders manage the election, ballots and scanned images. People will report discrepancies to officials or courts as needed.


7.    Ballot images need to become a standard part of campaigns, to verify counts and show the combinations of candidates which voters choose, helping design alliances for later campaigns.


8.    An optional, sophisticated, step is to analyze the patterns of pixels in the images to detect tampering. If an error or hack shifts black ovals from one candidate to another, there could be discontinuities at the edges of the area shifted. Wisconsin's IT experts said "manipulation would be difficult; might be easy to detect, and may even be impossible."[23]


9.    Steps A and B will catch most errors and are useful even if you cannot do step C. Do not let the perfect be the enemy of good first steps. Without step C, outsiders can still check whether totals are correct. A and B force election thieves into a smaller space, where whistleblowers may catch them. Step C is harder and is only needed for sophisticated hacks in the images, moving black-marked ovals from one candidate to another, and to catch staff errors in reconstructing damaged ballots.[24] Steps A and B are like locking your doors and windows. Step C is like stepping up to a home alarm system.


C. Comparing ballot images to the corresponding original ballots is a test of whether the scans and reconstructed[25] ballots were accurate. If the public cannot get comparisons with paper ballots, another approach is deep forensic analysis of the electronic images. True scans have slight imperfections from dirt, shadows and variation in how humans mark ballots. Accidental or purposeful moving of parts of the image to change votes can leave subtle edges.


Extent of checking


1.    The number of ballots to check depends on budget, time, space, and how many staff can be well-supervised.[26] Even a small sample of 200-500 ballots is enough to catch common errors. Suppose election machines report a victory margin of 2% (winner had 51% and loser had 49%). This result could be a mistake, if 1% or more of the scans were wrong. A random sample of 200 to 500 ballots has an 87% to 99% chance of finding at least one of those faulty scans,[27] so the crook or the faulty machine would be found out.


2.    Ideally checking would be done publicly by election staff right after each batch of ballots is scanned. For ballots scanned at precincts, a sample of each precinct can be compared to the images as soon as the ballot box comes back to the office. Both approaches identify faulty scanners immediately, so the ballots can be re-scanned and any preceding batches from that scanner can be double-checked.


3.    Immediate re-scans of faulty batches fix multi-feeds and streaks from dirty sensors. If the cause is not so obvious, and affects two or more batches, all batches need to be re-scanned, to remove uncaught random errors in the other batches. 2-batch cutoff can be changed, but in a sample of 500 comparisons it gives 96% chance of catching errors affecting 1% of ballots and 70% chance for errors affecting 0.5% of ballots.


4.    This small sample size is only reliable if you take seriously even two discrepancies, and either re-scan all ballots, or check a much bigger sample to search for more errors. Re-scanning is cheaper. Busy staff and candidates may want to ignore[28] two lone discrepancies, but expecting to find more discrepancies in a small sample is unrealistic. Bugs in the scans (darkening a black oval to select one candidate rather than another), should never happen, and finding two means the entire scanned file is unreliable. In the example above, where 1% of scans were faulty, a sample of 200 has only 33%[29] chance of finding 3 or more faulty scans. A sample of 500 is needed to get 88% chance of finding 3 or more faulty scans. If staff want to wait for 3 flawed scans before taking action, they need to examine at least 500 ballot images.

5.    In jurisdictions with only a few hundred ballots, it is feasible and reassuring to check them all.


6.    When people suspect errors in one area or type of ballot, these need to be sampled more heavily, or at 100%.


7.    When errors are found, the ballots need to be re-scanned on different scanners. These can be scanners from the same election vendor, or commercial off-the-shelf scanners such as local offices already own. Then new files can be released to the public, and a new random sample can be selected and checked against the new ballot images.


8.    This approach is a variation of a "Risk-Limiting Audit" (RLA).[30] When a traditional Risk-Limiting Audit finds a problem, it expands the hand count, ultimately up to 100%. Rescanning gives the same assurance that results match the original ballots, while avoiding the cost and delay of 100% hand counts. Maryland rejected RLAs because of the unpredictable cost of hand counts,[31] and they count scans instead, though they skip step C. Another weakness of traditional Risk-Limiting Audits is that they check only one or two contests, to minimize hand counts. Taking a little time to get verified scans makes it easy to check all contests. Finally, RLA requires a secure tally of verified electronic records, and traditionally the public has no evidence this tally is secure.[32] Releasing ballot images lets the public check the tally.




9.    Original ballots need to be kept in the same order they went through the scanner, to find the corresponding images. The alternative of printing numbers on ballots as they are scanned is touchy, since one does not want ink in the scanner which could be hacked to mark extra votes. Printing numbers can be safe if the only ink color in the scanner is one which voters don't use, like yellow or orange.


10. Ballots need to be compared immediately after random numbers are chosen, so there is no time for election thieves to change the stored originals which have been chosen. Even bringing the chosen ballots from a large storage room must be fast so the public knows there was no time for insiders to change them.


11. Numbers to identify ballots (3rd, 82nd, 209th, etc.) need to be truly unpredictable. If there is any chance of pre-selecting them, outsiders may suspect insiders of changing few selected ballots to match the already-released images.


12. Images need to be released before selecting the random numbers, so outsiders know that insiders could not fix just the few selected images to match stored ballots.


13. It is important for all supporters of losing candidates to see the audit has no holes, even after bitter campaigns.


14. When staff have reconstructed ballots after originals were torn or otherwise too damaged to be scanned,[33] comparisons need to be done with the original ballots, not the reconstructed ones.


15. If there are doubts about any precinct or type of ballot, like reconstructed ones, it needs to be covered more thoroughly in the checking.


16. If the random comparison finds any mismatch between ballots and images, people need to decide if it could affect election results. Sporadic light ink may not matter, if it is always dark enough to read. Black or white lines through candidate selections matter, since they can hide voters' marks.


17. Comparisons need to be visible to the public, or they create little trust. The public can bring their own copies of the released image files. The hard part is letting them see the paper ballots. It is tempting to project these on a computer monitor, but if a savvy hacker has changed ballot images, she can hack a computer projection of paper ballots to match. An opaque projector which uses light and lenses rather than software would be trusted more.


18. All scanning and random comparisons need to be done as soon as possible after the election, ideally by the next day, since physically stored ballots are very much at risk of being changed. If storage seals are broken, few will have confidence that the ballots are still trustworthy. In hotly contested elections, partisans have guarded storage sites. For example in Bush v. Gore 2000, Republicans guarded storage in Florida[34] and asked the state police to guard storage in New Mexico.[35]


19. American governments spend $7 trillion per year.[36] We choose these governments with an average of 140 million ballots per year, so an average ballot controls $50,000, half at federal level, half in state and local governments. Think of each ballot as worth $50,000. Treat and store boxes of ballots accordingly.


20. A word about precision. Poll workers report the number of voters, which should closely match the number of ballots in each precinct. A discrepancy of 3-4 ballots can happen in a busy precinct. I've been a poll worker. Voters are coming and going, getting regular ballots, provisional ballots, etc. and asking questions. However a discrepancy of 20-200 ballots needs an outside investigation, like any management failure or possible crime. If officials lose ballots or records, voters and law enforcement need to insist on better practices and new officials before the next election.



Like:††† †††††††††Comments & questions:


[1] Hand-counting is more common in small towns and parliamentary democracies, where voters choose only one member of Parliament.

[2] Map summarizing state rules for election audit is at

An international group discusses wide-ranging election problems and procedures to address them. At this writing it seems to have been hacked(!), and an archive copy is at

A US group offers expert answers to election questions


[4] NASS Survey on Cast Ballots as Open Records, Responses received as of March 29, 2007

[5] Reporters' Committee for Freedom of the Press

[6] Table of state laws and court decisions at

Discussion of Florida 2000:


[8] Some voting machines, such as iVotronic, print votes on long rolls of paper (300 feet), which a few scanners can handle:

       Fujitsu fi7600 can process up to 200 meters of paper tape without cutting it, and can divide the image into sections of any length up to 220 inches. Normal speed is 100 pages per minute, or 850 inches per minute, so 300 feet in 4.2 minutes, $4,155.

       Contex IQ 2490 can pull paper through at 14 inches per second, so 300 feet in 8.6 minutes, $3,895

       HP T830 can process 4.5 inches per second, so 300 feet in 27 minutes, $3,245

Save money by rental, if possible, or by re-selling scanner after the election, or by transferring it to an office which would otherwise buy a new one.

Scanning rolls of music for player pianos is an avocation which has addressed some of these same issues.

[9] Laws interpreted to allow scanning:

[10] Sample FOIA request language:

       FL 2020:

       SC 2020 county:

       SC 2020 state:

       OH 2018 or

       AZ 2016:


[12] 52 USC 20701, formerly 42 USC 1974. Pages 75-79 of Federal Prosecution of Election Offenses have a detailed discussion, and mention criminal penalties up to a year in prison. Election officials must "take appropriate steps to ensure that those records will be preserved intact until such time as they may become needed to resolve legitimate questions that frequently arise involving the election process."

[13] Marlow, Burns (2017) Journal of Intellectual Property Law "Fundamental, Unequivocal, Yet Unreliable: The Interplay of Voting, Electronic Voting Systems, and Trade Secrets in Today's Interconnected World

[14] Comparison of exit polls and official returns:

[15] Local exit polls:

[16] Changing national exit polls:

[17] Hand counts can be by

       Sort and stack

       One person reads each ballot's votes to another, who makes tally marks on a page; both need to be watched to ensure they read and mark accurately problems shown in

       Teams, with 2 people pressing clickers for each candidate, and and video documenting each ballot video of room

[18] Clear Ballot (2021) 

Lutz, Ray (2021)

Trachtenberg, Mitch. (2013-11-23). Democracy Counts

Free & Fair. (2018). "Open and Free Election Technology."

OSET Institute (2021 under development)

[19] Zetter, Kim (2008-12-08). "Unique Transparency Program Uncovers Problems with Voting Software". Wired. ISSN 1059-1028.

[20] "counties have discretion in managing the settings and implementing manufacturers' guidelines"

"Ballot Now was unable to detect at least 90 percent of each "target box"... Ballot Now (in autoresolve mode) confirmed and recorded the damaged contests as undervoted."


[22] Examples of blocked or faulty scanner sensors include:

        Washington: Gideon, John (July 5, 2005). "Hart InterCivic Optical-Scan Has a Weak Spot".

        Maryland: Walker, Natasha (February 16, 2017). "2016 Post Election Audits in Maryland" (PDF). National Institute of Standards and Technology.

        Maryland: Ryan, Tom and Benny White (November 30, 2016). "Transcript of Email on Ballot Images" (PDF). Pima County, Arizona..

[23]Using automatically created digital ballot imagesto verify voting-machine output in Wisconsin,

[24] Reconstructed ballots are ballots created by election staff when originals cannot be counted for some reason, such as tears, water damage or folds which prevent feeding them through election machines. As many as 8% of ballots in an election may be reconstructed. White, Rebecca (2019-11-18). "One Washington County Plans to Speed Vote Counting with Tech". Government Technology

"Roughly 2,000... ballots were damaged and reconstructed... ballots have to be recreated in every election for a number of reasons, ranging from damaged mail-in ballots, to early voters who use pencils which canít be read by ballot tabulators." Jordan, Ben (2018-11-07). "MKE Election Commission responds to criticism". WTMJ TV Milwaukee.

Duplicate ballot procedures in Michigan

Duplicate ballot procedures in Ventura County, CA

[25] "With the new digital procedure, staff will be able to fix whatever race couldnít be counted, instead of duplicating a voterís entire ballot." White, Rebecca (2019-11-18). "One Washington County Plans to Speed Vote Counting with Tech". Government Technology

[26] "perform the audit that you are able to" Vora, Poorvi (November 6, 2016). ""Exhibit B. Pages 20-23 in Lamone, Linda H. (December 22, 2016). "Joint Chairman's Report on the 2016 Post-Election Tabulation Audit" (PDF). Maryland State Board of Elections.

[27] When there are enough errors to switch the winner, the probability of catching at least one of those errors depends on the victory margin and the sample size. It is 1-(1-margin/2)sample size So if margin is 2%, which is 0.02, formula is 1-(1-0.02/2)500 = 1-(1-0.01)500 = 1-(0.99)500 = 1-(0.00657) = 0.99343 = 99.343%. If two or more candidates can win the same contest, like many school board members, the margin is between the lowest winner and highest loser.

[28] Rebecca Mercuri points out that election staff are used to ignoring small discrepancies. Normally they must, to get results done. She expects them to ignore even 10 discrepancies found by a random sample, which undermines the reliability of the sample.

[29] Hyergeometric distribution shows the chances of finding any specific sample of items from a distinct category, like flawed scans (k flaws in sample), depending on sample size (n), total number in the distinct category (m flaws total), and total number of all items (N ballots). For example if total scans=100,000=N, and assuming total flawed scans =1,000=m=1%, and sample size=200=n, then a calculator at shows 13% chance of exactly 0 flawed scans (k=0). The calculator also shows 27% chance of 1 flawed scan (k=1) and another 27% chance of 2 flawed scans (k=2). These numbers leave 33% chance of 3 or more flawed scans. The sample needs to be completely random, not clustered, and then it will catch flaws whether these too are random, or are clustered in one or a few scanners. A clustered sample would have more complex formulas and much less chance of catching clustered flaws.

[30] Pages 1 and 3 of Stark, Philip (March 16, 2012). "Gentle Introduction to Risk-limiting Audits" (PDF). IEEE Security and Privacy

[31] RLA sample "is highly dependent on the margin of victory in any given audited contest... A very close margin of victory could... require days of staff work, possibly compromising the local certification deadline." Maryland State Board of Elections (October 21, 2016). "Post-Election Tabulation Audit Pilot Program Report"

[32] Lindeman et al. (January 3, 2018). "Comments re statistics of auditing the 2018 Colorado elections" (PDF). Colorado Secretary of State

[33] "Roughly 2,000... ballots were damaged and reconstructed... ballots have to be recreated in every election for a number of reasons, ranging from damaged mail-in ballots, to early voters who use pencils which canít be read by ballot tabulators." Jordan, Ben (2018-11-07). "MKE Election Commission responds to criticism". WTMJ TV Milwaukee.

[34] Cobb, Sue (2016-10-17). "The 2000 Presidential Election Ė The Florida Recount". Association for Diplomatic Studies & Training.

[35] Baker, Deborah (2004-10-31). "ABQjournal: Contentious 2000 Election Closest in N.M. History". Albuquerque Journal.

[36] Table 3.1 in