EIIElection Integrity Index
How well does the legal framework defend against vote-altering attacks?
Dimensions
Citizen Verifiability
0.0% · 0/8| Datapoint | Score | Rationale & evidence | Source |
|---|---|---|---|
| 4.1Public verification artifactDoes law mandate a downloadable public package containing certificates, device records, and result signatures? | 0/10.0% | No section in the FTS-surfaced candidates satisfies this criterion. Best signal: Section 1307 addresses the voting process for military and emergency civilian absentee voters, including application procedures, ballot execution, and the custody of sealed envelopes. It does not address public verification artifacts, downloadable packages, certificates, device records, or result signatures. The section is focused on administrative procedures for absentee voting, not election result verification or transparency mechanisms. | § view source 2026-05-11 |
| 4.2End-to-end verifiability permittedDoes law permit (or require) per-voter cryptographic receipts that prove inclusion without revealing the vote? | 0/50.0% | No matching sections in corpus. | no FTS match 2026-05-11 |
| 4.3Voter-verifiable paper trailIs voter-verifiable paper record (VVPAT or hand-marked paper) legally required? | 0/10.0% | The section permits paper ballots as an alternative when electronic systems are impracticable, but it does not legally require a voter-verifiable paper trail in all elections or mandate that paper ballots be hand-marked by voters. The provision is permissive ("may arrange") rather than mandatory, and does not establish a binding requirement for voter-verifiable paper records. | § view source 2026-05-11 |
| 4.4Citizen re-tally rightCan any citizen — not just parties — legally re-tally from published precinct data? | 0/10.0% | No section in the FTS-surfaced candidates satisfies this criterion. Best signal: Section 1309-A is repealed and contains no substantive text. The section provides no information about citizen re-tally rights, published precinct data, or any election procedures. A repealed statute cannot satisfy any criterion. | § view source 2026-05-11 |
Custody Hardware
37.5% · 3/8| Datapoint | Score | Rationale & evidence | Source |
|---|---|---|---|
| 2.1Hardware tamper standardAre tamper-evident or tamper-responsive hardware standards mandated? | 2/540.0% | The statute mandates that election officers seal the voting machine and sign a certificate documenting the seal number, which establishes a tamper-evident seal requirement. However, there is no mention of tamper-responsive features, automatic quarantine, or logging mechanisms beyond the basic certificate. | § view source 2026-05-11 |
| 2.2Network isolation mandateIs internet/Wi-Fi/cellular connectivity legally prohibited on vote-casting equipment? | 0/10.0% | No section in the FTS-surfaced candidates satisfies this criterion. Best signal: This section addresses election notices for federal write-in absentee ballots, including preparation, distribution, and public availability of notices. It does not address vote-casting equipment, network connectivity, or any security measures related to voting machines or hardware isolation. | § view source 2026-05-11 |
| 2.3Custody documentationIs full chain-of-custody documentation required and publicly available? | 0/10.0% | The section requires designation of custody personnel and safe storage of voting systems and keys, but it does not mandate full chain-of-custody documentation or require that such documentation be publicly available. The statute addresses custody responsibility but lacks explicit requirements for documenting the transfer and handling of equipment. | § view source 2026-05-11 |
| 2.4Tamper criminal penaltyAre there explicit criminal penalties for unauthorized device access? | 1/1100.0% | This section explicitly establishes criminal penalties for unauthorized access to voting machines, including tampering, opening, injuring, or possessing keys without authorization. The penalties include fines up to $5,000 and imprisonment up to two years, directly addressing the criterion's requirement for explicit criminal penalties for unauthorized device access. | § view source 2026-05-11 |
Post Election Audit
22.2% · 2/9| Datapoint | Score | Rationale & evidence | Source |
|---|---|---|---|
| 3.1Mandatory auditIs a post-election audit legally required for every election? | 0/10.0% | Section 1602-A references post-election audits 'required under this act' but does not itself establish or mandate that audits must occur for every election. The provision assumes audits exist elsewhere in the code and only requires reporting of their outcomes. This section does not satisfy the criterion because it neither mandates nor guarantees that audits are legally required for every election. | § view source 2026-05-11 |
| 3.2Audit methodWhat audit method is mandated? | 2/540.0% | The section mandates a post-election audit using a fixed percentage (at least 2% of votes cast or 2,000 votes, whichever is lesser) hand recount with manual, mechanical, or electronic devices different from those used in the election. This is a fixed-percentage recount method, corresponding to score level 2. | § view source 2026-05-11 |
| 3.3Audit triggers beyond mandatoryDoes law trigger additional audits on close margins or sworn challenges? | 0/10.0% | No matching sections in corpus. | no FTS match 2026-05-11 |
| 3.4Public observation of auditAre parties, media, and citizens granted observer access to the audit? | 0/10.0% | No section in the FTS-surfaced candidates satisfies this criterion. Best signal: Section 912.1 addresses nominating petition signature requirements for primary candidates and has no connection to post-election audits, observer access, or audit procedures. This section governs candidate nomination processes, not election audits. | § view source 2026-05-11 |
| 3.5Binding forceAre audit results legally binding on the final certified result? | 0/10.0% | No section in the FTS-surfaced candidates satisfies this criterion. Best signal: Section 1635 establishes an audit function that produces findings reported to the Secretary of the Commonwealth and Attorney General, but it does not establish that audit results are legally binding on the final certified result. The statute describes audit procedures, reporting requirements, and the ability to initiate criminal prosecutions, but contains no language making audit findings modify, override, or legally bind the certification of election results. | § view source 2026-05-11 |
Software Verifiability
0.0% · 0/9| Datapoint | Score | Rationale & evidence | Source |
|---|---|---|---|
| 1.1Source code disclosureIs voting system source code legally accessible? | 0/50.0% | No section in the FTS-surfaced candidates satisfies this criterion. Best signal: This section addresses military-overseas ballot application procedures and email address collection by county election boards. It contains no provisions regarding voting system source code accessibility, disclosure to vendors, certifying authorities, academics, or the public. | § view source 2026-05-11 |
| 1.2Reproducible builds requirementMust the binary that runs in production be reproducibly buildable from public source? | 0/10.0% | No section in the FTS-surfaced candidates satisfies this criterion. Best signal: Section 1401 addresses the content and organization of voter registration records, including registration cards, digitized signatures, and SURE system information. It contains no requirements regarding reproducible builds, public source code, binary verification, or software development practices. This is a registration management statute, not a software development or procurement standard. | § view source 2026-05-11 |
| 1.3Pre-election binary commitmentIs the running binary cryptographically committed (hash published) before polls open? | 0/10.0% | No section in the FTS-surfaced candidates satisfies this criterion. Best signal: Section 1402 governs the physical organization, storage, and accuracy of district voter registration records and registers. It does not address software, binary commitments, cryptographic hashing, or any pre-election technical security measures for election systems. The criterion concerns cryptographic pre-election commitments to running binaries, which is entirely outside the scope of this registration record management statute. | § view source 2026-05-11 |
| 1.4Election definition publicationAre ballot contests, layouts, and tabulation rules signed and published before polls open? | 0/10.0% | No section in the FTS-surfaced candidates satisfies this criterion. Best signal: Section 1101-A provides definitions of election-related terms and equipment but does not address whether ballot contests, layouts, and tabulation rules are signed and published before polls open. This section establishes vocabulary for the Election Code rather than procedural or transparency requirements for pre-election publication of ballots or tabulation rules. | § view source 2026-05-11 |
| 1.5Post-election integrity checkDoes law grant a right to verify the actual running binary matches the committed one? | 0/10.0% | No section in the FTS-surfaced candidates satisfies this criterion. Best signal: This section of the Pennsylvania Election Code addresses enforcement jurisdiction, election integrity grant funding, and ballot canvassing procedures. It does not address software verification, binary code verification, or any requirement to verify that actual running software matches a committed or reviewed version. The grant program's eligible uses focus on staffing, physical security, and ballot handling—not software integrity verification. | § view source 2026-05-11 |
Transparency Observation
37.5% · 3/8| Datapoint | Score | Rationale & evidence | Source |
|---|---|---|---|
| 6.1Domestic observer rightsAre party and civil-society observers given full procedural access? | 1/1100.0% | Section 1308(b) explicitly grants watchers the right to be present during the opening of ballot envelopes and the counting and recording of absentee and mail-in ballots. This directly addresses observer access to critical procedural stages of vote handling and canvassing. | § view source 2026-05-11 |
| 6.2International observer accessAre OSCE/EU/IFES international observers admitted by default? | 0/10.0% | No matching sections in corpus. | no FTS match 2026-05-11 |
| 6.3Precinct-level results publication speedAre precinct-level results legally required to be published within 24h of poll close? | 2/540.0% | Section 302(k) requires county boards to certify results to the Secretary of the Commonwealth, but the deadline is 'no later than the third Monday following' the election, which is approximately one week or longer—not within 24 hours. Subsection (l) requires public announcement of results by posting at the board's office, but no specific timeline is mandated for this posting. The statute addresses result publication but does not meet the 24-hour requirement. | § view source 2026-05-11 |
| 6.4Public election event logIs a public, signed, append-only election event log legally required? | 0/10.0% | No matching sections in corpus. | no FTS match 2026-05-11 |
Vendor Independence
25.0% · 1/4| Datapoint | Score | Rationale & evidence | Source |
|---|---|---|---|
| 5.1Multi-vendor capabilityDoes law permit multiple certified vendors to operate in the same election? | 0/10.0% | Section 1106 governs the approval and examination of voting machines by the Secretary of the Commonwealth, establishing criteria for certification and prohibiting use of unapproved machines. However, the section does not directly address whether multiple certified vendors may operate simultaneously in the same election. The statute contemplates approval of different "kinds" of machines and allows for examination of machines from any "person or corporation," but it does not explicitly permit, restrict, or address the concurrent operation of multiple vendors in a single election. | § view source 2026-05-11 |
| 5.2Open protocol standardsAre vote-format / device-protocol standards open and publicly documented? | 0/10.0% | The statute requires development and publication of voting standards in the Pennsylvania Bulletin, establishing a mechanism for public documentation. However, the section does not explicitly require that these standards be 'open' in the sense of allowing independent implementation or modification, nor does it specify technical openness regarding device protocols. The focus is on uniform vote-definition standards rather than open protocol specifications for voting devices themselves. | § view source 2026-05-11 |
| 5.3Contract duration capAre vendor contracts capped in duration, preventing perpetual lock-in? | 1/1100.0% | The statute explicitly prohibits certified public accountants or accounting firms from obtaining contracts for two successive contract periods, thereby capping contract duration and preventing perpetual lock-in of any single vendor. | § view source 2026-05-11 |
| 5.4Source-code escrowIs source-code escrow with the state required as a condition of certification? | 0/10.0% | No matching sections in corpus. | no FTS match 2026-05-11 |
Voter Access
42.9% · 3/7| Datapoint | Score | Rationale & evidence | Source |
|---|---|---|---|
| 7.1Ballot secrecy guaranteeIs voter–ballot unlinkability legally guaranteed and enforceable? | 1/1100.0% | Section 1107(i) explicitly mandates that voting machines must 'permit and require voting in absolute secrecy' and be constructed so that no person can see or know how any other elector has voted. This directly guarantees voter–ballot unlinkability by requiring physical and operational separation of the voter from any record linkable to their vote, enforced through machine design requirements. | § view source 2026-05-11 |
| 7.2Accessibility mandateAre accessibility standards (vision, motor, language) legally required at every polling place? | 2/540.0% | The statute mandates assistance for voters with specific disabilities (blindness, physical disability, inability to read/write) and allows selection of a personal assistant, addressing motor and vision accessibility. However, it does not establish comprehensive accessibility standards required at every polling place (such as accessible equipment, materials in alternative languages, or universal design requirements), nor does it mandate pre-election planning or accessibility audits. | § view source 2026-05-11 |
| 7.3Polling-place density floorIs there a legal floor on polling places per N voters or per geographic area? | 0/10.0% | No section in the FTS-surfaced candidates satisfies this criterion. Best signal: This section addresses the procedural requirements for submitting a referendum question to voters about whether to adopt an electronic voting system. It does not establish any legal floor or minimum standard for polling-place density, nor does it regulate the number of polling places per voter or per geographic area. The criterion concerns polling-place accessibility and distribution, which is outside the scope of this referendum procedure statute. | § view source 2026-05-11 |