← All posts

Chain of custody: the boring paperwork that decides if you can trust an election

An election was annulled across an entire country — not because anyone cheated, but because nobody could prove they hadn't. Here's the paperwork that makes the difference.

It is just before 9 a.m. on May 23, 2016, and in a district election office somewhere in Austria, a member of the electoral board is doing something that is strictly against the law.

The postal ballots have arrived. The sealed outer envelopes — each one a small paper fortress around a citizen's vote — are sitting on a table. The law says those envelopes cannot be touched until the day after the election. It says the only people permitted to open them are the district electoral authority. It says witnesses must be present. It says a log must be kept.

None of that happened.

The board member opens the envelopes anyway. Maybe there is pressure to get the count moving. Maybe it feels like a trivial shortcut. Maybe nobody expects it to matter.

Six weeks later, Austria's Constitutional Court annulled the entire presidential run-off election.

What a custody chain actually is

Before we get to courts and consequences, let us be precise about what we are talking about — because "chain of custody" sounds like legal jargon and is actually something much simpler.

A custody chain is the documented record of who touched something, when, under what authority, and with what witnesses. It is what makes a piece of physical evidence usable in court. It is what makes a blood sample trustworthy in a trial. It is what makes a ballot, after it has passed through a dozen pairs of hands across several days, still provably the same ballot a citizen placed in a box.

Without it, you cannot distinguish "nothing happened" from "something happened and nobody caught it."

That distinction is everything. And it is exactly what the Austrian Constitutional Court was ruling on.

Austria 2016: the custody chain breaks, and the result breaks with it

The Austrian presidential run-off of May 22, 2016 was extraordinarily close. Alexander Van der Bellen defeated Norbert Hofer by roughly 30,000 votes — a margin of less than one percentage point in a national election.

Postal ballots were central. Hundreds of thousands of Austrians voted by mail. Austrian law was specific about how those ballots had to be handled: the outer envelopes could not be opened before 9 a.m. the day after the election, only by the district electoral authority, only with the required board members present, only with witnesses.

The Constitutional Court, examining challenges to the result, found in its decision W I 6/2016-125 that in multiple districts, those rules had been broken. Votes were counted prematurely. Unauthorized persons had handled the envelopes. Required witnesses were absent. There was no proper log.

Roughly 77,000 votes were affected by proven procedural violations — more than double the winning margin.

The Court found no evidence of actual fraud. Let that sit for a moment: the election was annulled without a single altered ballot being identified. The problem was that the broken custody chain made it impossible to rule out that ballots had been tampered with. Proof of innocence and proof of guilt require the same thing: a documented, unbroken record of who had access to what, and when.

A new run-off was held on December 4, 2016. The entire country voted again because of record-keeping failures in a handful of district offices.

The two things a custody chain is doing at once

Here is what makes the Austrian case so clarifying: the chain of custody was not broken in order to commit fraud. It was broken because some officials treated the rules as bureaucratic formalities rather than integrity mechanisms.

This is the misunderstanding at the heart of most custody-chain failures.

The rules exist to serve two completely different purposes simultaneously, and both are essential.

First: preventing fraud. If ballots can only be touched by authorized people, at authorized times, in front of witnesses, the window for tampering is narrow and witnessed. There is always someone in the room. There is always a name in the log.

Second: proving fraud did not occur. This is the half people routinely forget. After an election, if someone challenges the result, the only way to demonstrate that no tampering happened is to produce the complete, unbroken record showing every hand that touched every ballot. No record, no proof. Not proof of fraud — proof of the absence of fraud.

Break the chain for convenience, and you have destroyed the evidence that would have cleared you.

Austria's Constitutional Court understood this perfectly. Its ruling was not about what happened to those 77,000 ballots. Its ruling was about the fact that what happened to them could no longer be established. That uncertainty, in a race decided by 30,000 votes, was legally and democratically fatal.

Tower Hamlets 2014: when the chain breaks for a different reason

Austria shows us what happens when the custody chain breaks through carelessness. Tower Hamlets shows us what happens when it breaks through design.

In May 2014, Lutfur Rahman was elected executive Mayor of the London Borough of Tower Hamlets. In April 2015, an Election Court presided over by Commissioner Richard Mawrey QC voided that election entirely.

The judgment in Erlam & Ors v Rahman & Anor [2015] EWHC 1215 (QB) found a remarkable catalogue of corrupt and illegal practices: personation, postal-vote fraud, bribery, treating, false statements, and undue spiritual influence. The court found general corruption so extensively prevailing that it could reasonably be supposed to have affected the election. Rahman was removed from office.

Postal voting was at the heart of it. And this is the structural problem that postal voting creates in any system without robust chain-of-custody controls.

When you vote in a polling station, there is a chain of custody built into the physical environment. You are alone in a booth. Nobody is watching your hand. Nobody collects your ballot before it goes into the sealed box. Nobody takes it home and brings it back later.

When you vote by post, the ballot leaves the controlled environment. It travels through the mail. It may sit in someone's house. It may be filled in with other people present. There may be someone in the room — a family member, a community organizer, someone who drove the voter to their appointment — who can see what is marked, or who fills it in themselves.

The postal ballot's entire integrity depends on what happens before it ever arrives at the counting table. And that is precisely the segment of the custody chain that is hardest to witness, log, and verify.

North Carolina's 9th Congressional District in 2018 encountered the same vulnerability. A coordinated absentee-ballot scheme — collecting ballots, sometimes completing them, sometimes simply discarding unfavorable ones — led the State Board of Elections to order a new election entirely. The method the fraudsters exploited was the gap between a ballot leaving the voter's hands and arriving at official custody.

The lesson in both cases is identical. The chain of custody must cover the entire journey of the ballot — not just the part that happens in the counting room.

What "who may touch it, when, and how it's proven" actually means in practice

Chain of custody in an election is not one rule. It is a system of interlocking requirements, each of which closes a different gap.

Authorization: Only specific, named individuals with specific roles may handle ballots at each stage. "The election office" is not a person. There must be a name, a role, and a record.

Timing: Actions may happen only at specified times. Austria's rules were not about distrust of particular officials — they were about ensuring the count could not begin until the legal window opened, so that the sequence of events was provable afterward.

Witnessing: Most handling steps require at least one observer from outside the immediate team — a representative of a different party, an independent witness, a member of the public. The Austrian violations included counts conducted without required witnesses. That witness is not there to be useful in the moment. They are there to be useful six weeks later, when someone asks what happened.

Sealed containers: Physical tamper evidence. A ballot box sealed before it leaves the polling station and arriving at the counting room with the seal unbroken is a statement in the custody record. A box arriving with the seal broken needs an explanation in the record. The explanation is part of the chain.

Logging: A contemporaneous record of every step. Not a memory. Not an approximation. A signature, a time, a description of what was done and by whom. The log is the custody chain made physical.

Break any link in this system and you have a gap. A gap means the period covered by the break is unverifiable. And an unverifiable period, in a close election, is legally indistinguishable from an opportunity for fraud whether or not one was taken.

The uncomfortable math of hand counts and custody

There is a version of this story that ends with: "and then officials hand-counted everything and confirmed the result." Courts say it. Secretaries of State say it. And it is worth being precise about what that claim does and does not establish.

Georgia's statewide hand count of roughly 5 million ballots in 2020 was an extraordinary undertaking — 159 counties, 41,881 batches, completed in under six days. The hand count confirmed the machine-tabulated result to within about a tenth of one percent. That is genuinely meaningful. A physical paper ballot, independently counted, is the backbone of any serious verification regime.

But a hand count is only as good as the custody chain behind it. If you do not know that every ballot in those 41,881 batches is the same ballot that was cast — if there is any unlogged, unwitnessed gap between a voter's hand and the counting table — then the hand count is confirming the integrity of whatever is in the boxes, not necessarily the integrity of what voters submitted.

This is not a hypothetical. In Antrim County, Michigan in 2020, a hand audit of presidential ballots produced a final count that still differed from the machine tabulation by about a dozen votes out of roughly 15,700 cast. Twelve votes. In a small county, in a race not decided locally. But twelve votes is a reminder that the hand count — the gold standard — carries its own irreducible human error: a ballot misread, a stack miscounted, an ambiguous mark adjudicated differently by two different people.

In a race decided by a handful of votes, a verification method that is itself off by a handful of votes cannot settle the question. "The hand count confirmed it" and "the Secretary of State says it's fine" are reassurances. They are not proof. The thing that turns a reassurance into proof is an independent, unbroken record that any observer can check — not because they trust the official who produced it, but because the record is structured so that tampering would leave a detectable trace.

Colorado's risk-limiting audit framework points in the right direction: statistically rigorous sampling, sized to the margin of the race, conducted against a durable paper record. But even an RLA requires that the paper record itself traveled an unbroken chain from the voter's hand to the auditor's table.

The chain of custody is not the alternative to the audit. It is the precondition of the audit.

What makes a custody gap checkable — and what doesn't

The Austrian case produced something rare and clarifying: a constitutional court that articulated, in writing, exactly why procedural compliance is not a formality.

The Court's reasoning was not "we found fraud." It was: the required safeguards were not followed in ways that affected a number of votes larger than the winning margin, and therefore the result cannot be verified. The result cannot be verified not because the Court suspected manipulation — it expressly found none — but because verification is only possible when the record is complete. A partial record produces partial confidence at best.

This is the same logic the German Federal Constitutional Court applied in 2009 when it held that electronic voting machines were unconstitutional because ordinary citizens could not independently verify the essential steps of the vote — not because any machine had malfunctioned, but because the architecture made verification impossible. The Kenyan Supreme Court reached the same conclusion in 2017 when it annulled a presidential election because the digital chain from polling station to national tally could not be independently checked.

The throughline across Vienna, Nairobi, and Karlsruhe is identical: a result that cannot be independently verified is not a result a democracy can act on.

The fix is also the same in each case. It is not "trust us — we checked." It is a system designed so that checking is possible without trusting anyone in particular. Instant, precinct-level results published in machine-readable form. Tamper-evident ballot handling with contemporaneous logs anyone can request. Audit trails structured so that any gap in the record is as visible as any gap in the count.

The chain of custody is boring paperwork until it is the only thing standing between a legitimate election and one nobody can defend.

What is still not checkable — and what would change that

Here is what the Austrian Constitutional Court's ruling did not do: it did not create a system in which the next Austrian election's custody chain is independently verifiable by anyone who wants to check.

It produced a new election. It did not produce a new architecture.

In most jurisdictions that run postal ballots, the log of who handled a ballot, when, and with what witnesses is an internal administrative document. It may or may not be consistently maintained. It may or may not be publicly requestable. There is no standardized, real-time, machine-readable publication of custody events that any observer could download and verify.

That is what is still missing. The gap between "we followed the rules" and "here is the unalterable, publicly verifiable record proving we followed the rules" is the gap that produced Vienna 2016, Tower Hamlets 2014, and North Carolina 2018 — and that will produce the next one.

The tools to close that gap exist. Cryptographic logging of custody events. Real-time, signed records of which authorized person touched which sealed container at what time. Machine-readable audit trails published at the moment each custody step occurs, not reconstructed afterward. Not because any specific official is untrustworthy — but because a system in which trust is required is a system in which trust can be misplaced, and in which mistakes and misconduct are indistinguishable until it is too late.

A chain of custody that anyone can check is not a chain of custody that anyone can quietly break.

See how common this gap is across the world →

Read the 2-minute version of the verifiability problem →

Explore the full chain-of-custody gap →

Sources

See all postsExplore the gaps