← All posts

What a fully verifiable election would actually feel like to a voter

What would it actually feel like to vote in a system you could verify yourself — not by trusting an official, but by checking the math?

It is a weekday morning in Brasília, and a group of people who are not election officials are being handed the keys to the machine.

Not metaphorically. A qualified investigator — a computer scientist, an independent researcher, a citizen whose test plan was approved — is sitting in front of Brazil's urna eletrônica, the electronic voting machine used by over 150 million voters. She has been told, officially and in writing, to try to break it. The Tribunal Superior Eleitoral, Brazil's Superior Electoral Court, has published the rules, opened the doors, and invited the public in. Whatever she finds, the TSE commits to fix before the next general election.

This is the Teste Público de Segurança — the Public Security Test — which Brazil has run since 2009. It is regulated by TSE Resolution 23.444/2015 and covers the entire electoral lifecycle: ballot-media generation, voting, tabulation, file transmission, and the audit systems used to check the electronic count. Findings are used to improve the systems. Fixes are re-checked in confirmation testing before the election. No closed room. No vendor's word for it.

You might wonder: what does any of this have to do with you, the voter?

Everything.

What "verifiable" actually feels like from where you're standing

Most voters experience an election the same way. You walk in, you mark something, you leave. Maybe you get a sticker. A few days later, someone announces a winner.

At no point in that sequence can you confirm — personally, independently, without calling a hotline or trusting a press release — that your vote was counted, that it was counted correctly, and that the final total reflects what all the voters in your precinct actually chose.

That's not paranoia. It's a description of how nearly every existing election system works. The count happens somewhere else, to something you no longer possess, by a process you cannot directly observe.

The question a fully verifiable election has to answer is: what would have to be true for you to check it yourself, right now, with your own eyes?

That question is harder than it sounds. And a few places around the world have started to answer it concretely.

The scene in Brasília, and what it proves

Brazil's public security test is not a press-release exercise. Qualified investigators submit test plans, gain access to the actual systems, and execute their attacks under monitored conditions spanning the full electoral lifecycle. The TSE publishes the program and its results. It is institutionalized adversarial review — the election authority treating its own systems as suspect until outsiders have tried to break them.

This matters for a specific reason: it changes what "certified" means.

In Ireland in 2004, a state commission couldn't recommend an e-voting system the government had already paid for, because it could not independently satisfy itself as to the accuracy and secrecy of the system. The system was never used. In Germany in 2009, the Federal Constitutional Court ruled that electronic voting is only legitimate when ordinary citizens — not just experts — can check the essential steps of the count without specialist knowledge. The Dutch government's own advisory commission concluded the same year that there are no secrets in the election process and that any method acceptable to democracy must produce results that are answerable and verifiable by the public.

Certification by a single authority, once, before deployment, is not what these courts and commissions were asking for. They were asking for something ongoing, open, and independently checkable.

Brazil's test, imperfect as any human institution is, points at the right target: you invite the public to attack your system, you fix what they find, and you document the whole thing. That's not trust. That's verification.

The concrete voter experience: what changes when a system is built this way

Let's make this physical. Picture the experience of voting in a system designed from the ground up for public verifiability.

You arrive at a polling place. The machines running the count are built on publicly owned, open-source software — meaning the code that tallies your vote is not a trade secret. Anyone can read it, compile it, and confirm that the version running today is the version that was inspected. Los Angeles County's Voting Solutions for All People (VSAP) — the first publicly owned, open-source vote-tally system certified in California, certified by the Secretary of State on August 21, 2018 — took exactly this step: the county established an open-source work group so independent experts could inspect what was running, not just take the vendor's word for it.

You mark your ballot. In a well-designed system, the artifact you mark is the artifact that gets counted. Not a QR code only a machine can read — a federal court in Georgia found in 2020 that Georgia's ballot-marking devices relied on a QR barcode for vote tabulation that the voter cannot read and verify, meaning the physical paper was not actually the thing being counted. In a verifiable system, what you mark and what gets scanned are the same human-readable thing.

You deposit your ballot into a tamper-evident sealed box. The seal number is recorded. You can note it.

Your precinct counts its ballots. The result — not just the winner, but the full precinct-level breakdown, in machine-readable format anyone can download — is published the moment it is final. Not aggregated upward into a county total that appears hours later with no granular backup. Your precinct's numbers, right there, downloadable, reconcilable by any spreadsheet.

After the election, an independent audit draws a statistically determined sample of physical ballots and checks them against the machine count. Not because fraud is assumed, but because that's how you confirm a result instead of just announcing one. Colorado became the first state to run a statewide risk-limiting audit in 2017 — a method that sizes the hand check to the margin of the race, giving a defined statistical confidence level, not a fixed percentage spot-check that proves almost nothing in a close contest.

At every step, the chain of custody is documented and public: who sealed the box, who transported it, who opened it, who witnessed. Austria's Constitutional Court annulled a presidential election in 2016 — not because fraud was proven, but because absentee-ballot envelopes were opened and votes counted by unauthorized people without required witnesses, in numbers exceeding the winning margin. The chain of custody failed, and when it fails, a result cannot be trusted even if it happens to be right.

The number you can verify yourself

Here is the version of election night that verifiability makes possible.

Your precinct closes at 8 p.m. By 8:45, the hand-count tape from the optical scanner is posted on the wall of the polling place, the way many jurisdictions already require. A few minutes later — or that same night — the precinct result is published online in a downloadable file.

You go home. You open a browser. You pull up the precinct-level results file. You find your precinct. You check the numbers against what you saw posted at the polling place.

They match.

Now you check all the precincts in your county. You add them up. You get the county total. You check it against the county's published total.

It matches.

Anyone in the country can do this simultaneously. Journalists. Academics. Random retired accountants. Political party volunteers. A result no one can privately alter because thousands of people are watching the arithmetic from the outside is a fundamentally different thing from a result you are asked to trust.

The U.S. Election Assistance Commission already urges officials to make results downloadable in common formats — .csv, .xml — and to state which ballot types each report includes. Idaho publishes precinct-level results with downloadable raw data. These are the building blocks. The architecture is not science fiction.

What open code actually buys you — and what it doesn't

LA County's VSAP is worth dwelling on for a moment, because it demonstrates both the power and the limits of open-source software in elections.

Public ownership of the source code means the software counting the votes can be inspected by independent experts. No trade-secret shield. No "trust the vendor." When Coffee County, Georgia's proprietary voting system was copied and leaked in January 2021 — a forensics team walked out with the Election Management System, poll pads, ballot-marking devices, and Georgia's statewide Dominion software — the episode showed exactly how fragile secrecy is as a security strategy. Secrets leak. Open code doesn't need to be kept secret; it needs to be correct.

But open code alone is not enough. The Swiss Post internet-voting system had its source code published in 2019. Independent researchers Sarah Jamie Lewis, Olivier Pereira, and Vanessa Teague found that the shuffle proof relied on a trapdoor commitment scheme — meaning an authority who knew the trapdoor values could generate a proof that passed verification while having actually altered votes. The code was public. The flaw was still there. Swiss authorities suspended the system.

Open code is necessary. It is not sufficient. The code that runs on election day also has to be the code that was inspected — which requires reproducible builds, chain-of-custody controls for the compiled software, and independent confirmation that what's on the machine matches what's in the repository.

And beyond the software: the physical chain of custody for every ballot, the independence of auditors, the public granularity of results, and the existence of a durable paper record that the audit can check against — all of these are required. Leave any one out, and the remaining pieces don't add up to verifiability.

The parts the voter still cannot check today

Here is where intellectual honesty requires us to stop describing the possible and start naming the gap.

Even with open source code, public precinct-level results, paper ballots, and statistical audits, most voters in most elections today cannot independently verify the following:

That the software running on election day is the software that was inspected. Reproducible builds — the technical process of confirming that a compiled program matches the inspected source — are not yet standard practice in election administration anywhere in the United States.

That the paper ballot they marked was the ballot that entered the count. A risk-limiting audit checks a statistical sample. Georgia's 2020 hand count of roughly five million presidential ballots — 41,881 batches over less than six days — confirmed the machine total to within about a tenth of one percent. That's impressive. But Windham, New Hampshire's 2021 forensic audit found that a fold line and some dust on a scanner lens had miscounted hundreds of validly marked ballots, with no fraud, no malware, and no one catching it until afterward. The error was only recoverable because the paper existed and a hand count could recover voter intent. The audit worked — but it required someone to order it. In most elections, no one does.

That precinct-level results are published promptly in machine-readable form. Many jurisdictions still don't do this. The EAC recommends it. Some states do it. Most don't, or do it days later, or publish formats that require specialized tools to parse.

That the audit is independent. An audit run by the same officials who ran the election, checking their own work, with no independent third party verifying the process, is a reassurance — not a proof. Germany's Constitutional Court put this plainly: if only an expert designated by the authority can check the count, it is not a public election in any meaningful constitutional sense.

What would make it checkable by anyone — right now

The checklist is not long. None of it requires new technology that doesn't exist.

Publicly owned, open-source software, compiled reproducibly. So that the code counting votes is the code that was inspected, verifiable by anyone with a compiler.

Hand-marked paper ballots as the artifact of record. Not a QR code. The thing the voter touches is the thing that gets counted — and can be recounted, by hand, by anyone who is allowed to observe.

Precinct-level results published on election night in machine-readable formats. Every precinct. Every ballot type. Downloadable. Reconcilable. So that the county total is a sum anyone can independently verify.

Mandatory, independent risk-limiting audits before certification. Sized to the margin. Run by auditors who are not employed by the authority being audited. With results published in full.

A documented, public chain of custody for every ballot and every memory card — from the polling place to the canvass to the archive — so that the physical evidence can be traced, and any break in the chain is immediately visible.

Institutionalized public adversarial testing of the software and systems, on a regular cycle before every election. Not because the authority is dishonest. Because an invitation to break the system is the only way to prove it hasn't been broken.

Brazil runs the test. Los Angeles opened the code. Colorado built the audit. None of them did all of it together.

A voting system you can verify is not a system you trust because an official told you to. It is a system whose arithmetic you can check yourself, right now, with a spreadsheet and a public download.

That system exists in pieces. It does not yet exist whole. The pieces are not classified. They are not even expensive. What's missing is the political will to assemble them — and the public demand to insist on it.

See how common this gap is across countries →

Read the 2-minute version of the verifiability problem →

Explore the full gap database →

Sources

See all postsExplore the gaps