← All posts

What if the public, not a vendor, owned the software that counts your vote?

Los Angeles County built the first publicly-owned, open-source vote-counting system certified in California — and it still doesn't solve the hardest problem. Here's what it does, and doesn't, prove.

It is August 21, 2018, and the California Secretary of State's office has just certified something that has never existed before in the state's history: a vote-tally system that no private company owns.

The software that will count ballots for roughly 5.7 million registered voters in Los Angeles County — the largest voting jurisdiction in the United States — belongs to the public. Its source code is not a trade secret locked in a vendor's server room. In principle, any qualified engineer can read it, inspect it, and tell you what it does.

That is a genuinely significant moment. It is also the beginning of a harder conversation.

The problem that made VSAP necessary

To understand why public ownership of voting software matters, you need to understand what private ownership has produced.

In 2006, Princeton researchers Ariel Feldman, J. Alex Halderman, and Edward Felten obtained a Diebold AccuVote-TS — one of the most widely deployed touchscreen voting machines in America — and spent about a minute with it. That was enough. They demonstrated that an attacker with brief physical access could install malicious code that stole votes while altering every internal log and counter to look normal. They even built a version that spread automatically from machine to machine. The software running that machine was proprietary. Nobody outside Diebold could inspect it. When researchers finally got hold of one, the results were not reassuring.

The proprietary model creates a structural problem: you cannot independently verify what you cannot see. A vendor's claim that their code is secure is not evidence that it is secure. A government certification that relies on the vendor's own documentation is not an independent audit. An official saying "we tested it" is not the same as the public being able to test it.

In 2005, the U.S. Government Accountability Office examined the security and reliability of electronic voting systems and found that key activities remained incomplete — including the establishment of proper certification procedures and repositories for certified software. This was years after Congress passed the Help America Vote Act and funded an entire agency to oversee these systems. The apparatus for verifying that voting machines worked as claimed was still being assembled.

"We use certified systems" is a claim. It is not a check.

What LA County actually built

The Voting Solutions for All People program — VSAP — was born from frustration with exactly this dynamic. Los Angeles County's aging Sequoia AVC Edge touchscreen voting machines were approaching end-of-life, and the market for replacement systems was dominated by a handful of private vendors whose software was protected as proprietary. The county decided to build its own.

The result, certified by the California Secretary of State on August 21, 2018, was VSAP Tally Version 1.0 — California's first certified election system to use open-source technology and, in the state's own words, "the first publicly-owned, open-source election tally system certified under the California voting systems standards."

The county also established an open-source work group intended to let other jurisdictions build on the publicly-owned code base. The vision was a commons: voting software that belongs to the democratic process itself, not to any company's balance sheet.

That is architecturally different from everything that came before it in California. It removes one layer of opacity that proprietary systems make unavoidable. And it matters.

But it is worth being precise about what it actually changes — and what it does not.

Open source removes one problem. It does not remove the problem.

Here is what open-source voting software genuinely accomplishes: it means the software that counts your vote can be read, analyzed, and criticized by anyone with the skills to do so. Security researchers, academics, rival vendors, foreign governments, curious citizens — all of them can, in principle, inspect the code and tell you if something is wrong.

This is not a small thing. It is exactly how Switzerland discovered a devastating flaw in its postal e-voting system in 2019. When Swiss Post published the source code of the Scytl-built internet voting system ahead of planned use in binding votes, independent researchers Sarah Jamie Lewis, Olivier Pereira, and Vanessa Teague analyzed it and found a cryptographic trapdoor: a flaw in the shuffle proof that would let an authority generate a transcript that looked mathematically valid while having silently altered votes. The system claimed to be universally verifiable. It wasn't. Swiss Post pulled the system. The flaw was found because the source was public.

A closed system cannot be caught this way. The trapdoor stays hidden until someone with insider access chooses — or is paid — to reveal it.

But open source is a starting condition, not a finishing line.

Consider what still has to be true for an open-source voting system to be trustworthy:

First, the code that runs on election day must actually be the code that was published. Open-source software is inspectable. The compiled binary running on a specific machine on a specific night is a different artifact. If you cannot verify that the published source and the running program are the same — through cryptographic hashes checked against the published code, sealed before deployment and verified after — then publishing the source is a transparency gesture, not a guarantee.

Second, the physical chain of custody still governs what the software counts. A ballot that is swapped, lost, or duplicated before it reaches the scanner doesn't care how open the tally software is. When the Austrian Constitutional Court annulled a presidential election in 2016, it wasn't because the software was wrong — it was because roughly 77,000 postal ballots had been handled before the law permitted, by unauthorized persons, without required witnesses. About 30,000 votes separated the candidates. The software could have been perfect and the result still would have been unverifiable, because the physical chain was broken. No amount of open-source code fixes a sealed bag opened in the wrong room at the wrong hour by the wrong people.

Third, auditing the output still requires a physical record the software cannot fake. An open-source tally system that produces only a digital number — no voter-verified paper trail, no independently checkable artifact — still leaves you trusting the machine's output. The German Federal Constitutional Court captured this in its landmark 2009 ruling: an election is only legitimate when "the essential steps of the voting and of the determination of the result can be examined by the citizen reliably and without any specialist knowledge of the subject." Reading source code requires specialist knowledge. Counting paper ballots does not.

The audit still has to happen — and it still carries error

Open source makes the system inspectable before the election. Audits make the output checkable after it.

Both matter. Neither one alone is sufficient.

Georgia's 2020 full hand count of roughly five million ballots confirmed the machine-tabulated outcome to within about a tenth of one percent — a powerful demonstration of what voter-marked paper plus a serious audit process can achieve. Colorado became the first state to complete a statewide risk-limiting audit in 2017, building in statistical rigor that fixed-percentage spot checks can't match.

But audits have limits that are rarely discussed honestly.

In Antrim County, Michigan, in 2020, a hand count meant to verify corrected machine results differed from the machine total by about a dozen votes out of roughly 15,700 cast. Not because of fraud. Not because of software. Because hand-counting is done by humans at 2 a.m. under fluorescent lights, reading marks that are sometimes ambiguous, applying judgment calls that vary from table to table. The hand count is the gold standard — and the gold standard is still off by a dozen votes in a small county.

In a race decided by fewer votes than that, "the hand count confirmed it" is a reassurance. It is not proof.

In Windham, New Hampshire, a state-ordered forensic audit traced a significant miscount to folds through ballot vote targets — a folding machine that creased absentee ballots across the oval targets, which the optical scanners read as marked votes. No malware. No fraud. A mechanical interaction between a leased folding machine and a ballot scanner's optical system, producing errors in the hundreds. Caught only because the paper existed and a hand count could recover voter intent.

The lesson is not "paper fails." The lesson is that every method — machine, hand count, or optical scanner — carries irreducible error, and the only honest system is one where those errors can be independently caught and measured, not just reassured away by officials.

What "publicly-owned" still can't tell you

Here is the question that VSAP's architects could not fully answer just by making the code public: who checks it, how often, and with what independence?

Publishing source code is necessary. It is not sufficient unless someone actually reads it — adversarially, with the goal of finding what's wrong rather than confirming what looks right. Brazil's Superior Electoral Court invites the public to attack its voting machines in an official annual security test, with qualified outside testers submitting approved test plans and findings used to improve the systems before each election. That is institutionalized adversarial review — not a certification, an ongoing challenge. It is a model where "trust us" is replaced by "try to break it."

Washington D.C. discovered something similar, the hard way, in 2010: when the District opened an internet ballot-return pilot to public testing before deployment, a University of Michigan team gained near-complete control of the server in roughly 48 hours, changed all ballots that had been cast, and went undetected for days. The vulnerabilities were caught because the testing was open and real. The system was never used for live voting. Public adversarial testing — not private certification — is what protected D.C. voters.

VSAP's open-source work group and public code repository are steps in this direction. But a code repository is not the same as an institutionalized adversarial testing program with public findings, mandatory remediation, and independent confirmation.

The question worth pressing: has the running version of VSAP Tally been independently and adversarially tested by parties with no financial relationship to the county or any vendor? Has every test plan and its findings been made public? Not the code — the specific binary that ran the last election, the chain-of-custody logs for every memory card, the hash values published before polls opened.

Those are not rhetorical questions. They are the checklist that separates "open source" from "independently verifiable."

The throughline from 2000 to today

The Help America Vote Act passed in 2002 as a federal response to the 2000 election, in which the Supreme Court found that identical punch-card ballots were being evaluated differently by different canvassers in different counties — dimpled chads counted here, rejected there — with no uniform, pre-published standard for reading voter intent. The problem wasn't fraud. It was ambiguity baked into the system, resolved by human judgment applied inconsistently, producing a result that depended on who was doing the counting in which room.

HAVA funded new equipment and created the Election Assistance Commission. It moved voting-system requirements toward a federal baseline. What it did not do — and what GAO documented three years later — was build the full apparatus for independent verification. Standards and certification are only as strong as the institution enforcing them, and that institution was still being assembled.

VSAP is a different approach. It says: instead of asking you to trust the vendor, we're asking you to read the code. That is progress. It is not the destination.

The destination is a system whose correctness any citizen can check — not by being a software engineer, but because the evidence chain from ballot to result is tamper-evident, machine-readable, and published at the precinct level the moment counting finishes.

Open-source tally software is one brick in that wall. Voter-verified paper records are another. Routine, independent, adversarial audits — not internal spot-checks — are a third. Cryptographic commitments that prove the published code is the running code are a fourth. Real-time, precinct-level, machine-readable results that anyone can download and reconcile independently are a fifth.

LA County built something genuinely important. It also built something that can still be obscured by a sealed room, a broken chain of custody, or a compiled binary no one checked against the published source.

The argument for VSAP is the same argument that has always been available: transparency beats secrecy. Open beats closed. Inspectable beats trust-me. What it is not is complete. And 'complete' is the only standard that lets the public — not a vendor, not a Secretary of State, not a judge — confirm that the count is right.

What still can't be verified independently: whether the specific compiled binaries that ran on VSAP machines on any given election night were cryptographically verified against the published open-source code before polls opened, and whether those verification records are publicly available in machine-readable form. What would make it checkable: a mandatory pre-election hash publication requirement, public adversarial testing with published findings, and precinct-level machine-readable results posted the moment each precinct's count is complete — so anyone can reconcile them.

See how the secret-source-code gap plays out across the world →

Read the two-minute version of the verifiability problem →

Explore our full case database →

Sources

See all postsExplore the gaps