Software you're not allowed to check
The machine that counts the votes follows secret instructions. If no one outside the company is allowed to read those instructions, no one can be sure the votes are counted fairly.
What actually happened
In a landmark 2006–2007 study, Princeton researchers obtained a widely-used Diebold AccuVote-TS machine and showed that someone with brief physical access could install vote-stealing code that rewrote all the machine's own records to hide the theft — exactly the kind of flaw that public source review exists to catch.
Where it stands today
That specific paperless touchscreen machine is now largely retired — about 98% of votes in the 2024 U.S. general election were cast on paper. But the gap itself has not closed: the three vendors that run roughly 90% of U.S. voting today (Dominion, ES&S, Hart) are all privately held and keep their source code from being opened to public review. The 86% figure above is measured from today's election law, not 2006.
Imagine a referee no one can watch
A voting machine is like a referee in a game. It decides who won. Now imagine the referee keeps their rulebook locked in a drawer and won't let anyone read it. You just have to trust that the rulebook is fair.
That's how most voting machines work today. The software — the instructions that add up the votes — is closed. Only the company that made the machine can see it. Voters, election officials, and independent experts usually cannot.
Why it matters
If a mistake (or a deliberate change) is hidden inside that secret software, there is no one outside the company who can find it. Researchers have repeatedly shown that when they do get to examine real machines, they find serious flaws — and malicious code can even rewrite the machine's own logs to cover its tracks.
The point isn't that every machine is rigged. The point is simpler: if you can't check it, you can't prove it's right. Trust should not be required where proof is possible.
How TrustVoting closes it
TrustVoting is built on a simple commitment: the code that counts your vote should be open — published in full, with reproducible builds so anyone can rebuild it and get the identical program (not just read it and hope).
On top of that, a cryptographic integrity layer — checksums and an attested boot — lets each machine prove it's running exactly that published, reviewed version, and nothing swapped in later.
That's the chain that replaces trust with proof: open code anyone can inspect → a build anyone can reproduce → a machine that proves it's running it. Open source alone isn't enough (the source has to match the running machine), and checksums alone aren't enough (you'd be trusting code you can't see) — you need both, and that's the design.
How TrustVoting closes it
TrustVoting is built to publish its full source code with reproducible builds, so anyone — not just the vendor — can read and independently rebuild it. On top of that, a cryptographic integrity layer (checksums + attested boot) proves each machine is running exactly that published, reviewed version on election day. Open source is the commitment; verifiable integrity is the proof that the machine honors it.
Sources
- Feldman, Halderman & Felten, “Security Analysis of the Diebold AccuVote-TS Voting Machine” — USENIX/ACCURATE EVT ’07
- Same paper — full text (PDF, USENIX)
- MIT Technology Review, “How open source voting machines could boost trust in US elections” (2024) — today's top 3 vendors (~90% of the market) keep their code closed