Nothing locks the software before election day
Even if the voting software was checked weeks ago, in most places nothing forces the machine to prove — on election day — that it's still running that exact same checked version. So it could be quietly swapped at the last minute.
Explainer video coming soon
A 60-second, plain-language walkthrough of this gap.
What actually happened
When Washington, D.C. ran a public test of an internet ballot-return system in 2010, J. Alex Halderman's University of Michigan team took near-total control of the server within 36 hours — able to change votes — and the pilot was pulled. It's a vivid reminder that a system 'reviewed' at one moment can behave very differently once it's actually running.
Where it stands today
This 2010 internet-voting pilot is a demonstration of the principle, not a system in use now. What's current is the gap itself: most jurisdictions today still don't require a machine to prove, on election day, that it's running the exact software that was reviewed — which is what the figure above measures in present-day law.
Checked once isn't checked on the day
Imagine a chef whose kitchen passes inspection on Monday. Then nobody looks again before they cook your dinner on Saturday. The inspection was real — but it doesn't tell you what happened in between.
Voting software is often like that. It may be examined and approved before an election. But in most places, nothing forces the machine to prove, on election day, that it's still running that exact approved version. The window between "reviewed" and "running" is left unguarded.
Why it matters
That gap is where a last-minute swap could hide. The fix is a pre-election commitment: a cryptographic fingerprint of the approved software, published in advance, that the machine must match when it starts up.
How TrustVoting closes it
Each machine proves at boot that it's running exactly the fingerprinted, approved build — and that proof is public, so anyone can confirm the software on the day is the software that was reviewed.
How TrustVoting closes it
TrustVoting cryptographically fingerprints the approved software and requires the machine to prove, at boot on election day, that it is running exactly that version — a public pre-election commitment anyone can check against.