Four parts. One direction.
Ballot information flows out to the public, and only out. Nothing flows back in that could change a vote or a count.
- Polling placePaper ballots, check-in, scanner↓
- County officeCollects, signs, and publishes↓
- Public recordOne growing list, copied by many↓
- Everyone who checksVoters, watchdogs, auditors, press
The scanner never goes online.
Every hour, the scanner shows a code on its screen with its count, signed. A poll worker’s phone scans it and posts it. The phone can carry the count, but it can’t change it.
At closing, the full records travel to the county on sealed media, and must match the count that already went out.
›Under the hood
The scanner signs with a key held in its own hardware. The code carries the machine ID, the count, and a 64-byte signature, which fits easily in a standard QR code. The app only relays it; any edit fails the signature check. Counts only, never ballot contents.
Offline doesn’t mean trusted.
Being offline only means nobody can reach the scanner remotely. We still assume any scanner could be lying, and check it against two things it can’t touch: the paper the voter marked, and the check-in records.
A signature proves which scanner said something. It doesn’t prove it’s true. That’s what the checks are for.
›Under the hood
Signatures give origin and integrity, not correctness. Correctness comes from independent sources: voter-marked paper (full rescan by a second vendor, risk-limiting audits, public images) and separately run poll books (reconciliation). Any disagreement sends that unit to a public hand count.
- Tested by accredited labs and the state
- Public test run with a known answer
- Fingerprint checked at opening (Stage 3)
- Signed count every hour, which can only go up
- Never more ballots than check-ins
- Every ballot rescanned by another company’s machine
- Ballots must equal voters
- Every list entry matches a paper ballot (Stage 2)
- Public pictures anyone can recount
- Random ballots pulled and checked by hand
It plugs into what counties already use.
Paper ballots, poll books, and state voter lists all stay. The new parts sit around them.
Check-in and the scanner stay on separate equipment with no connection between them, so a ballot can never be matched to a name.
- ●Hand-marked paper ballots
- ●Your polling place and poll workers
- ●The state’s voter registration system
- ●Check-in poll books
- ●Federal and state equipment testing
- ●Audits states already run
- +Your ballot key, printed on your paper ballot
- +Signed counts, posted every hour
- +A county publisher that posts the public records
- +A second, independent scan of every paper ballot
- +Public copies and watchdogs
A public list that can only grow.
Every record goes into one public list. New entries can be added, but nothing can be removed or edited without the seal changing.
It’s the same kind of public list web browsers already rely on to catch fake security certificates, used billions of times a day.
›Under the hood
An append-only Merkle-tree log, the design behind Certificate Transparency. Each signed checkpoint (list size + root fingerprint) locks in every entry before it, and a short consistency proof shows a newer checkpoint contains the older one unchanged.
- … 48,209 earlier entries
Copies everywhere.
Libraries, universities, newspapers, and parties can all keep full copies. Get the records from any of them. The seal proves your copy is identical to everyone else’s.
›Under the hood
Records are plain, signed files served over ordinary HTTPS. Any web host can be a mirror, with no special software. Every file is checked against the signed checkpoint, so a mirror is trusted to stay up, never to be honest. A large county’s ballot records take a few gigabytes; the pictures are bigger and fit on an ordinary hard drive.
- County websitee3b0…c442✓
- State librarye3b0…c442✓
- Universitye3b0…c442✓
- Newspapere3b0…c442✓
- Party Ae3b0…c442✓
- Party Be3b0…c442✓
One open feed. No sign-up.
Yes, there’s an API: a set of fixed web addresses every copy serves the same way. Watchdogs, reporters, apps, and curious voters all read the same feed. Nobody gets special access, and there’s no account or key to revoke.
During voting it carries the hourly counts. After polls close, everything else.
›Under the hood
A read-only HTTPS interface modeled on Certificate Transparency’s (RFC 9162), plus bulk files for full download. Every response is signed or provable against the signed checkpoint, so it can be cached and served by any mirror without being trusted. The interface is defined in the standard itself, so no vendor can change or switch it off. Because it’s plain files, ordinary web caching handles election-night traffic.
- /seal/latestThe newest seal, signed
- /counts/hourlySigned hourly counts from every scanner and poll book
- /entriesBallot records and pictures, page by page
- /proofProof an entry is in the list, or that nothing was removed
- /voters/summaryRegistered, voted, and ballots, for every precinct
- /alertsEvery tripped rule, with the records behind it
Watchdogs compare one tiny fingerprint.
Every few minutes, each watchdog posts the latest seal it checked and reads everyone else’s. It’s a few hundred bytes, sent over normal web links.
If two watchdogs were ever shown different records, their seals wouldn’t match, and everyone would know.
›Under the hood
Each watchdog publishes a signed feed of the checkpoints it has verified and polls other watchdogs’ feeds, the way transparency-log witnesses work today. Two validly signed checkpoints of the same size with different roots are proof of a split view.
Inside a watchdog.
A watchdog runs the same short loop, over and over, all election long.
The rules are written down and frozen before the election. Same records in, same answer out, on any computer. See the rules →
- Fetch new recordsFrom any copy
- Check the new seal contains the old oneNothing removed or edited
- Run every rule in the rulebookPlain yes-or-no checks
- Post its own signed noteThe seal it checked
- Compare notes with other watchdogsSame seal everywhere?
- All clear, or sound the alarmThen wait a few minutes
How the software gets built.
First comes a written rulebook and record format. Then two separate teams each build a checker from it, without sharing code.
Both are run on practice elections with known answers. If they ever disagree, that’s a bug, found before election day.
›Under the hood
The record format builds on NIST’s existing Common Data Format for cast vote records (SP 1500-103), which vendors already know. Reference tools are written in memory-safe languages and built reproducibly, so anyone can rebuild the download from source and get the same fingerprint.
Who runs what.
The state hosts the official record. Counties publish into it. Everything else, the copies, the watchdogs, the checking, can be run by anyone.
It’s mostly plain web hosting. Copies spread the load on election night.
- Official public record + open feed· State election officeHosts the official list.
- Publisher· County election officeThe one piece that’s online. It can’t forge a scanner’s signature.
- Approved fingerprint list· StatePosted in the public record, so every change shows.
- Copies· AnyoneLibraries, universities, newspapers, parties. Trusted to stay up, never to be honest.
- Watchdogs + list of watchdogs· AnyoneWatchdogs share the list with each other, so nobody can quietly drop one.
- Checker software· Independent open-source groupNo voting machine company involved.
How each person gets it.
Voters install nothing. Reporters can use a dashboard, a download, or the open feed. Everyone else gets open-source software, with a fingerprint to prove it’s the real thing.
The code is maintained in public, by a group independent of every voting machine company.
- 1Nothing to installYou vote on paper, the same as today.
- 2Your key, if you want itA slip with your ballot key. Take it or leave it.
- 3Look it up anywhereAny phone, home computer, or library computer, from any public copy.
Rolled out in stages.
It doesn’t need every machine replaced on day one. Each stage is worth doing on its own, and each adds new checks.
›Under the hood
Stage 1 uses the cast vote records and ballot images most current scanners already produce. The open-source publisher removes any ordering or timing information, shuffles each contest separately, and posts them. Ballot-by-ballot matching to paper starts in Stage 2, once keys are printed on ballots.
- Stage 1Works with today’s machines
Publish the ballot records and pictures most scanners already save. Match ballots to voter lists, recount, rescan, and watch.
Catches wrong totals, extra ballots, misread marks, and changes after close.
- Stage 2Scanner upgrades
Scanners print your ballot key on the paper and post signed hourly counts.
Adds: look up your own ballot, and match every list entry to a real paper ballot.
- Stage 3Fully open machines
Open-source software on every machine, which proves its fingerprint before taking a ballot.
Adds: bad code blocked before it counts a single vote.
Every weak spot, out in the open.
No system is perfect. Here are the weak spots we know of, and what covers each one.
- !A scanner was tampered with before election day→✓Its count is checked against the paper: a full rescan by another company, public pictures, and ballots pulled by hand.
- !A scanner secretly keeps the order ballots went in→✓Not allowed. The open-source publisher rebuilds and shuffles every record, and memory cards stay sealed. Stage 3’s open, fingerprinted software closes it fully.
- !Someone steals a scanner’s signing key→✓The key is locked in the scanner’s hardware. Even a forged count only trips alarms. The result comes from the paper.
- !A poll worker skips or holds back an hourly count→✓A missing count is itself a tripwire. Counts are numbered, so an old one can’t be replayed, and workers from two parties each scan.
- !Fake check-ins to cover extra ballots→✓Voter lists are frozen before voting, check-ins are posted hourly beside ballots, and any voter can opt in to an alert if they’re marked as voted.
- !Paper ballots swapped in storage→✓The record was sealed and sent from the polling place before the box left. Swapped paper won’t match it on the rescan.
- !The county shows different records to different people→✓Watchdogs compare seals. Any split is proof.
- !The county stalls or the website goes down→✓Records are due within 24 hours or the result is held. Copies keep serving if any one site falls over.
- !Someone tries to cut off a watchdog→✓There’s no account or key to revoke. It can read from any copy.
- !A bug in the checker→✓Two independently written checkers must agree.
- !False alarms to stall the result→✓An alarm only holds the result if anyone can reproduce it from the public records. One that can’t is dismissed in public.
- !Accessible marking machines print barcodes people can’t read→✓Those ballots are counted from the printed words the voter can check, never a barcode.
- !Mail voters never visit a booth to get a key→✓Mail ballots get the same rescan, matching, and audits. You can track that yours was counted, but not look up its contents, so nobody can pay for a provable mail vote.
Like receipts shown to a vote buyer, paper custody, mail ballots filled in under watch, and ballot pictures used to prove a bought vote. We list every one, and what limits it today.
What it is not.
Simple on purpose. Every piece is something that already works somewhere else today.
- ✓Not internet voting
You vote on paper, and paper is the final word. Ballots some states accept electronically from overseas voters are copied onto paper in front of both parties and counted separately.
- ✓Not a blockchain
Just signed files and a public list, built from parts already in wide use.
- ✓No AI
Every check is a fixed rule that gives the same answer on any computer.
- ✓No app required
Voters need nothing new. Looking up your ballot is optional.
- ✓Scanners stay offline
Counts leave by a signed code on a screen, never a network connection.
- ✓No single point of failure
Many copies, many watchdogs, two checkers, and paper behind it all.