What gets asked, and what gets found
Published in advance on purpose. A jurisdiction should be able to read every question and every possible finding before it answers anything, so that nothing in the process is a surprise and nothing looks like a trap.
The questions
How people vote
| Question | Published? |
|---|---|
| What is the primary voting method for in-person voters? | Counted in the roll-up |
| Can a voter read their own choices on the paper, in words? | Counted in the roll-up |
| What does the tabulator actually read to produce the count? | Counted in the roll-up |
Equipment
| Question | Published? |
|---|---|
| Ballot-marking device make, model and software version | Held locally |
| Tabulator or scanner make, model and software version | Held locally |
| Can your existing tabulators scan ordinary hand-marked ballots? | Counted in the roll-up |
Check-in
| Question | Published? |
|---|---|
| Do you use electronic poll books? | Counted in the roll-up |
| If the poll books, the registration system, the network or the power fails, can check-in continue on paper? | Counted in the roll-up |
Accounting for ballots
| Question | Published? |
|---|---|
| Do you reconcile voters, ballots issued, ballots cast, spoiled, provisional, unused and accepted mail ballots before certification? | Counted in the roll-up |
| Are batch identification, seals, transfer records and bipartisan handling documented for every movement of ballots? | Counted in the roll-up |
Verifying the count
| Question | Published? |
|---|---|
| What independent check of the paper happens before certification? | Counted in the roll-up |
Network and access
| Question | Published? |
|---|---|
| List every way a person outside the election office can reach an election system: vendor support tunnels, remote management tools, modems, wireless, enterprise network paths. | Held locally |
| Are election systems separated from the general county or state network? | Held locally |
| How are administrative accounts protected? | Held locally |
| Is every piece of removable media, every laptop and every service device entering the election environment inventoried and controlled? | Held locally |
| Is security, system and network logging configured, validated and retained through certification? | Held locally |
Capacity
| Question | Published? |
|---|---|
| Estimated ballots to be cast in November | Counted in the roll-up |
| People available for counting work only, not poll work | Counted in the roll-up |
Barriers
| Question | Published? |
|---|---|
| Is there a barrier that prevents you from moving toward a trustworthy paper record before November? | Counted in the roll-up |
| Describe the barrier, and cite the statute, rule or contract clause if there is one. | Counted in the roll-up |
The findings
Each is opened by arithmetic on the answers. None is a matter of anyone's opinion.
The audit happens after the result is certified.
Do: Move the check before certification, where it can still change what gets certified.
audit_after_certification
The audit is a fixed percentage and does not expand when the evidence is thin.
Do: A fixed sample can miss an outcome-changing error in a close contest. Make the audit escalate.
audit_cannot_escalate
A barrier is claimed but not described.
Do: Name the statute, rule, clause or shortage. An unnamed barrier cannot be helped.
barrier_undescribed
A barrier is claimed and has not yet been independently verified.
Do: A second reviewer must verify the barrier and identify the fastest lawful remediation. This assessment cannot close until they do.
barrier_unverified
There may not be enough count-only workers for a manual verification at this ballot volume.
Do: Run a timed count on realistic volumes and measure ballots per worker-hour before assuming either way.
count_capacity_short
The count is taken from a barcode rather than from what the voter can see.
Do: Configure tabulation from the readable marks, or transition to hand-marked ballots on the existing scanners.
counted_from_barcode
Chain of custody is not documented for every movement of ballots.
Do: Batch identification, seals, transfer records and multipartisan handling on every movement.
custody_gaps
Logging is not configured.
Do: Configure it before operations begin. Without logs an anomaly can only be argued about, never investigated.
logging_absent
Logging is configured but has not been validated.
Do: Confirm the logs are actually being written and retained.
logging_unvalidated
Removable media and service devices are not inventoried or controlled.
Do: Inventory and control everything that enters the election environment.
media_uncontrolled
Election systems sit on the general enterprise network.
Do: Segment them. Until then treat every workstation and mailbox on that network as adjacent to the count.
network_shared
Administrative accounts have no second factor.
Do: Enable multi-factor authentication where the system supports it.
no_mfa
There is no paper record of votes at all.
Do: This cannot be verified by any audit. Escalate immediately.
no_paper_record
Check-in cannot continue if the electronic poll books fail.
Do: Print the voter list. A paper participation record is also an independent input to reconciliation.
no_pollbook_continuity
Nothing independently checks the paper against the machine count before certification.
Do: Adopt a risk-limiting audit that escalates to a full count, or a full hand count of the federal contests.
no_precert_verification
Voters cannot read their own choices on the paper record.
Do: Move to a ballot a voter can read, or configure the device to print readable text as the counted record.
no_readable_paper
Ballots and voters are not fully reconciled before certification.
Do: Account for voters, ballots issued, cast, spoiled, provisional, unused and accepted mail ballots, and document every difference.
no_reconciliation
Paper check-in exists but has not been tested this cycle.
Do: Test it under load before Election Day.
pollbook_continuity_untested
Network separation is assumed rather than traced.
Do: Trace the actual paths. Shared authentication, vendor tunnels and legacy configurations defeat assumed air gaps.
segmentation_assumed
Administrative accounts are shared.
Do: Unique accounts, least privilege, multi-factor where the system supports it.
shared_admin_accounts