Ballots and ballot data have been recently seized: the FBI in Fulton County, Georgia1, and the Sheriff’s office in Riverside County, California2. But we are faced with the specter of possible seizures in upcoming elections to alter the results by force.

Even if no one hacks a voting machine, an election can still be thrown into chaos if ballots, ballot images, and vote records are disappeared. Without the records, election officials may not be able to complete the count or independently verify the outcome. They can just make up the result and we can’t prove otherwise.

Even a 1% chance deserves a contingency plan. This time, it is nothing less than predictable, given the Trump pattern of using force and fear to get his way.

Let me make the case and you can connect the dots.

THE THREAT:

• Trump is in trouble. He is one of the least popular presidents in history. High gas prices, a new on-going “forever war”, high prices due to tariffs, the list goes on.

• Midterms go to the opposition party. Experts3 are now predicting that D-party candidates may take a majority of the House and maybe even the Senate.

• Impeachment? If this happens, Trump knows he will lose much of his power and might be impeached yet again4.

• The R-controlled Congress may try to get involved. They do have some say regarding how congressional elections are processed, despite the fact that processing is done by states and counties. They can order recounts or stoppages to benefit R-party candidates as Congress does judge elections of its own members under Article I, Section 5.5

• EAC is DOA. The Election Assistance Commission is not a very powerful independent agency, but they may get in the way. So Trump fired the remaining two D-party members and the last R-party member resigned. It now has no seated members, so it can do nothing to get in the way. Without commissioners, it cannot take formal commission actions6.

• Mail Ballots Threatened. The Trump administration is already asking the U.S. Supreme Court to allow new federal restrictions on mail-in ballots before the 2026 midterm elections7. That demonstrates a willingness to use federal authority to reshape election administration, despite ongoing constitutional challenges.

• Emergency. Trump can declare an emergency to defend against “the enemy within.”

• Seizure: Trump will direct the FBI to seize ballots and vote data before totals can be officially announced. Once the ballots and vote data are seized, then the count cannot proceed. The FBI can seize all machines and tabulators, leaving the election offices with nothing (unless they plan ahead).

• Congress can do nothing to stop it. We know congress is worried. D-party members proposed the “Protect Our Polls Act,” which would prevent troops or “armed men” at polling places. If passed, this might block ICE agents from surrounding polling places and grabbing anyone that looks “out of place.” But this will likely go nowhere, as the R-controlled congress won’t support it and certainly Trump will veto it.

• Announcement. Trump then announces, Maduro-style8, that his endorsed candidates have “won by a landslide”.

• Thus, no need to hack machines. The hack occurs far above that, with the official announcement of the winners. All ballot data is gone, so we can’t prove otherwise.

• The R-controlled Congress swears-in the candidates and forms a new R-controlled Congress.

• Worst case, new laws are passed to allow unlimited tenure for Trump, and our Democracy sinks further into authoritarianism and fascism.

SOLUTION — REGULAR DATA BACKUPS

• Election offices should BACK UP all ballot images and vote data.

• Backups are NOT done routinely today. But we must start.

• Ballot Images are ALREADY created by all modern ballot scanners.

• Most election offices save these, with some posting these anonymous images to their website.

• Yet, many election offices routinely delete ballot image data produced by election equipment, saying they are worthless and only “ephemeral” data.

• We must get them to stop this practice and make ROUTINE DATA BACKUPS.

• TWO BACKUPS should be created and placed into separate off-site safes. (Another secret backup is even better).

• Officials should keep one copy even if authorities seize the others

RECOVERY

• Even if Trump and the FBI seize the ballots and election data, these backups can be used to reconstruct the election.

• Ballot images and digital records are evidence that can be read either by human eye or by software to recreate the official result, even if all paper ballots are seized or destroyed.

You can help

1. Request Election Data Backups. Please contact your local election office and ask them if they make regular backups and store them off site, and ask them to do so if they do not. Visit Contact Your Election Office for contact information.

2. Use Drop Boxes. If you vote using a mailed-out ballot, do not use the Postal Service to return your ballot. Drop it off at an official election drop box or return to your county’s election office. Don’t be fooled by imposter drop boxes.

3. Subscribe to ballot tracking services. Generally, this is handled by the Secretary of State in your state (or equivalent agency), and it will notify you by text when your ballot is sent out and when it is received. Online ballot tracking for mailed-out ballots is available in every state except Illinois, Missouri and Wyoming9 — and even if there is no statewide system, some counties also provide the service.

SUGGESTED MESSAGE:

Offsite Election Backups

Background:

Law enforcement has started taking ballots and other election data to investigate.

A Federal District Court has already ruled the FBI can seize and keep ballots for investigations.

The California Supreme Court will rule if Sheriffs can do this. Natural disasters and accidents are also risks.

Proposal:

Each election office needs to be prepared with two offsite backup copies of all the ballot images created by election scanners and other vote records, in case paper ballots and records are impounded or suffer disaster.

Put the copies, sealed, into offsite safes as they are scanned. Two backups let law enforcement seize one, and the office still keeps one.

For Those Offices Routinely Deleting Data:

Some jurisdictions claim that there is no reason to save ballot images that have been created by ballot scanners, and in some cases, they set these machines to routinely delete them.

If they say there is no need for the ballot images “because we have the paper ballots,” the need for these secure backups makes the case for keeping that valuable data.

Let us know if you contact your offices about backups.

Just mail a note to signup@citizensoversight.org and put # DATA BACKUPS in the subject and tell us what you have done. We really appreciate this feedback.

Subscribe now

Share

Leave a comment

All posts by Ray Lutz: https://raylutz.substack.com

Exactly 10 years ago today, we filed a lawsuit against San Diego County Registrar of Voters for not including any mail ballots processed after election night in the audit. That was about 285,000 ballots at that time. In the last election it was about 370,000.

On June 8, 2026, the San Diego County Registrar of Voters conducted a second public random draw to select additional vote-by-mail ballot batches for the county’s 1% Manual Tally Audit. They gave in, finally after 10 years of resistance.

That may sound like a routine administrative event. It was not.

The additional draw expanded the audit pool to include hundreds of thousands of vote-by-mail ballots that would otherwise have had no chance of being selected for audit. The decision represented a significant change in how San Diego County approaches election auditing and addressed an issue I have been raising since June, 2016. But it was only a partial step. Even after the second draw, about 100,000 ballots remained not audited.

The broader issue extends well beyond San Diego County and affects election auditing throughout California and the rest of the country which largely performs inadequate, horrible, or no audits.

History of the 1% Manual Tally

California’s 1% manual tally audit dates back to the early era of electronic vote tabulation.

Election officials and lawmakers understood that computerized tabulation could produce incorrect results if systems were misconfigured or operated improperly. Software can be subverted. Hackers exist. To provide an independent check, counties were required to manually count ballots from a sample of precincts and compare those results with the machine count.

At the time, almost all voting occurred at polling places. “Absentee” voting by mail existed, but it represented a very small portion of the electorate. When counties began their audits, nearly all ballots had already been counted.

Under those conditions, the audit effectively covered the entire election when only election night ballots were included.

Over time, voting habits changed.

California expanded absentee voting. Permanent vote-by-mail status became available in the mid 1990s. Eventually the state adopted the practice of mailing ballots to all active registered voters.

As vote-by-mail grew, the audit system remained largely rooted in procedures developed during an era when most voters cast ballots in person.

Around 2006, then-State Senator Debra Bowen sponsored legislation (SB 1235) clarifying that vote-by-mail ballots had to be included in the 1% manual tally audit. Up to that point, they were excluded completely. The change reflected the reality that a growing share of California voters were casting ballots through the mail.

Previously, the 1% manual tally law (Cal Code 15360) said that the audit would include “one percent of precincts” and it was changed by SB-1235 to “one percent of precincts and mail ballots.” But the election officials did not like the change, and they decided to audit only some of the mail ballots.

Discovering the Gap

About 20 years ago, I began a side project to understand how Diego County conducted its elections. It took me years to gather enough information to finally understand the process and also understand that audits were being performed.

Then in 2016, I finally had a good understanding and could tell that something was wrong.

The county did follow the change in the law in 2006 and included vote-by-mail ballots, but only those that had been fully processed by election day. Ballots that arrived on time but were processed later during the canvass were excluded from the population randomly selected for auditing.

It was hard to understand what was happening because election reports used different ballot counts at different stages of processing, and county officials were not eager to acknowledge that a large group of ballots was left out of any auditing. They tend not to fully openly state what they are doing, and to figure it out, you have to ask for more information. That takes time, because they are also adept at avoiding returning information unless they have to.

Just watching the random draw or the tallying of paper ballots was not enough. You had to know what the full population of ballots was and check it yourself.

In 2016, I determined that approximately 285,000 timely vote-by-mail ballots were being left outside the audit pool.

I contacted the Registrar of Voters at the time, Michael Vu, and requested that the county add approximately eight additional audit batches. Doing so would have extended audit coverage to those ballots and brought the county into compliance with what the law required.

Vu said he “respectfully declined.”

The Lawsuit

At that point, I filed suit as a self-represented litigant. Later, it was extended to represent Citizens Oversight and handled by Attorney Alan Geraci, of San Marcos.

Silly me. I expected the matter could be resolved without extensive litigation. The additional auditing represented a relatively small amount of work and expense compared with the county’s overall election budget. I honestly thought they would just arrange for a change of procedures for the future.

Instead, the county fought the case tooth and nail.

The litigation proceeded through a full court hearing. Recordings of the proceedings were not permitted. (You might ask why would a governmental office proud of its activities would not want it to be public.) After months of effort, we obtained a favorable ruling at the trial court level. We won. (Read the ruling by the court in our favor: https://copswiki.org/w/pub/Common/M1658/Lutz_Vs._Vu_Ruling_on_Injunction_CCE07282016.pdf))

For anyone that wants to review the complete record, including court documents, press conferences, protests and other actions, please see ElectionAuditLawsuit

The Circumvention

We won. But the battle was not over. The County and Vu refused to accept the tiny change to their procedures. The county appealed, normal procedure.

The appeal was expected. They knew we had a strong case, and without some other change, we would win the appeal.

Therefore, while the appeal was pending, election officials pursued a change in the law so they would not have to perform complete audits, and they would be guaranteed to get their way. Not secret, but certainly on the down low.

Through the California Association of Clerks and Election Officials (CACEO), language was inserted into AB 840 (see https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201720180AB840), a bill that originally dealt with signatures on vote-by-mail ballots.

If you look carefully at Election Code section 15360, it first says

California Election Code section 15360 (extract)

• 1% Manual Tally: Elections officials conduct a public manual tally of 1% of all ballots tabulated on a voting system during an election, including vote-by-mail ballots.

But then later, it expands on this requirement:

California Election Code section 15360 (extract)

• ...using either of the following methods:
  (1) (A) A public manual tally of the ballots canvassed in the semifinal official canvass, including vote by mail ballots but not including provisional ballots

The term “semifinal official canvass” includes only the vote by mail ballots received by election night. It looks like not much changed unless you realize that the semifinal canvass is far from what it used to be. Small innocuous change in wording goes unnoticed by lawmakers.

California Code, Elections Code - ELEC § 353.5

• The “semifinal official canvass” is the public process of collecting, processing, and tallying ballots and, for state or statewide elections, reporting results to the Secretary of State on election night. The semifinal official canvass may include some or all of the vote by mail and provisional vote totals.

Thus, elections officials changed the law by putting forward AB-840 which redefined the audits as only applying to the election night results. It changed the requirement from

• “conduct a public manual tally of the ballots tabulated by the voting system, including vote by mail ballots, cast in 1% of the precincts chosen at random, as specified”

to

• conduct “A public manual tally of the ballots canvassed in the semifinal official canvass, including vote by mail ballots but not including provisional ballots, cast in 1 percent of the precincts chosen at random by the elections official.”

This was done late in the legislative calendar and without full opportunity to comment on it. Clearly, the change from “ballots tabulated” to “semifinal canvass” was not appreciated without a very careful reading.

The only reason I found out about this scheme was that I was contacted by a friendly election official. We formed as much opposition as we could in the short time provided but it was a done deal. “Elections officials need something? Of course we give it to them,” that’s what the legislature thinks.

Thus, they reduced the audit to cover only the semifinal official canvass, which may sound good to officials that want to economize, but it means only those ballots processed by election night are audited, ignoring all those not processed until later.

Any statistical expert will tell you that this is ridiculous. Philip Stark, professor at Berkeley, (https://statistics.berkeley.edu/people/philip-b-stark) testified to that effect in the court hearings and we appreciated his expert testimony in our case. He is the “inventor” of Risk Limiting Audits (RLAs) and the question was almost a silly one for him. Of course you can’t omit 285,000 ballots from the random draw.

It’s like the IRS saying, “We’re going to audit your books at random sometime next year, but not after July.” Obviously, any fraudster could cheat on their taxes in the latter part of the year without any fear of being caught.

Same here. If the computer code were modified to alter the result later in the election, then that would never be detected.

The problem is that elections offices can delay and not process mail ballots received on election day and make sure those are not included in the audit. There is no legal requirement that they make even a reasonable attempt to include as much as possible. All their call. It is easier for them to minimize the audit. Less checking means less chance that they will have to admit their process is faulty.

They “win,” the public loses.

Once the law changed, the appellate court concluded that the dispute had become moot. Later, Vu said our case was “frivolous” so he could minimize the damage of losing the case initially.

The question I had raised was fully resolved in the Superior Court case. We had a full evidentiary hearing over three days. The merits were evaluated. We won. But instead of accepting that, the election officials worked to change the law to avoid the effect of our case and permit the practice to continue, even though it goes against all logic and statistical theory.

To make it all worse, the appellate court ruled that our attorney would not get fair compensation for pursuing the case, but they did at least rule that each party would cover their own costs.

Despite that ruling, the county placed a lien on my property to the tune of over $10,000 which flew under the radar because in our minds, the case was concluded. Six years later, when I attempted to sell the property with the lien in 2023, I was told that the lien existed. No big deal, I thought, we’ll just resolve that with the proceeds of the sale.

Aha, not that easy. No, I could not just pay it using proceeds from the sale. Instead, I had to clear up the lien in court before we could close. We had to back out of the property purchase we had started and it took months to resolve.

Okay, San Diego County. Not only do you want to conduct partial audits, but you can’t stand to lose, and will dig in your heels even if it starts looking pretty stupid, and slap me up for pursuing the case, even though we were right all the while, and should have been compensated for making this case in court for the benefit of the public.

I have been amazed at how far they would got to cover their asses and make it appear that everything is fine. And the courts are largely complicit as seen by this evidence.

Why is this all necessary to avoid conducting full and complete audits?? Why did we not conduct the hearing in public, allowing video recording? Why not admit that we won the first case even if you do want to change the law? And then why not use a full procedure to change the law, including sufficient time to comment and raise an opposition??

Needless to say, this level of avoidance makes my mind spin through quite a number of possible conspiracy theories, especially those that involve later-processed mail ballots. But those will have to wait for future articles.

The Problem Grew Larger

Since 2016, California has even more strongly embraced vote-by-mail.

Today, roughly 93% of ballots cast in many California counties are vote by mail (VBM) ballots, because all active registered voters are mailed a VBM ballot which they can use if they want to, or vote in person.

I made the following chart in 2020. The vertical axis represents the total percent of ballots that are included in the audit. We want the solid orange line be at the top, at nearly 100%. Instead, because mail ballots were unaudited, the fraction of ballots included in the audit dropped to about 60% in 2006. In 2016, ten years after Bowen’s SB-1235 was passed, the situation was unchanged. The area over the orange curve are all the ballots not subject to any audit. About 40% were still excluded.

This is even worse today. (The dashed orange line in the upper right corner is where our ruling should have moved the audit coverage, but AB-840 allowed continued reduction of coverage.) By 2020 in San Diego, coverage dropped to about 58% audited (est.).

Many ballots are returned during the final days before election day. Others are delivered on election day through drop boxes, vote centers, and the Postal Service. Additional ballots continue arriving during the canvass period if they were timely mailed.

As those numbers increased, the portion of the election falling outside the audit pool also increased.

An Additional Audit Avoidance Approach

What we are looking at here is avoidance of the audit. If large chunks of the ballot inventory is not subject to checking by the audit process, and particularly if those chunks can be easily targeted, then malicious actors can modify the computer results so they do not match the paper record, and it will never be detected. Even though we can be very happy that we have paper ballots that can be audited, these records do no good if we never use them to check on the accuracy of the computer result. And the elections officials are bending over backwards to avoid auditing.

Receiving Inspection Diversion

I need to mention one more method for diverting ballots to avoid the audit. This method was used by San Diego as documented in my 2008 report on the processing in San Diego1, where I documented that perhaps 9,000 ballots were diverted by receiving inspection. There are two ways to handle this:

• Eager Diversion, where ballots are inspected and routing for remaking as they are received from polling places or extracted from the mail envelope. This method would be best if the scanners are primitive and failures are likely, and if electronic adjudication is not available or not strong. This may result in a larger diversion than actually necessary.

• Lazy Diversion, where ballots are not removed in advance (unless there is obvious damage) and proceed with scanning. If there is a problem with scanning, pull out the problematic ballot and divert it for remaking. This approach may rely more heavily on post-scanning electronic adjudication.

In eager diversion, there may be more likely to divert rather than lazy diversion. But in either case, the problem is that the diverted ballots are likely NOT included in the audit. This is just the opposite of what should be the case, because these “hard ones” are exactly what we want to check.

The Breakthrough

Last year I discussed the issue with Shawn Brom, then the Deputy Registrar of Voters in San Diego County and who has since advanced to be the Registrar, hopefully on a permanent basis. He is much easier to talk to than Vu, let me say that up front.

His position was that the county was complying with the law by auditing only the semi-final canvass available shortly after election day.

My question was straightforward: Even though election offices can now legally omit many mail ballots from the audit, where should the audit boundary be drawn? Do they actively try to complete processing as many mail ballots as possible prior to drawing the line, or the opposite, just to make the auditing process less of a hassle?

For the 2025 election on Prop 50 to allow redistricting, San Diego included in the scope of the audit:

• all* early in-person ballots cast at voting centers

• all* in-person election day cast at voting centers, and

• all* fully processed mail ballots as of the morning of election day.

But they omitted:

• all mail ballots mailed by election day and delivered by the postal service on election day (and after),

• all ballots from drop boxes collected on election day,

• all mail ballots dropped off at voting centers on election day, and

• all ballots diverted from the semi-final canvass for remaking or just to remove “hard” ballots (from flows marked with an * above)

Is it okay to not include mail ballots received and processed even ON election day? They think so. To me, it seems to be pushing this to the extreme. The “semifinal official canvas” is supposed to include all election day ballots from voting centers. So why not also include all mail ballots received on election day? This point could be argued in court.

In this most recent election, that was a large chunk, because voters were holding off as much as possible due to last minute changes in the governor contest lineup.

At the time of the initial random draw in the June 2, 2026 primary election, approximately 380,000 ballots had not yet been processed.

The county selected 23 vote-by-mail audit batches from the ballots that had already been completed, accounting for about 23 * 100 * 200 = 460,000 ballots, as there are typically 200 ballots per batch, and 1% are selected.

A Partial Yet Important Step Forward

This year, San Diego County responded to my concerns.

The Registrar scheduled a second public random draw to select additional audit batches from ballots processed after the initial draw.

That decision expanded audit coverage to a large population of ballots that previously would have been excluded entirely.

This is a breakthrough, even if only partial. We must acknowledge when election officials do the right thing, even if they do it kicking and screaming for 10 years. Yes, it is almost exactly — to the day — ten years ago that I filed the lawsuit. Michael Vu did not help election integrity. Not until Shawn Brom took the helm could we sense a new cooperative attitude. Thank you.

It demonstrates that expanding the audit pool is practical. It demonstrates that counties can adjust their procedures to include additional ballots. It demonstrates that audit coverage does not have to be frozen based solely on the earliest available canvass numbers.

The second random draw did not include every ballot that I believe should be represented in the audit. 12 additional batches were drawn, but another 5 batches should be drawn to fully complete the audit. This is just a matter of manual tallying, and more tally teams gets the job done faster.

The larger statewide (and national) issue also remains, as these limited audits are not confined to San Diego.

A big missing piece in San Diego, and other Counties

So with this increase in the number ballots included in the audit, is San Diego off the hook? Well, there is one more key ingredient that we still have trouble with, and it relates to what we need to fully comply with audit procedures.

Before any random draw is performed, we need to have the complete computer results, broken down by the sampled unit. In this case, the totals for all contests in each batch that can be selected. We call this the “Snapshot report” because we need a full report of the snapshot of the ballots included in the partial results.

The process should be as follows:

• Complete the semifinal official canvass, but include as many ballots as possible. (In some places, they audit the final results, and then everything can be included.)

• Create a “Snapshot Report.” This report should show the total of each contest included in each batch, batch by batch.

  • Such a report could be created by taking the Cast-Vote Record (CVR) data file which includes a record for each ballot and grouping by batch and summing vote for each candidate (called a “pivot” in spreadsheets) to create the totals for each candidate in each contest, for each batch. This report can further be used to check the total number of ballots processed and the grand totals for each contest.

  • In San Diego, they call this the Ray Report as I have been asking for it for years.

• Publish the Snapshot Report, such as on a website, so no further changes can be made.

• Randomly draw from this list of batches. The best way to do this is by assigning a sequential number in each batch and throwing 10-sided dice. Choose 1% of the batches for tallying.

• Pull each batch from storage without opening, and then break the seal of each box with public observation, checking the seal number.

• Tally the ballots and record on a tally sheet for each contest. The tally teams should not know the totals and sometimes it can help to split each batch between two teams.

• The key part of the audit is comparing the totals from the batch report to the tally sheet. Good to watch that process as an observer and make sure it is clean. Some places do this using a projector so observers can watch.

Why is this important?

Let’s say there is an insider who can modify the results in the central tabulator, and assume 1,000 batches have been modified only to the extent that they won’t be obvious. If some of those batches are included in the audit, to avoid detection, fraudsters may apply those changes to batches that were not included, so the grand totals are the same, and change the totals for selected batches back, so they will match the tally. One way to do this might be to just swap the labels on batch boxes.

If the snapshot report is prepared in advance, then the fraud can be detected, if we have observers who will compare the tallied totals to the batch report prepared prior to the random draw.

One way to think of this is that the totals in each batch for each contest in that batch are a somewhat unique fingerprint of the batch that has no reliance on the label on the batch. If the batch labels are swapped, we can tell because we know the unique fingerprint of the batch based on the detailed results.

Situation in San Diego (and LA)

Although I have received the report from San Diego for all precincts in the past, they lately say it is not easy to create a report of all batches, and have only prepared results for the selected batches. Without the complete frozen report, we can’t tell if the audit is all just theater, because insiders could modify the report to match the paper ballots even if the results for that batch were initially altered. We will continue to request this report and research the theory that they really can’t create that report.

Los Angeles also avoids this report, even though their contract for the VSAP voting system contract required the batch report capability.

Summary (based on website results on June 16, 2026)

• Total ballots cast in the June 2, 2026 primary: 848,112

• Total Mail Ballots: 790,823 (93%)

  • Not included in the audit: 380,000 (from San Diego website as of June 4 random draw)

• Batches drawn in first round: 23.

  • Approx. mail ballots included in audit based on first round batch count: 23 * 200 * 100 = up to 460,000 (58% of mail ballots)

  • Approx. Mail Ballots not included, 790,823 - 460,000 + 2,000 = up to 332,823 (42%)

• Batches drawn in second round: 12

  • Ballots included in audit based on second round batch count 12 * 200 * 100 = up to 240,000 additional ballots covered (yay — 700,000 total max, 88%).

  • Remaining ballots after second round: about 100,000 --> about 5 batches.

• Vote Center Ballots: 57,289 (7%)

  • All included in the audit except those diverted. (More research required.)

MAIL BALLOT COVERAGE

Before Supplemental Draw
🟩🟩🟩🟩🟩🟩⬜⬜⬜⬜
58% Covered

After Supplemental Draw
🟩🟩🟩🟩🟩🟩🟩🟩🟩⬜
88% Covered

Next Steps

Our mission is clear:

All counted ballots should be equally subject to audit.

This movement by San Diego is an important win. Partial, but important. A foot in the door. Progress, but still incomplete. Half of the remaining is not enough.

We plan the following:

A. Contact all counties and assess the current practice

Citizens Oversight will soon contact election officials throughout California and request information about their recent 1% manual tally audits, including the number of vote-by-mail ballots included in the audit pool and the number excluded because they were processed after the initial random draw, and not technically in the “semi-final official canvass”. Also, we will seek answers regarding diversion for remaking, and whether these are included in the audit.

Based on the procedure used by San Diego, we will encourage counties to conduct additional random draws when necessary to maximize audit coverage of timely ballots counted during the canvass. By collecting data, we will know which counties are the worst offenders of common sense, and which ones are already being prudent.

B. Contact the Secretary of State (again)

Citizens Oversight will also submit recommendations to the California Secretary of State requesting a statewide review of audit coverage practices and encouraging procedures that maximize representation of timely ballots counted during the canvass period.

C. Develop Model Legislation and Recruit Sponsors

Finally, we will develop model legislation to reverse the changes enacted by AB 840.

The goal is straightforward: when ballots are included in the official election results, they should also be eligible for inclusion in the audit process that verifies those results. Also, a snapshot file should be created for all batches and precincts, so we can compare with the audited batches.

You can help.

If you live in California, contact your county Elections Official (see https://www.sos.ca.gov/elections/voting-resources/county-elections-offices) and ask whether all timely vote-by-mail ballots are represented in the audit selection process. If substantial numbers of ballots are excluded from the audit pool, ask the county to conduct additional random draws so those ballots also have an opportunity to be selected for audit. Also, contact the SOS Shirley Weber https://www.sos.ca.gov/contact-information and let her know you don’t like the partial audits going on in California.

Please don’t under-estimate the value of your calls. They count them. We must get this on their radar.

If you live elsewhere, the question is still one that can can be asked. Some areas don’t do any audits, but we are making progress.

Please join our team by sending your info to signup@citizensoversight.org. Help us by upgrading your substack subscription to paid.

Subscribe now

Share

Leave a comment

BELOW IS OUR PRESS RELEASE

We had a couple of TV stations contact us.

FOR IMMEDIATE RELEASE

After 10-Year Campaign, San Diego County Expands Election Audit to Include 375,000 Vote-by-Mail Ballots Otherwise Excluded

Additional public random draw scheduled Monday at 10:00 a.m.; media/public invited to attend

SAN DIEGO, Calif. — On Monday, June 8, 2026, at 10:00 a.m., the San Diego County Registrar of Voters will conduct an additional public random draw to select batches of vote-by-mail ballots for the county’s post-election manual tally audit. The additional draw will extend audit coverage to ballots that were processed later in the canvass and were not included in the original audit selection.

The action marks the culmination of a ten-year effort by Citizens Oversight and election transparency advocate Raymond Lutz to improve the representativeness of California’s post-election auditing process.

In 2016, Citizens Oversight requested that San Diego County expand its audit to include additional batches covering later-processed vote-by-mail ballots. At the time, approximately 285,000 ballots were effectively excluded from the audit selection process because they fell outside the batches selected for the manual tally. After the request was denied, Citizens Oversight filed suit and ultimately prevailed in court.

Following that victory, election officials across California sponsored legislation through the California Association of Clerks and Election Officials (CACEO). The resulting legislation, AB 840, changed California law and removed the requirement that audits include later-processed vote-by-mail ballots. As a result, many counties, including San Diego County, continued conducting audits without extending the audit pool to cover those ballots.

For the current election cycle, approximately 375,000 ballots—representing roughly 1,875 ballot batches—would have remained outside the audit pool under the prior practice. Because California’s manual tally audits examine approximately one percent of batches, the additional random draw is expected to add approximately 19 audit batches from this previously excluded population, increasing the number of vote-by-mail audit batches from approximately 23 to approximately 42. (actually, only another 12 batches were chosen, leaving another 140,000 ballots out of the audit (est.))

While only a sample of ballots is manually audited, expanding the audit pool is important because it ensures that later-processed vote-by-mail ballots are represented in the audit process rather than being excluded entirely.

Under the leadership of Registrar of Voters Shawn K. Brom, San Diego County has now agreed to conduct an additional random draw and audit additional batches, extending audit coverage to ballots that previously would not have been represented in the audit process.

“This is an important step toward a more complete and representative post-election audit,” said Raymond Lutz, Executive Director of Citizens Oversight. “For years, hundreds of thousands of valid vote-by-mail ballots were effectively excluded from the audit selection process. In 2016, that number was approximately 285,000 ballots. This year, it would have been about 375,000 ballots. We appreciate the new attitude of this department as demonstrated by the willingness of the current Registrar’s office to address this longstanding issue and improve public confidence in election auditing. We hope this will become a normal practice and spread to other CA counties that are still excluding ballots from the audit.”

The additional draw expands the audit process to provide greater assurance that the audited ballots reflect the full population of ballots counted in the election, including ballots processed later during the canvass period.

MEDIA ADVISORY

Television cameras, photographers, and other media representatives are welcome to attend and record the proceedings. Raymond Lutz, Executive Director of Citizens Oversight, will be available for interviews before and after the random draw.

REF: See documents related to the case in 2016 here: ElectionAuditLawsuit There, you will find all other steps we took over the past 10 years.

It affirms that the public has a right to access the CVR report that can be used to show that the election results are consistent The Court explicitly ties this to the principle of “trust but verify,” emphasizing that transparency supports confidence in election outcomes.

You can read the whole thing here (it is interesting reading for true election nerds, lol): https://law.justia.com/cases/pennsylvania/supreme-court/2026/79-map-2024.html

What the Court Actually Granted

The ruling is strong on classification but incredibly narrow on access mechanics.

CVRs must be disclosed, but only under the procedures defined in the Election Code. This creates a controlled-access model rather than open distribution.

Key constraints (are you kidding me?):

• Access is limited to “qualified electors” of the county

• Inspection occurs only during normal business hours

• Review must occur in the presence of election officials

• Access is subject to “safekeeping” controls by the county

These constraints are outrageous, but the court had to comply with the wording in existing statutes. The Court explicitly states that the Right-to-Know Law (RTKL) does not apply where it conflicts with the Election Code, and therefore cannot be used to obtain CVRs more freely. But time will tell how they end up interpreting this.

Many if not most places around the country are now willing to provide the CVRs, and many states like Georgia, now also say that ballot images are available too. Florida even allows access of paper ballots on-site, but were (until recently) routinely deleted ballot images. We have obtained ballot images from counties in WI, NJ, GA, FL, CA, CO, and TX just to name a few.

Practical Interpretation

The ruling creates a separation between legal transparency and operational transparency.

Legally:

• CVRs are public records

• The “contents of the ballot box” exemption does not apply

• The public has a right to verify tabulation

Operationally:

• Counties retain control over access conditions

• Data extraction is not guaranteed

• Copying vs. viewing remains ambiguous and likely contested

The Court repeatedly refers to “inspection” rather than “distribution.” It suggests that jurisdictions may comply by allowing supervised viewing of CVRs without providing digital copies. That’s frankly ridiculous, because it means you can’t easily handle processing of the data. But I am open to being wrong on this.

Implications for Audit Efforts

We planned to get CVRs and ballot images from major PA counties so we could check on the results of the 2024 general election. You may remember that PA was close, with Trump getting 3,543,308 votes while Harris got 3,423,042, a measly 120,266 vote difference. That’s only 1.7% margin between just those two candidates, which is quite close. So close in fact, that the state decided that they would rather audit the State Treasurer’s contest, with a 426,943 vote difference (6.12%) and then do nothing to check on the Presidential contest. You heard that right. No Checking. So this ruling might actually allow us to either get the CVRs and ballot images, and allow us to perform ballot image audits and check on the result.

[An aside, ballot image audits can only do a consistency check between the images and the CVRs. If there are 45,000 ghost ballots like what we are seeing might be the case in Riverside, CA1, then the result will check and yet be desperately wrong. But the same is true for auditing methods like Risk Limiting Audits, so an audit of the chain of custody of the ballots is still a great idea. We have until the end of August to get these records before they are destroyed after 22 months.]

(I have to admit I have always been skeptical of the Trump win in 2024 to exactly 1.5000% (between Trump and Harris only). That reads like a line in a contract.)

BUT…

They did not rule on the availability of ballot images, and if they restrict the CVR access per what the ruling implies, then it’s not a big win at all.

The unanimous nature of the decision strengthens its authority, but its silence on ballot images leaves a gap.

Strategic Reality

This is a breakthrough in legal footing, not yet a breakthrough in data access.

The Court removed the primary legal barrier by rejecting the “contents of voting machines” argument. That is significant. It aligns Pennsylvania with jurisdictions that treat CVRs as auditable records.

At the same time, the enforcement mechanism remains decentralized. County election offices still control the conditions under which access occurs.

Ballot Box Exemption is silly anyway

So they have a law from 1937 that says that the contents of the ballot box are not accessible to the public via the PA RTKL. But why? Is it because they want to be able to mis-count the ballots, come up with some fabricated number, and then say, “You’ll have to trust us, because of this law from 1937 means you can’t check on the result”?? The secret “Australian” ballot was largely adopted by 1937 in most states, but was not fully adopted nationally until 1950s. So there may have been a lingering concern about looking at the ballots.

Plus, I get that access to actual paper ballots must be restricted because of the danger of modification or destruction. But not really due to privacy concerns. You can’t tell who voted on a random ballot selected, and elections are designed that way.

But once a restriction gets in place, it can be hard to undo it. In Georgia, they had a simple new law passed by the legislature that just said that ballot images were public records. Done. (But of course with later strings attached).

The courts can’t make new laws. They can only interpret what is on the books, so we will need some legislative action.

Bottom Line

The decision establishes that CVRs are public, which is a major development for election transparency. However, access is mediated through restrictive procedures that may limit practical usability. We need to get the data so our software can process it, not just view it.

But we need to at least try at this stage, and if we get blocked, then legal action may be necessary, but again, legislative action would be better to expand access rather than nit pick over meanings of words.

Can you help?

We seem to need people who at least live in PA and are willing to be on a list of electors we are asking data for.

Our primary targets for our audits are the following 18 counties (in order of importance): Philadelphia, Allegheny, Montgomery, Bucks, Delaware, Chester, Lancaster, York, Westmoreland, Berks, Lehigh, Northampton, Luzerne, Erie, Dauphin, Cumberland, Lackawanna, Washington. That accounts for about 75% of the electorate while auditing only the top 25% of the counties in the state. Pareto pretty much holds. And yes, most of these are right around Philly.

If you live in PA and esp. in any of these counties, please contact me so we can add you to our (privately held) list of residents that we will reveal only to the election offices if requested. That’s it. We just need your name and later, perhaps a signed affidavit that you live in PA.

Please contact me by direct message if you can help! Click the button below if so!

— Ray

Subscribe now

Share

Leave a comment

1

See

Ray Lutz

Legitimate Concerns in Riverside County are Hard to Explain

We need to keep a close eye on this one. The community group that did the work in Riverside did what appears to be an outstanding job, while the Registrar of Voters does not even take it seriously. And worse, the Board of Supervisors appears not to understand the issue at all…

Read more

4 months ago · 38 likes · 5 comments · Ray Lutz

• -- “Legitimate Concerns in Riverside County are Hard to Explain -- 45,896 more ballots than voters. Liberty Vote machines appear to be adding ghost ballots.”

We have a problem. Ballots can be added to computerized tabulation that do not exist in the physical inventory. The entire purpose of paper ballots is to provide a ground truth, yet in practice those ballots are often out of reach when verification is needed.

California guidance makes this tension explicit. The preservation rules state that once ballots are counted and sealed, they are not to be opened. The language is unambiguous: “After ballots are counted and sealed, the elections official may not open any ballots nor permit any ballots to be opened.” See California Secretary of State guidance in the April 2026 CCROV report1.

This restriction has real consequences. In 2016, Citizens Oversight (my org) attempted to verify results in the presidential primary and was unable to access the ballots. The evidence existed on paper, but the paper was effectively locked away. Unfortunately, they now reference my case as proof that the ballots remain sealed. We still disagree. Those are public documents, designed to be anonymous. Proof that the machines did not make mistakes, that no hacking occurred, that no ghost ballots exist. Yet, not available to inspect.

So we are left with a contradiction. The ballots are the evidence, yet the rules prevent inspection when it matters most.

Riverside shows the failure mode

The situation in Riverside County illustrates the problem in concrete terms.

There is a discrepancy of roughly 45,000 ballots between the reported tabulation and the chain of custody records assembled by a community group. This is not a rounding error. It corresponds to the equivalent of an entire pallet of ballot boxes.

At the same time, the ballots remain sealed. The public cannot simply open the boxes and count them. Officials are reluctant to break seals. The rules discourage it. The system defaults to trusting the tabulator.

The Sheriff intervened to preserve the ballots past the standard retention window. An investigator opened 22 boxes and found an average of about 571 ballots per box. There are 1,086 boxes in total. That sample is suggestive but not decisive. If the remaining boxes average modestly higher (35 per box), the official count could be correct. If they average modestly lower (8 fewer), the community group could be correct.

The community group is more likely correct, which is a big problem, but really the sample was not scientifically drawn and so we don’t have any known margin of error.

Noninvasive inventory

There is a third option.

Take an inventory without opening the boxes.

The phrase “take an inventory” usually implies direct counting. That is exactly what the rules prohibit. But counting does not require opening. It requires measurement.

We can determine the number of ballots in a sealed container by weighing it.

This is not novel. It is standard practice in shipping and receiving. Every day, warehouses count large quantities of identical items without opening packages. They rely on weight.

The method is straightforward.

1. Determine the tare weight of the empty container. That is simply the weight of an identical empty box.

2. Weigh a sample of identical ballot sheets. Generally, all sheets in the election are identical in size, thickness and weight.

3. Now, weigh a sealed box containing ballots.

4. Subtract the tare weight and any known packing materials. What remains is the net weight of the ballots.

5. Divide the net weight by the weight per ballot. The result is the ballot count of that box. Continue from step 3 until you are all done with all boxes.

Counting scales automate this entire process. They allow the operator to set a tare, sample a known quantity, and then display a count directly. This is routine industrial practice. It is accurate enough to run global supply chains, and these scales are precise enough to easily count ballots.

Even for a large number of ballots, like exist in the Riverside case (about 650K) the time required to count them with scales is vastly shorter than any other method, and it DOES NOT “OPEN ANY BALLOTS”.

For ballot counting, we suggest that this be a PUBLIC PROCESS and that is done any time there is a dispute AND on a routine basis from time to time. This should all be recorded and streamed. The counts of each box as weighed should be entered into a spreadsheet which can be projected or provided on a large screen. The public should be invited and provided with chairs to observe. This is not a secret. The whole process should produce a report and show that the chain of custody records match the inventory of ballots and it matches the Cast Vote Record counts.

What are they afraid of?

Why this matters

This approach changes the geometry of the problem.

It respects the rule that sealed ballots are not to be opened. At the same time, it provides an independent measurement of how many ballots actually exist in storage.

It does not rely on the tabulator. It does not rely on paperwork. It measures the physical evidence without actually touching any ballot.

If the weight-based count aligns with the reported totals, confidence increases. If it does not, the discrepancy is immediately visible and then further investigations can be warranted.

In cases like Riverside, this would narrow the uncertainty quickly. Instead of arguing over partial samples or spreadsheets, instead of blocking all access in court or seizing 12 pallets of ballots, officials could obtain a full inventory count across all boxes in a matter of hours.

The likely objection

We can expect election departments to come up with an objection to avoid public oversight. They will claim that this method is not accurate enough or that any checks are “opening ballots.”

Industrial counting scales handle variability by sampling. The same approach applies here. Use jurisdiction-specific ballots. Sample multiple stacks. Account for known inserts. The error margin becomes small relative to the discrepancy in Riverside of an entire pallet of 90 boxes and 45,000 ballots. A method with a margin of error of a few hundred is more than sufficient.

The real issue

The current system treats ballots as both the ultimate evidence and an object that must not be touched. That combination guarantees blind spots.

Noninvasive inventory removes that excuse. It provides a way to verify existence without violating sealing rules. It allows the public to confirm that the physical substrate of the election matches the reported outcome.

If we are serious about verification, we should use the tools that already exist.

Otherwise, we are left trusting numbers that may or may not correspond to anything real.

Start with the obvious comparison

Before weighing anything, there is a simpler step that should already be routine.

Election offices maintain a ballot manifest. This is the chain of custody record that states how many ballot sheets are in each container. Separately, the tabulator produces the Cast Vote Record. These two sources describe the same reality from different directions. One is physical inventory. The other is digital tabulation.

They should match.

The first step in any review is to line up the ballot manifest with the CVR totals and compare them directly. If that comparison is difficult, that is not an excuse. It is a defect in the reporting format. The reports should be structured so that reconciliation is trivial. Election departments should perform this reconciliation as a standard procedure, and the public should be able to verify that it was done correctly.

In Riverside County, the available information suggests that the custody records and the tabulator totals do not align. That is already enough to justify scrutiny.

Ballot inventory standards

If this method is to be effective, the underlying practices must be standardized. The public owns these records, and we must demand that we be able to check on them

Each container should have a documented ballot count in the manifest. Containers should be sealed in a way that allows them to be weighed without disturbing contents. The smallest batch unit should remain intact so it can be independently verified.

The contents of each box must be controlled. Ballots only. If additional materials are included, they must be documented and standardized so their weight can be accounted for. Loose items such as rubber bands, clips, or dividers introduce avoidable error and should either be eliminated or recorded explicitly.

The goal is not perfection. The goal is consistency. With consistent containers and documented contents, weight-based counts become reliable and repeatable across an entire jurisdiction.

Not sufficient to detect all errors or malfeasance

Okay, we admit this is not perfect and it will not detect anything other than ghost ballots. For example, if insiders wanted to fix the totals and add another 45,000 ballots, they could find 45,000 blank ballots and put them in boxes, and then the test might not find any errors. But it would still have to align with all other chain-of-custody records. So actually that workaround is not that easy.

Fraudsters could alter the votes as recorded by the election equipment for as many ballots as they want, and since we can’t actually compare with the votes on the ballots, the count of paper might be the same, and yet the outcome changed due to the change in the votes written on the paper. But we do have a way to put a check on that aspect, and it is a Ballot Image Audit (BIA). Again, not perfect, but it will detect a number of hacks or mistakes that can occur.

Yet, even with these deficiencies, this is a big breakthrough in our thinking. A new tool in our tool box.

Why this changes the equation

This approach breaks the deadlock.

Officials can maintain sealed ballots. The public can still verify that those ballots exist in the quantities claimed. Discrepancies can be identified without immediately resorting to intrusive handling.

It is a practical way to detect ghost ballots. Not by accusation, but by measurement.

If the numbers align, confidence increases. If they do not, the system has a clear path to investigate.

We are the public. Those are our records. Demand that the inventory be checked.

No more ghost ballots!

Subscribe now

Share

Leave a comment

See all posts by Ray Lutz: https://substack.com/@raylutz/posts

Location: Riverside, California. (1,406,690 Registered Voters)
Election: Special election for Proposition 50
Equipment: Liberty Votes (formerly Dominion) voting system
Total ballots cast: Paper records say 611,426 while computer says 657,322.
Net difference: 45,896 more ballots than documented in paper records.

Thus, there are more ballots counted by the Liberty Vote election system than are accounted for by paper records. Ideally, these numbers should match exactly. The ROV seems to not want to look at the paper records at all, and they discount the issue by saying the paper records are unreliable and are subject to human error.

Of course this is political fodder

Sheriff Chad Bianco, candidate for governor, has made a play by confiscating all the ballots from the Riverside ROV. Some say the action is purely political, playing into the same “election denier” narrative. The ROV, however, states that the difference is only 103 ballots and the election system results are correct. If the ROV is not going to investigate, then perhaps they are allowing Bianco to make this play. They could have done their own investigation.

https://www.usatoday.com/story/news/politics/elections/2026/04/03/ballot-seizing-sheriff-chad-bianco-california-riverside/89349378007/

Registar of Voters: Art Tinoco

ROV says the following, relying on reporting by Dominion (Liberty Vote) machines.

Community group says:

So what sort of records were reviewed by the community group? They examined the statements from the in-person voting centers, like the one below.

Those numbers are clear and easy to read. The ballots are typically counted and recounted to ensure accuracy. All board members at the voting center must sign the statement and attest to its accuracy.

They also obtained all the forms from the drop boxes, like the one below, which are also easy to read. These forms are completed by Registrar of Voters (ROV) staff, whether temporary or permanent, and can be trusted to a significant extent. They are also signed by the collector, Louis Fuentes, and witnessed by observer Morgan Funder. This appears reliable.

When vote-by-mail ballots are delivered to the office, they are enclosed in envelopes and processed by a BlueCrest ballot processing machine.

Below is a picture of this machine, which can accurately process vote-by-mail envelopes into batches. It captures an image of each envelope, including the QR code that identifies the voter, and matches it to the voter record database. This system helps ensure that no voter can vote twice; if a voter has already voted in person, the ballot is rejected. These machines are highly accurate and are not subject to typical human error.

The community group reviewed this log sheet for VBM ballots received from the USPS.

They say the total is the MAIL: line with 51 ballots included. The NONDELIVERABLE ballots are those that were returned without being voted, for example due to the voter having moved.

In some cases, signatures do not match. Therefore, from the raw numbers, the total must be reduced by the number of signature mismatches that are not cured. This yields the total number of “good” ballots.

Please note: we are not counting votes here, only ballots. Some ballots may be invalid for several reasons, and that will only reduce the total number, not increase it.

Board of Supervisors Meeting

You can watch the BOS meeting for Riverside County at the following link. You can skip to approximately 3:30:00 (3.5 hours into the meeting):
https://riversidecountyca.iqm2.com/Citizens/SplitView.aspx?Mode=Video&MeetingID=3355&Format=Agenda

What I found disturbing is that the ROV failed to address the numbers in their own paper records and instead provided only summarized totals. They also discussed other unrelated information about voter registration rolls, which is not directly related to the issue in question.

Community group comment start at about 4:40:00.

4:50:00 Best testimony was from Jim Niederecker

We love show and tell, we have seven of these [boxes], 3,500 pcs of paper . It took 100s of hours to gather all this. I’m going to describe how we did the audit and why we believe it is legitimate.

We did a process audit. In a process audit, the auditor must gather objective evidence to demonstrate that the process meets the requirements.

We collected that evidence, based on 15.1302(d) where ballots cast has to equal votes counted. Cindy and Sharon just did a great job describing these records, all 3500 of them.
All the records we asked for, we got. There were none missing. The ballot counts from all these records were input into excel spreadsheets and tallied. To ensure no mass calculation errors, the spreadsheets were validated. I learned that from medical device history, 35 years.

We also collected ballot counts regarding conditional ballots, ballots received by fax, and confidential. Art said we were missing some of those. No. We’re not missing any of those. All of these represent the ballots that were input into the system.

Art said you’ll need the raw data. Yeah, they’re raw data. That’s what came in. We have physical records of the ballots that showed up. Then, we provided the number of ballots rejected or not counted, such as ballots with mismatched signatures that were not cured.

Art said maybe we made a mistake we did not account for the rejects? The rejects are in there.

And thank you from … that we got that correct. We have rejects from provisionals, conditionals, and all other ballots. That accounted for about 16,000 rejects.

That count was deducted from all the ballots that came in. So now we know the number of ballots that were “good”. So Art made the point that we need to count good ballots? We know what the good ballots are. We have what came in and what was rejected.

The allowable error in this process is one error in 125,000 ballots tabulated. Jeff Nelson said there is no requirement. There is a requirement and that is it.

None of the last four elections even came close to meeting that requirement. Art showed a table that showed percentages? None of those percentages meet the requirement that need to be met. We recongnize that Art did not train this system, he did not program it, and he did not pick it. But he’s got to live with it because that’s what we’ve got. So we need to make it work.

It’s been claimed that these statements are outside the system and are error prone. Cindy and Sharon did a real nice job of explaining that they are reliable. There are three election codes, and the roster audit all point to the fact that these statements are part of the process. The vote center ballot statements and vote by mail collection forms are independently counted by two people.

… This is not difficult. I watched two people count ballots at the Melbourne library, and they had a big stack, a couple of hundred. They checked them twice and then the lead came over and said let’s check it again. So they got counted three times. So this process is not that hard, to count pieces of paper. The USPS form? Everything that comes in has to go through the mail sorter. That mail sorter counts very accurately to get a number and they put it on the page. So if that’s a human error, what other human errors are they making throughout the process. We think that process is very robust, so we think the use of these numbers makes perfect sense. We think they are accurate.

There was a mention that there could be errors on these statements. We made sure that none of those numbers on those statements was part of a math error. That’s not a viable error mode.

The staff says these numbers are no good. But they never interviewed any of the leads, never interviewed any of the people making the counts. They just “Know” these statements are not accurate. They did NO INVESTIGATION.

We know the BlueCrest Sorter knows how to count. They know that these statements are inaccurate, but in the three audits we were able to complete, the ballot counting errors are consistently on the low side resulting in thousands more ballots counted than cast. If I’m going to have random random errors be some up and some down? That’s not the case. Every time we do this, we get more counted than cast. So they are always counting to the low side?? Does not make any sense.
You’ve got 3,000 statements. That’s 3,000 counting activities with 2 pairs of people, and they always made a mistake on the low side. Does it make sense? We don’t think so.

The 2% industry standard that Jeff Nelson mentioned, that 2% industry standard applies. I stood here two weeks ago and said that the Secretary of State said there is NO 2% industry standard. I didn’t bring the email from the Secy of State to give it to you to show that that doesn’t exist. But I’m going to send it to you.

Mr. Tran and our team are going to meet in about 2 weeks or so and we’re going to talk through this accuracy standard. And so we’ll be able to put this to bed.

Jeff said there is no allowable error rate. That’ makes absolutely no sense. You can’t say “Any error is okay”.

…

In closing, the ROV must document their reconciliation process. You all should see the numbers, before you accept it. Art’s numbers are different from my numbers. And I used the report from the EIMS that I was told to use. His numbers are now different. So we need to see a report of where did he get his numbers, so we can try to figure out why we are so far off. (mike cut out).

Court Case

The action by Sheriff Bianco is being reviewed by the California state court to determine whether it is legitimate.

https://kesq.com/news/local-news/2026/03/30/sheriff-bianco-files-formal-response-to-california-supreme-court-in-ballot-probe/

I understand that the next court hearing will be on April 13. I may drive up to Riverside from my home in San Diego to observe.

Regardless of the court case, the ROV should recount the ballots — not a vote recount, just a ballot sheet count. One sheet per ballot. This can be done using a counting scale.

Attempting to count all the ballots without proper planning is difficult in an election with 657,000 ballots. The experience in Maricopa County AZ was that the Cyber Ninjas count was off by approximately 300,000 ballots, determined by using machines that count paper but do not move the paper. In this case, weighing the paper may be a practical method.

The “Bantam-1” machine counts sheets by slightly deforming the corner in front of an optical detector. This method was used in Maricopa. The machines can insert tabs every specified number of ballots and have very high accuracy, although paper can occasionally stick together. I think most people are not aware of this option.

See this video:

In this case, a counting scale is much more cost-effective. The JCE-30K has a 60 lb capacity (1,000 ballots can be easily handled) and is in the $449 price range. Purchasing two of these would make the process faster than using a Bantam-1–type counter. But using both may be a smart move to make damn sure the ballots are counted.

Thus, counting the ballots would take about a week at most. With the scale, it takes only a few seconds to load, allow it to stabilize, and then read the count.

They will likely spend more time in court and discussing this than actually resolving it.

There are two major possible outcomes to the process:

1. Paper ballots match the Liberty Vote machine count. But then, we still have to figure out where the paper came from, or question the paper records.

2. Paper ballots match the paper records. This is even worse. It means the paper ballots were scanned twice or loaded twice or that the Dominion/Liberty machines are changing the numbers in the results instead, and in such a way that the election officials will stand by the results.

We must be concerned

Connect the dots. The Dominion voting system was purchased by an unknown group associated with the pollbook company KnowInk (See my substack post “Dominion Voting Systems Secretive Buyout — Liberty Vote is owned by a complex matrix of Delaware shell corporations and LLCs.”) Now, we see that this voting system is dreaming up 45,000 ballots that were not cast.

This will not change the results in the Proposition 50 election, which passed 64.4% to 35.6%, with about a 3,000,000-vote margin of victory. So the 45,000-ballot discrepancy in Riverside will not affect the outcome. Some would argue that this means there is no cause for concern, but I disagree. This discrepancy must be understood.

How could it happen?

There are only a few possibilities:

1. The paper forms were consistently filled out incorrectly, resulting in an aggregate error of 45,896 ballots. This initially seemed possible, but it is unlikely given that each sheet accounts for only up to about 1,000 ballots.

2. Some paper records were not included in the community group work. This would exonerate the system and the results, but put into question the fact that all records were supplied.

3. Ballot count matches paper records. Ballots were scanned twice in the scanning process.

4. Ballot count matches paper records. Ballots were scanned once but transferred twice to the Election Management System. I have seen this occur in Volusia County FL and Monmouth County NJ but only for Election Systems & Software (ES&S) voting systems.

5. Ballot count matches paper records. The Liberty Vote (Dominion) system generated “ghost ballots” internally. This would imply a serious systemic issue.

Dominion/Liberty systems could, in theory, influence results across election districts nationally in November.

Election Officials should routinely check their paper records

These paper records are created but not fully reconciled by the ROV, which appears to rely heavily on the Dominion (Liberty) voting system, trusting it over the paper records.

This could indicate a much, much larger issue that we need to resolve prior to November.

I will stop here. As I learn more, I will provide updates. I may attend the hearing on April 13.

April 10 Update: April 13 Hearing Off Calendar

The previously scheduled April 13 hearing in Riverside Superior Court will not take place. The parties jointly requested that the matter be taken off calendar, and the case has been paused at the trial court level.

Current Status of the Case

The case is now before the California Supreme Court (Case No. S295901), which has granted review and assumed control over the proceedings.

The Court has issued an order that:

• Halts the Sheriff’s investigation

• Requires that all seized ballots be preserved

• Directs the parties to propose measures to safeguard the materials, including possible transfer to a neutral custodian

The matter is now in an expedited briefing phase, with key filings due in mid-April. No in-person hearing has been scheduled at this time.

Warrants Unsealed

One other development in the case is that the search warrants used to seize the ballots have now been unsealed. This makes the underlying investigative basis and supporting declarations publicly available for review, including quantitative details about the ballots themselves.

Six-Month Retention

We noted that these ballots are subject to California’s retention requirement for elections with no federal offices, which requires preservation for at least six months rather than the 22-month federal standard. For a November 4, 2025 election, that would place the earliest destruction date at approximately May 4, 2026. However, that timeline is no longer operative. The ballots have been seized under warrant and are now subject to court orders requiring that all seized materials be preserved. As a result, the normal retention schedule has been superseded, and the ballots must be maintained until the court directs otherwise.

Warrant-Based Ballot Estimates

The warrants show that the investigation proceeded in stages, with multiple warrants issued over time. This suggests that the scope of the seizure was incrementally expanded, rather than executed as a single, fixed operation. That pattern is consistent with investigators developing their estimates as additional boxes were examined.

In the most recent warrant, the investigator reports counting ballots in 22 boxes, totaling 12,561 ballots. This yields an average of approximately 571 ballots per box. Applying that average across the full set of 1,086 boxes gives an estimated total of 620,106 ballots.

This estimate can be compared to two reference figures:

• Election office reported total: 657,322 ballots

• Community group estimate: 611,426 ballots

Using the warrant sample:

• The estimate is short of the official total by 37,216 ballots

• There are 1,044 boxes remaining beyond the 22-box sample

• To match the official total, those remaining boxes would need to average about 606 ballots per box, or roughly 36 more ballots per box than the sampled average

By contrast:

• The community group total is 8,680 fewer than the sample-based estimate

• This would require the remaining boxes to average slightly lower than the sample, by about 8 ballots per box

Interpretation of the Sample

Based strictly on the warrant sample:

• Matching the official total requires a significant upward shift in ballots per box relative to the sample

• Matching the community group total requires only a modest downward adjustment

Thus, the sample is more consistent with the community group’s reported total than with the official reported total, assuming the sample is representative.

This remains a preliminary comparison. The key variable is whether the 22-box sample is representative of the remaining 1,044 boxes. But the fact that the sample more likely supports the community group’s assertions should give them more credibility in addressing the question about whether a full count should be performed.

Communication to Riverside Sheriff’s Office

Since it appears they did not read this substack article (What!? They don’t read my substack??!!) and used pure (and time consuming) hand counting rather than machine-assisted counts, I sent the Sheriff’s office a note with a link to his substack to assist in any future counting projects using their web portal. Some argued that they would know very well how to count paper (probably count cash sometimes, but cash counting machines are common and not useful for ballot counting), but it appears they just did a quick sample of 22 boxes and counted by hand.

—Ray

P.S. So sorry that my substack has been neglected for a while as I have been deep in auditing and improving our auditing system, AuditEngine. See more at https://AuditEngine.org. Please stay tuned for more frequent updates!

Subscribe now

Share

Leave a comment

All posts: https://substack.com/@raylutz/posts

Summary of points in this article:

• Creating a paper record can detect machine errors, but only if it is adequately checked

• No audits were performed in TN for the Dec 2 election due to legal constraints.

• The machines in TN include some of the worst, yet some of the best.

• An RLA audit would be feasible in this election.

• The Risk Limit in RLA audits is only about the sample sizes, not all risks.

• The RLA audit would clarify who won and lost, but not by how much.

• Ballot Image Audits (BIAs) can clarify whether the margin of victory was correct.

• We should attempt to do a BIA of Williamson county

• We must push for hand-marked ballots in 10 of these 14 counties, and retire the pushbutton with VVPAT machines.

• In the future, all ballot images should be saved and made available for public review.

Creating a paper record can detect machine errors, but only if it is adequately checked

Paper ballots make verification possible only if someone actually looks at them. Without audits, the paper record functions largely as an emergency backup rather than an active safeguard. That backup role still matters because machines can fail catastrophically, but failing to examine ballots leaves the public with little more than trust in software-reported totals.

No Audits Are Being Performed in Tennessee for the December 2 Election

For the December 2 election, no audit is required by Tennessee law. The statutes mandate audits only for elections held in August and November, not for those conducted in December.

In practice, election officials interpret these provisions not merely as defining what must occur, but as setting the outer limits of what is permitted. If the code does not explicitly require an audit, it is treated as if audits are not allowed at all. As a result, even straightforward post-election verification is avoided.

The sections that follow examine Tennessee’s election audit statutes and explain how this interpretation has effectively eliminated audits for the December 2 election.

From the statutory language shown below, several additional limitations become clear. Even when audits are conducted, they involve only a small fraction of the state. Depending on the provision applied, just 3 or 6 counties out of 95 are selected for review.

The statute indicates that the Secretary of State selects these counties at random on election day. From an audit-design perspective, this timing is problematic. Ideally, selection should occur only after all results are finalized and frozen, so no county knows in advance whether it will be audited. Advance knowledge undermines the deterrent value of audits by allowing jurisdictions to anticipate scrutiny.

The code does not clearly specify when on election day the selection occurs. Given typical administrative practice, it is reasonable to assume the selection is made early, possibly at the start of the day. If so, counties would know well in advance whether their work will be reviewed, further weakening the audit’s effectiveness.

The next clip shows an additional constraint. In November elections, only a single contest is audited, either the presidential or gubernatorial race. In August elections, the audit is limited to the top county-level contest.

In each case, only one contest is examined, and election officials know in advance exactly which contest it will be. This advance certainty further limits the audit’s value, as it narrows both the scope of review and the uncertainty that audits are meant to introduce.

The workload is reduced even further by limiting the number of precincts audited. As shown below, counties audit either 1 or 5 precincts.

Only the 5 largest counties—Shelby, Davidson, Knox, Hamilton, and Rutherford—are classified as large counties and are required to audit 5 precincts. The remaining 90 counties, if selected at all, audit just a single precinct.

In practical terms, this produces extremely low coverage. In Shelby County, with approximately 907,000 residents and about 540,000 registered voters—roughly 400,000 of whom turn out—auditing 5 precincts amounts to coverage on the order of 0.1 percent. A more typical benchmark is closer to 1 percent.

A more defensible approach would scale the audit to a percentage of precincts rather than a fixed number, ensuring that audit coverage grows with county size rather than shrinking in relative terms.

The process then calls for one or more machines to retabulate the selected precincts. Critically, the machine used for this retabulation is one that was already used during early voting.

As a result, any configuration errors shared across machines would not be detected by this process. The audit does not introduce an independent tabulation method; it simply repeats the count using similar equipment.

Absentee and early-voted ballots are handled in the same manner, rescanned using scanners already deployed for that category. This further limits the audit’s ability to detect systematic errors affecting the original counts.

The process also assumes, implicitly, that all margins of victory exceed 1 percent. Discrepancies are not investigated unless the difference between the retabulation and the original results exceeds that threshold.

This creates a serious blind spot. Consider a contest decided by a 0.3 percent margin. If a retabulation using another machine differs from the original count by 0.5 percent, the reported outcome could be wrong. Yet because the discrepancy is below the 1 percent trigger, the results are still certified.

In close races, this policy allows potentially outcome-altering errors to pass without further review.

If they find a variance of more than 1%, then they can rescan 3% of those or other precincts using a different machine or do a hand count.

They also conduct performance audits, which verify that procedures were followed but do not examine election results.

Although risk-limiting audits are mentioned, the statutes provide no detail describing how such audits would be conducted.

Taken together, the weaknesses in Tennessee’s audit framework can be summarized as follows:

• Audits are required only for August and November elections.

• The December 2 election is therefore not audited at all.

• Even when audits occur, only 3 or 6 counties participate, and those counties may be identified before polls close and before results are frozen, eliminating the element of surprise.

• In November elections, only the gubernatorial or presidential contest is audited; in August elections, only the top county office on the ballot is reviewed. Other contests are not automatically checked, even though configuration errors or malicious interference could affect any contest in any county.

• Within a selected county, only a small number of precincts are audited.

• The audit consists of rescanning ballots using machines that were already used in the same election, likely with the same configuration and the same potential errors.

• If the audit reveals discrepancies of up to 1 percent, no further action is required, even if the margin of victory is far smaller. While this is not a concern in the December 2 election, which had a 9 percent margin, it is critical in closer races.

• If discrepancies exceed 1 percent, officials are only required to rescan the ballots again and possibly expand the audit to a few additional precincts. A hand count is never mandated.

• The statutes do not provide a detailed or operational description of a risk-limiting audit.

The Machines Used in Tennessee Include Some of the Worst, Yet Some of the Best

Machine Types

Tennessee uses a wide variety of voting systems, ranging from some of the most outdated technologies still in service to systems that are comparatively strong from an auditability standpoint.

At the low end are legacy DRE (direct-recording electronic) pushbutton machines. These systems do not produce conventional paper ballots and have instead been retrofitted with VVPAT devices, or Voter-Verifiable Paper Audit Trails. The VVPAT prints the voter’s selections onto a narrow paper tape, similar to a cash-register receipt. Voters can view this tape through a window, and in theory it can later be audited.

In practice, however, this assurance is largely illusory. If no audits are performed, the VVPAT serves no verification function at all. The paper exists, but it is never meaningfully examined.

Across the state’s 95 counties, roughly one-third still rely on these pushbutton systems, shown in red in the map below. Counties using ballot-marking devices with touch-screen interfaces that produce paper records containing barcodes are shown in yellow. Counties that primarily use hand-marked paper ballots—where voters darken ovals directly on the ballot—are shown in green.

(The county in the lower left corner is County, home of Memphis. Although supported, they still tend to avoid hand marked ballots. The voters can choose. 95% pick BMD’s and 5% use hand marked paper. Education can help on this front.)

This diversity of systems has direct consequences for auditability and public confidence, especially in the absence of mandatory post-election verification.

Tennessee’s 7th Congressional District includes 11 counties in their entirety and portions of 3 additional counties. The partial counties are clustered around Nashville in Davidson County and extend south into Williamson County.

Davidson County, a Democratic stronghold, is divided in a manner that appears designed to ensure the 7th District remains reliably controlled by the Republican Party. This configuration reflects the effects of partisan gerrymandering on the district’s composition and electoral outcomes.

See NYTimes summary here: https://www.nytimes.com/interactive/2025/12/02/us/elections/results-tennessee-us-house-7-special.html

MicroVote Infinity (DRE Pushbutton)

The worst of the systems used in the 7th Congressional District is the MicroVote Infinity, a pushbutton DRE machine that can be outfitted with a VVPAT (Voter Verifiable Paper Audit Trail) device. The VVPAT printer, visible just beyond the voter’s arm in the image below, produces a continuous paper tape recording the voter’s selections which the voter can verify when they vote.

If no one compares the VVPAT tape to the data uploaded into the Election Management System (EMS), the reported totals in the EMS can be altered without meaningful constraint. In this election, approximately 16,000 votes were reported for Van Epps over those reported for Behn. Given that 65,367 votes were cast on these machines, that outcome could easily be reversed by manipulation or misconfiguration affecting only a fraction of the totals.

Although the VVPAT is often described as providing a “paper record,” that assurance is meaningless when no audits are conducted. In this election, nothing is checked.

Even if officials wanted to examine ballots from the VVPAT tapes, doing so would be logistically difficult. A truly random selection would require generating a random index and physically counting forward on the tape to reach that ballot. Because the tape is continuous, it tends to unspool uncontrollably, making handling and preservation challenging. When California still permitted these systems, the law required a 100% hand count of the tapes. Some counties resorted to using custom jigs to keep the tape aligned while unrolling it from start to finish.

These machines do not produce ballot images, and creating them would require specialized scanners capable of handling continuous tape media and a lot of work.

For additional technical details on the MicroVote Infinity system, see: https://verifiedvoting.org/election-system/microvote-infinity/

ES&S ExpressVote BMDs + DS200 scanners

About half of the ballots in the 7th Congressional District across 6 counties were cast using a combination of ES&S ExpressVote ballot-marking devices and DS200 scanners.

The ExpressVote is a touch-screen BMD (ballot marking device). Voters make their selections using the on-screen interface, shown in the first image, and then print a ballot summary sheet. This is a narrow, half-sheet paper ballot containing both human-readable text and barcodes.

The printed summary sheet is then inserted into a DS200 scanner. The scanner reads the barcode to tabulate the vote and generates both aggregated totals for that machine and a ballot image of the summary sheet. At the close of voting, the memory card from each DS200 is removed and returned to the election office, where the results are uploaded into the Election Management System (EMS).

Because ballot images are created, these systems support ballot image audits, which can be used to compare reported results against recorded voter intent at scale.

There is one important caveat: these machines allow ballot image saving to be disabled. If that option is not enabled, the auditability advantage of this system is largely lost.

Even though there is a paper record and ballot images of this ballot that are created, if they are never reviewed, then again, the totals in the EMS can be changed without any limit.

Unisyn OpenElect Optical (OVO) and Hart Intercivic Verity Scan

The Unisyn OpenElect Optical (OVO) and the Hart Intercivic Verity Scan systems both use hand-marked paper ballots and represent the stronger end of the technology spectrum used in the district. Each accounts for roughly 6 percent of the vote, with Unisyn used in 1 county and Hart Intercivic used in 3 smaller counties.

These systems are similar in design and operation. They are not BMDs that rely on barcodes, and they are not DRE systems retrofitted with VVPAT devices. Voters mark paper ballots directly, which are then scanned optically. This is good.

Both systems produce ballot images, making them well suited for ballot image audits. From a technical standpoint, they support meaningful post-election verification.

Unisyn OpenElect Optical (OVO)

Hart Intercivic Verity Scan

Even so, sound technology alone does not ensure accuracy. Without audits, even the best systems provide no verified assurance that the reported results reflect voter intent.

An RLA Audit Would Be Feasible in This Election

With a reported margin of approximately 9 percent, this contest is especially well suited for a ballot-polling risk-limiting audit. Verifying the outcome—who won and who lost—would require examining only a small number of paper ballots.

A district-wide RLA would require on the order of 400 ballots drawn randomly across all or part of the 14 counties in the district. On average, that is about 29 ballots per county, with sample sizes ranging from roughly 4 ballots in the smallest counties to about 96 in the largest. This is a modest effort with a high return in assurance.

What a Risk-Limiting Audit Actually Does

A risk-limiting audit is a statistically guaranteed check of an election outcome. It is designed so that:

• If the reported outcome is wrong, the audit has at most a small probability—called the risk limit—of failing to detect the error.

• If the reported outcome is correct, the audit usually stops after examining only a small, random sample of ballots.

• Unlike fixed-percentage audits, RLAs scale with the closeness of the race. Narrow margins require more ballots; wide margins require fewer.

In this contest, the margin is large enough that a ballot-polling RLA would conclude quickly.

The BRAVO1 method uses this formula for estimating the expected number of ballots needed is:

Where:

• alpha is the risk limit (commonly 5%)

• m is the margin as a fraction (0.09)

For a 5% risk limit, the expected sample size is about 400 ballots district wide (14 counties)

For a 5 percent risk limit, the expected sample size is approximately 400 ballots district-wide, spread across 14 counties. This is an extraordinarily small burden for what it provides: statistical confirmation that the reported outcome is correct.

Why Audit a Race with a Large Margin?

This question comes up frequently, and the answer is straightforward: Audits are not just for close races, they are for all races. Even contests that seem like they have impossibly wide margins could be reported incorrectly due to configuration errors or malicious actions.

In this election, the margin of victory in raw votes was about 16,000. Altering a computerized result does not require changing the marks on paper ballots; it only requires modifying a few numbers in a spreadsheet. Without audits, those numbers can be changed without detection.

And we know that computers can be hacked. Please see this article if you think the machines can be trusted at all: https://raylutz.substack.com/p/usb-hacker-tool-could-change-virtually “USB Hacker Tool Could Change Virtually Any Election Results, Given Access” which provides two solid examples of how the results could be hacked.

Machines do a very good job of tallying the votes, but errors do happen. Machines themselves are not malicious. But humans can be, and humans can insert code to make changes even if normally the machines are trustworthy and rarely make errors.

Paper Ballots Only Protect Elections If We Look at Them

Significant effort goes into securing paper ballots: controlled ballot stock, chain-of-custody procedures, sealed containers, and retention requirements. But these safeguards only matter if ballots are actually examined.

Without audits:

• The paper record is unused.

• Confidence depends on trusting software totals.

• The public loses visibility into a process that should be open and verifiable.

With such a favorable statistical environment—large margin, small sample size, straightforward logistics—this election represents an unusually efficient opportunity to demonstrate a modern, evidence-based audit.

If the state does not conduct an RLA, the public loses:

• A scientifically sound confirmation of results

• An opportunity to normalize and refine best-practice audits

• A moment to show that verification is routine, not exceptional

Audits are not about suspicion.
They are about good governance, transparency, and accountability.

The table below provides a convenient reference for estimating the number of samples required for a risk-limiting audit using the BRAVO ballot-polling method.

If there is any indication that the reported loser may in fact be the true winner, additional ballots will be required, potentially doubling the initial estimate. This reflects how RLAs respond to conflicting evidence by expanding the sample until the outcome is resolved.

A technical note is important here. The BRAVO method simplifies the mathematics by assuming ballots are sampled with replacement, meaning the same ballot could theoretically be selected more than once. This assumption is used only for statistical convenience. In practice, ballots must never be resampled, or the audit could fail to converge if significant discrepancies are present.

The table also illustrates how sharply the required sample size increases as margins narrow. Margins above 2 percent require relatively modest samples, while margins below 2 percent grow rapidly. At a 9 percent margin, very few ballots are needed to confirm the outcome. Although the calculation yields an estimate of 370 ballots, it is prudent to plan for at least 10 percent more in the initial draw to avoid the need for additional sampling.

The method itself is straightforward. Ballots are randomly selected, and the vote on each sampled ballot is recorded and the margin calculated. After the initial sample is examined, the statistical risk is evaluated. If the calculated risk falls below the chosen limit, the audit stops.

In this case, the number of ballots drawn from each county would likely range from about 4 to 96, selected randomly from all ballots cast. The variation reflects differences in turnout, with roughly 1 ballot sampled for every 450 ballots cast across the district.

Conceptually, this is similar to an election poll, except that instead of asking voters how they voted, the audit examines the ballots themselves. Sampling continues only until the uncertainty is low enough to confirm the outcome. The key comparison is between the reported margin of victory and the margin observed in the sample, and the audit stops only when the evidence shows that the paper ballots support the computer-reported result.

Other RLA Methods Do Exist

There are several forms of risk-limiting audits, each with different requirements and efficiencies.

The method described above is known as a ballot-polling RLA. One advantage of this approach is that it does not require a cast vote record (CVR) that lists individual ballots. Ballots are sampled directly and interpreted by hand, making this method usable even in jurisdictions without ballot-level digital records.

If a jurisdiction can reliably match each paper ballot to its corresponding CVR, a ballot-comparison RLA2 becomes possible. This method is generally more efficient, requiring fewer ballots, because it compares each sampled ballot directly against the machine-recorded vote.

Another commonly used approach is the batch-comparison audit. In this case, vote totals are compared at the batch level rather than ballot by ballot. Many election offices find this method easier to administer because it closely resembles a traditional recount process and aligns with existing procedures. However, it typically requires examining more ballots than a ballot-comparison audit.

“Risk Limit” does not limit all risks

It is important to understand what the term risk limit actually means. It does not mean that all risks are limited to that value. The risk limit applies only to the additional uncertainty introduced by sampling.

Because an RLA examines only a subset of ballots, there is some chance that the sample could indicate the outcome is correct when it is not. The stated risk limit bounds only that probability. It does not account for other sources of risk in the election process.

For example, RLAs do not address the risk that ballots were added or removed, that some ballots were never included in the count, or that ballots were altered while in storage. Paper marks could be changed by someone with access, such as darkening ovals or creating overvotes. Ballots could be invalid, or ballot boxes could be stuffed. The actual audit itself could be performed incorrectly. None of these risks are included in the RLA risk limit.

In that sense, RLAs can be thought of as “risk-taking audits.” The risk limit represents the additional risk accepted due to sampling, layered on top of all other risks that may already exist.

This is why RLAs must be part of a broader verification framework. Other risks must be reduced as much as possible through reconciliation checks, such as matching the number of ballots to the number of voters who signed in, verifying chain of custody, and enforcing secure storage. While it may be impossible to eliminate every risk, sampling risk should not be confused with total election risk.

Multiple Contests

This election contained only a single contest on the ballot. That simplicity makes the statistical analysis straightforward, because the required sample size depends only on the margin in that one race.

Most elections are far more complex. They can contain hundreds of contests, even though any given ballot may include only 10 or 20 of them. When sampling ballots, some contests—especially those that appear on relatively few ballot styles—may be represented by very few sampled ballots, or none at all.

Jurisdictions handle this problem in different ways, but the common approach is to minimize the number of ballots examined. That typically means selecting a contest that appears on many ballot styles and has a relatively large margin. Colorado follows this approach and promotes its audits as a “gold standard.” In practice, however, this strategy provides limited assurance. It avoids testing many contests and does not justify the strong claims implied by the tight risk limits that are advertised. A more accurate description would be a fool’s gold standard.

In the present case, these multi-contest complications do not apply. However, other challenges remain.

An RLA audit can clarify who won, but not by how much

This election presents an ideal opportunity to conduct a risk-limiting audit, which is the most efficient method for confirming the election outcome—specifically, who won and who lost. But an RLA does not go further than that.

The reported margin of victory was 9 percent, compared to Trump’s 22 percent margin in the same district in 2024. Reducing that gap from 22 percent to 9 percent was obviously a rhetorical victory for Behn and her supporters. The unanswered question is whether the reported results are accurate.

Merely confirming that the winner was correctly identified is not sufficient here. An RLA will not determine whether Van Epps actually won by 9 percent, by a much larger margin such as 18 percent, or by a much smaller margin, say 4 percent. A risk-limiting audit is outcome-oriented, not margin-sensitive. It answers only one question: would a full hand count confirm the reported winner?

If the election were partially compromised, or if configuration errors reduced a true margin of 18 percent down to a reported 9 percent, an RLA would not detect that. Likewise, if the true margin were only 4 percent or even 2 percent, an RLA would still stop once it had sufficient evidence to confirm the winner, though it might require examining more ballots to do so, and the difference in the reported and actual margin would never be determined.

In both cases, the conclusion is the same: the audit would report that Van Epps won the election with 95 percent confidence, meaning that a full hand count (if conducted properly) would be expected to confirm that result in 19 out of 20 trials, but miss a flipped contest 5% of the time. What it cannot tell us is whether the reported margin accurately reflects the true level of voter support.

Ballot Image Audits (BIAs) can clarify the margin of victory

Because RLAs are not designed to measure margins precisely, a different approach is needed. Ballot Image Audits can process all ballots and determine whether the reported margin of victory is correct. While both RLAs and BIAs assume the underlying paper record is valid, BIAs examine every ballot image and can produce a highly accurate, independent tabulation.

Modern voting systems capture a digital image of each side of every paper ballot at relatively high resolution. These images are aligned and registered using image-processing techniques, and the marks are interpreted to create a cast vote record. This is a fundamentally different process from earlier systems that sampled only limited areas of the ballot to detect marks.

Because ballot images exist at the individual ballot level, they can be reprocessed independently to generate a full tabulation of the election. This allows verification not just of who won, but of the size of the win, if it was improperly tabulated, and that would obviously should trigger a full hand recount to verify the change of the margin.

Another important advantage of ballot image audits is that they can be conducted without handling the physical ballots and can be performed by an independent entity. For this purpose, the AuditEngine.org platform is available and well suited to the task.

BIA Feasibility in the 2025 TN 7th CD election

In this election, the MicroVote pushbutton machines with VVPAT do not produce ballot images. While it is technically possible to create images from the VVPAT tapes, doing so is difficult and requires processing the tapes, something only the election staff can do with a court order. Therefore, these machines are poorly suited for a ballot image audit conducted by an outsider.

By contrast, the other voting systems used in the district do produce ballot images and are readily auditable. AuditEngine can process these images directly, making those ballots the most accessible starting point for a ballot image audit, and most easily will be those from ES&S, as those are already easily processed.

Looking at the counties that make up the 7th Congressional District helps clarify what could be reasonable and feasible targets. The plot below arranges counties horizontally based on their partisan lean in the 2024 election, with more Democratic-leaning counties on the left and more Republican-leaning counties on the right.

Across all counties in the district, there was a margin shift in favor of the Democratic candidate, Aftyn Behn. The observed shifts range from at least about 7 percentage points to as much as 20 points. In the plot, the shift is shown as the numerical change in margin relative to prior results, and should fall on the line if all counties experienced the same relative shift.

Only one county, Davidson, leans Democratic, with a 2024 partisan lean of roughly 21 percent Republican, or about 79 percent Democratic (far on the left). All other counties are Republican-leaning. Those counties generally show smaller shifts, though one tiny county, Perry, exhibits a shift of nearly 15 points.

I sketched a trend line through the data and noted what appear to be outliers. In the two boxed cases, the observed shift in favor of Behn is smaller than what the trend would suggest. The two counties that stand out are Montgomery and Williamson, with 2024 partisan leans of approximately 59 percent and 65 percent Republican, respectively.

Montgomery County uses MicroVote pushbutton/VVPAT machines and recorded 43,118 votes. If its shift had aligned with the trend seen in comparable counties, the margin would have increased by roughly 5 additional points in Behn’s favor. That corresponds to a margin shift of about 3,448 votes (which could be 1,724 votes flipped from Behn to Van Epps, or 3,448 votes improperly posted to Van Epps or not posted to Behn, or some combination, just to be clear about the number.

Williamson County shows a similar pattern. Instead of the observed 7-point shift, it might have exhibited a shift closer to 14 points, consistent with the trend line. That implies an additional 7-point margin shift, amounting to roughly 1938 votes shifted.

Combined, these two counties would account for approximately 5,386 additional votes for Behn, or roughly a 3 percent improvement overall. In that scenario, the reported loss margin would shrink from 9 percent to about 6 percent. Behn would not win, but the change in margin would still be of incredible interest.

These calculations are illustrative only. They are not claims of fraud or manipulation. They are rough estimates intended to identify where closer scrutiny would be most informative.

To test this hypothesis, a ballot image audit of Williamson County would be a logical next step. Approximately 28,000 votes were cast there, and auditing that county would be relatively straightforward for AuditEngine, assuming access to the ballot image data.

Some may argue that the election has already been certified and any audits are now moot. While certification deadlines matter, they are not absolute. There are precedents for elections being reconsidered after certification. If meaningful discrepancies are found, it would cast the entire election in a different light and could justify a full hand count of the VVPAT-based systems, as well as expanded ballot image audits of the ES&S, Unisyn, and Hart systems.

Agenda for Tennessee

We offer the following agenda items for TN and our oversight activities, to improve the auditability and verifiability of the result, and improve voter confidence.

• MicroVote pushbutton machines must be replaced immediately with hand-marked paper ballot systems.

• Hand-marked paper ballots can already be used with ES&S DS200 scanners without new purchases. ExpressVote machines should be limited to accessible voting only and hand-marked ballots used by all other voters, scanned directly by the DS-200 scanner. No new purchases, just use hand-marked ballots and avoid barcodes.

• Ballot images must be retained by default and made available for audit and public review.

• Auditing laws should be updated to require:

  • All counties to participate

  • All elections to be audited, including special and December elections

  • All contests to be at least partially sampled

  • A minimum of 1% of precincts, or 1% of absentee (mail) ballot batches

  • Random selection of audit units after results are frozen

  • Hand counts only, with no machine re-tabulation allowed

  • Ballot Image Audits where ballot images exist, to verify margin accuracy

  • Risk-limiting audits should be clearly specified in statute, with defined procedures rather than vague references.

  • Ballot image audits should be explicitly authorized as an acceptable audit method.

• Our Action: Request ballot images and conduct a ballot image audit for at least Williamson County as a pilot and demonstration project.

What we’ve learned from Tennessee

• Tennessee presents a mixed landscape, ranging from obsolete pushbutton machines to strong hand-marked paper ballot systems. Similar mixtures exist in many states.

• Elections can be substantially improved by retiring legacy machines and standardizing on hand-marked ballots. In many cases (ES&S, Dominion) the scanners can already handle hand-marked ballots, and the only purchase may be ballot printers so ballots of any style can be printed on-demand.

• Audit practices are currently too limited to provide meaningful verification.

• Automated audits that rely on the same machines used in the election do not provide independent assurance and should be abandoned.

RLA Audits Can Verify Outcomes, but Not the Quality of the Win

This case shows that risk-limiting audits are valuable but insufficient on their own. RLAs can confirm whether the reported winner is correct, but they cannot determine whether the reported margin accurately reflects voter intent.

Ballot image audits go further. By examining all ballots, they can assess the quality of the win, not just its existence.

Subscribe now

Share

Leave a comment

• All Posts: https://substack.com/@raylutz/posts

• Prior Post: https://open.substack.com/pub/raylutz/p/dominion-voting-systems-secretive “Dominion Voting Systems’ Secretive Buyout”

When I actually go into the election office, I learn a lot. It seems I can never predict what the issues will be. But this issue is so egregious, I decided to fully document it here so you can understand the details and hopefully check your district for these same issues. Honestly, the extent that this issue might exist in other areas is limitless.

Feel free to send this article to your registrar or election supervisor and ask them to explain if it also applies to them. Document their process like I did here and ask them to tell you where in the process they are anonymizing the ballots from the voter record.

Why Ballot Privacy Matters

The secrecy of the ballot is the foundation of a free election.

No voter should ever have to worry that anyone—even insiders—could discover how they voted. If voters believe their votes can be traced back to them, it opens the door to coercion, intimidation, or worse. We must respect the privacy of the vote! Even if voters think their votes may be linked to them, they may decide to not vote at all, and we must avoid that.

And, we can’t fully trust insiders either, because they can be hired, bribed, or blackmailed.

Privacy breaches can occur in two main ways:

1. Small-group exposure:
   For example, if batches are processed, as they are in San Diego, with 200 ballots in each batch, then if the results are subtotaled by precinct, and if there is only a single voter from that precinct, the totals for that precinct in the batch will be the exact vote of that single voter.

2. Systemic exposure:
   If internal election data link each voter’s mail ballot envelope to the exact scanned ballot image, then every voter’s choices can, in principle, be reconstructed—especially by an insider or if a hacker obtained both datasets.

In the current statewide special election—one simple proposition (Prop 50) on all ballots—category (1) is not a major concern, particularly if they take care to group the same precincts to the same batch. Yet, it is still a concern and we can evaluate that when we get the CVR data. [We will continue to investigate the small groups issue in San Diego because the batches are pretty small, only 200 ballots each, and report on that later.]

But category (2) is a severe latent hazard that persists in every election that uses vote-by-mail processing systems capable of maintaining ballot order.

What was Observed in San Diego

On October 30 and 31, 2025 I observed processing at the San Diego Registrar of Voters (ROV). In this period prior to election day, the ROV provides in-person early voting and also processes mail ballots received each day. I have been a regular observer since about 2006, and I encourage you to also do the same in your area. Here is the main office of the ROV in the Kearny Mesa area of San Diego.

To observe, you must sign an observer agreement, and sign in and get a badge each day. You don’t have to go every day, and you don’t have any specific times you must go. This job is strictly voluntary (i.e. no pay) but that is important. If you are paid by the ROV, you are their employee and no longer independent. They can’t fill this role themselves.

Signing in is easy and they provide a stick-on badge. You can’t leave with the badge and so if you leave for lunch, you will need to sign-in again. But procedures vary.

Here is the block diagram of their procedure for mail ballot processing:

In my observation of the extraction room (step 5), I noticed some procedural changes that would be good for them to make, so the ballot sheets and the voter’s ballot envelope, with name showing, could not both be seen at the same time.

The staff were cooperative and took corrective steps when I raised those two issues in the extraction room. This is the room where the envelopes are opened and the ballot is removed, after the signatures have been verified. I noticed that a worker or observer could see both empty envelopes with the voter’s name and signature exposed and concurrently could see their voted ballot.

After I brought up the issue (and after I complained again in 24 hours with no changes made yet):

• They restacked the empty envelopes white-side down so voter names were not visible to anyone.

• They closed ballot boxes during worker breaks so no ballot–envelope pairs could be seen.

These small changes are significant and appreciated. But they address only surface-level privacy risks.

A deeper design flaw remains.

The Hidden Hazard: Ballots linked to Voter identities

To explain this, I will need to go through their process at a fairly detailed level. I apologize for “getting into the weeds” but we must get comfortable with these details, because details do matter.

Here is the process being used in San Diego:

1. Initial Batching for Signature Verification. Mail ballot envelopes arrive from USPS and are sorted by the BlueCrest high-speed mail management system into batches of 200. At this point these envelopes are unopened and ballot sheet(s) are still inside. They have two of these BlueCrest machines. One can be seen in the foreground in this picture and another is against the far wall.

2. Envelope Scanning and Signature Verification. In the process above, the white side of the envelope is captured as a computer image by the BlueCrest machines and the signatures are first subjected to automated comparison, using the industry de-facto standard Parascript signature comparison tool originally used by the banking industry, and now used for mail ballot signature verification in many districts. If they are not deemed a match by this first automated comparison, they are then checked and verified by staff by human eye. This is done by operators at computer terminals that look at both the envelope image and other signatures on file for that voter. They can also look at the physical ballot if they want to.
   

3. Re-sort to Signature Verified Batches: The batches are run again through the BlueCrest sorter, and any envelopes that have no signatures, if the signatures are challenged or need further review, are removed. The balance of the envelopes are cut open (top edge is cut off, about 1/16”) and sorted into batches, each with 200 ballots (or perhaps less if it is the last batch of the day).
   
   It is important to understand that this mail ballot sorter can read the identity of the voter from the white side (using the QR Code on it) and so it has a record of every single envelope and which batch it has been placed, and the identity of that voter. They said it can sort about 40,000 envelopes an hour (so you have to get there early to see it!)

   
   As these batches are created by this machine, it also uses an ink-jet printer to print the batch number and the offset in the batch (1-200) also on the envelope so it can be easily read. Of course, it also knows exactly the voter identity and the exact batch and offset of that envelope in the batch, so internally, it keeps that in a data file.

4. Traveler and Ballot Box. Batches of signature-verified are then moved into the extraction room (Step 5 in the block diagram). These batches are then associated with a traveler document that states the batch number, number of envelopes in the batch, and the like. An empty brown ballot box is created with a “tray number” generated by the mail machine, for the ballots to be placed when they are removed from the envelope. The tray number is attached to the box using a clear plastic pocket that can hold a rectangular slip of paper.

5. Count Verification. Each worker first verifies the count of the envelopes in the batch box. This is done without removing the envelopes from the box, and separating them into groups of say 20 envelopes each using dividers. The user then documents the count of envelopes on the traveler document.

   

6. Extraction. The envelopes are then processed in order, from the front of the bin box to the back. The envelopes are already cut open, so the worker must then remove the ballot sheets from each envelope. Each extracted ballot sheet is placed—still in that same sequence—into the brown ballot box.

   There are two methods in use for this process, one is entirely manual, and the other has a machine to assist. The workers using the manual process are in the foreground above, while the machines are way in the back and can’t be easily seen.

   1. Manual Process: In the manual process, the worker pulls the first envelope from the end of the source bin box, pulls open the top of the envelope, which is already cut open (about 1/16” of the top of the envelope is cut off by the sorting machine), removes the ballot sheet(s), puts the envelope in the output bin (in order) white side down, so the voter name is not visible, and then unfolds the ballot sheet(s), and places them into the brown ballot box. We can note the ballots are in the same order as the envelopes, which are marked 1-200 on their white side.

      

   2. Machine Assisted Process:
      San Diego uses these machines from OPEX. See the operation video at their website: https://www.opex.com/product/model-72

      
      In the machine assisted process, the worker loads the input hopper with part or all of the envelopes. Each envelope is fed first to an end-cutter, which cuts off the end of the envelope (the top is already cut off), and then the envelope is transported in front of the worker, and suction cups are used to spread open the envelope. The worker reaches into the open envelope and pulls out the ballot sheet(s). Those sheets are unfolded and placed into brown ballot batch boxes by the worker. The empty envelope is removed by the worker and stacked, in order. Again, the ballots are in the same order as the envelopes.

      
      Interestingly, the machine configuration shown above shows a “gravity bin”, which would NOT keep the envelopes in order, as they would fall randomly into the bin. San Diego also has a gravity bin, but they do not use it, specifically so they can keep the envelopes in order. I am told the process in Ventura County does use the gravity bin.

7. Scanning. The brown ballot boxes go to the scanning room, where ballot sheets are scanned in order. Also, the images are NOT shuffled after scanning, as there is a desire to be able to pair up the ballot sheet with the ballot image and CVR record, to support an RLA audit. In the picture shown below, they are scanning batches using the high speed scanners.

8. Double Voting Investigation: Sometimes, it is necessary to investigate if a voter was able to cast two mail ballots or cast a mail ballot and also vote in person. In such an investigation, the processed ballot envelope can more easily be accessed by first going to the batch and with the knowledge of the envelope number, 1-200, can more easily find it. If they are not kept in order, then the worker would have to look through the envelopes to find it, resulting in looking at an average of 100 envelopes per search instead of starting a linear search near where the ballot is expected, and maybe looking at a dozen envelopes to find it.

   
   The investigation will access the empty voted ballot envelope and the unopened and unprocessed second envelope. Please note that it is not required that the ballot sheets of that voter be accessed, and there is no requirement that ballots be pulled from the database of cast ballots, as is the case in states where ballot retrieval is required such as when a voter who dies just after casting a vote. Ballot retrieval is not required in California. A second mail ballot will not override the first and the second will be removed. Similarly, if a voter has already voted by mail, and it has already been processed, voting in person will not override the mail ballot.
   

Result:

The ballot references used in the voting system count (BatchId and RecordId) will match exactly the envelope order and Tray Number known to the BlueCrest system.

Anyone with both the BlueCrest data and the Cast Vote Record (CVR) file can connect every voter to all their votes.

Below is a mock-up of the data in the BlueCrest system, on the left, and the data in the Dominion (now LibertyVote) system, on the right. Blue crest has the full name, address, voter ID, and the Batch and Record numbers. The Dominion System can has the same batch and record numbers. Thus, votes for each issue on the ballot can be entirely linked to the voter. If nothing is done to shuffle the ballots and batches, they will remain all lined up.

Anonymization of ballots is required by the election code. Here, there is no procedure to anonymize the ballot data from the voter data, and the votes of all voters can be revealed.

Why “Trust Us” Is Not Enough

To reveal the votes of any voter, it is necessary to have access to both the voted data (Cast Vote Record) and the BlueCrest mail processing data to link them. But many people have access to both.

We should not have to rely on permanent secrecy agreements or hope that no one ever leaks or sells the data. Privacy must be structural, not trust-based.

If the system design itself prevents correlation between the identity record and the scanned ballot, then even insiders cannot violate secrecy. It is better to know that no reconstruction is possible rather than wonder if it happens. And if voters know it CAN happen, they may be dissuaded from taking the risk by voting in consequential elections. And each election seems to be more consequential than the last.

Just like software security vulnerabilities, there is a question whether the vulnerability should be reported, because then the vulnerability may be used by another malicious person to exploit it. However, it is standard procedure to quickly report vulnerabilities and responsible software companies will promptly fix the vulnerability. For privacy concerns in voting systems, we have the same concern about disclosing this egregious violation of privacy protocols, but we hope by reporting this, we can fix the problem, which is not too hard to do.

A Practical Fix: Randomize Ballot Order and Batch Designators Before Scanning

There is a straightforward procedural solution that can be adopted immediately. Essentially, we need to break the correlation of the extremely careful work done in the handling of the envelopes versus the ballot sheets, before they are scanned. This amounts to shuffling the ballot sheets AND batches so they can’t be tracked back to the source. But we are aware that it is sometimes hard to handle the ballot sheets, and so handling the envelopes just as they are being extracted can be an alternative that does not require physically handling the sheets.

Process 1: Block Shuffle ballot sheets before scanning

When loading ballots into the scanner, we recommend a simple block shuffle procedure. Scanner operators would implement this as they load the input hopper. Simply pull small hunks (around 20 ballot sheets at a time) from about the middle of the source stack, and place them into the input hopper in order, until the source stack is exhausted (about 10 hunks per batch). This can probably be done faster than the scanner can scan, meaning no time is lost.

When each hunk is pulled, do not keep track of where the prior hunk was pulled. We want there to be a good chance that the new hunk is pulled across the place where the prior hunk was pulled, i.e. will include some ballots before and after the location of the prior hunk. Thus, this is not the same as a “Strip Shuffle” commonly used for a very light shuffle of playing cards. The block shuffle is quite a bit better in effectiveness and yet is also easy to implement in practice.

However, this process is not as good as the random-pull method during extraction.

Process 2: Vary Envelope Selection During Extraction

There are two methods used for envelope extraction, one is manual and the other uses the machine assistants. For randomization, the workers can manually vary which envelopes are opened next, which is great.

1. Manual Process -- use the Arbitrary Pull Method: In the manual process, workers can simply change how they pull envelopes from the source bin. Currently, each batch is processed front-to-back, positions 1–200, by pulling envelopes only from the end. Instead, each worker should:

   1. Reach roughly into the middle of the box for the next envelope.

   2. Occasionally alternate between the front third, middle, or back third.

   3. Continue until the entire batch is complete.

This will fully randomize the ballot order within the batch and takes no extra time, but the envelopes are shuffled the same as the ballots (are still fully correlated) and should be shuffled a bit more using the block shuffle when putting them in the storage box.

2. Machine Assisted Process -- Use Block Shuffle: When the machine is loaded, each worker should:

   1. Grab a portion of the ballot envelopes roughly from the middle of the bin box. Do not align the selection with the counted divisions. Shoot for about 10-20 envelopes. It is good if sometimes the worker grabs a portion that begins and ends around the place where the prior portion was removed.

   2. Add this hunk to the input hopper, from front to back.

   3. Continue until the hopper is fully loaded or the batch is exhausted.

   4. Process the envelopes as usual.

Both procedures DO change the order of the envelopes which does make fetching the envelopes slightly more difficult than if they are kept in order, if an investigation is necessary.

Envelope Order Concern:

Please note that this results in the ballot envelopes being kept in the same shuffled order as the ballot sheets in the box, and thus preserves the risk that the votes of a voter could be linked to a voter if the physical envelopes are accessed.

The output envelopes should be removed from the output hopper and placed in the storage box using the block shuffle procedure, in the same manner as they were loaded in the machine-assisted case, by grabbing hunks of envelopes and ruining the order. Thus, it is not feasible to simply use the order of the empty envelopes to reconstruct the order and obtain a linkage to the ballot.

An alternative used in some places is to let the empty envelopes fall by gravity into a larger output bin, which will tend to change their order as the envelopes fall arbitrarily to the bottom. But there is time spent pulling them out of the gravity bin and straightening them up for storage.

Process 3: Batch Designator Randomization

Current practice links the identity of each batch to the source batch number. Even though ballot order within a batch has been changed using one of the procedures above, it is still possible to sometimes link voter identity with their votes if the ballot order is changed in a batch, if the batches are correlated. Therefore, the identifier used by the BlueCrest mail ballot processing stage should NOT be used by the Dominion voting system, and ideally, the two identifiers are not BOTH shown on the box, on traveler documents or anywhere else.

One other issue is the last-batch problem. Normally, all batches are 200 ballots or envelopes, but there is one last-batch which has fewer than 200, because the total number of envelopes processed that day was not an integral multiple of 200. If the last batch has a unique number of ballots, then it can be identified in the CVR and linked back to the envelope data.

It is recommended that the last batch be split between at least two batches. Particularly if say the last batch had very few ballots. Batches should not have very few ballots. Perhaps it would be better to hold a few ballots in any small batches until they can be united with the next day’s batches.

Summary

Using the procedures outlined above, the linkage of the positional sequence as recorded by the BlueCrest system and the ballot data in the Dominion EMS is broken, while keeping the same total ballot count and full chain-of-custody.

The envelopes (and the resulting ballots) will now be in a different order than known to the mail-management software—achieving effective randomization without new hardware or additional costs.

Why are they doing this?

San Diego is simply doing a very good job of tracking every single envelope and ballot. But the downside of doing such a good job of tracking means that privacy is at risk.

Maintaining the order makes it slightly faster to locate a voter’s envelope in rare cases such as duplicate-vote investigations (e.g., one mailed ballot and one in-person attempt).

However, even in those cases, staff would only need to search within a single batch of ~200 envelopes—hardly an operational burden, and would be found after reviewing an average of 100 ballots.

The convenience of ordered storage is not worth the catastrophic privacy risk it creates. However, if ballot sheets are shuffled prior to scanning using the block shuffle method, it will break the linkage and be very difficult to reconstruct the shuffled ballot order and link it to the voter id data.

In California, there is never a time when at voter’s ballot needs to be retrieved, so there is no reason NOT to anonymize.

Why Shuffling Must Occur Before Scanning

After scanning, ballots must stay in the same order as the scanned images and CVR records to enable ballot-comparison Risk-Limiting Audits (RLAs). The scanner itself cannot shuffle the order of the images.

Therefore, shuffling must happen before scanning, either by shuffling the ballot sheets just prior to scanning, or shuffling the envelopes just prior to extraction.

The Broader Concern

This issue is not limited to San Diego.

Any county that uses automated vote-by-mail equipment (BlueCrest, Agilis, Pitney Bowes, etc.) likely maintains per-ballot order metadata tied to voter IDs. If that order is preserved through scanning, the same vulnerability exists.

This means that across the nation, tens of millions of vote-by-mail ballots could, in theory, be deanonymized by someone with insider or cyber access to paired datasets.

What Election and other Officials should do.

All election officials should evaluate their system and add active shuffling to break the linkage between the two data sets. County officials should direct their election offices to respect voter privacy and break such trackable linkages. Secretaries of State should direct all jurisdictions to add processing steps that will actively anonymize the ballots from the envelopes.

What Activists and Observers Can Do

If you are monitoring elections in your county:

1. Ask whether mail ballot envelopes are opened in the same order they were received or sorted.

2. Observe extraction and scanning:

   • Are ballots or envelopes shuffled before scanning?

   • Do ballot boxes remain in the same sequential order?

   • Is it possible to link voter identities with their ballots if the mail system dataset and the voting system data (CVR) are both known?

3. Check whether voter ID barcodes and RecordIDs are retained in internal databases.

4. Encourage immediate adoption of randomized extraction (envelope shuffling or variable-pull method).

5. Document any improvements—for example, whether ballot boxes are closed during breaks and envelopes stacked name-side-down.

Your observations can help ensure that no voter’s ballot can ever be traced back to them.

Conclusion

San Diego’s Registrar of Voters deserves credit for promptly fixing the visible privacy issues identified on October 30.

But the deeper design flaw—ordered processing that allows complete ballot-to-voter reconstruction—must be addressed now, before public confidence erodes further. So far, they have not agreed to make any changes, but we are still hoping they will see the light. We will be sending this article with a cover letter to the San Diego County Board of Supervisors to make sure we get this squared away, and to other counties and the California Secretary of State. We may need to promulgate this to other states too.

Randomization during extraction is easy, inexpensive, and effective. Shuffling during scanning is not painful and is effective and does not reorder the envelopes. Using different batch numbers is not hard to do.

With only small procedural adjustments, San Diego—and any county using similar systems—can improve ballot secrecy and ensure that it is mathematically and operationally preserved, not merely promised.

Please join our team to find and stop this egregious privacy hazard.

Subscribe now

Share

Leave a comment

Addendum — Applicable law

Here is information about privacy rules that are applicable in CA and other areas. I will be updating this as we learn more.

California

California has requirements for ballot privacy but does not mandate shuffling of ballots. This may be part of the regulations provided by the Secretary of State.

California Code, Elections Code - ELEC § 2170

(3) The elections official shall conduct the receipt and handling of each conditional voter registration and offer and receive a corresponding ballot in a manner that protects the secrecy of the ballot and allows the elections official to process the registration, determine the registrant’s eligibility to register, and validate the registrant’s information before counting or rejecting the corresponding ballot.

California Code, Elections Code - ELEC § 3017

(b) The elections official shall establish procedures to ensure the secrecy of a ballot returned to a polling place and the security, confidentiality, and integrity of any personal information collected, stored or otherwise used pursuant to this section.

California Code, Elections Code - ELEC § 18562.5

(a) A member of the public is guilty of a misdemeanor if, while observing any of the following, he or she willfully engages in any conduct set forth in subdivision (b):

(1) The processing of vote by mail ballots conducted pursuant to Chapter 2 (commencing with Section 15100) of Division 15.

(2) the semifinal official canvas conducted pursuant to Chapter 3 (commencing with Section 15150) of Division 15.

(3) the official canvas conducted pursuant to Chapter 4 (commencing with Section 15600) of Division 15.

(b)

(1) Attempting to ascertain the identity and ballot choices of a voter, or having observed or learned the identity of a voter, attempting to ascertain the ballot choices of that voter.

(2) Opening a provisional or vote by mail ballot envelope containing a voted ballot in order to ascertain the voter’s ballot choices.

(3) Making or placing a mark or device on a ballot secrecy envelope in an attempt to ascertain the voter’s ballot choices.

California Code, Elections Code - ELEC § 19101

19101. (a) The Secretary of State shall adopt and publish voting system standards and regulations governing the use of voting systems. The Secretary of State shall adopt standards that meet or exceed federal voluntary voting system guidelines set forth by the United States Election Assistance Commission or its successor agency. […]

(b) Voting system standards adopted by the Secretary of State pursuant to subdivision (a) shall include, but not be limited to, all of the following requirements:

(2) The system shall preserve the secrecy of the ballot.

Colorado

These are from the SOS rules in Colorado.

7.4.7

After election judges verify the elector’s eligibility and signature, the county clerk must dissociate and segregate the mail ballot return envelope from the secrecy sleeve, if applicable, and a voted ballot in a manner that ensures no person is able to determine how an individual voted.

7.4.9

Before tabulating ballots, the county clerk must, to the extent practicable, dissociate counting batches from any SCORE batch number that could trace a ballot back to the specific voter who cast it.

Note: Per 1.1.47, “SCORE” means the centralized statewide registration system and the computerized statewide voter registration list described in Part 3 of Article 2 of Title 1.

7.16 Anonymity

7.16.1 Measures to protect anonymity include:

(a) The county may not keep any record indicating the order in which people voted on the BMD.

(b) When more than one BMD is available at a voting location, the county must, to the extent practicable, allow the voter to choose the BMD they wish to vote on.

7.16.2 The county clerk may not release a report generated from SCORE that includes a date and time stamp that could potentially identify a voter who cast a specific ballot.

7.16.3 The county must arrange voter service and polling center in a manner that prevents election officials and other voters from observing how any voter marks or casts their ballot.

7.16.4 The county clerk must arrange voter service and polling centers in a manner that prevents a video surveillance camera from recording a voter marks or casts their ballot.

Washington State

In WA, they have one more envelope in the process, which holds just the ballot. This is to allow them to fully separate the outer envelope with the voter information from the contents, and still not be able to see the ballot. WA unfortunately has serialized ballots, and those are being discontinued.

Thus, they have gone to great lengths to make sure no one sees the voter name on the envelope and the ballot. The new system in the extraction room in San Diego is much better now and respects the to maintain this separation of information. Just think of the cost incurred by WA to make sure no one sees the envelope and the ballot by adding yet another envelope, and then shuffling those prior to opening to remove the ballot. Reminder, WA is a mail-ballot only state, so the extra envelope is used for all voters just to make sure they can shuffle them

Notice the “secrecy shuffle” to dissociate the ballot order from envelope order.

From https://www.sos.wa.gov/sites/default/files/2023-05/protecting_secrecy_of_the_vote.pdf

Opening and Separating Envelopes

Separate the outer mailing envelope from the inner security envelope (or security sleeve) containing the ballot, to ensure the voter’s identity is also separated from the ballot. Use a two-step process to protect the secrecy of the votes:

1. Remove the security envelope from the outer envelope

2. Isolate the outer envelope prior to removing the ballot from the security envelope

If outer envelopes are not isolated from security envelopes, another suggested procedure for providing secrecy would be to shuffle the security envelopes prior to removing ballots. This “secrecy shuffle” ensures that security envelopes will not remain in the same sequential order as outer mailing envelopes.

After ballots are removed from security envelopes, perforated stubs containing sequentially numbered barcodes must be detached.

The objective is to break any appearance of order or sequence to protect voter secrecy.

1. Shhh! Don’t look.

In late 2025, the nation’s largest voting-system vendor, Dominion Voting Systems, was quietly sold and rebranded as Liberty Vote. How patriotic. It must be good, right?

Public headlines framed it as a patriotic “return to American ownership.” But Delaware corporate filings reveal a far more complicated reality: a tangle of shell corporations — Liberty Vote Corp., Liberty Voting LLC, Liberty Vote Holdings Inc., Liberty Vote Intermediate Inc., and Liberty Vote USA Inc. — formed in 2009, 2018, and 2025, each with different registered agents and none disclosing their true owners.

The timing aligns precisely with the acquisition, showing a carefully staged restructuring designed to obscure who actually controls Dominion’s assets. In 2016, its machines served 70 million voters in 1,600 jurisdictions. This is a major voting system vendor, and we must watch and understand!

2. A Partisan Irony

The public face of Liberty Vote is Scott Leiendecker, founder of the Missouri-based poll-book company KNOWiNK and former Republican director of the St. Louis City Board of Elections.

Leiendecker presents himself as a reformer restoring trust in U.S. elections, but his partisan background raises obvious questions. He says he is not MAGA supporter and does not fully support Trump. I say that is probably just cover.

The company most vilified by Trump and his allies after 2020 — Dominion Voting Systems — has now been taken over by a Republican operative from that same political camp.

It is an extraordinary reversal: the movement that once denounced Dominion now effectively controls it.

3. A Pattern of Access Breaches

Public concern about ownership secrecy is sharpened by a series of documented breaches involving Dominion equipment after the 2020 election:

• Coffee County, Georgia (2021): Local officials allowed outside operatives linked to attorney Sidney Powell to copy Dominion software and data.

• Mesa County, Colorado (2021): Clerk Tina Peters permitted outsiders to image Dominion servers before a state update; Colorado decertified the equipment, and Peters was later convicted. This breach also exposed the fact that Dominion routinely installed the Microsoft SQL System Management Suite (SSMS), essentially a database editor, that could be used to modify the results without any voting-system logging or official tracking. But all this was ignored due to the admission of outsiders without the approval of the Secretary of State.

• Antrim County, Michigan (2020): A brief reporting error was used to justify seizing machines for partisan “audits,” though a state investigation confirmed it was human error.

These episodes show that actors aligned with the Trump orbit sought and gained unauthorized access to voting systems, including all source code and disk images. But why struggle to gain access to source code when you can just buy the company?

4. The Corporate Maze

The Liberty Vote structure resembles a private-equity buyout more than a civic technology company.

Such layering might be ordinary in commerce, but in election infrastructure it creates unacceptable opacity. Delaware law conceals beneficial owners, so the true financiers of Liberty Vote remain entirely hidden. (The details are guesses in the list above until we find out more.)

No potential investor or political interest can be ruled in or out — and that uncertainty itself is the problem.

The danger cuts both ways: concealed ownership could serve any agenda, from manipulating outcomes to perpetuating distrust by keeping systems opaque enough to blame when results are challenged, or allowing “bugs” and backdoors to persist.

5. Paper Ballots: Worthless if they are not checked.

Liberty Vote’s new branding echoes the Trump administration’s call for “all-paper voting,” implying that paper alone ensures integrity.

In truth, nearly every system already generates a paper trail, and any voting system vendor can process hand-marked paper ballots. The reliance on barcodes or QR codes has never been required, but has been a boon to device manufacturers who can sell many more voter-facing machines when in reality, only a cardboard booth, pen, and paper ballots are needed. Going back to hand-marked paper does not require modifying the “Voluntary Voting System Guidelines” (VVSG) that Trump has demanded in his Executive Order. Any voting system that supports mail voting (and all of them do) can also support fill-in-the-bubble style ballots and avoid bar codes. Done.

But since it actually is quite easy for voting machine makers (and any counties buying them) to convert to hand-marked paper ballots, why change the VVSG standard, which would be at least a multi-year endeavor before any changes exist in the market? It seems the pursuit of changing the standard is another diversion, to be able to complain that the D-party is blocking the progress toward hand-marked paper, when it is actually easy to change BACK to that for any voting system maker. The VVSG standard has many deficiencies, but it needs no changes at all to support hand-marked paper ballots. Election integrity advocates support HAND MARKED PAPER BALLOTS pretty much without exception, regardless of party affiliation.

Plus, Dominion’s (now Liberty Vote’s) ballot-marking devices can produce full-face bubble layouts which CAN support accessibility for voters with disabilities using one accessible machine per polling place, and the ballots are the same format and essentially indistinguishable from a hand-marked ballot.

Yet even if we have hand-marked paper which can be audited, that paper is valuable only when it IS audited. Without verification, even a printed ballot is just another artifact of an unverified process, and they are dutifully stored for 22 months, as required by federal law, but of no use to anyone under seal where no one can see them. Thus, it is essential that we also can require that ballot images are created, saved and published so they can be reviewed.

6. No Trust. We must Verify.

Voting equipment is complex, proprietary, and—like any software—hackable.
Given Liberty Vote’s hidden ownership and its leader’s partisan pedigree, no reasonable observer can assume these systems are immune to manipulation.
The only rational safeguard is transparent, independent auditing: risk-limiting audits, public ballot-image verification, and reconciliation between paper and digital records.

Yet even risk-limiting audits have faltered in practice. As RLA advocate Professor Philip Stark noted at the 2025 DEF CON 33 conference, although RLAs are mathematically sound, the number of states that correctly implement them is “almost exactly zero.” Just as I predicted back in 2019 when I debated Stark at the Election Integrity Conference in Berkeley, CA: Although the mathematics is sound, the implementation is very difficult indeed. Even states that claim to be the “gold standard” only fully audit one or two contests, and those are chosen to be the easy ones, not the ones that really need auditing. In PA, they audited the State Treasurer contest rather than the Trump vs. Harris contest in 2024. WTF indeed.

7. The Bottom Line: Trust Only What Can Be Verified

The Liberty Vote takeover simply reinforces what technologists have long warned: we must assume all election equipment, and even manual procedures, can be compromised.

Security depends on voter-verifiable paper ballots, ideally hand-marked and free of vote-encoding barcodes, combined with comprehensive auditing. Yet even where audits are officially performed, they are often limited in scope and, if insiders are compromised, can be manipulated to ensure that discrepancies are never discovered. Even when election workers act in good faith, they are effectively auditing themselves. As Goodhart’s Law predicts, once the measure becomes the goal, the goal is gamed—workers focus on achieving a “zero-discrepancy” audit report rather than revealing genuine variances. The result: audits that are well-intentioned but ultimately worthless as independent verification.

True accountability requires independent audits, but gaining access to physical ballots is exceptionally difficult. Verification therefore must extend beyond physical recounts to include cryptographically secured ballot-image audits: digital replicas of every voted ballot that are hashed, signed, and publicly published so that any alteration is immediately detectable.

This is the model pursued by AuditEngine, a nonpartisan platform enabling nationwide ballot-image audits. It allows independent review of election results without exposing voter identities and can audit every contest on every ballot, rather than a tiny subset of ballots in sampling audits that that provide only statistical comfort, yet tend to only audit one or two contests, and sometimes the wrong ones.

Until such end-to-end auditing becomes standard, hidden ownership and unverifiable technology will continue to erode public confidence. The Liberty Vote transaction is merely the latest episode in a long pattern of opacity and misplaced trust.

Now, more than ever, we need robust, comprehensive auditing—and citizens actively watching and questioning every step: the voting procedures, the chain of custody, and the audits themselves.

Subscribe now

Share

Leave a comment

REFERENCES
Ownership & Corporate-Structure / Acquisition

1. Rubin, Olivia. “Dominion Voting Systems sold to company run by former Republican election official”, ABC News, October 9, 2025. ABC News

2. “Dominion Voting Systems acquired by St. Louis­-based Liberty Vote”, CBS News, October 2025. CBS News

3. “One Republican Now Controls a Huge Chunk of US Election Infrastructure”, Wired, October 2025. WIRED

4. “Dominion Voting Systems, previously at the center of false 2020 election fraud allegations, has been sold to a new entity called Liberty Vote”, Politico, October 9, 2025. Politico

5. “Analyzing Dominion Voting Systems sale to firm run by ex-Republican elections official”, NPR (via The Public Radio), October 11, 2025. TPR

6. “Dominion Voting Systems, the company at the center of false fraud claims about the 2020 election, has been acquired by an entity called Liberty Vote”, CPR News, October 2025. Colorado Public Radio

Auditing / Risk-Limiting Audits (RLAs)

7. Lindeman, Mark & Stark, Philip B. “A Gentle Introduction to Risk-Limiting Audits”, IEEE Security & Privacy / NIST, 2012. NIST

8. Stark, Philip B. “Risk-limiting audits: theory and practice”, presentation at DEF CON Voting Village (slides), 9 August 2024. Department of Statistics
   The question was asked: “How many states are doing this?” -- Philip Stark answered, “Yeah, approximately zero”. (laughter) (Offset 52:00 in the DEFCON 33 talk by Stark). He explained further: “Some are doing large portions of this, some are pretending to do it, some have laws that authorize them to do it but aren’t doing it. There’s a lot of variability, yeah.” (I appreciate Stark’s honesty about our situation.) https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20villages%20and%20creators/DEF%20CON%2033%20-%20Voting%20Village%20-%20Stark%20-%20Risk%20Limiting%20Audits.mp4

9. “Election Auditing: Best Practices and New Areas for …”, MIT Election Lab Report, October 2023. Link MIT Election Lab

10. “Risk-Limiting Audit – Final Report”, U.S. Election Assistance Commission (EAC), 2015. Link U.S. Election Assistance Commission

Additional Sources / Context

11. “Colorado county clerks question company taking over Dominion Voting Machines”, 9News (Denver), October 2025. 9News

12. “Dominion sale not expected to change Colorado elections, experts say”, Colorado Newsline, October 16 2025. Colorado Newsline

More by Ray Lutz

• Prior Post: https://open.substack.com/pub/raylutz/p/taming-our-elections-you-can-help “Taming our Elections, you can help! -- Eyes Open: Join the Movement for Election Transparency”

• Next Post:

• All Posts: https://substack.com/@raylutz/posts

Our Problem

Every democracy depends on elections to make collective decisions. Yet, public trust in election outcomes has eroded dramatically. Making matters worse, we do not have one coherent system but thousands of independent jurisdictions, each with its own laws, procedures, and interpretations. In many cases, written procedures are incomplete or differ substantially from what actually occurs in practice.

This complexity makes the field of election integrity both challenging and fascinating.

Some people imagine that a perfect machine could manage elections impartially and eliminate the risk of manipulation. In reality, every machine is designed and programmed by people, and all software can be compromised, even when its creators have honest intentions. Experts across the field agree that no software system can ever be fully trusted. For that reason, a voter-verifiable paper trail is essential, and it must be audited.

Hand counting is slow and prone to some error, but it remains the only definitive way to confirm results. We use machines to do most of the work quickly, followed by an audit to review the paper record and detect improperly decided outcomes to a high probability, or at least that is the intent.

We also cannot rely solely on government officials or elected representatives to ensure fairness because they face political pressures and conflicts of interest. The press once played the role of watchdog, but most media outlets now focus on national stories and rarely cover local election processes. Discussion of election problems is often treated as taboo. Those who raise legitimate concerns risk being labeled as “conspiracy theorists” or “election deniers,” which discourages open discussion and reform.

The challenge is clear: how do we bring accountability to thousands of jurisdictions with differing laws, histories, and partisan incentives? There is no single solution, but a coherent strategy exists..

Independent Oversight by the Public

The key is independent oversight by the public.

We need thousands of trained observers who understand the election laws and procedures in their own communities. These citizens must be able to observe polling places and election offices to confirm that fair and lawful practices are followed. Perfect neutrality is impossible, so the best safeguard is having multiple observers representing different viewpoints. Their combined presence provides the redundancy needed for fair oversight.

Insiders within the system can be pressured, bribed, or otherwise compromised. Only independent observation by the public can create real accountability. When no one is watching, the system drifts toward secrecy and control by insiders.

This is where you come in

After more than twenty years studying how to oversee government operations and elections, I have learned that while there are unifying principles, every jurisdiction presents its own challenges. Laws vary between states, and procedures often differ by county. Effective oversight must therefore be both locally informed and guided by common principles of transparency, verifiability, and public accountability.

If the public wants elections they can trust, they must be willing to watch.

Eyes Open

To address this complex problem, we need a network of volunteers who can become knowledgeable about election laws, procedures, and issues in each state and county. If you are reading this, you likely care about improving our elections and want to help restore public confidence in the results.

You can get started right away. Formal training helps, but it is not required to begin observing or learning. Reading this guide will give you a strong foundation.

We call this the EYES OPEN campaign because we literally need your eyes open and watching. The presence of informed observers alone discourages misconduct and helps maintain integrity in the process. The best approach is to form a small local group so you can share observations, confirm that procedures are being followed, and identify problems early.

Four Key Aspects of Election Oversight

Oversight can take place in four main settings:

1. Before and after the election in the election office, watching ballots being prepared, processed, and stored.

2. At polling places before and on election day, especially during the closing and ballot transfer process.

3. After the election during the auditing phase, when officials reconcile and verify results.

4. After preliminary results are announced, during the short period when statistical checks or court contests can still be filed.

This document focuses on the first two areas. Later sections will cover auditing and post-election statistical analysis.

WHERE: Most of the time, you will need to visit election offices or polling locations in person to observe the process. In some cases, however, you can participate virtually, which allows you to cover more ground and help multiple areas at once.

RULES: Rules differ among states. Some allow any member of the public to observe without party affiliation, while others limit access to officially designated party representatives. A few allow only the two major parties to participate. Because of this variation, it is often best to register as an independent citizen observer rather than as part of a named group. Later, you can coordinate informally with others to share information and discuss what appears proper or irregular.

Facts and Tools

Before getting into the specific steps of oversight, it helps to know where to find the governing laws and procedures for your state and county. You do not need to master every detail before starting, but you should at least locate the key resources.

Election State Laws and Audit Procedures

KNOW THE LAWS: A fantastic resource will be https://verifiedvoting.org. This site compiles detailed information on voting systems, audit requirements, and recount laws. Use “The Verifier” to select your state and county to see which equipment is used. The “Auditing Laws” section summarizes state audit rules. Be aware that the statutes on that site are often incomplete because key terms may be defined elsewhere in state law, which can change their meaning.

Public Records Laws

WE OWN WHAT OUR GOVT PRODUCES: All fifty states recognize the public’s right to access government records. The principle is simple: the government works for the people, and its records belong to the people unless a specific exemption applies. Each state has its own version of these laws, known by different names such as Public Records Act, Open Records Act, Public Information Act, Sunshine Law, Right to Know Law, or Freedom of Information Act (FOIA). Federal agencies follow their own FOIA rules.

The National Freedom of Information Coalition provides summaries and links for each state. The MuckRock website also offers tools for submitting requests.

Most states and counties now provide online portals listing previously released records and allowing new requests. Agencies must usually respond within about ten days, either providing the records or explaining any delay. Managing requests takes persistence; agencies often ask for clarification or extensions.

ELECTION RECORDS: Election records are generally not exempt from production, but election departments may have their own procedures. Some laws require written answers only when documents exist, not when you ask general questions. In such cases, it may help to contact the election office directly while also using the public-records portal so both channels stay informed. Agencies often prefer to classify your inquiry as a public-records request because that lets them follow established procedures and sometimes recover costs from the state.

Public-records laws are your strongest tool for obtaining information not already published. Always request records in electronic, machine-readable form to avoid paper copies and high printing fees.

If an online portal is not available, the best method is to hand-deliver two printed copies of your request to the office. Ask staff to date-stamp both copies and return one for your records. If you are not local, use a service such as onlinecertifiedmail.com, which prints and sends your letter by certified mail while tracking delivery online. The small added cost is well worth it.

Election Processing Oversight at the Election Office

Your first opportunity to observe begins at the election office as mail ballots are processed. In states such as California, Colorado, Washington, and Oregon, mail voting is the dominant method. Ballots begin arriving at least ten days before election day, and processing may continue through certification, which can occur up to 29 days afterward. In California, most counties finish their work within the first two weeks.

Getting an Observer Badge

In many areas, there are few or no prerequisites to receive an observer badge, which is required to enter the facility. Some counties provide a short training video and an observer agreement, while others may impose more restrictive requirements, limiting observers to major parties or capping their number.

Counties that welcome observers often value the transparency observers provide. Once admitted, you should be able to see and understand what is taking place. If the process is unclear, it is appropriate to ask questions politely and take notes. Discuss concerns with your local team, and raise issues with staff if they appear significant.

Policies on photography and video vary. If restrictions exist, staff should be able to explain them clearly.

Mail Ballot Processing Observation

In jurisdictions where mail voting is common, processing starts several days before election day. The process generally follows this sequence, based on typical California county procedures such as those used in San Diego:

1. Ballot List Creation – The election office compiles a list of eligible voters and assigns each the appropriate ballot style. In California, all voters automatically receive a mail ballot. This list is provided to the printer and mailing vendor.

2. Ballot Package Printing – The vendor prints envelopes with voter names, addresses, and ID numbers. Each package contains the correct ballot style for that voter. Some envelopes have a window to show a barcode matching the assigned ballot style.

3. Outbound Mailing – Ballots are mailed to all eligible voters or those who have requested to vote by mail.

4. Voting – Voters mark their ballots, enclose them in the return envelope, and typically sign the envelope.

5. Return – Voters may return ballots by mail, drop box, election office, or early voting site.

6. Ballot Reception – The election office receives ballots and groups them into batches. These may mix precincts depending on local procedure.

7. Envelope Scanning – Each sealed envelope is imaged, usually showing only the front. Some sorting may occur here or earlier. The ballot envelope is not opened at this stage.

8. Signature Validation – Staff or automated systems compare the voter’s signature on the envelope with one on file. Some counties also check other identifiers such as date of birth.

9. Signature Curing – If a signature is missing or does not match, the ballot is set aside. The voter is contacted by mail, phone, or other method and given the opportunity to correct the issue. We must note that this is one of the few places in business today where the signature is ever carefully compared.

10. Envelope Opening and Ballot Removal: This is a critical stage of the process because the workers should not see both the name of the voter and their ballot. Envelopes are normally cut open and then as a separate process the ballot sheets are removed. Ballots are batched into batches from 200 to 1000 ballot sheets per batch.

11. Scanning – High-volume scanners capture ballot images. Staff should not have access to vote totals before the close of polls.

12. Ballot Tracking: Many counties notify voters by text, email, or automated call as ballots are mailed, received, and accepted. If a signature fails verification, the voter is notified immediately. This tracking system helps detect lost or mishandled ballots, both in transit and within the election office. It works best when voters are enrolled.
    
    Tracking Services:

    1. BallotTrax. Full statewide support in: CA, CO, DC, HI, NC, NV, RI, UT. Partial support in : AK, AZ, FL, IL, MD, MO, NJ, OH, OR, TN, VA. See coverage here: https://wheresmyballot.com/

    2. BallotScout: Statewide in: GA, NM, VA; Partial support in KS, SC, TX. See coverage details here: https://www.ballotscout.org/track-ballot

What to Observe:

1. Understand the Process: Election offices often display charts or videos explaining their workflow. Ask questions if you need clarification, and compare what you see to the steps outlined above.

2. Reception and Batching: Watch how incoming ballots are received, sorted, and imaged.

3. Signature Verification: Observe how staff compare signatures and how exceptions are handled. If visibility is too limited to verify that the process is followed properly, raise the concern respectfully.

4. Signature Curing: Confirm that voters with mismatched or missing signatures are notified and allowed to correct the problem. Later, review statistics on how many ballots were cured.

5. Envelope Opening and Ballot Removal: This is one of the most sensitive stages. Staff should never be able to connect a voter’s name with their marked ballot. The ballot must not be altered. In some offices, workers improperly darken marks or use correction tape without keeping records. Damaged ballots must be “remade” under supervision, with clear tracking between originals and replacements.

6. Scanning: Verify that scanners are functioning reliably and that batches are logged accurately. Paper log sheets can be difficult to read and may result in errors; note whether electronic tracking is used.

7. Tracking: Determine what tracking method the county uses and whether voters are informed to report missing notifications. Check whether the office maintains statistics or a public complaint log for tracking failures.

8. Lost Ballot Reports: Request from the Secretary of State (or equivalent authority) any reports regarding unaccounted mail ballots. The U.S. Postal Service maintains records of ballot mailings, which should reconcile with election office receipts.

Additional Activities:

1. Early Voting: If the election office also conducts early in-person voting, you can observe this as you would any polling place. Are ballots processed from Early Voting sites daily or at then end of the entire period.

2. Provisional Ballots: Observe how provisional ballots are processed. These are issued when a voter’s registration or precinct status is uncertain. Jurisdictions using vote centers rather than precinct polling places generally issue fewer provisional ballots. Same-Day Registration, where allowed, reduces some registration-related problems but may still lead to provisional handling for verification.

   Same-Day Registration can also prevent common registration abuses such as purging or early deadlines.

Polling Place Observation

Observation is valuable during both early voting and on election day. Whenever possible, go to your home precinct so you are familiar with the local setup and voter flow.

Observing on Election Day

You can observe throughout the day, but the most critical time is during closing. Arrive near closing time, introduce yourself as an observer, and make it clear that you are there to watch, not to assist. Take notes carefully, but avoid taking pictures unless explicitly permitted. Watch for any irregular handling of ballots, equipment, or materials.

Access Rules

Each state and county may have its own access policies. In some locations, prior approval or party designation is required for full observation privileges. In many places, however, you can simply ask to walk through and observe the setup, check-in process, and closing activities. Remain courteous and follow any lawful instructions from election officials.

Photography Restrictions

Photography is almost always prohibited inside polling areas. Never photograph individual voters or anything that might reveal how someone voted. Respect privacy and confidentiality at all times.

Persuasion and Intimidation

Note whether any campaign materials or persuasive items are visible near the entrance. Record the presence of candidate signs, voter guides, or individuals attempting to influence voters. Watch for any signs of intimidation, such as aggressive questioning, uniformed officers, or individuals wearing threatening clothing or openly carrying weapons. Similar monitoring should occur at ballot drop boxes.

Line Monitoring

Observe how long voters wait in line. Ask a few voters how long they have been waiting and note the average. Identify whether any voters are being turned away, and if so, why. Record whether voters are directed to other polling places and whether that information is clear.

Voter Sign-In Process

Pay close attention to how voters are checked in.
Questions to consider:

• Can voters see the names of others on the sign-in list?

• What happens when a voter’s name is not found?

• Is the voter’s signature verified, and how? (pen on paper, stylus, or touch screen)

• Does the process prevent multiple voting attempts?

• Are identification documents required, and are they applied uniformly?

Ballot Custody and Accountability

Observe how ballots are managed and tracked.

• Do officials count the total number of voters who entered the polling place?

• Are wait times tracked?

• Are ballots reconciled by category (voted, spoiled, unused)?

• Is on-demand ballot printing used, and if so, how is it controlled?

These reconciliation procedures ensure that every issued ballot is accounted for.

Poll Tapes and End-of-Day Reporting

After polls close, many jurisdictions print “poll tapes,” which show the total votes recorded by that machine or location. These tapes are often posted publicly at the polling site. If allowed, photograph the posted tapes clearly with your phone so that totals can later be compared with official results. If poll tapes are not posted, make a note of the fact and report it to your oversight group.

Closing Thoughts

Every election depends on public trust, and that trust must be earned through transparency. Watching the process is the first step toward understanding it, and understanding is the foundation of confidence.

If we want elections that we can all believe in, the public must take an active role. You do not need a title or an organization to start—only curiosity, persistence, and a willingness to observe.

Begin with what you can see. Visit your election office. Watch mail ballots being processed. Observe polling places. Ask respectful questions and take careful notes. Each observation strengthens the integrity of the process and helps ensure that elections belong to the people they serve.

Stay alert. Stay informed.

EYES OPEN

Subscribe now

Share

Leave a comment

• Prior Post: https://substack.com/@raylutz/p-171240720 Ban Hackable Ballot Marking Devices

• Next Post: https://open.substack.com/pub/raylutz/p/dominion-voting-systems-secretive “Dominion Voting Systems’ Secretive Buyout”

• All Posts: https://substack.com/@raylutz/posts

There is an agenda to use a touchscreen interface for voting because it might help improve access for many voters. These machines can be outfitted with audio devices so the blind can hear the list of options and decide how to vote on their own, for example. They can help voters with other disabilities too. But a blind voter can never tell if the the audio matches what is on the ballot itself. And actually, it’s not much better for people who have vision. These touch screens are not always easy or trustworthy.

Laws exist to try to make it feasible for voters with disabilities to vote using a machine without assistance. But does that mean they are a good idea for everyone?

The reasoning goes that because only a very few people need these machines, there is a push to have all voters use them, so that the few voters that find they are helpful can't be easily paired up with their ballots.

The "voting system for all people" (VSAP) in Los Angeles is a good example of this trend brought to its obvious extreme. Everyone votes on the touch screen machine. (Except mail voters, that is, and that is why many voters prefer to use mail voting, as they avoid these machines.)

Using a new computer interface is not always easy. There were lawsuits in Beverly Hills regarding the confusion over MORE and NEXT buttons, what do they mean? Many people were not seeing all the options they could vote for, if they did not appear on the first screen of only four candidates.

https://www.latimes.com/california/story/2020-01-25/la-me-beverly-hills-touchscreen-ballot-design-lawsuit

To view additional candidates, voters must select the “MORE” button. However, if voters inadvertently press the “NEXT” button instead, Beverly Hills officials warn, they won’t see all the candidates in a particular race.

If you have a few minutes, watch the demo video below.

They don’t show this weakness in this video of operation, because they never have more than three options shown. If you had 10 options, then you would have to press “MORE” 2 times to see all 10… And then have space in your short term memory to remember the first 8 that you can’t now see. Or do you press “NEXT” to see the next page of candidates? It isn’t necessarily clear to voters, even those with perfect eyesight, how to use the interface, and it is too easy to hit the CAST button at any time and skip all the “down ballot” contests.

The Big Problem — A private screen session

There is a big problem with all these systems. The PRIVATE SESSION the voter has with the screen is impossible to prove what the voter was shown. Were you given all the contests? All the candidates? Where they in the proper order? Was the “polarity” of yes-no contests as stated in the description correct?

Flip Hacks

Imagine the following contest:

REFERENDUM ON MARIJUANA LEGALIZATION

I support making marijuana legal in this state.

[ ] Yes [ ] No

Unfortunately, this can be easily flipped on its head.

REFERENDUM ON MARIJUANA LEGALIZATION

I support making marijuana illegal in this state.

[ ] Yes [ ] No

Notice the difference? There is either “legal” or “illegal.” Which one is right? You probably don’t know off hand if you are a voter. You try to vote according to your position. Now with only two characters inserted into the text that is displayed, you would need to vote the opposite way. Say you want to legalize, you vote YES in the first case and NO in the second. Would you catch that, and what would you do?

And if you look at the paper ballot summary with QR Code that is printed, it will reflect exactly how you voted, but it only show perhaps REFERENDUM 1 — NO. And that would mean legalize if you happened to get the “illegal” wording. And the QR code ALSO represents correctly how you voted. But your vote may be 100% wrong. You cannot prove that you were shown the wrong thing, and no one is the wiser.

And you can watch this demonstration from DEFCON 33 where they hacked the machines exactly this way in real time: https://x.com/i/status/1957409735499514046
(The full video of this presentation should be available soon, and I will update it here when it is available.)

This sort of polarity rigging is not new. In 2008 there as Proposition 8 on the ballot regarding same-sex marriage in California. If you vote YES on the proposition, you might think that means you want marriage equality. It was originally called “California Marriage Protection Act”. Yes on 8 actually means you want to ban same-sex marriage, No, that you want to allow it. Seems backwards. Maybe some low-information voters would vote YES intending to make it legal, and you can bet the authors of the proposition thought that through.

Reordering Hacks

This hack is similar to the flip hack, but it relies on the fact that the QR Code of these ballots, particular those from Dominion, represent the selection by SEQUENCE NUMBER rather than by name. So if you had:

PRESIDENT OF THE UNITED STATES — Vote for 1

[ ] Donald J. Trump / J.D. Vance (R)
[ ] Kamala D. Harris / Tim Walz (D)
[ ] Jill Stein (multiple running mates) (G)
[ ] Robert F. Kennedy Jr. / Nicole Shanahan
[ ] Chase Oliver / Mike ter Maat (L)
[ ] Claudia De La Cruz / Karina Garcia (Party for Socialism and Liberation)
[ ] Cornel West / Melina Abdulla (I)
[ ] Write-in

Maybe instead it is shown like this on the screen:

PRESIDENT OF THE UNITED STATES — Vote for 1

[ ] Donald J. Trump / J.D. Vance (R)
[ ] Cornel West / Melina Abdulla (I)
[ ] Jill Stein (G)
[ ] Robert F. Kennedy Jr. / Nicole Shanahan
[ ] Kamala D. Harris / Tim Walz (D)
[ ] Chase Oliver / Mike ter Maat (L)
[ ] Claudia De La Cruz / Karina Garcia (Party for Socialism and Liberation)
[ ] Write-in

Assume a voters wants to vote for Kamala D. Harris. In the top (correct) display, that voter would vote for candidate #2 in the list. And on the printout, it would be printed as Kamala Harris and be encoded as #2 in the QR code.

But if the same voter was shown the second screen, that voter would choose #5 in the list. Sure, it would be shown on the paper as Kamala D. Harris. But the QR Code would contain a vote for #5, normally Chase Oliver / Mike ter Maat (L), in this example. The scrambling could be randomized, as long as the voter would not vote in position #2, those voter would never vote for Harris, as they desired. And this scrambling could be turned on based on the party of the voter, because that is known by the machine.

Unlike the flip hack, which is impossible to detect by any normal audit, this could be detected IF that ballot were compared with the Cast Vote Record.

Other hacks of BMDs…

What else could be done? If it were a vote-for 3 contest, if you are affiliated with the hated party by the hackers, you might be shown “Vote for 1” and you would lose two of your votes. That could not be detected by any audit. But the hack would be impossible if this is written on paper.

Maybe the contest does not appear at all, and the ballot summary sheet would show NO SELECTION MADE, and the voter probably does not notice. But if they do, then the machine hack could have a “fail only once” toggle in the code. If the voter brings this to the attention of the election staff, “Gee, I wasn’t shown this contest at all”… “Oh really, well, let’s try it.” They would try it the second time and the toggle would flip to no-hack, and the voter would be shown the contest. “See, there is the contest. You must have just missed it! User error again.” But it isn’t. It is a clever hack that is certainly possible.

A fraudster would not have to modify the programming of the BMD very much, maybe just the configuration files, i.e. controlling what is printed. If you watch carefully, there is commonly a “de minimis” update for “security” purposes to these machines. They can modify the configuration of the machine, the “config.ini” files, which have been moved out of the hash-controlled set of files to allow such changes and not prompt any concern. The election official wants to make it easy to change those files for last-minute corrections. But we want those files locked down.

Machines are harder to use than paper!

So remember the reason we have all these machines is to allow everyone to use “accessible” machines so voters with disabilities can vote independently, and not be singled out on just one machine per precinct.

Yet, there is (at least) one disability where it is easier to accommodate on paper, those with EYE TRACKING difficulties. A voter may appreciate voting on paper where they can use a ruler, index card, or a colored overlay to help track across the page. These assistive technologies may not be usable on a touch screen at all. Plus, many people don’t like reading on a screen.

I already mentioned the fact that if you only have four selections per screen, and you have 10 possible selections, you have to keep those selections in your mind. In fact, they expect you to keep almost everything in your memory which is difficult for many people. Instead, paper puts it all in one place.

And as it turns out, reading information from paper is at least different from reading on the screen. Have you noticed that you remember the content of documents that are printed on paper? That you find different mistakes if you proofread on paper? Well, they’ve proved that it is indeed the case.

This article “Screen vs. paper: what is the difference for reading and learning?”
https://insights.uksg.org/articles/10.1629/uksg.236 points out that tests have proven that people by and large do better with paper.

A study was undertaken in 2013 with tenth-graders in Norway, where the students were divided into two groups. One group read two texts (1,400–2,000 words) in print and the other group read the same texts as PDFs on a computer screen. In the reading comprehension test that was administered, the students who read on paper scored significantly better than those who read the texts digitally. It was easier for those who read on paper to remember what they had read. Mangen et al. say that this is because paper gives spatio-temporal markers while you read. Touching paper and turning pages aids the memory, making it easier to remember where you read something. Having to scroll on the computer screen makes remembering more difficult.

And this article from BrainFacts.org discusses a study showing that people are not getting better at reading and comprehending on screens.

https://www.brainfacts.org/neuroscience-in-society/tech-and-the-brain/2020/reading-on-paper-versus-screens-whats-the-difference-072820
They said:

Instead of getting better at digital reading, we may be getting worse. A study examining reading comprehension research between 2000 and 2017 indicates it’s harder to comprehend digital text. The researchers found print’s advantages are greater now than in 2000. In other words, this digital-reading problem isn’t going away

And interestingly, people who learn from screens are more confident in their comprehension, but actually are a bit worse.

https://www.sciencedirect.com/science/article/abs/pii/S0747563214001149 — “Overcoming screen inferiority in learning and calibration”

Previous studies that compared learning outcomes and calibration of monitoring when learning texts on screen and on paper have found screen inferiority: screen learners performed worse and were more overconfident about their success.

Hand-marked Paper is Better

1. People can read paper more easily. Those with “tracking” disabilities can read paper more easily and can use assistive aids.

2. There is no “private screen session” that can’t be proven. What the voter was shown is printed on the ballot. They received no less and no more. No flip hacks or ordering hacks are possible. No vote-for change hacks.

3. People generally already know how to vote on paper. It isn’t hard. Darken the oval next to your choice. No barcodes or QR codes please!! A good short term memory is not needed, the paper has it all permanently printed and you can see all the options at one time.

4. Voting on paper makes it easy to expand the number of polling booths. You don’t actually need much, just a ballot, a pen, and a divider. All those long lines? That’s because voting on machines is SLOWER and HARDER. They need electrical power. They all have to be tested ad-nauseum before every election, and that testing must be done on every machine, using fingers and it can’t easily be automated. Trust me, I have a deep background in testing and they don’t do enough!

5. Paper ballots can be printed on-demand for any language and style (set of contests) that are appropriate for any given voter. This is the usual excuse for the machines, as they can be in any language and set of contests. This is a double-edge sword. You get flexibility but now they are easier to hack and harder to test.

6. Finally, there is one compromise position: Use a touch screen for data entry (bad, we admit) but print the ballot in a hand-marked “fill in the bubble” format (which at least is readable). This avoids barcodes and QR Codes with embedded votes, and still provides a proof readable format so you can be sure you were shown all the contests and candidates. But this is obviously not as good, because the voter has to proof read it, and studies1 have shown that voters do not easily find mistakes.

Enjoy!

--Ray Lutz

Subscribe now

Share

Leave a comment

• Prior Post:

  All Posts: https://substack.com/@raylutz/posts

In the video, I was trying to think of the name J. Alex Halderman of the University of Michigan who demonstrated in their court hearing room that the Dominion BMD that is used in Georgia could be brought to a “developer state” by using a pen and pushing a reset button inside the device.

Again, I am so sorry this video was cut off, just when I was getting to the juicy part, LOL.. Please be ready for another episode tomorrow at about noon.

Here is the short post I made about Voting Village at DefCon 33, just in case I could not find this video. Still learning!

Subscribe now

Share

Leave a comment

Get more from Ray Lutz in the Substack app

Available for iOS and Android

Get the app

Here is a bit more information, since my live video apparently was completely lost.

1. They don’t live stream these sessions, which is very sad, or at least that is how it has been in the past. I will look into any livestream available and post it here if it is available.

2. Entrance fee is $500 cash at the door. And by “cash” I don’t know for sure what that exactly means, nor if there is some way around the fee.

—Ray

Share

Leave a comment

Subscribe now

(Updated 2025-07-17 — Added sample of better ES&S EV Summary Card)

A few days ago, the U.S. Election Assistance Commission (EAC) had their annual meeting regarding the Technical Guidelines Development Committee's (TGDC) action on the Voluntary Voting System Guidelines (VVSG). You can view the full meeting in the box below: (warning, about 3 hours). But before you start, you may want to finish this article so you will know what to look for.

First, some context

While I wouldn't call the process entirely pointless, it comes dangerously close. The VVSG is promoted as a roadmap for improving voting technology, but in practice, it often serves as a gatekeeping brick wall. Rather than encouraging innovation, it tends to protect the dominant vendors already in place.

Here’s what’s happening:

• The guidelines are voluntary. States are not required to use them. In fact, 11 states don't reference them at all. (See map below).

• Dominant players like ES&S and Dominion can continue selling equipment certified under older versions, such as VVSG 1.0 or 1.1. They are even allowed to update that equipment under vague “security patch” or “minor change” categories, and ignore the more recent VVSG 2.0 and any 2.1 that may come out.

• New companies, by contrast, must meet every loosely defined specification in the newer VVSG 2.x standards. This creates a steep entry barrier and gives a significant advantage to the established players, who continue to see crappy old technology.

• Just Updated after my Original Posting: It turns out that only one company has been certified under the VVSG 2.0 standard — announced by the EAC on July 16, 2025 — by Hart Intercivic, not one of the two dominant players, but has very competitive equipment and prior versions are used by more than 500 jurisdictions in 17 states. We must note that this new equipment does comply with the EO, and does not use QR or Barcodes to encode the vote.

We do have a chance to shape how these voting systems evolve, but any real impact is still years away. This slow process risks pulling attention away from more urgent problems that deserve our attention, so we need to also maintain that focus as well.

Why This Matters Now

My aim with this series is not to drop back into an “Election Technology 101” course, even though I am tempted, because I have a lot of experience and we need to groom new members of our oversight crew. Instead, I hope to guide readers through current events that directly affect the direction of election integrity right now, while exposing a bit more detail than other people might, and thereby developing a new set of experts who can continue to provide critical oversight to our election systems.

By focusing on recent developments, including Trump’s executive order and the EAC’s evolving standards, we can explore what’s happening right now, and what it means for anyone working to improve transparency, security, and trust in our elections. Stay tuned and read along. You’ll gain awareness of the key issues without starting from square one or wasting time on baby steps that don’t address the real challenges.

Summary of current events

1. The Election Assistance Commission (EAC) and its Technical Guidelines Development Committee (TGDC) are responsible for the Voluntary Voting System Guidelines (VVSG). They are currently planning a “minor” update, labeled VVSG 2.1. This release aims to clarify how stakeholders should interpret existing requirements when seeking certification -- though many of the so-called clarifications remain ambiguous and open to interpretation.

2. Around the same time, President Trump issued an executive order titled “Preserving and Protecting the Integrity of American Elections.” This order seeks to impose sweeping changes on how states conduct elections, including deadlines, voter registration processes, and voting system standards. The administration tied compliance to access to federal funding -- a tactic widely seen as overreach, and one likely to end up in lengthy court battles, potentially reaching the Supreme Court. Yet, the EAC is contemplating changes due to the EO.

3. However, one demand in the EO aligns with a long-standing concern of election integrity advocates: barcodes or QR codes used for voter selections on ballots. These encoded ballots are unverifiable by the voter, and complicate any type of audit, and should be banned. Some states, such as Colorado and Georgia, have already taken steps to phase them out. Others, like Burlington County, New Jersey, have adopted hand-marked bubble ballots that don’t rely on any barcodes or QR codes, while still preserving accessibility by voters with disabilities.

4. We already have a simple and reliable way to mark ballots: using a pen on paper. The method is well understood, and additional voting booths can be opened as needed with minimal cost or complexity. This should be embraced for most voting, and indeed all by-mail voting uses this method.

5. The EO’s language prohibits barcodes and QR codes that encode votes but still permits their use on machines that provide accessibility features. Even the accessibility representative on the TGDC Diane Golden acknowledged that barcodes are not necessary to meet accessibility requirements1. Still, the EO -- like the VVSG draft -- retains vague language that allows barcodes to persist in accessible voting equipment, which must all now support accessibility features, while in the same sentence saying they don't all need to support accessibility features.

6. The result: no real ban on barcodes, despite the rhetoric. I've seen this pattern many times in various settings: the policy gives the appearance of reform while functionally maintaining the status quo.

7. It appears the other aspects of the EO have been sidelined to litigation over states' rights vs. federal mandates. But no matter what, the changes made in VVSG 2.1 will not affect any voting machines for a long time to come, and certainly not per the desired timeline expressed by the EO.

8. It’s not the only other issue I have with VVSG 2.1, but the idea of a "microCDF" which will allow them to print the evaluation of the vote on the ballot in a mostly unreadable encoding (but using text, not graphics) should be stopped, along with the barcodes. This was a poorly designed and rushed add-on by a committee that did not embrace discussion and review, but rather needed to produce a deliverable for their contract. The microCDF should not be included, period.

9. Processing the VVSG will take time and effort. It is a legitimate opportunity to have an impact, through written comments that usually are read and become an official part of the public record. There are many aspects that need further review, but this article will primarily focus on just the barcodes issue as broached by the EO.

The EAC decided also to have more regular meetings to discuss the changes for VVSG 2.1 including those prompted by the EO, instead of just a token meeting each year. There’s nothing wrong with that, and they should get the other nominated-but-not-seated members seated and operating. Now, let’s get into it.

The U.S. Election Assistance Commission

The EAC is an independent bipartisan federal agency established by the Help America Vote Act of 2002 (HAVA). Its primary role is to assist states in improving election administration, including by maintaining voluntary voting system guidelines (VVSG), certifying voting equipment, and distributing federal funding to support election modernization efforts.

Historically, from 1990 to 2002, the Federal Election Commission (FEC) issued the original "Voting System Standards," which were nationally voluntary. Since 2002, under the Help America Vote Act (HAVA), authority shifted to the Election Assistance Commission (EAC), which now maintains the Voluntary Voting System Guidelines (VVSG) and accredits test labs, certifies systems, and administers election improvement funds. (The FEC now plays no role in voting system oversight and instead is focused strictly on federal campaign finance.)

The VVSG guidelines are designated as "voluntary" to respect the constitutional principle that elections are the responsibility of the states. If the federal government had full control of all aspects of our elections, then it would be far too easy for the regime in power to entrench itself. Thus, the EAC was set up as an independent, bipartisan body. The EAC can issue standards and best practices -- such as the Voluntary Voting System Guidelines (VVSG) -- which states may choose to adopt or modify according to their own election laws and needs.

According to a recent review2, the U.S. states exhibit the following patterns in adopting or modifying the VVSG. The various nuances could take forever to detail out, let's consider this high-level view:

1. Full EAC Certification Required
   12 states (including D.C.) require voting systems to be fully certified under the EAC’s VVSG standards and tested by EAC-accredited labs.

2. EAC Lab Testing Required, But Not Full Certification
   17 states require systems to be tested by EAC-accredited labs, but do not mandate formal EAC certification.

3. Reference VVSG, Allow Any Qualified Lab
   9 states refer to VVSG standards, but permit testing by any qualified lab, not necessarily EAC-accredited.

4. Customized Standards Based on Federal Guidelines
   4 states incorporate federal standards as a baseline, but have modified or expanded them to include state-specific requirements.

5. State-Only Certification (No Federal Reference)
   11 states rely entirely on state-defined certification processes, with no formal reference to EAC or VVSG standards, (Florida, Hawaii, Maine, Mississippi, Montana, Nebraska, New Hampshire, New Jersey, Oklahoma, Tennessee, Vermont).

Thus, it is a mixed bag. Not all states follow these guidelines, and they are not required to do so. Yet, understanding and influencing these guidelines can help us to get a much more reliable and trusted voting system.

The Executive Order

In late March 2025, former President Donald Trump issued an executive order titled "Preserving and Protecting the Integrity of American Elections."

You can read the Executive Order at this link: https://www.whitehouse.gov/presidential-actions/2025/03/preserving-and-protecting-the-integrity-of-american-elections/

High Level -- Raises a state/federal constitutional controversy

The Executive Order proposes what some may consider fairly simple changes: improving the federal registration form, banning QR code-based ballots, tightening voter ID provisions, and enhancing DOJ authority to investigate election crimes.

However, the EAC is an independent commission. It does not answer directly to the executive branch -- and that is by design. As such, these requests are likely to be met with resistance, especially when paired with threats like, "Comply or lose federal funding," which sounds more like something out of a gangster movie than a democratic process. A more constructive approach would be to incentivize states to adopt reforms voluntarily.

Many of these initiatives are familiar to election integrity activists, because we've seen them all before. I categorized these as election scams that rig the rules of elections, to tip the scales in favor of the ruling party. (You can see a full list of election scams in this substack post: https://substack.com/home/post/p-155383427 "Election Scams").

But this is new. The EO includes a Constitutional controversy that challenges state control of elections, and thus will likely be blocked -- even if some proposals may seem viable on the surface. But then you must realize that the proposals are largely not seriously being pursued in a way that will be successful, and there is a lot missing. In some cases, proposals are more about pandering to a base than fixing anything that is actually broken.

Retaining state-level control of elections may be the last safeguard in preserving our democracy and blocking the slippery slope toward oligarchy and fascism. Federal coordination can support consistency, but federal control, especially in the hands of partisan actors, may be the greatest threat to electoral legitimacy and the future of our democracy.

Meanwhile, we note that the EO dares the opposition to block it in court, to make sure the order gets a lot of media exposure so the underlying narrative gains legitimacy and opponents look like they dislike all election integrity initiatives and would rather have lousy machines, immigrant and non citizen voters that have no IDs. Actually, no one seriously supports that, but that is information that will be spread.

While the executive order is framed as forward-looking, its true intent lies in recasting the past -- particularly, the false claims that noncitizens voted en masse, that late-counted ballots were fraudulent, and that voting machines flipped results. All three were central to the misinformation ecosystem following Trump’s 2020 loss.

The Constitutional controversy will dominate legal claims against it and it will ultimately go nowhere. This follows a "act like I am doing something, make it controversial so it gets a lot of press, but include a poison pill so it will never be enacted" template. Very common for the Trump playbook.

I want to focus on the barcode issue and the treatment by the EAC, but for now, I can summarize the other requests, as follows:

• Citizenship Requirement -- Well, this is already the case. Trump and the R-party have been making the claim, over and over, that millions of non-citizens vote. However, all research on the topic does not support that claim3. At least for federal elections, all voters must be citizens by law. What the EO does is make it harder to register to vote because you have to have proof of citizenship, such as a passport, REAL-ID driver's license or ID card, Military ID, or Federal or state issued ID. Also:

  • Requires that state and local officials have access to systems to verify citizenship (and these systems, such as eVerify, are already used by employers)

  • And then they go into uncharted territory, where DOGE will have access to all records and databases so as to prosecute "aliens unlawfully registered to vote or casting votes."

  • And if the states don't comply, the EO wants the EAC to withhold funding to those states. We can expect this to be stuck in the courts for a long, long time.

  If you pay attention, you will realize that they don’t want to solve this issue, they want to fight over it and keep it for a future fight as well.

• Election Crimes: The DOJ will enter into information sharing agreements to prosecute federal crimes. This sounds good and would have been great if the DOJ would have the ability to go after Musk and his million-dollar giveaways, bomb threats, and other scams. But what is the likelihood of that? Zero, to be sure. But they might go after the opposing party, without any doubt.

• Ballot Casting Deadline: In some states, if mail ballots are postmarked by the election day, they are still accepted, and the EO wants this to stop. It isn't a big deal one way or the other, but historically, the postmark is the legal delivery date, and so those ballots are technically received on time. This issue is all bluster, particularly when they call it the "National Election Day".

• Improving Security of Election Systems. Sure, we support this, but there is nothing specific suggested, just the general notion that it will improve. We might note that the recent violations of security, by stealing voting machines and code, were at the hands of R-party operatives after the 2020 election and a desire to make the claim that the election was stolen. Some of these actions (such as the Tina Peters case in Mesa County, CO4) did reveal issues in the voting systems, but it did not reveal that those issues were leveraged in a way that would have altered the results in 2020. Nevertheless, those issues still do exist, and to the extent this provision makes progress, it might be a good thing.
  
  On the other hand, if they take this to extremes, it will mean that no records can be examined by the public, and so we have no means to provide critical oversight. That would certainly be detrimental.
  
  Security of ballot images should be improved, and they should be made available for review. Ballot images should be cryptographically signed, so they cannot be modified without detection, and this would facilitate ballot image audits. This is actually part of VVSG 2.1, and yet it still is not clear enough to make sure it improves security and is not just words on paper.

Banning the barcodes?, EO Sec. 4b

The section of the EO of interest (underlining and highlighting added):

Sec. 4 (b)(i) The Election Assistance Commission shall initiate appropriate action to amend the Voluntary Voting System Guidelines 2.0 and issue other appropriate guidance establishing standards for voting systems to protect election integrity. The amended guidelines and other guidance shall provide that voting systems should not use a ballot in which a vote is contained within a barcode or quick-response code in the vote counting process except where necessary to accommodate individuals with disabilities and should provide a voter-verifiable paper record to prevent fraud or mistake.

This section has two things that essentially all election integrity advocates support:

1. Do not use a barcode or quick response code (QR code) to encode votes.

2. Require a voter-verifiable paper ballot.

However, it also perpetuates a long-standing “devil’s bargain” between accessibility advocates (i.e. “individuals with disabilities”) and voting machine vendors. Accessibility advocates rightly argue that voters with disabilities deserve equal access and the ability to vote independently. But voting machine manufacturers often leverage this need to justify deploying touchscreen ballot-marking devices (BMDs) for everyone, not just for those who need accessibility features, and they also assert that such machines have to use barcodes or QR codes to operate — they don’t.

The truth is, accessibility advocates typically don't object to or require barcodes. The presence or absence of a barcode has no direct impact on accessibility. Yet they also don't want to be singled out, and this tends to result in all machines supporting all accessibility features, which gives vendors an incentive to push for universal use of touchscreen systems -- even when most voters would be better served by simple pen-and-paper ballots.

The EAC was asked to clarify:

Is it required that every voter-facing device (including ballot markers, stand-alone optical scanners, and hybrid ballot markers capable of both marking and tabulating ballots) at all voting locations (such as polling places, voting centers, and early voting sites) include assistive technologies (such as tactile keypads, headphones, and personal assistive technology switches)?

And they responded with this very unclear clarification (italics added)5:

It is not a requirement of VVSG 2.0 that every voter-facing device, at all voting locations, includes all assistive technologies. However, it is a requirement that the voting system in all voting locations must support the accessibility needs of individuals to create an equivalent voting experience. It is expected that every voter-facing device, at all voting locations, will include the assistive technologies applicable to their corresponding functionality.

Is that at all clear now? I think not. (Who wrote this, honestly??) They say both that it is not a requirement and then that the same thing is expected to include accessibility.

While only a small fraction of voters actually require accessible machines, the vendors and advocates argue that having just one such machine in the corner of a polling place isn't good enough. They also raise a legitimate concern: if only a few ballots are produced by the accessible machine, and if those ballots can be uniquely identifiable, this can potentially compromise the ballot’s anonymity, and allow the ballot to be linked to the voter and violate voter privacy.

The industry solution has been to push the same machines for all voters. This benefits vendors financially, but undermines public confidence, auditability, and the simplicity of hand-marked paper ballots.

Yet the reality is that you can use a touch-screen machine with all the accessibility features, and still avoid the use of barcodes and QR Codes that are unverifiable, by using a fill-in-the-bubble design, which looks just like someone created it by hand, but is marked by a ballot marking devices (BMD).

Let's take a look at some BMD ballot summary cards:

ES&S Express Vote

This first example is from Election Systems & Software (ES&S) from their "ExpressVote" machine. The user makes their selections on a touch-screen and it prints out this narrow summary card, which is then later scanned by a DS-200 scanner, which can also scan hand-marked ballots. Yes, these are very different from a hand-marked ballot and can be easily differentiated as a result.

In section 1, we see the header barcode, which includes the precinct, style and number of votes cast by this voter. This is read this to obtain the style of the ballot so the later barcodes can be read and interpreted. These are all standard code-128 barcodes.

Section 2 are the actual votes, which are (typically) provided with six digits, XXYYPS where the first two digits XX provide the column, YY the row, p the Page (side) and S the sheet. The row and column is the position of the bubble on a hand-marked (fill-in-the-bubble) type ballot of that style, based on the timing marks around the sides of the ballot.

The barcode for a given candidate is NOT always the same on different style ballots. Notice that six candidates were voted for, while there were four NO SELECTION entries. There are only 6 barcodes. NO SELECTION is not encoded in the barcodes.

Section 3 has the human-readable text, which should match the barcodes, but you can't easily verify that as a voter. Finally, in Section 4, the barcode at the top is the precinct number for other purposes and is not always present.

Although this is a newly installed voting system, this summary card is one of the worst, with only 38 characters provided for candidate names, and unfortunately, only TOWN COUNCIL (but not also describing which town) for example. So reading this means you have to already know what town it is for, from the top header, and this makes it hard to verify that the vote is correct.

Even though you can easily read these standard Code-128 barcodes with any smartphone camera, they can't be easily checked because the encoding for a single candidate can vary from style to style. Thus, even though they are easy to decode to numbers, validating them is infeasible for most voters because the numbers are inconsistent and hard to map to specific candidates.

Sadly, the new ES&S ExpressVoteXL is even worse, with the row/column encoding changed to a sequence number on that style ballot, and sometimes the numbers are skipped, making them unpredictable and therefore even harder to use. Strangely, vendors are opting for more obscurity rather than transparency. (Alright I admit, that isn't strange at all, but it is sadly true at least.)

A better ES&S ExpressVote Summary Card

To be fair to ES&S, they do have a better summary card format, with more characters per line (54 instead of 38), so the title of the contest and option (candidate) name can be more detailed. Dane County WI does a pretty good job of labeling the contests and maintaining the same candidate names on both this card and on the hand-marked ballot, which is important for avoiding errors, which do happen.

Dominion Voting Systems

The Dominion Voting Systems ballot summary card is printed on a normal sheet of paper using a laser printer. (See example below) The scan that you see here is from an "ImageCast Precinct" scanner, and it has a lower resolution (200 dpi) than the original printout (300+ dpi) because it is a scan of a printout.

The QR Code in the middle left part of the ballot is a conventional QR Code, but you won't be able to read it using your camera phone because it is a binary encoding, and the first byte is 0, meaning "end of string" and so you get nothing. The encoding is based on a bit field approach, where each bit represents a candidate for a given contest. This encoding is proprietary and not publicly disclosed by Dominion, so even if you read it, making sense of it is still a challenge that requires extensive reverse engineering. But they are not encrypted, and will be exactly the same if the votes are the same on the same style ballot.

If there are a lot of contests or a lot of write-ins, then there may be more barcodes, for a total of up to five on the first page, and then they continue on the next page, if more are required, and the text summary will continue on the next page as well.

You may note that the text is actually not that easy to read due to the small (weird) font and tight line spacing, and three column design makes it very hard for reader-apps that might be used by blind or those with bad vision. We think the contest names could be shorter and easier to understand. For example, instead of "For State Representative in the 117th Congress from the 11th Congressional District of Georgia (Vote for One) NP", something like "U.S. House GA-11" would be enough.

This is a very problematic BMD summary card because it is completely unverifiable. The voting system reads only the QR Code and it is not feasible for voters to validate that the text matches the QR Code. And there have been recent cases where the QR Code was wrong even when the text was correct (For example, in DeKalb County 2022 election where one candidate dropped out, and the configuration was not correctly changed. I’ll cover that in a later article).

Dominion Voting Systems, Burlington, NJ

We can note in the next example, they used a landscape-style design where contests are rows and party affiliations are in columns. They were used to this type of ballot in the past. I'm not a big fan of that aspect. But my point is that this is a hand-marked type of ballot which is filled in by machine.

The ballot shows that the voter voted for all R-Party candidates in the first column, except for Trump/Vance, and wrote-in "Nikki Haley".

If we look very closely at the write-in:

We can see that it is actually printed by machine on the ballot, not by human hand. Also, the ovals are perfectly filled in by machine. This essentially creates a type of barcode, but one that is easy to read by both humans and machines, and can be marked by hand.

The fonts used here (as well as in the hard-to-read three-column BMD output by Dominion) are not standard fonts you can easily find, but rather are custom fonts that make it just that much harder for hackers to create their own ballots. This is a good idea.

Here are a few similar fonts (but none matching exactly):

The point is pretty clear. It is feasible to print a ballot that does not use barcodes while still providing accessibility.

Non-barcode-reliant solutions

Some vendors offer solutions that do not rely on barcodes. I will be updating this section as we learn of more that to so.

1. Hart Intercivic is the first vendor to produce a voting system certified under VVSG 2.0 and also does not rely on barcodes.

2. Dominion, as mentioned above, has a solution already deployed in Burlington County, NJ that use a hand-marked style ballot and do not use barcodes. This voting system is not certified under VVSG 2.0.

Accessibility Requires Barcodes?

The coupling of barcodes with accessibility is a false connection used to allow vendors to do nothing -- and continue to sell machines with barcodes and QR codes -- as long as they have accessibility features.

Not only that, but now, all voters must use the same machines, perpetuating the bargain made by accessibility advocates.

SIDEBAR: We must not fail to mention that, the “devil’s bargain” included “bribery” funding from voting machine vendors at least in this case:

In 2004, Wired reported6 that Diebold (which later became Premier Election Solutions and was acquired by ES&S) donated $1 million to the National Federation of the Blind (NFB).

Following this contribution, the NFB filed multiple lawsuits to mandate touchscreen voting machines in various jurisdictions, actions that critics said benefited the vendor's interests.

Observers noted the appearance of a conflict of interest: after receiving vendor funding, the NFB endorsed systems from the same donor and pushed for their deployment.

Sadly, it is not possible to provide the same voting experience to voters with disabilities, particularly those who are blind or have low vision, if they cannot independently verify the printed official record of their vote. These voters must rely on audio output through headphones, which may or may not accurately reflect what is printed on the ballot. Ensuring the audio matches the printed text requires extensive pre-election testing for every contest, in every jurisdiction, for every machine used for accessible voting. And that is expensive and rarely done right.

Even with thorough testing, there is still no way to guarantee that what the voter heard in their private session is exactly what was printed. This fundamental asymmetry makes the concept of "equivalent voting experience" impossible to fully achieve when using machine-marked ballots.

An alternative worth considering is the use of sworn election officers -- functioning in a role similar to notaries -- who can assist voters with disabilities by marking a paper ballot on their behalf, under oath and in the presence of the voter. This approach avoids the technical complexity and unverifiability of machine-marked ballots while still preserving voter intent.

Such a solution acknowledges the limits of current technology and prioritizes transparency, simplicity, and equal treatment under the law. While not identical in experience, this method can offer a verifiable and trustworthy path to accessibility without compromising election integrity.

In many jurisdictions -- including Canada, Australia, and several EU countries -- human assistance for voters with disabilities is a standard practice. It is often provided by bipartisan poll workers or voters’ trusted designees, under signed declarations and in the presence of witnesses. These practices have been found to be low-cost, low-risk, and more equity-compliant than complex digital alternatives.

Indeed, historically, the use of trusted assistants is arguably a far better solution that trusting rarely used and hard to test technology. From the International Institute for Democracy and Voting Assistance (IDEA) Handbook on Special Voting Arrangements, they discuss this issue:

SPECIAL VOTING ARRANGEMENTS

https://www.idea.int/sites/default/files/2023-11/special-voting-arrangements-international-idea-handbook_0.pdf

Concept
Assisted voting is one of the earliest modern forms of [Special Voting Arrangements] (SVA). It developed because of the introduction of the secret ballot, which in its early forms required voters to write the name of their chosen candidate on a sheet of paper. This raised the question of how an illiterate person could vote. The procedures introduced in France in 1831 allowed them to ask another voter to write the ballot on their behalf (Kent 1937: 96).

This SVA includes procedures for voters who cannot cast their ballot autonomously and require the active assistance of another person.

...

Ballot Integrity
Ensuring secrecy and that the ballot is cast as intended are two crucial challenges for any assisted voting, but in essence assisted voting is not compatible with either principle. Once it is accepted that a person has to assist another with casting a ballot, a trade-off is also assumed: this person will know what the voter’s choice is and, in some cases, may be able to alter that choice, manipulating the ballot without the voter’s consent and awareness. Obviously, this practice will be illegal, and ordinary sanctions on tampering with a vote may apply whenever it is identified, but the procedure of assisted voting as such poses barriers to this external monitoring. Essentially, assisted voting relies on a trusted person, and the system admits that such a person could tamper with the procedure. This risk is accepted for the sake of making voting more accessible and increasing the legitimacy of the overall process.

Voting and counting
Counting does not require specific arrangements. Once the ballot is cast, either with assistance or not, it is no longer tracked and receives the same treatment as all other ballots. Assisted procedures apply to the voting phase, not to the counting one.

If the assistance is provided by a machine, since it is not a person, the issue of a person not knowing the vote is respected, but the machine may modify the vote on the ballot and the voter may not be aware of it, and this is impossible to audit.

Simpler ballot readers could be used to simply read the ballot back to the voter so they can verify that what was created does indeed match what was marked. Indeed, these are commonly now a function of smart phone apps that can be used by the blind without needing technology to be provided by the election office.

The difference between voting and counting is critical. Barcodes and QR Codes have to do with counting the vote, not voting. If such unreadable graphic codes are avoided, and instead the easy-to-read and mark approach of a hand-marked style of ballot is used, then any form of assistance can be used, including machine assistance.

Conclusion

It appears that the draft VVSG 2.1 does not actually ban barcodes or QR codes. Instead, it continues to allow these unverifiable encodings to persist. And even if the VVSG were modified to prohibit barcodes, it remains a voluntary guideline. These changes would not take effect unless individual states or jurisdictions act on their own to adopt fill-in-the-bubble ballots, which avoid barcodes and can still be produced by accessible machines. To save money and preserve flexibility, hand-marked paper ballots remain a very competitive solution.

While technology can support accessibility in voting, it comes at a high cost. Certified human assistants are often overlooked in favor of increasingly complex technology: headphones, tactile interfaces, sip-and-puff controls, and so on. But in this case, less may be more. Each addition of technology to our election systems must be weighed carefully. Is it worth the cost? And more importantly, does it make our elections more secure? As we gain more experience with more and different technologies in elections, it is frequently the case that we are better off with less. Far better off.

Subscribe now

Share

Leave a comment

• Prior Post: https://substack.com/home/post/p-165758877 "Yet Another Red Flag -- Election Fraud is now okay? -- Domestic cybercrime given a loophole."

• All Posts: https://substack.com/@raylutz/posts

June 11, 2025

On June 6, 2025, the Trump administration issued a new Executive Order1 that amends and weakens prior cybersecurity protections—and in the process, removes a critical tool for pursuing domestic cybercriminals. While the order presents itself as a routine update, the reality is more troubling. It systematically strips teeth from earlier executive orders, especially Executive Orders 14144 (January 2025) and 13694 (April 2015), both of which were designed to bolster national cybersecurity and hold bad actors accountable.

Among the many changes, one stands out as a flashing red warning:

Executive Order 13694, which once allowed sanctions against any person engaging in significant malicious cyber-enabled activities, now applies only to foreign persons.

This seemingly small edit—a change of two words—has major implications. It eliminates the authority to impose sanctions on U.S. citizens who engage in severe cybercrime, including those who may have participated in interference with our elections.

Why does this matter?

It opens the door for domestic bad actors—people within our own borders—to conduct malicious cyber operations without the same level of accountability. It reduces our ability to respond swiftly and decisively to threats that originate from within. And it does so at a time when faith in our electoral infrastructure is already fragile.

Many already suspect that Elon Musk played a pivotal role in helping Trump “fix” the 2024 election—not just through his financial support, which reportedly exceeded $200 million (and may be far higher), but also through his vast and largely unaccountable technical infrastructure. With access to an arsenal of cybersecurity and AI resources, Musk has the capability to exploit the notoriously weak digital defenses of local election offices. Whether through direct interference or by enabling others, this raises serious concerns about how a manipulated result could have been engineered to secure a Trump victory.

And isn’t that nice. Now Musk need not worry that he can be held accountable. It’s disgusting.

Background

Executive Order 13694 was originally issued in 2015 under President Obama to deter cyber-enabled threats to critical infrastructure and democratic processes. It empowered the U.S. government to freeze assets and deny entry to any individual who engaged in significant cyberattacks. This bipartisan tool was extended and strengthened across multiple administrations—until now.

The new order rewrites the scope of this authority, targeting only foreign nationals. Why exclude Americans from accountability in cyberspace? Why now?

It’s worth noting that this change comes after an election that remains clouded in controversy, with widespread concerns about digital manipulation and vote tampering. The timing is not subtle.

Other concerning changes

• The removal of specific references to shared threat information between the Department of Defense and civilian agencies weakens collective defense mechanisms.

• Critical language regarding intrusion detection, hardware root of trust, and security patches has been deleted.

• Post-quantum cryptography transition deadlines are pushed out to 2030.

• AI’s role in cyber defense is emphasized—but with vague deliverables and no concrete accountability.

This is not an upgrade. It’s a rollback.

What does this tell us?

This is yet another signal that the current administration is not prioritizing national cybersecurity, especially not when it conflicts with protecting politically aligned bad actors. In fact, it appears that the rules are being rewritten to shield them.

It also shows how executive authority can be quietly weaponized. One might expect that a law protecting against “significant malicious cyber-enabled activities” would be above partisan tinkering. But apparently, even cybersecurity is fair game.

And so the pattern continues: weaken enforcement, rewrite the rules, and create cover for loyal insiders. It’s not just a red flag. It’s a neon sign.

==========================================

Update: We’ve continuing to work to evaluate the 2024 election to find how if and how it was altered to put us on the course toward fascism and authoritarianism, because it was surprising and we know the motive, means, and opportunity all existed. We are finally getting some response from the Nevada SOS and Clark County, with a partial response after about 6 months.

Subscribe now

Share

Leave a comment

• Prior Post: https://raylutz.substack.com/p/the-parable-of-snake-river-rocks "The Parable of Snake River Rocks"

• Next Post:

  "Trump's Executive Order on Elections, Barcodes on Ballots & EAC's VVSG 2.1 -- Barcodes will become more prevalent in current draft"

• All Posts: https://substack.com/@raylutz/posts

When I was 19, I went on one last RV camping trip with my parents and younger sister. We drove through Wyoming and Montana, eventually stopping to camp by a tributary of the Snake River, under the watchful gaze of the Grand Tetons. My two older sisters were already off on their own, and it felt like the end of an era.

After a long day on the road, we settled into the campsite and wandered down to the river. For fun—and maybe to stretch our legs—we started throwing rocks into the raging water. These weren’t pebbles. These were big rocks, the kind you could barely carry. A few other kids joined in. It was fun. No one thought we’d dam the river or even shift its course. The current was strong, at least four times the normal volume. Still, we all kept tossing rocks into the same spot, laughing and splashing.

Later that evening, my family left for dinner. The next morning, I walked back to the same spot. What I saw stopped me in my tracks.

The pile of rocks had grown—dramatically. A small jetty now jutted fifteen feet into the water, built with boulders far too heavy for kids—or even one adult—to move alone. The “dam” had taken on a life of its own. Campers who had nothing to do with us must’ve spent the evening carrying rocks for fun, continuing the project we started. No one told them what to do. They just saw someone else throwing rocks and joined in.

That moment stuck with me.

Life is like a river.

And every now and then, we get to throw a rock in.

Throwing rocks is not about destruction. It’s not about fighting the current just to make a splash. It’s about contribution—about adding something solid and intentional to the flow of things. Each rock is an action, a voice, a choice. It's a reminder that you're here, and that you care.

These days, I think about that parable when I see people protesting or organizing events—small, seemingly insignificant efforts to push back against the powerful current of the world around us. Each act is like one of those rocks. It won’t change the river’s course on its own. But it’s still worth throwing, because combined, those rocks will add up.

What worries me is how few people are at the river now. Too many stand on the shore, talking about the current, analyzing the flow, or just scrolling past it.

What matters now is showing up. Bringing a rock. Throwing it in. And maybe—just maybe—others will see, and join in. Not because someone told them to. But because they want to help. Because it feels good to push back, even just a little.

No, we won’t stop the river. But we might nudge it, for a moment, in a new direction. That’s all any of us can really do in a single lifetime.

Throw your rock.
Then throw another.
And invite others to the river.

—Ray Lutz

Subscribe now

Share

Leave a comment

Prior Post: Detecting Election Fraud and Responding to it.
Next Post: https://substack.com/home/post/p-165758877 "Yet Another Red Flag -- Election Fraud is now okay? -- Domestic cybercrime given a loophole."
All posts: https://substack.com/@raylutz/posts

Since people were asking me this question a lot, I decided to take it up now as a separate post. I will also apologize for a gap of posts (even though I have a lot of partial posts in process) because I had total knee replacement surgery and was out of my mind for a while.

Our Situation

Our team has been working steadily to develop effective methods for identifying potential election anomalies — particularly those that might suggest fraud or systemic error. Our goal is to establish a quick and reliable check to flag when something looks “off” in the results, especially when compared to historical voting patterns and expectations.

One of the primary tools we’ve employed is Precinct Deviation Analysis (PDA), which comes in several variations. PDA focuses on identifying unexpected turnout levels or shifts in vote margins at the precinct level — the smallest reporting unit — to spot irregularities that may warrant further investigation. Importantly, this method can detect some types of fraud that are undetectable by Risk Limiting, ballot image or other audits.

Our most concentrated work has been on Clark County, Nevada, which accounts for about 66% of the total vote in the state. Notably, although Harris won Clark County in the 2024 presidential election, the overall statewide result flipped from a Democratic win in both 2016 and 2020 to a Republican win in 2024 — by a margin of just 46,000 votes. So it was an obvious place to start and learn as much as we could.

What we observed through PDA is that turnout in D-leaning precincts appeared to be unusually low, raising concerns that either ballots were not properly counted, voters were disenfranchised, or turnout was suppressed in ways that do not align with expected trends.

You can take a look at these posts to refresh your memory:

• https://substack.com/home/post/p-152243533 "Nevada 2024 Partisan drop off"

• https://substack.com/home/post/p-154291476 "Convincing evidence of likely manipulation of 2024 Presidential votes in Nevada" (newly updated)

• https://substack.com/home/post/p-156436516 "Estimated Lost Votes in Clark County by Precinct Deviation Analysis (PDA)"

I have updated the “Convincing Evidence” post with plots of the same county in prior elections, were the “droop” in the D-leaning precincts does not exist or at least is a lot less pronounced.

I will be soon posting deep dive into our further research which should be out soon, but I may have to split it up to meet length limits.

Part I: Evaluating potential indications of fraud

Making claims that fraud can be proven is a pretty high bar — and rightly so. Even our recent "Convincing Evidence" post stops short of making that assertion outright. We’re still in the evaluation phase, and it's important to distinguish between a plausible anomaly and conclusive proof. Other groups have also surfaced claims, some suggesting that the Trump campaign — possibly in coordination with technically sophisticated allies like Elon Musk — may have found a way to manipulate the results. Regardless of the source, any such claims must be subjected to a methodical review to determine whether they are credible, coherent, and supported by verifiable data.

Step 1: Sanity Test

The first step is simple but essential: Does the claim even make basic sense?

This step asks whether the evidence being presented aligns with public, independently accessible data, and whether it is logically sound. Many claims fall apart here — not because they are malicious or deliberately deceptive, but often because they’re based on a misunderstanding of election processes, data sources, or terminology.

For example, one group claimed:

“The abortion ballot question received more votes than all presidential candidates combined.”

This is a straightforward claim that we can test using official election results. If the numbers don’t bear it out, the claim is false — and should either be corrected or set aside. If clarification can’t be provided, it’s not worth further pursuit. (And so we set this claim aside because it did not make sense, and the maker of the claim did not attempt to clarify.)

A notable case of this kind of failure occurred during the Maricopa County, Arizona “audit” conducted by Cyber Ninjas. They claimed that there were 76,000 more ballots processed than there were voters on the voter list. At face value, this would be a massive red flag — if true. But the claim was based on a misunderstanding of which version of the voter list was being used.

The list they referenced was a static snapshot used during the election for Get Out The Vote (GOTV) efforts — specifically, to help campaign volunteers target voters who had not yet cast a ballot. That list was no longer being updated late in the process, because the GOTV campaign was already over. So the mismatch they pointed out was not fraudulent; it was an artifact of using the wrong version of the data. Election officials explained this, but the original claim was still widely circulated and tweeted as fact — long after it had been debunked.

(That said, this list should reflect the final numbers so this comparison could be made, and it was put forward by Sen. Ken Bennett in Arizona as a reform to improve the process. While the bill was not approved due to other issues, it’s possible that the list is being improved nevertheless.)

After the 2020 election, Edward Solomon, Beadles and “Operation Sunlight” offered $50,000 if you could prove that their claims were incorrect. We looked into this because the money seemed worth a little time. But in the end, it was just a big circular hoax, which I can summarize their broken logic. They said:

• We believe the results in the 2020 election in NV were hacked by the Biden campaign.

• Therefore, we will consider Will County in Illinois.

• And prove that there is self-consistency of the numbers there, such that we can model the relationship between the in-person and mail voting using a cubic spine curve fit.

• And the curve fits so well that it could not be due to natural causes.

• And therefore, even though this is not even in NV, the results in NV are fraudulent.

I kid you not. They create a quagmire of mathematics and definitions, but then boil it down in their spreadsheet to a cubic spline curve fitting. If you can make it through their misdirection and unusual definitions you get to a simple cubic spline curve fit and the notion that “if fits too well, and therefore must be fraudulent.” This conclusion has no support. Consistency within the numbers in Will County, IL does not mean it is fraudulent and that does not mean Clark County NV is also fraudulent. I guess you know they had no intention of ever admitting that the claims were simply silly, and no one got the $50K, but today, they still say: No one was able to prove us wrong! (I did spent far too much time on this one.)

But this does point something out that is pretty important. We need a method that can be easily understood. That means a visualization is required and it must be easy to see possible fraud.

Step 2. Independent Analysis

If a claim relies on a statistical model or visual representation, it's critical that independent analysts replicate the analysis to verify the results. This process ensures that the outcome is not simply the result of a coding error, a misunderstanding of the data, or selective interpretation.

In the case of our “Convincing Evidence” Precinct Deviation Analysis (PDA) plot, multiple independent analysts accessed the same underlying election data and replicated the findings using their own code and methods. Their confirmations strengthen confidence in the accuracy and validity of the original analysis — and reinforce that the visual pattern we highlighted is not an artifact of error.

Bullet Ballots Theory was False

Contrast that with the so-called “bullet ballot” theory, originally promoted by Stephen Spoonamore. This theory was presented as a potential explanation for the partisan drop-off observed in some precincts — where voters purportedly selected only a presidential candidate but left the rest of the ballot blank. However, the supporting claims did not hold up under scrutiny. Once the data was reviewed more closely1 , it became clear that the pattern described simply wasn’t present in the actual vote records, and the theory collapsed under the weight of its own inconsistencies. We will give some credit to Spoonamore for at least retracting his claims but certainly his reputation is at least partially damaged. (And now I hear he has retracted his retraction. But we looked at the data and there are some bullet ballots, but not an unusual number, and about the same number for Harris as for Trump)

Independent analysis serves as the guardrail against both unintentional error and overconfidence in compelling — but unverified — narratives.

Step 3. Visualization or Statistical Related Misconceptions

Several popular methods for visualizing election results can unintentionally — or sometimes deliberately — distort the public’s understanding of what actually happened. These methods often convey strong visual impressions that are not supported by the underlying data. Here are two of the most common examples:

• Choropleth maps
  A choropleth map2 uses shading or coloring to depict the distribution of a variable across geographic regions, such as states or counties. While useful for many purposes, these maps are often misleading when used to present election outcomes.
  
  For instance, coloring states red or blue by majority vote creates an image where vast areas of the country appear bright red — implying overwhelming support for one candidate. But area is not a variable in the election; population is. Large but sparsely populated states like Wyoming and Montana carry the same visual weight as densely populated states like New York or California, which skews perception.

  Only 175 counties out of roughly 4,500 contain half of the U.S. voting population — but that fact is completely lost in a traditional red/blue state map.

  

  This issue was examined in depth by Mark Monmonier in “How to lie with Maps”,3 where he wrote:

  • “Not only is it easy to lie with maps, it is essential. To portray meaningful relationships for a complex three-dimensional world on a flat surface, a map must distort reality... While most map users willingly tolerate white lies on maps, it’s not difficult for maps to tell more serious lies.”

• Cumulative Vote Totals (CVT) charts.
  CVT charts are another visualization tool that has led to widespread confusion. These plots typically:

  • Place precincts on the x-axis (usually ordered from small to large),

  • Show the cumulative vote margin on the y-axis.

  The claim made is that once enough votes are counted, the margin should stabilize — and any deviation from that is suspicious. But this assumes that precinct size is correlated with vote behavior, which is not always true.

  Larger precincts often differ demographically or geographically from smaller ones, so their inclusion can legitimately change the margin. Worse still, many people misinterpret the x-axis as a timeline, speaking of the chart as if it shows the election unfolding over time — when in fact it may be simply ordered by size, not by when votes were counted.

This visualization gained popularity in 2020, especially in analyses by Jeffrey O’Donnell, also known as “The Lone Raccoon.” His 281-page report, The Fingerprints of Fraud, relies heavily on CVT plots to argue that every district in the country was compromised. I made a YouTube that reviews his claims. He describes the plots as if they are related to time, even when he inverts the x-axis and shows it in the other order. The ordering he uses is never precisely described. He may incorrectly use the order in the Cast Vote Record, which is not correlated with time, and again, can be easily misinterpreted.

While the methodology is deeply flawed and fails to account for the statistical nature of precinct-level data, O’Donnell did provide a valuable public service: his collection of Cast Vote Records (CVRs) was assembled by university researchers into one of the largest open datasets of from across the country, now housed in the Harvard Dataverse.4

Although his conclusions are incorrect, the effort to collect and release CVRs has been a significant contribution to public transparency and research on election integrity.

Step 4: Evaluate the Anomaly

Once we've ruled out basic misunderstandings, visual distortions, and analytical errors, the next step is to evaluate the anomaly itself. Specifically: Can the observed deviation be explained by any plausible cause?

We typically break possible explanations into three categories:

• Known and proven natural causes

• Hypothetical (but unproven) natural causes

• Hypothetical errors or malicious causes

A common fallback explanation for the 2024 election is something like:

“Democrats just didn’t show up to this election — that’s why they lost.”

This would fall under a hypothetical but unproven natural cause. It's plausible — but is it true?

To evaluate this, we turn to the data. In our Precinct Deviation Analysis (PDA), we found that turnout between the two parties was nearly identical overall. However, when we looked at D-leaning precincts, we noticed that the total turnout (votes cast for any candidate) was lower than in R-leaning precincts. In other words:

• D-leaning precincts showed lower overall turnout (of both parties)

• Within those precincts, Democratic and Republican voters turned out at roughly equal rates, when compared with the number of registered voters.

So it’s not accurate to say that "Democrats didn’t vote." Rather, it may be that ballots from D-leaning areas were not fully processed, or there are more inactive voters in D-leaning precincts than in R-leaning precincts. Those hypotheses — while still under investigation — fits the data more closely than the vague assumption of voter apathy.

It’s critical that reviewers do not accept unproven natural causes as definitive explanations just because they sound reasonable. Even if a natural cause could explain the result, the actual evidence must support it.

Likewise, even in the presence of natural explanations, certain specific statistical or geographic patterns might be more consistent with the actions of a malicious actor. For example, if uncounted ballots or turnout suppression are clustered tightly in specific precinct types — and those types strongly correlate with one party — the anomaly may warrant closer scrutiny for intentional interference.

We don’t need to jump to conclusions. But we do need to weigh the plausibility of all causes — and match them to the patterns in the data.

(I will publish a deep dive into the PDA results in Clark County soon).

Part II: What can we do?

1. Immediately after the election

One of the main goals of Precinct Deviation Analysis (PDA) — or any post-election statistical review — is to provide a rapid, credible, and data-driven evaluation of whether the results seem legitimate or if something appears to be amiss. We also want to include the chance that ballots may have been suppressed before being cast. This type of fraud is not detectable by tabulation audits, which compare the actual ballots accepted as cast with the final results.

Contesting the election in court

This early evaluation is not just academic — it has real-world legal implications. In most jurisdictions, any formal election contest must be filed within days of certification, and the right to file is typically limited to a candidate or their campaign. The deadline is strict and the window is short.

In terms of legal mechanics, the process to initiate a contest is surprisingly simple: in many cases, it’s just a brief letter stating that the candidate is contesting the results. The processes vary by state, but I have been through this myself in California and am familiar with how it works in practice.

To go beyond the initial filing, however, and reach a discovery phase, the plaintiff must present a specific, plausible basis for challenging the results. This is where analyses like PDA become critical — they provide targeted, statistical indicators that can justify further scrutiny of the results, precinct-level behavior, or specific voting equipment.

More often than not, any court proceeding will be stopped dead it its tracks at this point, due to a technicality, like standing, whether there is a remedy, or the idea that the plaintiff did not prove that there was a problem with the outcome. Yes, that’s right, you have to prove it sufficiently to be able to get started and look at any further evidence.

Recounts are an Alternative Path

In addition to legal contests, there's another path available in most states: the recount.

Recounts are not handled by the courts but are part of the standard election procedures. A candidate or campaign can request a “recount” which may be a manual hand count of the results, and in some states, it is just a machine recount. If the recount reveals a result-changing error, the county typically bears the cost. But if the result stands, the requester is responsible for the full cost — which can be substantial, particularly in large counties, and also if the physical ballots are not sorted by precinct.

This cost barrier makes it even more important to have a fast, accurate, and publicly credible method of assessing whether a recount is warranted. Without data-driven suspicion, most candidates are understandably reluctant to fund a recount effort on vague doubts alone.

The Role of the Candidate — and the Problem of “Conceding”

Because these legal options are frequently only available to candidates or campaigns5, it's crucial that any statistical findings or irregularities are communicated to them before key deadlines pass. Unfortunately, modern political culture places tremendous pressure on losing candidates to concede quickly, as a show of unity or to avoid being seen as a "sore loser."

But legally, conceding has no effect. The outcome becomes final only after the results are certified and the challenge period ends, or after courts resolve any contest.

There is no legal requirement to concede — and in situations where anomalies are present, withholding concession until a proper evaluation is complete is a prudent and responsible course of action.

Actually, candidates and campaigns should avoid conceding and wait for all audits to be completed and the results certified, no matter how large the margin may seem, and no matter what sort of pressure they may feel.

2. After Certification (but still rapidly)

Once the election has been certified and the official challenge period has passed, it is technically no longer possible to change the results — at least according to most legal interpretations.

But in practice, that’s not entirely true.

A striking example occurred in Monmouth County, New Jersey, where an objection was raised after certification by a concerned citizen — someone who was not even on the ballot — simply because the results “did not look right.” Upon investigation, it was discovered that election staff had accidentally read the media from seven voting machines twice, and the election management system, shockingly, treated those double-read ballots as new ballots and assigned them new serial numbers.

This error added 977 extra ballots to the tally and directly impacted multiple contests. A recount was ordered, and in at least one race, the outcome changed.6

The lesson: Anomalies can be corrected post-certification — but only when credible concerns are raised quickly and taken seriously. That makes early detection and communication absolutely essential, even after the official window has closed.

3. Much Later

In the case of a presidential election, there is currently no established legal pathway to undo the results — no matter how compelling the evidence may be, except through an impeachment process.

Even if it becomes clear that the outcome was more likely the result of malicious interference than natural causes, the courts are unlikely to act. Why? Because they typically require not just a harm, but an available legal remedy. And when it comes to a seated president, particularly Donald Trump, it is highly improbable that the Department of Justice — under its current leadership — would entertain any attempt to overturn the result.

This is the unfortunate legal and political reality we face.

My experience tells me that even if such a legal mechanism existed, it would rarely be effective. Legal challenges are time-consuming, costly, and often a nonstarter. How long did it take for the Dept of Justice to complete proceedings into actions after the election by Trump and his campaign? Nearly the entire four yeas of the Biden administration.

Such cases tend to stall or backfire — and unfortunately, many organizations raising funds for such efforts are either misguided or misleading. As of now, Harris is not contesting the outcome, and the Democratic Party is not aligned on any legal strategy to challenge the result. So if someone says they are raising money for a legal challenge, it is most likely just grifting.

The Power and Wisdom of Crowds

So what can be done?

We must turn to the power of the people — the wisdom of crowds. When people work independently but with a shared purpose, their combined impact can be surprisingly powerful7. You can become a member of protests and rallies. Don’t underestimate the power you have when combined with others of the same mindset. Don’t wait to be told what to do. Put on your thinking cap and take action, but stay within legal bounds and avoid violence.

We’re now beginning to see signs of change. Even former Trump voters are waking up to the disconnect between promises and outcomes. He did not lower prices, he did not solve the war in Ukraine in 24 hours, and he’s already imposed tariffs that will destabilize long-standing international trade agreements in ways that are hard to predict. A full recession or depression may be around the corner. Even the conservative-leaning Wall Street Journal has begun raising the specter of impeachment.

To harness this momentum, we must each do everything we can, as aggressively as we can. If you can join a protest — do it. If you can contribute to data analysis or amplify credible findings — do it. And above all, help spread the word that it is not yet proven that Trump, Musk, and others did not manipulate this election. The burden of proof must go both ways.

A Note on the Idea of a General Strike

Some have proposed a general strike — a coordinated shutdown of economic activity — as a way to apply pressure to political leaders and signal mass dissent. In theory, such an action could force attention to issues that are being ignored or dismissed.

But in practice, a general strike is extremely difficult and risky to execute effectively. Unlike traditional labor strikes, most participants in a general strike would not be backed by unions, would not have legal protections, and would personally bear the economic cost — often those least able to afford it.

Even more importantly, a general strike presumes that those in power care about economic disruption or fear the consequences. But in this case, Trump has already created significant economic instability through tariffs and policy shifts, and if a general strike were to occur, the resulting disruption would likely be blamed on the strike itself — not on the underlying policies that caused the decline. The protest might be dismissed outright, while its economic consequences are weaponized politically to deflect blame and further entrench power.

For these reasons, I do not believe a general strike is a wise or effective strategy in this moment.

Consider Targeted Boycotts Instead

That said, targeted boycotts can work. They apply pressure selectively, can be more easily coordinated, and allow participants to retain agency over their level of involvement.

Targeted action focuses energy where it can do the most good — without broad collateral damage. It's a strategy worth considering as part of a larger grassroots effort.

4. For the Future

From what I’ve seen, lawsuits rarely produce meaningful change — and often harden opposition. The courtroom is an adversarial arena, and once legal positions are staked out, compromise becomes nearly impossible. That’s why courts are generally a poor venue for reform.

While courts can rule that a government action violates existing law, they cannot create new laws or mandate systemic improvements. So even if a lawsuit succeeds, it often doesn’t move things forward — it can only stop what’s already happening. If you're suing the authorities, you're not building something new — you're just trying to block what’s already been done.

But that doesn’t mean we’re powerless.

Sometimes, the simple act of putting evidence into public discourse — even in the context of a failed lawsuit or public hearing — can change minds, shift narratives, and lay the groundwork for reform. Legislative change is a viable option, but it’s often highly contentious. Too often, bills are drafted at ideological extremes, loaded with “poison pills” designed to ensure failure — not passage. This allows politicians to blame the other side for inaction while scoring points with their base, rather than building real consensus.

A Path Through Technology and Transparency

Election officials may adopt better practices simply because they work. Personally, I find these opportunities the most productive — they allow us to push for change by example rather than confrontation.

One such opportunity lies in the realm of election auditing. While many current audit practices are weak, opaque, or easily manipulated, audits run well can help. I’ll soon be publishing more about the deep flaws in Risk-Limiting Audits (RLAs) — particularly in Nevada, Pennsylvania, Arizona, and other states — as well as how they can be improved and how Ballot Image Audits can supplement or replace them.

A truly bad audit can be worse than nothing, as it may give false reassurance without real accountability.

Our current focus — building tools for fast, reliable evaluation of election outcomes using public data — may be the most critical challenge we face right now. We’re not giving up.

Subscribe now

Share

Leave a comment

Prior Post: https://substack.com/home/post/p-159096971 Ridiculous Issues in Dominion Voting System Certification in California
All posts: https://substack.com/@raylutz/posts

1

Planet: Critical

Cyber-Security Experts Warn Election Was Hacked

Read the update to this piece here…

Read more

2 years ago · 17580 likes · 1648 comments · Rachel Donald

Dominion Voting Systems has submitted its Democracy Suite 5.19 for certification in California. While election technology must evolve to meet modern security needs, this release raises significant concerns that should prevent certification until key issues are addressed.

Read our full official comment here: https://copswiki.org/w/pub/Common/M2034/COPS%20Comment%20on%20Dominion%20Democracy%20Suite%205_19.pdf

What is being certified?

Dominion Voting Systems has submitted its Democracy Suite 5.19 for certification in California. This comprehensive election management system is designed to handle various aspects of the electoral process, from election definition to results reporting.​ This system includes the “Central Tabulator” which is responsible for aggregating all the results from all machines.

I’m not a big fan of the general architecture of our current voting systems, but until we have many laws and requirements changed, we are stuck with these systems.

Key Features of Democracy Suite 5.19:

• Election Event Designer: Manages the import, entry, and tracking of all districts, precincts, contests, candidates, voting locations, and hardware.​

• Results Tally and Reporting: Consolidates results from all voting channels into a single comprehensive database, supporting both physical data transfers and air-gapped, closed networks.​

• AuditMark®: Provides a clear and fully auditable single vote cast record for every ballot, enhancing transparency and allowing stakeholders to review both ballot images and the tabulator's interpretation.​

You can read more about this system on the Dominion Voting Systems web site: https://www.dominionvoting.com/democracy-suite-ems/

Certification Process in California:

As of March 10, 2025, the California Secretary of State's Office of Voting Systems Technology Assessment (OVSTA) has listed the Democracy Suite 5.19 under "Post-Testing" phase for full certification. This stage follows rigorous testing to ensure the system meets California's stringent requirements for security, accuracy, and accessibility. On March 13, we submitted our official comment document which recommended that the system NOT be certified.

The Problem with Near-Monopoly Control of Election Systems

Dominion and ES&S (Election Systems & Software) collectively control about 90% of the U.S. voting system market. The Dominion Democracy Suite 5.19—with serious security risks and transparency failures—impacts the majority of jurisdictions in the country.

Security & Transparency Issues That Should Stop Certification

We were disappointed that the review package did not include a list of software components used in the system, including “Commercial Off-The-Shelf” (COTS) software packages. To allow us to still review this, we looked at the later version 5.20 which was certified (unbelievably) by the federal reviewers associated with the Election Assistance Commission (EAC). (See our official submission for full details).

All software components should be disclosed!!

1. Visual Studio 2022 Is Included in the Deployment

   • An Integrated Development Environment (IDE) has no place in a certified election system. Such an IDE is used by software engineers to help them design, change and debug software. A certified voting system should not have any chance that it can be modified.

   • The presence of Visual Studio suggests the ability to modify software post-deployment, which violates election security best practices.

   • The idea that election officials may want to modify the source code is beyond belief.

2. SQL Server Management Studio (SSMS) Is Likely Included

   • SSMS was discovered in previous Dominion deployments and could be used to manipulate the vote database outside of controlled security mechanisms.

   • SSMS is not listed in the official COTS components for Democracy Suite 5.20, but is it being installed anyway?

   • This was discovered and reported on by the technical review instigated by former Mesa County, CO election official Tina Peters, who was subsequently sentenced to nine years of incarceration. We don’t think she handled the situation very well, but the sentence was far too long given that she actually provided a service by outing this troublesome situation due to the presence of this database management studio, which allows unlimited inspection and alteration of the Dominion database.

     

     (See the technical report by the analysts hired by Tina Peters, most importantly, finding 1: https://useip.org/wp-content/uploads/2022/03/mesa-county-forensic-report-no.-2.pdf)

3. Event Logging Can Be Disabled

   • Critical election systems should never allow logging to be turned off.

   • Disabling logs would make unauthorized changes to vote data undetectable.

   • The only safeguard described is manual verification in Event Viewer, which is not a serious security measure.

4. Voter-Verified Ballot Images and Cast Vote Records (CVRs) Lack Transparency

   • The DVSorder vulnerability (DVSorder.org) showed that Dominion’s pseudo-random number generator made it possible to determine the order of ballots cast.

   • Ballot images should be publicly verifiable with cryptographic hashing to prevent tampering.

   • Public keys for scanners should be published before elections to allow independent validation of ballot images.

5. No Auditing Standards Are Enforced

   • There is no system-wide requirement for risk-limiting audits (RLAs), ballot image audits, or batch audits.

   • The SQL database should be snapshotted before and after the election to verify that all log entries correctly reconstruct the final results.

   • Without a strong auditability framework, certification should not proceed.

Conclusion: Certification Should Not Proceed Until These Issues Are Fixed

With the ability to turn off event logging, possible inclusion of SSMS, and the presence of Visual Studio 2022, the certification of Dominion Democracy Suite 5.19 should not move forward without serious scrutiny.

Voters deserve election systems that prioritize security, transparency, and auditability. The certifying body should reject this application until these concerns are addressed.

—Ray

P.S. I will be posting more information about our analysis of the 2024 election and fishiness we are finding very soon.

Subscribe now

Share

Leave a comment

Prior Post: https://substack.com/home/post/p-156974909 Election Audits in NC: Improvement needed!
All posts: https://substack.com/@raylutz/posts

And of course, we must always appreciate it when states and jurisdictions implement some sort of audits of the records they have, including hand-marked paper ballots, ballot images and tracking documents against the ultimate results, normally produced by the Election Management System (EMS) as a report.

One of the things we need to do at every election is watch these audits very carefully and try to make them as good as possible. I thought I’d write a few articles about this because there are some pretty interesting principles we can learn, and since they need so much help, we need a lot of eyes on them, and suggestions going in all the time to make them a lot better.

The first problem is that these audits are usually done by the election officials themselves, and it is like a day when the sun rises in the west when they will admit their work was even the least bit imperfect. It’s an obvious conflict of interest, like expecting drivers who exceed the speed limit on the freeway to flag down a patrol officer and ask for citations.

I’ve done a lot of observation and I don’t think this is usually malicious. The election office staff are so used to fixing any problems they see (and there are a lot!) and when the perform an audit, they are used to mainly fixing human error when it does not match the computer reports. They may go around and around and lose track, and fix some problem that are not human errors, like fixing the samples that are not correct instead of reporting them. It’s like an inspector on a widget production line that takes random samples and instead of reporting the broken widgets, fixes the samples, and then reports that all is well, of course then ignoring the fact that there are a lot of other widgets that were not sampled that are still broken.

But let’s put that problem aside and assume that all election officials have halos, and will report errors and any hacking that might occur, and will conduct the audits with good faith. Will the audits work?

Look, I’m all for audits, because it is our best chance of getting good results out of our elections. But they are limited in scope even if done really well, and rarely — if ever — guarantee the results are correct.

Let’s take a look at the audit in North Carolina conducted for the 2024 election. They tout this audit as one that requires a “statistically significant sample” which is actually a pretty meaningless phrase, but we will go with it for now. This audit is limited, but it is better than nothing.

They used a batch comparison audit which involves randomly selecting a subset of precincts or batches of ballots and manually tallying each batch, and then comparing that result to the reported results. If the selection is random, we can rely on the laws of statistics to prove, to a specific level of confidence, that the election results do indeed match the paper ballots. Of course, we need to tally batches that will match reported groups in the published reports, and we’ll get to that.

The reality? The audit design has many faults and needs to be cleaned up.

Here are some references if you want to fully understand what they are saying:

• https://www.ncsbe.gov/about-elections/election-security/post-election-procedures-and-audits — this document describes the canvass and audit process.

• https://www.ncleg.gov/EnactedLegislation/Statutes/HTML/BySection/Chapter_163/GS_163-182.1.html -- The statute that covers this process, including the statement that “The size of the sample of each category shall be chosen to produce a statistically significant result.”

• https://s3.amazonaws.com/dl.ncsbe.gov/State_Board_Meeting_Docs/2024-11-26/Canvass/Post_Election_Audit_Report_2024_General.pdf — the report of the 2024 audit.

1. How many samples are required?

The Inspector Game

This question has been carefully analyzed, and within the paradigm of the “inspector game” within the field of “game theory” the thought process goes like this:

There is an intelligent fraudster who wants to modify the election without being caught, and an inspector who is trying to catch the fraudster.

We have to assume that the fraudster is intelligent and will try to hide the changes to the results so the inspector can’t easily find them. That means that no single batch can be modified very much as then it will be obvious. And at the same time, the inspector will try to predict what the fraudster will do so they can catch it.

In this case, the presidential contest was reported as won by Trump by 3.26%. Let’s assume that Trump was behind by 3% and he wanted to win. That means he will need to alter not just 3%, but more like 6%, so that the result is a large enough win to not be questioned. This is exactly the scenario that I consider to be the most logical as a target for fraudsters. They have to be pretty close to winning to want to try it, and then they don’t want to overshoot very far. And most of the time in this scenario (esp. if it is a pre-positioned hack in a voting machine) the fraudster may not know what the final outcome will be, so they have to overshoot a bit more.

Since the contest is very close, the maximum any precinct can be modified would be about 50%, by changing all those votes for Harris over to Trump, as the other votes are already for Trump. But you can’t change all the votes for Harris to Trump and “hard-peg” any precinct to 100% votes for Trump, that would be easy to spot. Most people who consider this question say that it is reasonable to assume the maximum change per precinct is about 20% of the votes flipped. The more that can be flipped per precinct means fewer precincts will be involved. But it can also be further analyzed because we also know the partisan split of the precinct, and that is what we use in PDA analysis, and it can help is spot hacks, see https://substack.com/home/post/p-154291476 “Convincing evidence of likely manipulation of 2024 Presidential votes in Nevada” and https://substack.com/home/post/p-156436516 “Estimated Lost Votes in Clark County by Precinct Deviation Analysis (PDA)”

Fraudsters might want to choose large precincts and modify them maximally, so that more votes are obtained with each one and fewer precincts need to be altered. But those are also the first ones the inspector will want to check, knowing those are the best targets for fraudsters. And so the fraudsters know that, and so they won’t use the absolute best ones, and the inspectors know that, etc. When you run this out, the best strategy for both the fraudster and the inspector is to randomly select the precincts to be altered by the fraudster and the same for the inspector. If the fraudster uses this strategy, the inspector need only to find one altered batch, because it is really, really wrong. We won’t have any doubt at that point, and then a full investigation will take place.

But that is not the only strategy the fraudster might adopt. Another one is to make large changes to all the records, but in a way that can be explained as human error if it is ever caught, and rely on the fact that most of these audits don’t check all contests. If we know that the inspectors will check only check contest B, then we can modify contest A without much fear of being caught. Then we might swap the “column headers” in Contest A, so that all votes for the original winner (say Harris) become votes for the original loser (say Trump). It is really close, so the votes don’t look too bad from a high level report. Checking even one ballot will reveal the hack, but then they can just say that “It looks like there was human error! The column headers were accidentally reversed!” and then the fraudsters use this as cover for their exploits.

For now, we can consider the first case, where it takes some work to find the hacked batches.

The math for this is not too hard to explain, if you can stick with me. Or you can just skip this part and jump to then end of the paragraph if these details are not your bag. But I think it is important to go through this, for those that want to be able to analyze their local election procedures.

We know that in NC:

• Total number of precincts/batches: 4,371 batches.

• Average precinct/batch size: 1,304 ballots per batch, or 1,304 votes.

• For sake of simple calculations, we’ll assume they are all the same size, which is absolutely not true, but will still give us a start.

• If a fraudster might alter 20% of the votes in a precinct, then about 1304/5 = 261 votes flipped, which gives a net change of 2 votes per flip, that is 522 additional votes per affected batch.

• Donald Trump received: 2,898,423 votes, 183,048 votes ahead of Harris.

• Kamala Harris received: 2,715,375 votes

• For this analysis, we want to be as conservative as possible, i.e. demand that sufficient batches are checked in even the most extreme case, when a minimum of votes are changed. That means we will assume that exactly 183,049 votes were altered, which is assuming that Harris was ahead by one vote (rather than more likely 3%, perhaps) before the alteration by the fraudster, and then resulting in the reported 3.26%.

• The total number of batches the fraudster must modify then is
  183,049/522 = 350 batches, of course with all the assumptions we mentioned, and this is statewide. Since there are 100 counties, the fraudster would need to modify an average of about 4 batches in each county, which certainly seems feasible.

• If we randomly choose one batch across the entire state, then the chance of finding one of the 350 modified is 350/4,371 = 8%. Thus, if we had an audit which looked at one batch, 92% of the time the fraudsters would get away with it, even if they do nothing else.

• The question becomes: how many batches do we need to randomly select to hit an altered batch with 95% certainty (what the law probably means by “significant”)? For sake of simplicity, we will assume the chance of hitting one is the same for all draws, even though with each draw, the chances get a little bit better, and there are a lot of assumptions I mentioned that are not true (batches are not the same size etc.)

• The trick to this analysis is to consider the chances of NOT selecting one of the 350 at each draw. That is (4371 - 350) / 4371 or 92%. The chance of doing it two times in a row is 0.92 * 0.92 or 0.85, 85%. Notice this is slightly less. We can keep doing this until the chance of not hitting it is less than 5%, meaning the chance of hitting it will be over 95%.

• Thus, we need to solve

  Take the natural logarithm of both sides, to allow us to get to the exponent.

  Using the logarithm power rule:

  Solving for n reverses the inequality. And since n must be an integer, we must round up:

You can check this by multiplying 0.92 by itself 36 times, and the result will be less than 0.05 (5%). I get 0.0497. NC says they are choosing 200 batches and hand-checking them, and since 200 is much larger than 36, that sounds pretty good, right?

2. Sampling Issues

Well, not so fast. It turns out that they don’t select precincts or batches completely randomly. It seems they choose them “arbitrarily,” based on convenience or just what some person thinks seems random. But that is actually not random enough. We can check on this further, but my guess is they are not rolling a die or the like, but they might.

With 100 counties and 5.7 million ballots cast, the audit reviewed 260,800 ballots across 200 selected batches, averaging 1,304 ballots per batch. But there is a problem. North Carolina's audit includes only two sample groups per county, selecting samples from two of the three groups:

1. of election day precincts, they select one precinct

2. of early voting sites, they select one site, or

3. of absentee ballots cast, tally all of them.

That, is, they select say one precinct and one set of early voting ballots, or one precinct and all the absentee ballots in that county, or one set of early voting ballots and all the absentee ballots in the county. There are really only three cases, but there are two “samples” for each of the 100 counties, 200 total. That makes some sense if all counties were the same size. But they are far from it.

The top four counties (4% of the total) account for about 30% of voters, while the top 13 counties account for 50%, and the top 40 counties account for 80%. Yet, the selection process treats every county equally, allotting each county only two samples regardless of population size. This means smaller counties are disproportionately represented, while major population centers receive insufficient scrutiny. A more statistically sound approach would involve selecting batches in proportion to their contribution to the overall vote count.

Those top four counties, in the current sampling plan, have only 8 batches chosen as samples, when it reality, it should be more like 1/3 of the total number of batches sampled, or about 12. Thus, they are choosing only 75% of the batches they need for those largest counties. My general rule has been that a pretty good number of ballots to sample is 14, and it is supported yet again. It would be best to have each county sample 14, because the contests that are not statewide actually have to live by the same sampling rule.

A better method would be to compile a list of all 4,371 batches statewide and select 200 at random, ideally weighted by batch size, and for any counties not covered at all, choose one batch. This approach would ensure that every ballot has a roughly equal chance of being audited, and meeting their claim for wanting the results to be “significant” (although it really is a meaningless term in this context, but likely is intended to mean 95% confidence.) While they are doing the tally, including all the contests is a little bit more work, but honestly worth it to produce an audit that is closer to being trustworthy.

And if they really wanted to be safe (and also statistically cover all the local contests) each county should also tally at least 14 batches, which we can call the “Lutz Rule of 14”, which applies to most counties and is a pretty safe way to go, and yes, it is more than 2.

3. Limited Contests (only one!)

Another big problem: the audit only examines one contest—the top contest on the ballot. Fortunately, that is the presidential race when the president is on the ballot, and that is certainly the most consequential contest, which is better than choosing some other less important contest like a judge seat or state treasurer, so we give them that.

However, this narrow focus fails to address potential issues in down-ballot contests, which sometimes are very consequential and a target for local hackers. In contrast, California regulations, for example, mandate auditing all contests on the ballot (not that California has no warts in their process, because they do). Given that errors or discrepancies could affect any contest, auditing only the top race significantly limits the effectiveness of the review.

Selecting only one contest per county means that all local races, which may have tighter margins and different patterns of irregularities, are ignored. A more robust audit would involve randomly selecting additional contests at different levels of government. If the hackers know the auditing process, and they know that the down ballot contests will not be audited, then they will never be caught. Open season.

4. “Recallable Ballots” = manipulated ballots?

North Carolina allows election officials to “recall” ballots under certain circumstances. For example, if a voter passes away after casting a ballot but before Election Day, their ballot may be removed. Although this seems reasonable as those people did die before election day, others argue that it is hardly worth the risk as these policies create an opportunity for election officials to tamper with ballots post-submission. Plus, if you were still alive and were able to cast a ballot in the election, why not allow the poor dying soul one last measure of respect?

Worse, the presence of identifying numbers on ballots raises concerns about voter privacy. These numbers could potentially be used to match all ballots to the corresponding voters, obliterating the secrecy of the vote.

While some states ensure ballot anonymity by separating voter identification from the ballot at an early stage, North Carolina's approach leaves room for potential abuse. Most experts agree that ballots should have no identifying numbers that can be used to directly link each and every ballot to the voter that cast it.

5. Voter History Audit (Essential!)

The voter history audit aims to verify that the number of ballots cast matches the number of eligible voters who participated. This is a reasonable step and should be part of every audit and every canvass.

This verification step is an essential safeguard, but it should be expanded to include cross-checking voter rolls against election system logs to detect irregularities, such as duplicate voting or improperly canceled registrations.

6. Are all the ballots included?

One common problem, and this exists in California, is that they don’t include all the ballots in the audit, only those that have been processed as of election night. All the vote-by-mail ballots that were received on time, but haven’t been fully processed yet, are not included, and neither are any remakes or provisional ballots.

I’m not sure if NC includes the full set of batches in its sampling universe, but I would need more information to know. CA makes the same sort of reports and says everything is fine, but does not openly admit that there may be 40% of the ballots missing (not processed yet), and those will never be audited. (And we sued them in 2016 over this point, won the case, but then the election officials association pushed through a new law that allows this malpractice to continue).

7. Honest Reporting

And we are back to that first issue. The NC asks the counties to pull certain samples and hand tally them, and the report the results. Do they fix the samples and correct them, and then report that all is perfect, or do they actually report the mistakes. And if the election officials are corrupted, then they will just report that “We had excellent results but there were a few minor mistakes, usually human errors,” because that is what the SOS is expecting.

So it requires that we demand that the computer results are published prior to the random selection of the batches from the report. If we have the original and full report, then election staff can’t alter the computer report to match. And then it takes diligent members of the public to check on all this. I’ve been trying to get the complete batch report from Los Angeles for years, because in the past, they have consistently modified the results to match the hand tally by rescanning the ballots. I’ll probably write a full article on just that one subject because it was outrageous (and may still be!)

Quality Factors

I’m adding this section after the initial release of this article. I have previously developed a set of quality factors that we can use to rate any auditing procedure. We will use this same set of criteria when we review other recent election audits, some of which are much worse than NC!

Ballot Coverage

• Definition: Are all ballots included in the audit, or does every ballot have a chance of being randomly sampled?

• In this case: Bad. There is a non-random arbitrary selection of precincts, early voting sites and mail ballots, and as we showed, not all ballots have a roughly equal chance of being sampled.

Contest Coverage

• Definition: Are all (or nearly all) contests included in the process? For sampling audits, will the process increase the number of units (ballots or batches) sampled for every contest with regard to sampling risk?

• In this case: Bad. Only one contest is audited. At least it is the presidential contest, so it is not ‘horrible’. Officials rely on the broken concept that auditing one contest will also all other contests. It is simply not true.

Data Origin

• Definition: Are ballots evaluated by a) human-eye evaluation of paper records; b) scans from the election system; c) fresh scans using non-voting system scanners either c1) before ballots go into storage, or c2) after ballots were stored; d) original scans and a sample of fresh scans?

• In this case: Good. Paper ballots are tallied by hand, with human-eye evaluation.

Consistency Coverage

• Definition: There are many consistency checks that can be included in the process. In some types of audits, many of these are automatically included. For others, additional checks would be required. For example: a) Whether the total number of records in the CVR matches the total number of voters who voted per poll-books; b) Totals as reported on machine tapes match the totals in aggregated reports and CVR; c) The total number of images if sheets matches the total number of CVR records, and matches per precinct, and there are many more.

• In this case: Fair. The state does do a number of consistency checks but there are a lot more that could be done.

Diagnostic Precision

• Definition: Does the process allow individual ballot sheets to be compared with the official results (CVR) and the differences examined and reported?

• In this case: Poor. In general, batch comparison audits do not provide very precise diagnostics, and so it is not always know which ballot caused the issue, and it is common to assume it is human error.

Voter Intent Verification

• Definition: Does the process evaluate voter intent? For example, if the process reviews BMDs with QR Codes, does the process “read” the human readable portion or rely on the QR Code or barcodes?

• In this case: Good. Human-eye evaluation does provide voter intent verification. However, sometimes auditing staff will bias the comparison to how the machine would read it, rather than flagging discrepancies based on voter intent.

Independence

• Definition: Is the process managed or performed independent from official actors? Can it be redundantly repeated by unrelated groups? If physical paper is involved, is the chain of custody of those ballots respected, as any of them could be altered or swapped out at any time?

• In this case: Bad. The process is run by the election departments and there is no attempt to use non-election office staff.

Auditability

• Definition: Can the process be audited and checked by independent groups?

• In this case: Bad. It is really impossible to redo the audit and not enough information is provided to check on the process. For example, if batches were scanned to create ballot images, non-staff could actually hand count those batches to check on the result.

Cybersecurity risks

• Definition: Cybersecurity risks of the audit process itself is dependent on cybersecurity risks of the voting system, and can be limited by auditability of the audit process.

• In this case: Bad. We could see no effort at all to provide hashes and other checks to verify the data received at any step.

Conclusion

North Carolina’s post-election audit lacks the statistical rigor necessary to inspire full confidence in its results. The combination of an unequal sampling method, a narrow focus on a single contest, potential ballot recall mechanisms resulting in concerns over voter privacy highlight the need for a more robust auditing process. This state makes high claims about its post election audit, but this process needs to be cleaned up.

Improving this audit would not be difficult. They say the audit must be approved by a statistician. I’d like to know who it was that endorsed this broken process because it is absolute malpractice. What gets to me is how easy it would be for the state to vastly improve this audit by selecting batches randomly, including all contests, and reducing threats to privacy by avoiding identifying numbers. Of course, we want them to fully publish their results prior to choosing any random batches as well.

Is it always necessary to cut corners at every turn?

Bottom line, we can’t really trust elections that don’t have trustable audits. Period.

Subscribe now

Share

Leave a comment

Next post: https://substack.com/home/post/p-159096971 Ridiculous Issues in Dominion Voting System Certification in California
Prior Post: https://substack.com/home/post/p-156805063 "Ballot Image Security: Why Election Scanners Should Be Doing More"
All Posts: https://substack.com/@raylutz/posts