Every Voting Method Ranked by Security: A Tampering Risk Matrix With Real Cases (2026)

No Voting Method Is Perfectly Secure. Some Are Just Easier to Rig Than Others.

In 2014, two HOA board members in the Pocono Mountains filled out blank ballots for homeowners who typically didn't vote. They were convicted on 407 combined criminal counts, forgery, identity theft, tampering with records. In 2018, a political operative in North Carolina's 9th Congressional District collected and tampered with absentee ballots, leading to an entire federal election being thrown out and re-run. In 2019, researchers cracked Switzerland's national internet voting system before the public penetration test even started, finding a flaw that could let an insider replace every ballot undetected.

Every voting method can be attacked. The question isn't *whether* fraud is possible, it's how detectable, scalable, and reversible each attack is.

This guide is a comprehensive security analysis of 12 voting methods, grounded in documented cases, academic research, government reports, and court records. We built a risk matrix so you can see, at a glance, where each method is strong, where it breaks, and what that means for your next election.

This article is for informational purposes only and does not constitute legal advice. Election requirements vary by jurisdiction, organization type, and governing documents. Consult a qualified attorney for advice specific to your situation.

The Security Matrix: 12 Voting Methods Compared

Before we go deep on each method, here's the full comparison. Each method is rated across six dimensions:

Rating definitions:

• Tamper difficulty: How hard is it to alter results without getting caught?
• Detectability: If tampering occurs, how likely is it to be discovered?
• Auditability: Can results be independently verified after the election?
• Scalability: How well does the method work for large electorates?
• Voter privacy: Is the ballot truly secret?
• Overall security: Composite rating based on all five dimensions.

Now let's break each one apart.

1. Hand-Counted Paper Ballots

How It Works

Voters mark paper ballots by hand. After polls close, election workers count every ballot manually, typically in the presence of observers from multiple parties.

Attack Vectors

• Ballot box stuffing: Adding extra ballots. In Philadelphia, former congressman Michael "Ozzie" Myers bribed election workers to stuff ballot boxes in local races between 2014 and 2016, resulting in federal conviction [1].
• Ballot destruction: Removing or discarding ballots for a specific candidate. Requires insider access.
• Miscounting: Intentional or accidental errors during tabulation. Mitigated by multi-party observation.
• Chain of custody breaks: Ballots left unattended between polling place and counting location.

Security Strengths

• Physical evidence trail: Every ballot is a tangible artifact that can be recounted.
• Decentralized by nature: Fraud must be executed precinct by precinct; scaling is extremely difficult.
• Observable: Counting can be watched by representatives of all parties.

Security Weaknesses

• Slow: Large elections can take days to tabulate.
• Human error: The Brennan Center found that hand-count error rates range from 1% to 2%, compared to 0.01% to 0.1% for machine counts [2].
• Difficult to recount uniformly: Each recount may produce slightly different totals.

Documented Cases

The National Endowment for the Humanities documented that before the Australian ballot reform of the 1880s, ballot box stuffing was "rampant" in U.S. elections, with parties even producing their own ballots [3]. Modern cases are rare precisely because of the method's transparency.

Security Rating: ★★★★☆

The gold standard for auditability. The main weakness is speed, which is why most jurisdictions now combine paper ballots with optical scanners.

2. Optical Scan Ballots (Paper + Machine Count)

How It Works

Voters fill in bubbles or complete arrows on a paper ballot. A scanner reads the marks and tabulates results electronically. The paper ballots are retained for audits and recounts.

Attack Vectors

• Scanner miscalibration: A miscalibrated scanner may fail to read certain marks or read stray marks as votes.
• Software manipulation: Compromised scanner firmware could alter how votes are interpreted. DEF CON's Voting Village has demonstrated this on decommissioned equipment every year since 2017 [4].
• Ballot design manipulation: Confusing ballot layouts can cause systematic voter errors (the "butterfly ballot" in Palm Beach County, 2000).

Security Strengths

• Dual-record system: The paper ballot is the legal record; the electronic count is the fast count. Discrepancies trigger recounts.
• Risk-limiting audits are possible: Colorado has conducted risk-limiting audits (RLAs) on optical scan results in every election since 2017, with zero cases of the voting system switching votes [5].
• 98% of U.S. votes in 2024 were cast on systems with paper records, primarily optical scan [6].

Security Weaknesses

• Software is a black box: The three major vendors (ES&S, Dominion, Hart InterCivic) collectively control over 90% of the U.S. market and have historically "tenaciously resisted transparency" in their source code [7].
• Physical access attacks: Researchers at DEF CON 26 breached "every piece of equipment" in the Voting Village "in a matter of minutes" [4].

Documented Cases

A Wisconsin post-election audit in 2024 hand-counted approximately 327,230 ballots (10% of the vote) and found no machine errors or proof of tampering [8]. This is the system working as designed, the paper trail catches what the machines miss.

Security Rating: ★★★★★

The combination of paper trail + machine speed + audit capability makes this the current best practice for large-scale elections. The Brennan Center, MIT Election Lab, and Verified Voting Foundation all recommend this approach [2][5][9].

3. Ballot Marking Devices (BMDs)

How It Works

Voters make their selections on a touchscreen or accessible interface. The machine prints a human-readable paper ballot summarizing their choices. The voter reviews the printout and feeds it into an optical scanner.

Attack Vectors

• Barcode discrepancy: Some BMDs print both human-readable text and a barcode. If the scanner reads only the barcode, malware could encode a different vote than what appears on the printed text [10].
• Voter inattention: University of Michigan researchers found that many voters don't verify their printed ballot before scanning it, reducing the effective auditability [10].
• Software compromise: CISA issued advisory ICSA-22-154-01 identifying nine vulnerabilities in Dominion Voting Systems' ImageCast X BMDs, including the ability to install arbitrary code and alter ballot definitions [11].

Security Strengths

• Accessibility: BMDs enable voters with disabilities to cast ballots independently.
• Paper trail: When voters verify their printout, BMDs offer the same audit advantages as optical scan.

Security Weaknesses

• Verification gap: The security model depends on voters checking their printout. Studies suggest most don't.
• Complexity: More components mean more attack surface.

Security Rating: ★★★★☆

Strong when combined with post-election audits. The verification gap is the Achilles' heel.

4. Direct Recording Electronic (DRE) Machines: No Paper Trail

How It Works

Voters make selections on a touchscreen. Votes are recorded directly to internal memory. No paper ballot exists.

Attack Vectors

• Undetectable vote manipulation: Without a paper record, there is no way to independently verify that the machine recorded votes correctly. A U.S. District Judge in Curling v. Raffensperger (2019) found that Georgia's DRE system was "highly susceptible to manipulation and malfunction" [12].
• Firmware attacks: Researchers found "numerous exploitable vulnerabilities in nearly every component" of ES&S DRE systems, enabling attacks that could "alter or forge precinct results, install corrupt firmware, and erase audit records" [7].
• Memory card swaps: Physical access to the memory card slot allows wholesale replacement of vote data.

Security Strengths

• Fast tabulation: Results are available immediately.
• No ballot design issues: The touchscreen interface prevents hanging chads and ambiguous marks.

Security Weaknesses

• Zero auditability: If the machine lies, there is no independent check.
• Vendor lock-in: The three dominant vendors (ES&S, Dominion, Hart InterCivic) block independent code audits [7].
• Being phased out: The EAC's 2024 survey found only 80 jurisdictions in 3 states still use DRE systems without paper trails, down from hundreds in 2016 [6].

Documented Cases

In Georgia, the entire DRE fleet was replaced with BMDs following the *Curling v. Raffensperger* litigation. But plaintiffs argued the replacement Dominion system still had "some of the same cybersecurity vulnerabilities" [12]. In November 2020, Georgia conducted a full hand tally of nearly 5 million ballots across 159 counties, possible only because the state had already transitioned away from paperless DREs [5].

Security Rating: ★★☆☆☆

Paperless DRE machines are the single most dangerous voting technology in widespread use. Every major election security organization recommends replacing them.

5. DRE Machines With Voter-Verified Paper Audit Trail (VVPAT)

How It Works

Same as paperless DREs, but the machine prints a paper record behind a glass window. The voter can view (but not touch) the printout before confirming.

Attack Vectors

Same as paperless DREs, but the paper trail provides a backup record. The main residual risk is that voters often don't review the VVPAT printout, creating the same verification gap as BMDs.

Security Strengths

• Audit capability: The paper trail enables recounts, though VVPAT thermal paper can degrade over time.
• Better than nothing: Significantly more auditable than paperless DREs.

Security Weaknesses

• Thermal paper decay: VVPAT records printed on thermal paper can become illegible within months.
• Difficult to recount: Long paper tapes are harder to process than individual paper ballots.

Security Rating: ★★★☆☆

A meaningful improvement over paperless DREs, but still inferior to optical scan systems where the paper ballot is the primary record.

6. Mail-In / Absentee Ballots

How It Works

Ballots are mailed to registered voters. Voters mark them at home and return them by mail, drop box, or in person. Signature verification (or other identity checks) authenticate the voter.

Attack Vectors

• Ballot harvesting: Third parties collect filled ballots from voters, with varying degrees of legality by state. In North Carolina's 9th Congressional District (2018), operative Leslie McCrae Dowless collected and tampered with absentee ballots, leading to the entire election being invalidated and a new election ordered, the first voided federal election in modern U.S. history [13].
• Intercepted ballots: Ballots stolen from mailboxes before voters see them.
• Coercion and vote buying: Without the privacy of a polling booth, someone can watch or direct how a voter fills out their ballot.
• Forgery: Submitting ballots under the names of non-voters, deceased persons, or fabricated identities.

Security Strengths

• Paper trail: Every mail ballot is a physical, auditable record.
• Signature verification: 31 states compare return envelope signatures against voter registration records [14].
• Barcoded envelopes: Modern mail ballot systems track every ballot from printing through return, with barcodes that enable delivery tracking.

Security Weaknesses

• No controlled environment: Voting happens outside the polling place, so polling-place secrecy controls do not apply in the same way.
• Chain of custody gaps: Ballots spend time in the postal system and private mailboxes.

Fraud Rate Data

The numbers are clear. Over the past 20 years, more than 250 million mail ballots were cast in the U.S. with just 143 criminal convictions for mail ballot fraud, a fraud rate of 0.00006% [15]. Oregon, which has conducted all-mail elections since 2000, has sent over 100 million mail-in ballots with approximately a dozen proven fraud cases [14].

Documented Cases

Despite the low fraud rate, the Heritage Foundation's Election Fraud Database (now exceeding 1,500 proven cases) shows that absentee/mail ballot fraud is the most common category of documented election fraud, largely because it's the method most accessible to individual bad actors [16].

The Brennan Center's analysis of the Heritage data puts this in perspective: in Arizona, Heritage found 36 fraud cases over 25 years of elections involving 42.6 million ballots, a rate of 0.0000845% [17].

Security Rating: ★★★☆☆

High accessibility, paper trail, and signature verification are strong. The unsupervised voting environment and chain of custody gaps are the key weaknesses.

7. Proxy Voting (Paper Proxies)

How It Works

A voter authorizes another person (the proxyholder) to vote on their behalf, typically by signing a paper proxy form specifying the meeting and (optionally) voting instructions.

Attack Vectors

• Blank proxy harvesting: Collecting signed but unfilled proxy forms and filling in the votes later.
• Proxy stacking: One person accumulates enough proxies to control the election outcome.
• Forgery: Creating proxy forms with falsified signatures.
• Pressure tactics: Coercing voters into signing proxies through implied threats or misleading claims.

Security Strengths

• Legal framework: Most states regulate proxy form requirements (signature, date, expiration).
• Revocability: Voters can generally revoke proxies before they're counted.

Security Weaknesses

• Nearly impossible to audit: Once a proxy is submitted, proving the voter's actual intent is extremely difficult.
• No secret ballot: The proxyholder often knows (or controls) how the vote is cast.
• The #1 mechanism for HOA election fraud: Two states (Arizona and Florida for condos) have banned proxies in board elections entirely.

Documented Cases

The Las Vegas HOA fraud conspiracy (2008–2013) is the most extensively prosecuted case: 26 individuals pleaded guilty in a scheme that used forged proxies and fake ballots to seize control of condominium boards, enabling over $30 million in fraudulent construction contracts. The ringleader used straw buyers to purchase 37 units across 11 HOAs [18].

In Miami-Dade in 2015, one community recorded voting participation of 115%, more votes than homeowners, using paper proxies. Four former board members were later charged in a scheme involving $3 million in misappropriated funds [19].

At Wild Acres Lakes in Pennsylvania (2014), two board officers were convicted on 407 combined criminal counts for filling out blank ballots for non-voting homeowners [20].

Florida alone received 1,908 condominium election fraud complaints in a single year, with proxy abuse among the most frequent allegations [19].

Security Rating: ★☆☆☆☆

Paper proxy voting is the least secure method of voting in widespread use. It combines minimal authentication, no secret ballot, and nearly zero auditability. Organizations that still rely on paper proxies are operating with maximum election risk.

8. Show of Hands / Voice Vote (Viva Voce)

How It Works

Members indicate their vote by raising their hands or calling out "aye" or "nay." The presiding officer estimates the majority.

Attack Vectors

• Estimation bias: The presiding officer makes a subjective judgment about which side has more votes. This judgment is unreviewable.
• Social pressure and intimidation: Voters are visible to everyone, eliminating ballot secrecy. Dissenting votes can be socially punished.
• Non-member voting: In open meetings, non-eligible persons may vote without detection.
• No record: There is no ballot, no audit trail, and no mechanism for a recount.

Historical Context

Voice voting was the standard in American elections from colonial times through the 1880s. George Washington, Thomas Jefferson, and Abraham Lincoln all cast and received votes this way [3]. It was abandoned specifically because of its vulnerability to coercion and fraud, replaced by the secret "Australian ballot" during the Progressive era.

Security Strengths

• Speed: Results are immediate.
• Simplicity: No technology or materials required.

Security Weaknesses

• Zero privacy: Everyone can see how you voted.
• Zero auditability: No record exists to recount or challenge.
• Zero scalability: Impractical for groups larger than a few dozen.

Security Rating: ★☆☆☆☆

Acceptable only for trivial procedural matters where the outcome doesn't significantly affect anyone. Not suitable for any election with material consequences.

9. Online Voting (Standard: Email/Link-Based)

How It Works

Voters receive a link or login credentials via email and cast their ballot through a web interface. Authentication is typically limited to email address or a shared password.

Attack Vectors

• Credential sharing: Email links can be forwarded to anyone.
• Man-in-the-middle attacks: Network adversaries can intercept or modify votes in transit if encryption is improperly implemented.
• Server-side manipulation: The platform operator (or an attacker who compromises the server) can alter results.
• Device compromise: Malware on the voter's device can change votes before they're transmitted.
• Voter impersonation: Without strong identity verification, anyone with access to the voter's email can vote on their behalf.

Security Weaknesses

• No paper trail: Results exist only on the server.
• Single point of failure: Compromise of the central server compromises the entire election.
• Weak authentication: Email-only verification proves access to an inbox, not identity.

Documented Cases

MIT researchers Specter, Koppel, and Weitzner (2020) analyzed Voatz, the first internet voting app used in U.S. federal elections, and found that "a passive network adversary, like your internet service provider, could detect which way you voted in some configurations." They also discovered that votes weren't actually submitted to a blockchain as claimed but to a standard API server [21]. Trail of Bits' subsequent white-box audit found 79 vulnerabilities, a third of which were high-severity [22].

West Virginia and one Washington county abandoned Voatz before the 2020 primaries as a result [21].

Security Rating: ★★☆☆☆

Standard online voting without strong identity verification offers convenience at the cost of security. Suitable only for low-stakes polls where fraud incentives are minimal.

10. Online Voting (With Verified Identity)

How It Works

Same as standard online voting, but with layered identity verification: email OTP, SMS OTP, or government ID verification (document photography + biometric selfie matching).

Security Improvements Over Standard Online Voting

• Multi-factor authentication: SMS OTP proves possession of a registered phone. Government ID verification proves physical identity.
• One-voter-one-vote enforcement: Unique verification per voter prevents duplicate voting.
• Audit logging: Timestamped, immutable logs of every verification event, vote cast, and system access.
• Encryption in transit and at rest: TLS 1.3 for transmission, AES-256 for storage.

Attack Vectors (Residual)

• SIM swapping: For SMS-verified elections, a targeted SIM swap could intercept OTP codes. This is a sophisticated, targeted attack unlikely in organizational elections.
• Deepfakes: Government ID verification using selfie matching faces emerging risks from deepfake technology, though current liveness detection catches most attempts.
• Server-side risk: The platform operator still has theoretical access to results, mitigated by audit logs and third-party verification.

Security Strengths

• Scalable: Works for any electorate size.
• Accessible: Voters can participate from anywhere.
• Cost-effective: Flat-rate pricing from $4.99/election (email + SMS included); government ID: $3.00/voter add-on.
• Eliminates proxy fraud: Each voter must verify their own identity; there is no mechanism for one person to cast another's vote.

Security Rating: ★★★★☆

Identity-verified online voting represents the strongest balance of security, accessibility, and scalability for organizational elections (HOAs, nonprofits, unions, corporate boards). The residual risks are targeted attacks that require significant sophistication, not the casual fraud that paper proxies enable.

11. Blockchain Voting

How It Works

Votes are recorded as transactions on a distributed ledger (blockchain). Each vote is cryptographically signed and appended to an immutable chain. Depending on the implementation, the blockchain may be public (anyone can verify) or permissioned (only authorized nodes participate).

The Promise

Blockchain offers three theoretical advantages: immutability (votes can't be altered after recording), transparency (anyone can verify the chain), and decentralization (no single point of failure).

The Reality

Academic consensus as of 2025 is that blockchain voting is not ready for large-scale elections [23][24].

Attack Vectors

• Pre-chain manipulation: If the vote is altered before it reaches the blockchain, the chain faithfully records the wrong vote. As the MIT researchers titled their Voatz paper: "The Ballot is Busted Before the Blockchain" [21].
• Endpoint vulnerability: The voter's device is outside the blockchain's security perimeter. Malware can change votes before they're cryptographically signed.
• 51% attacks: On proof-of-work chains, controlling a majority of mining power enables rewriting the chain.
• Smart contract bugs: Voting logic encoded in smart contracts can contain exploitable bugs.
• Scalability: Processing millions of votes on-chain is prohibitively slow and expensive with current technology.

Documented Failures

• Voatz: MIT found 79+ vulnerabilities. Votes didn't actually go to a blockchain [21][22].
• Switzerland (sVote): Researchers found a critical flaw in the zero-knowledge proof that would allow replacing every ballot undetected while the verification system confirmed everything was valid. Johns Hopkins cryptographer Matthew Green called the vulnerability "astonishing" [25]. Swiss authorities suspended the system.
• Moscow (2019): French researcher Pierrick Gaudry broke the encryption of Moscow's blockchain voting system in 20 minutes, using a $60 cloud computing instance [26].

What Blockchain Gets Right

• Corporate shareholder voting: Nasdaq's Linq platform has processed over 10,000 shareholder votes since 2015, where the threat model is different (fewer voters, higher trust in endpoints).
• Small-scale pilots: Colorado ran a 2024 blockchain pilot for municipal elections processing 12,347 votes with zero security breaches, though it covered only 0.3% of the state's electorate [24].

Security Rating: ★★★☆☆

Blockchain solves the database integrity problem but not the endpoint security problem or the voter authentication problem. It's a cryptographic hammer looking for a nail that requires a different tool.

12. Hybrid Systems (Paper + Digital + Audit)

How It Works

The strongest systems combine multiple methods: voters cast ballots (paper or digital), results are tabulated electronically, and statistical audits verify the electronic count against the paper record.

The Gold Standard: Risk-Limiting Audits

A risk-limiting audit (RLA) uses statistical sampling to provide a measurable confidence level that the reported winner actually won. Colorado sets its risk limit at 9%, meaning if the wrong candidate was declared the winner, the audit would catch it 91% of the time [5].

The math is elegant: the closer the margin, the more ballots must be sampled. A landslide might require checking fewer than 1,000 ballots to validate an entire statewide contest. A razor-thin margin might require a full hand recount, which is exactly what happened in Georgia 2020, where the 0.23% margin triggered a hand tally of nearly 5 million ballots across 159 counties [5].

Current Adoption

• 17 states have passed legislation requiring or allowing RLAs [5].
• 98% of U.S. jurisdictions now use voting equipment that produces auditable paper records [6].
• Logic and accuracy testing is conducted by 93% of states [6].
• Post-election tabulation audits are conducted by 66% of states [6].

Security Rating: ★★★★★

This is the approach recommended by every major election security organization: the Brennan Center for Justice, Verified Voting Foundation, MIT Election Data + Science Lab, the American Statistical Association, and CISA [2][5][9].

The Threat Landscape: What Types of Fraud Actually Happen?

Not all fraud is created equal. Here's what the data shows about how elections actually get attacked:

By Frequency (Most Common → Least Common)

By Impact (Highest → Lowest)

What Makes a Voting System Secure? The Five Pillars

Based on the evidence above, secure elections require five properties:

1. Voter Authentication

The system must verify that each voter is who they claim to be. The strongest methods:

• Government ID verification (biometric matching)
• SMS one-time passcode (proves device possession)
• Email one-time passcode (proves inbox access)

The weakest: paper proxy forms, shared login links, show of hands.

2. One-Voter-One-Vote Enforcement

The system must prevent duplicate voting. Electronic voter rolls with real-time deduplication are more reliable than paper sign-in sheets. In the Miami condo case, participation hit 115% because paper tracking couldn't prevent double-counting [19].

3. Ballot Secrecy

The voter's choice must be private. Show-of-hands and proxy voting fail this requirement entirely. Controlled polling environments enforce it. Mail-in and online voting require trade-offs.

4. Tamper Evidence

If someone alters results, the system should leave evidence. Paper ballots provide this inherently. Electronic systems require audit logs, cryptographic hashing, and immutable storage.

5. Independent Auditability

Someone other than the election administrator must be able to verify the results. Risk-limiting audits are the gold standard. Paperless DREs and show-of-hands votes are the worst, results must be taken on faith.

Choosing the Right Method for Your Election

The right voting method depends on your threat model, your electorate size, and your legal requirements.

For Government Elections

Recommended: Optical scan + risk-limiting audit.

This is what 98% of U.S. jurisdictions already use [6]. It provides the best combination of speed, accuracy, and auditability for large-scale elections.

For HOA and Condo Board Elections

Recommended: Identity-verified online voting.

Paper proxies are the dominant method for HOA fraud. Moving to verified digital voting eliminates ballot harvesting, proxy stacking, and forgery, the three most common attack vectors in community association elections [18][19][20]. States including California, Florida, Texas, Nevada, and Arizona have all authorized electronic voting for HOAs.

For Nonprofit Board Elections

Recommended: Identity-verified online voting or optical scan.

Depends on size. For boards under 100 members, verified online voting offers the best accessibility-to-security ratio. For larger organizations, optical scan provides the strongest auditability.

For Corporate Shareholder Votes

Recommended: Blockchain or identity-verified online voting.

Corporate voting has a different threat model, fewer voters, higher stakes per vote, and existing legal infrastructure for proxy solicitation. Blockchain's immutability properties are better matched to this use case.

For Union Elections

Recommended: Mail-in ballot with independent inspector, or identity-verified online voting.

The NLRB increasingly supports electronic voting methods. The key requirement is an independent third party to administer the election.

FAQ

Q: Is online voting safe for elections?

It depends entirely on the implementation. Standard online voting with email-only authentication is low-security and appropriate only for low-stakes polls. Online voting with multi-factor identity verification (SMS OTP, government ID) provides security comparable to mail-in voting with stronger authentication. No online voting method, including blockchain, has been proven secure enough for national government elections by academic consensus [23][24]. For organizational elections (HOAs, nonprofits, unions), identity-verified online voting offers the best balance of security and accessibility.

Q: What is the most secure voting method?

Optical scan paper ballots combined with risk-limiting audits represent the academic and institutional consensus for the most secure large-scale voting method [2][5][9]. For organizational elections, identity-verified online voting eliminates the most common fraud vectors (proxy abuse, ballot harvesting) while providing comparable auditability through cryptographic audit logs.

Q: Has blockchain voting been proven to work?

Blockchain voting has worked in small-scale pilots (Colorado processed 12,347 votes in 2024 without incident) and in corporate shareholder voting (Nasdaq Linq). However, every major deployment for public elections has encountered critical vulnerabilities: Voatz had 79+ security findings [21][22], Switzerland's sVote had a flaw that could replace every ballot undetected [25], and Moscow's system was broken in 20 minutes [26]. Academic consensus is that blockchain voting is not ready for large-scale elections [23][24].

Q: How common is election fraud in the United States?

Extremely rare. The Heritage Foundation's database documents approximately 1,500 proven cases of election fraud across all U.S. states over multiple decades [16]. The Brennan Center found fraud rates between 0.00004% and 0.0009% [14]. MIT's Charles Stewart calculated a mail-ballot fraud rate of 0.00006% based on 250 million ballots cast over 20 years [15]. That said, fraud is more common in organizational elections (HOAs, condos) where oversight is weaker, Florida alone received 1,908 condominium election fraud complaints in a single year [19].

Q: Why do security experts oppose paperless electronic voting?

Because paperless voting machines (DREs without VVPAT) have zero independent auditability. If the software contains a bug or is compromised, there is no way to detect the error. Researchers have demonstrated exploitable vulnerabilities in every major DRE vendor's equipment [4][7]. The EAC's 2024 survey showed only 80 jurisdictions in 3 states still use these systems [6]. Every major election security organization, including the Brennan Center, Verified Voting, and CISA, recommends voter-verified paper trails [2][9][11].

Q: What is a risk-limiting audit and why does it matter?

A risk-limiting audit (RLA) is a post-election procedure that hand-counts a statistically determined sample of paper ballots to verify the electronic count. If the sample confirms the reported winner, the audit is complete. If discrepancies are found, more ballots are counted until statistical confidence is reached, or a full recount is triggered. Colorado pioneered statewide RLAs in 2017, and 17 states now require or allow them [5]. The American Statistical Association calls RLAs the most efficient method to ensure election outcomes are correct.

Sources

• 1U.S. Department of Justice: United States v. Michael "Ozzie" Myers, federal conviction for ballot stuffing, E.D. Pa. (2022)

• 2Brennan Center for Justice: "Voting Machines at Risk" and "Our Election System Is Resilient, but Still Has Room for Improvement" (2024)

• 3National Endowment for the Humanities: "Back When Everyone Knew How You Voted" (2016)

• 4DEF CON Voting Village: Annual reports on voting equipment vulnerabilities, DEF CON 25–32 (2017–2024); Verified Voting Foundation summary analysis

• 5Colorado Secretary of State: Risk-Limiting Audit program and 2024 General Election audit results; National Conference of State Legislatures: "Risk-Limiting Audits" (2024); Carter Center: "Risk-Limiting Audits: A Guide for Election Observation Efforts"

• 6U.S. Election Assistance Commission: 2024 Election Administration and Voting Survey (EAVS) Comprehensive Report (released June 30, 2025)

• 7U.S. Senators Klobuchar, Warner, Wyden, Reed: Letter to ES&S, Dominion, and Hart InterCivic regarding known vulnerabilities (March 2019); TechCrunch coverage

• 8Wisconsin post-election audit: Hand count of 327,230 ballots (approximately 10% of total vote), 2024 General Election

• 9Verified Voting Foundation: Recommendations on voter-verified paper ballots and risk-limiting audits; MIT Election Data + Science Lab: Voting technology research

• 10University of Michigan: J. Alex Halderman research on ballot marking devices and voter verification behavior

• 11CISA: Advisory ICSA-22-154-01: Vulnerabilities Affecting Dominion Voting Systems ImageCast X (June 2022)

• 12Curling v. Raffensperger: U.S. District Court, Northern District of Georgia (2019); ongoing litigation regarding Dominion BMD system

• 13North Carolina State Board of Elections: Investigation of NC-9 Congressional District election fraud (2018–2019); new election ordered February 2019

• 14Brennan Center for Justice: "The False Narrative of Vote-by-Mail Fraud" and "Debunking the Voter Fraud Myth"; mail ballot security features primer

• 15McReynolds, Amber and Charles Stewart III: Analysis of mail ballot fraud rates: 143 criminal convictions out of 250+ million mail ballots over 20 years (0.00006%); MIT Election Data + Science Lab

• 16Heritage Foundation: Election Fraud Database, 1,500+ proven cases as of January 2024; Brennan Center contextual analysis

• 17Brookings Institution: "How widespread is election fraud in the United States? Not very" (2024). Analysis of Heritage Foundation data showing Arizona fraud rate of 0.0000845% over 25 years and 42.6 million ballots

• 18U.S. Department of Justice, Criminal Division: HOA Cases: United States v. Leon Benzer et al. (2013), 26 guilty pleas in Las Vegas HOA fraud conspiracy

• 19CooperatorNews South Florida: "Keeping Board Elections Honest"; El Nuevo Herald and Univision 23 investigation of Miami-Dade condo election fraud (2015); Florida DBPR complaint data

• 20HOAleader.com: "HOA Officers Convicted of Election Rigging": Wild Acres Lakes, PA (2014), 407 combined criminal counts

• 21Specter, Michael A., James Koppel, and Daniel Weitzner. "The Ballot is Busted Before the Blockchain: A Security Analysis of Voatz, the First Internet Voting Application Used in U.S. Federal Elections," 29th USENIX Security Symposium (August 2020)

• 22Trail of Bits: "Our Full Report on the Voatz Mobile Voting Platform" (March 2020), 79 findings including high-severity vulnerabilities

• 23Park, Sunoo, Michael Specter, Neha Narula, and Ronald L. Rivest. "Going from bad to worse: from Internet voting to blockchain voting," Journal of Cybersecurity, Oxford Academic (2021)

• 24ITM Web of Conferences: "Blockchain-Based Voting Systems Enhancing Transparency and Security" (2025); Springer Nature: "Blockchain for securing electronic voting systems: a survey" (2024)

• 25Lewis, Sarah Jamie, Vanessa Teague, and Olivier Pereira: Critical vulnerability in Swiss Post/Scytl sVote e-voting system zero-knowledge proof (March 2019); The Register, Vice/Motherboard coverage

• 26Gaudry, Pierrick: Breaking the encryption scheme of the Moscow internet voting system (2019), Institut national de recherche en informatique et en automatique (INRIA)