Conventional voting systems have a limited audit capability. Much greater auditability can be designed into voting software, but only if there are separate trails of objects and data to compare against the electronic record.

The concept of auditing derives from accounting. In a double-entry bookkeeping system, every item can be checked against other recorded items and against external records, reducing opportunities for fraud and embezzlement. An auditable computer system must similarly incorporate two separate but linked data tracks, and external records corresponding to each. However, in a voting system there is a legal requirement that the identities of voters and the votes that they cast cannot be linked, either directly in the recorded data, or by any reasonably inference from the records. Severing that connection makes design of auditable voting systems significantly more difficult than auditable accounting systems.

Banks, for example, must be able to relate every transaction to the customers or other participants involved. Otherwise no customer would be able to establish an account balance. Since each citizen gets one vote in an election, we do not have this particular problem. What, then, can we link without giving away individual votes? Vote totals by machine and polling place matched with paper ballots turns out to satisfy the requirements moderately, as long as nobody records which individuals use which machines. Even better, we can calculate results from the selections made by voters in many different ways, but in every case the calculation in the machine is supposed to match the calculation from the selections on the ballots. Faking voting records can be made as hard as necessary with such tests.

Resources available for use in auditing conventional systems include voter registration records, the books where voters sign in at polling places, exit polls, and (in systems using marked paper ballots or punched card ballots) the marked ballots themselves. The sorry history of vote fraud shows that these are useful but in no way sufficient.

An electronic voting system that prints paper ballots would automatically have somewhat better auditing information in the two separate tracks of data, electronic and on paper. It could be designed to have much better auditing capabilities by using methods of computer security and authentication. The basic idea is to compute properties of the electronic data that must match the data read from the paper ballots, where the calculation methods used make it hard to match a given value using plausible modifications of the data.

External References

Open Voting Consortium
Black Box Voting
Verified Voting