(cc) 2006, Joseph Lorenzo Hall, Some rights reserved. This work is licensed under a

Creative Commons Attribution-NonCommercial-NoDerivs 2.5 License:

http://creativecommons.org/licenses/by-nc-nd/2.5/

Design and the Support of Transparency in VVPAT

Systems in the US Voting Systems Market

Joseph Lorenzo Hall (UC Berkeley, School of Information)

1 Introduction

Voter-verified paper audit trails (VVPATs) are an important technical subsystem that

supports transparency in computerized voting systems. An ideal VVPAT allows voters

to essentially disregard what is internal to the black box of computerized voting terminals

and know that as long as the VVPAT matches their intent, their vote will be counted.

In the United States, the debate over the past few years surrounding VVPATs has been 

vigorous. However, states have begun to recognize the importance of recording a paperbased audit trail verified by the voter at the time of casting their ballot. Twenty-six states

have passed laws requiring some form of a paper record to be produced by voting 

systems.

1

The market has responded to this trend and now all major vendors offer direct recording

electronic (DRE) voting systems with VVPAT capability. However, evidence shows that

these VVPAT subsystems were added subsequently to the design of the latest generation 

of DRE products. Adding VVPAT as an afterthought in the design process resulted in 

design flaws that have significant implications. This paper reviews why VVPATs are

important for transparency in paperless systems, the current crop of VVPAT offerings

from the major and minor voting system vendors in the US and then the implications that

their design flaws have for future VVPAT systems.

2 VVPATs are Important for Transparency

Independent audit trails are important for high-integrity and fault-tolerant systems.

2

These systems must retain enough information during processing to allow for detecting 

and correcting error and malfeasance. While DRE voting systems generally do keep

multiple copies of vote data in different memory and storage locations, these are not

sufficiently independent from the main computerized processing. To solve this dilemma,

Rebecca Mercuri developed the notion of the VVPAT in her PhD thesis work.3 VVPATs

were developed with the goal of providing an independent audit mechanism for

computerized voting systems.

In terms of transparency and public oversight of the electoral process, VVPATs provide a

permanent record, which the voter has had the opportunity to inspect, of each ballot cast.

In a challenge to an election or in routine auditing, VVPATs can provide an independent

 1 Electionline.org. Election Reform: What's Changed, What Hasn't and Why 2000-2006, March 2006,

available at: http://electionline.org/Portals/1/Publications/2006.annual.report.Final.pdf. Also see

VerifiedVoting.org’s “Legislation Tracking” page:

http://www.verifiedvoting.org/article.php?list=type&type=13. 2 Jones, D. W. 2004. Auditing elections. Commun. ACM 47, 10 (Oct. 2004), 46-50. DOI=

http://doi.acm.org/10.1145/1022594.1022622. 3 R. Mercuri. Electronic Vote Tabulation Checks and Balances. PhD thesis, University of Pennsylvania,

Philadelphia, PA, Oct. 2000.
(cc) 2006, Joseph Lorenzo Hall, Some rights reserved. This work is licensed under a

Creative Commons Attribution-NonCommercial-NoDerivs 2.5 License:

http://creativecommons.org/licenses/by-nc-nd/2.5/

check on electronic records of vote data stored on less-permanent, write-many media. To

voters, VVPATs short-circuit the need for trusting the hardware and software of pollingplace vote terminals. In these respects, VVPATs support the values of transparency,

auditability and recovery.

There are recent examples where votes have been lost by DREs without audit trails.

While there have been other examples,

4 the poster child example of loss of votes due to 

failures related to human-computer interaction was in Carteret County, North Carolina

during the 2004 presidential election.5 The cause of failure involved their early-voting 

technology, the Unilect Patriot voting system. It had half as much memory as election 

officials expected and the error signal, triggered by casting a vote when the system’s

memory was full, was easy to overlook, cryptic and overrideable. Approximately 4,000

votes were not recorded and a statewide election for one candidate on the ballot had to be

reheld. If this jurisdiction had been using a VVPAT subsystem, votes would not have

been lost and they would not have had to spend millions of dollars to hold a new election.

There are increasing reports of paper records being used as recovery mechanisms and as

surrogates for corrupt or inaccessible data. In Clark County, Kentucky, “the transfer of

precinct data into the central computer” was “not functioning” and vote data compiled 

from totals tapes from each machine had to be manually entered.6 Totals tapes were used 

in Bradford County, Pennsylvania when there was “no time for county employees to train

in the computer software system that would allow them to electronically count the

votes.”

7 In Boone County, Indiana “poll workers at several precincts had not properly

shut down the computerized voting machines” but the machines “[generated] a paper

record of votes cast” which was used to produce the final tally of votes.

8 Finally, in

Phillips County, Arkansas, elections officials “had trouble downloading the count from

some machines, and [used] the state-mandated paper trail to finish up.”

9

While these current events show that paper records and VVPATs are being used in real

election contexts to recover from error, VVPATs are most powerful when routinely used 

as an auditing mechanism. In fact, of the twenty-six states with VVPAT legislation,

twelve require post-election auditing of a percentage – from 1-10% – of paper records

 4 Abby Goodnough, Lost Record of Vote In '02 Florida Race Raises '04 Concern, New York Times, July 28,

2004; Jeff Testerman, Bill Varian and Brady Dennis, All the work boils down to today, St. Petersburg

Times (Florida), November 2, 2004; Editorial, Get On With The Vote, Hartford Courant (Connecticut),

December 7, 2005, and; Noam N. Levey, Voting System Results Still Out; Questions about the reliability

of electronic ballots combine with changing regulations to fuel confusion and debate over technology, Los

Angeles Times, January 3, 2006. 5 Associated Press. More Than 4,500 North Carolina Votes Lost Because of Mistake in Voting Machine

Capacity, USA TODAY, Nov. 4, 2004, available at:

http://www.usatoday.com/news/politicselections/vote2004/2004-11-04-voteslost_x.htm. 6 Alex Davis. Computer woes slow vote count, The Courier-Journal (Louisville, Kentucky), May 3, 2006. 7 C.J. Marshall, Manual tally needed in primary, The Daily & Sunday Review (Towanda, Pennsylvania),

May 17, 2006. 8 John Flora. Early tabulations suggest Campbell is the winner, The Crawfordsville Journal Review

(Crawfordsville, Indiana), May 2, 2006. 9 Press Release, Arkansas Secretary of State, Arkansas Will Review Election Systems, May 26, 2006,

available at: http://govtech.public-cio.com/newsStory.php?id=2006.05.26-99632.
(cc) 2006, Joseph Lorenzo Hall, Some rights reserved. This work is licensed under a

Creative Commons Attribution-NonCommercial-NoDerivs 2.5 License:

http://creativecommons.org/licenses/by-nc-nd/2.5/

against electronic records.

10 However, there have been hints that only a small percentage

of voters inspect VVPAT records and voters may prefer other forms of verification.

11

3 Design Flaws in Major VVPAT Systems

The US market has responded to the state-level call for VVPAT; all major DRE vendors

have a VVPAT-equipped product on the market. The designs of these vendors are all

fairly uniform, consisting of thermal paper printed and stored on reel-to-reel printers;

however, it is instructive to examine the ways in which these implementations do differ.

From examining their various design flaws, we can see that they stem from adding in

VVPAT capability as an afterthought to an existing design.

3.1 General design concerns12

There are a variety of problems, in general, with the form of VVPAT design that the

major vendors have chosen to incorporate into their products. They all use thin thermal

paper rolls, printers and reel-to-reel take-up mechanisms, which are used heavily in pointof-sale products. The printers are enclosed in cases to the side of the computer screen 

with a viewing window that allows the voter to see the contents of the VVPAT, but not to 

touch it.

One of the most significant concerns with this general design involves ballot privacy and 

secrecy and the serial storage of VVPATs. All the major vendors’ VVPAT mechanisms

record paper records serially on a reel-to-reel system. This, in some cases, can violate

state law

13 and has serious implications for the secrecy and privacy of voter’s ballots, a

long-recognized feature of expressing democratic preferences free from undue

influence.

14

With the general design, the contents of a VVPAT record are not read back to sightimpaired voters from the paper or printer, independent of the electronic record. When 

 10 Id. at note 1. 11 Jim Adler. Testimony to the EAC: Comments on the Voluntary Voting System Guidelines, June 30,

2005, available at: http://www.votehere.net/files/Jim_Adler_EAC_VVSG_Comments_6.30.05.pdf; Connie

McCormack. Testimony in front of the U.S. Senate Committee On Rules And Administration: Hearing On

Voter Verification In The Federal Electoral Process, June 21, 2005, available at:

http://rules.senate.gov/hearings/2005/McCormack062105.pdf; Ted Selker, Sharon Cohen. An Active

Approach To Voting Verification, CalTech/MIT Voting Technology Project Working Paper #28, May

2005, available at: http://www.vote.caltech.edu/media/documents/wps/vtp_wp28.pdf. 12 These concerns apply to the systems mentioned in following section (§3.2) as well as the Hart InterCivic

eSlate with VBO printer. The author does not know about any remarkable system-specific concerns with

the eSlate’s VBO printer. 13 For example, reel-to-reel VVPAT mechanisms are not certifiable in the state of Pennsylvania. See page

5 of: Commonwealth of Pennsylvania, Examination Results of the Diebold Election Systems’ AccuVoteTSx Electronic Voting System, OS Optical Scan Units and GEMS Election Management Software, Dec.

22, 2005, available at:

http://www.hava.state.pa.us/hava/lib/hava/votingsystemexamination/diebold_report_122205.pdf. 14 Keller, A. M., Mertz, D., Hall, J. L., and Urken, A. 2004. Privacy issues in an electronic voting machine.

In Proceedings of the 2004 ACM Workshop on Privacy in the Electronic Society (Washington DC, USA,

October 28 - 28, 2004). WPES '04. ACM Press, New York, NY, 33-34. DOI=

http://doi.acm.org/10.1145/1029179.1029189.
(cc) 2006, Joseph Lorenzo Hall, Some rights reserved. This work is licensed under a

Creative Commons Attribution-NonCommercial-NoDerivs 2.5 License:

http://creativecommons.org/licenses/by-nc-nd/2.5/

California designed standards for Accessible VVPAT mechanisms,

15 this functionality 

was a specific part of the requirements. However, the vendors remarked that this

functionality was complicated and would be very difficult for them to support. When the

final version of the standards was promulgated, this requirement was left out.

16

The general design of VVPAT systems marketed and sold by the major vendors records

onto thin thermal paper, which can be problematic in elections contexts. Paper jams are

reported frequently. The thinness of the record, coupled with minimum type size

requirements, leads to long VVPAT records and very long zero and totals tapes,

especially at early-voting sites or during primary elections when there are many choices

on each ballot an dozens of ballot styles handled by on machine. The paper these systems

use is thermal register-receipt-like paper, not of archival quality, which requires special

storage arrangements to last unharmed for the 22-month federal retention period.17 This

type of paper is hard to recount as it is not robust against repeated handling, the paper

tends to curl making ballot-sorting complicated and the vendor-recommended barcodes

on each ballot may not be legal in all jurisdictions and might introduce covert channels.

This was not an exhaustive list of concerns,

18 but a list of general concerns with the

designs of the major vendors’ current VVPAT mechanisms. These vendors seem to have

all chosen the same design for a set of reasons. The most plausible explanation seems to 

be that thermal, reel-to-reel printer mechanisms were well understood and cheap and that

each of these vendors had already invested heavily in the design and manufacture of their

latest generation DREs and could not afford to redo the design process. Next, we discuss

design concerns of specific systems.

3.2 System-specific design concerns

Here we cover design flaws in the VVPAT mechanisms of the Diebold Election Systems,

Inc. (DESI) AccuVote-TSx with AccuView printer, the Sequoia AVC Edge with 

VeriVote Printer and the Election Systems and Software’s (ES&S) iVotronic with RTAL.

3.2.1 DESI’s AccuVote-TSx with AccuView Printer

Most of the concerns with the design of DESI’s AccuVote-TSx with AccuView printer

involve the viewing area of the VVPAT window. This area is much smaller than other

VVPAT viewing areas. The voter has to pay extra attention during the VVPAT printing 

process or they might miss races higher on the ballot that might scroll out of view. There

is a fixed magnifying glass attached to the viewing area. It only magnifies the contents in

 15 “The data relayed to the audio device must come either directly from the data sent to the printer or

directly from the paper record copy.” §2.4.3.1.2 of Kevin Shelley, Secretary of State of the State of

California. Standards For Accessible Voter Verified Paper Audit Trail Systems In Direct Recording

Electronic (DRE) Voting Systems (Jun. 15, 2004), available at:

http://www.ss.ca.gov/elections/ks_dre_papers/avvpat_standards_6_15a_04.pdf. 16 Kevin Shelley, Secretary of State of the State of California. Standards For Accessible Voter Verified

Paper Audit Trail Systems In Direct Recording Electronic (DRE) Voting Systems (Jun. 15, 2004), available

at: http://www.ss.ca.gov/elections/ks_dre_papers/avvpat_standards_1_21_05.pdf. 17 42 USC §1974. 18 Other concerns include: Many of the VVPAT mechanisms are attachments to the main polling place

interaction unit and are not available for curbside voting. Most require separate chains of custody in their

transportation and handling from the main unit.
(cc) 2006, Joseph Lorenzo Hall, Some rights reserved. This work is licensed under a

Creative Commons Attribution-NonCommercial-NoDerivs 2.5 License:

http://creativecommons.org/licenses/by-nc-nd/2.5/

the middle of the VVPAT viewing area and, since the voter doesn’t control the rate of

printing, this can lead to some voters only being able to examine part of their VVPAT

record. To increase the privacy of voters with severe visual impairment who cannot

visually inspect their VVPAT, the viewing area can be obscured completely by an opaque

“flap”. Unfortunately, this “flap” is fixed via a hinge to one side of the viewing area and

is not “reset” to the open position automatically after each vote. This poses a danger that

the flap might remain closed by accident during non-disabled voting and that voters may

not realize that there is a VVPAT to be inspected.19

3.2.2 Sequoia AVC Edge with VeriVote Printer

The design of the Sequoia VeriVote printer is unique in one very important way: the

whole printer mechanism was designed to be replaced when it runs out of paper instead 

of the paper roll itself being swapped out. Since the paper was not designed to be easily 

removable or swappable, the paper roll is not easy to change and paper jams are difficult

for non-technicians to reconcile.

The printer used for zero reports – printed before the polls are open – and results reports

– printed after the polls are closed – is the same printer used for VVPATs. This means

that the zero reports will be on the extreme inside of a roll of VVPATs and the results

reports will be on the very outside after all the VVPAT records on the reel.

20 States like

California require recording and posting of results reports in each precinct,

21

which 

cannot be done without opening the printing mechanism and separating the results reports

from the cast VVPATs. This is cumbersome and can potentially compromise the chain 

of custody for the paper records; Registrars in three California Counties that use this

voting system have recently announced their intentions to disobey or have waived these

California laws.

22 The lesson learned here is that the printer in a VVPAT mechanism

should not be part of the VVPAT chain of custody package.

One surprising problem in early models of this system seems to have been recently 

corrected. The VeriVote printers used in Nevada November 2004 elections would reset

the machine for the next voter while the previous VVPAT record was still scrolling on to

the take-up reel, which took about ten seconds. This posed interesting privacy 

implications.

23 However, in recent demonstrations of this system, the system is reset only 

after the VVPAT is done scrolling.

 19 There have been anecdotal reports that this has happened during recent early-voting in Los Angeles. See:

Michael Alvarez, “More early voting observations from California, and a question about the Diebold

VVPAT device”, June 1, 2006, available at: http://electionupdates.caltech.edu/2006/06/more-early-votingobservations-from.html. 20 Paul Craft, California Secretary of State Consultant’s Report Sequoia's Voting Systems, February 24,

2006, available at: http://www.ss.ca.gov/elections/voting_systems/sequoia_consultant_report.pdf. 21 California Election Code §19370 and §10260. 22 Chris Bagley, County in good (and bad) company, North County Times, May 30, 2006, available at:

http://www.nctimes.com/articles/2006/05/31/news/californian/21_51_075_30_06.txt. 23 Lillie Coney, Joseph L. Hall, Poorvi L. Vora and David W. Wagner, Towards a Privacy Measurement

Criterion for Voting Systems in National Conference on Digital Government Research (2005), available at:

http://josephhall.org/papers/poster_VotingPrivacy.pdf.
(cc) 2006, Joseph Lorenzo Hall, Some rights reserved. This work is licensed under a

Creative Commons Attribution-NonCommercial-NoDerivs 2.5 License:

http://creativecommons.org/licenses/by-nc-nd/2.5/

3.2.3 Election Systems & Software iVotronic with RTAL Printer

The ES&S iVotronic is distinguishable from other major vendors’ VVPAT solutions in

that it uses what ES&S calls a Real-Time Audit Log (RTAL). The RTAL system records

each choice onto the VVPAT right when the voter makes the choice. It also voids

deselected choices when a voter changes their preference or corrects a mistake. Of

course, this design will use more paper as a voter can change their mind or make

mistakes an arbitrary number of times before they are ready to cast their ballot. To make

up for this the ES&S printer has paper rolls much larger than the other vendors.

24

To accomplish the real-time printing and still have the printed text in the viewing area in

a reasonably compact form, the RTAL printer mechanism reverses the paper back, prints

the choice and scroll the choice back into the viewing area. VVPAT printer mechanisms

that reverse the paper record back towards the printer head under the control of software

could be used to void the last paper record when the voter has left the vicinity. This is a

non-trivial security concern.

Finally, RTAL records will be very difficult to recount without using the vendorrecommended barcode printed on the record. The choices printed on the RTAL record 

are not necessarily in a standard order and could even be misleading. When a voter

changes their preference in a high-ticket race much later in the process, the mark to void

their previous choice will be very far from their initial choice on the VVPAT. Instead of

simply counting choices on VVPAT records, those conducting manual counts will have

to reconcile all the voided choices on a ballot first, which will undoubtedly increase the

opportunity for error and decrease the efficiency of the process.

4 VVPAT Designs from Small Vendors

Smaller vendors do not tend to have this uniform, reel-to-reel thermal paper design and

have been more innovative in their designs. Despite this, these products have not

generally garnered widespread use. In this section, we discuss some of these designs and 

contrast their features with those above.

AccuPoll, Inc. had a much-lauded VVPAT design. Their voting system produced

individual VVPAT records on thick paper stock that were individually deposited into a

ballot box. The system also retained electronic records of each ballot cast so the paper

and electronic records could be reconciled at poll closing. Unfortunately, the AccuPoll

system was used in a few demonstration elections, but AccuPoll eventually filed for

bankruptcy after questions about accounting practices increased the strain of having too 

little business too late.

Avante International Technologies has had a few VVPAT-capable systems, the first

generation of which was used in Sacramento, California in November of 2002 and for

municipal elections in Southington, Connecticut in 2003. Their second-generation 

system would slice individual ballots and deposit them in a ballot box or in a spoiled 

container if the VVPAT had been voided. Unfortunately, Avante has not made a sale of

their equipment for use in general elections.

 24 Anecdotal reports indicate that the RTAL printer also makes more noise than other VVPAT printers. In

this case, any attempt by a voter to conduct a denial-of-service by wasting paper would likely be heard.
(cc) 2006, Joseph Lorenzo Hall, Some rights reserved. This work is licensed under a

Creative Commons Attribution-NonCommercial-NoDerivs 2.5 License:

http://creativecommons.org/licenses/by-nc-nd/2.5/

Yet another interesting design comes from Populex, which makes a “ballot-marking

device”. The Populex system allows voters to interact via touchscreen technology or via

an assistive device, but then records the voter’s choices on individual pieces of thick 

paper stock. The voter can then verify their vote using a barcode reader or by correlating

ballot positions written on the ballot. Populex has made one successful general election 

sale to Sangamon County, Illinois.

These designs from small vendors stand in stark contrast to the general designs of the

major vendors and don’t exhibit the quirks of the system-specific concerns noted in the

last section.

4.1 The Success of the AutoMARK

The themes common to the small vendors we’ve listed so far in this section cluster

around innovative designs and a lack of success in the market. We can contrast the cases

of these small vendors with the case of another small vendor, Vogue Election Systems.

The differences point out that there are real regulatory, organizational and perceptional

barriers to innovation to new entrants in the market.

25

The AutoMARK, created by Vogue, seems to be the epitome of VVPAT success. This

system is a ballot-marking device that allows the voter to interact with it via a

touchscreen or assistive device and then marks a normal optical scan ballot with the

choices the voter has made. The voter or a poll worker then places the voted ballot in a

ballot box. This design is especially unique as it works with an existing jurisdictions

optical scan system. It also has the distinction of being the only product on the market

that will display or read back the contents of a filled-out ballot to a voter by directly

reading the marks on the ballot that correspond to votes, not a barcode.

The AutoMARK has been wildly successful.

26 It overcame the barriers in the voting 

system market that thwarted other small vendors. In order to do this, Vogue, had to enter

into an exclusive relationship with ES&S. If it had not teamed up with ES&S, it would

have faced a variety of difficulties. Foremost of these difficulties being the cost of federal

and state certification coupled with the requirement that voting systems be tested in an 

end-to-end configuration, containing all pieces of the system used during an election.

27

All the systems discussed in this section have important, innovative differences compared 

with the uniform designs of the major vendors. Barriers inhibit the diffusion of

innovations unless a smaller vendor is willing and can convince a larger vendor to enter

into a working relationship. We now turn to the technical and policy implications of this

landscape of VVPAT mechanism designs.

 25 While a discussion of these barriers is out of scope of the current article, see: Joseph L. Hall,

Transparency and Access to Source Code in E-Voting (forthcoming) in USENIX/ACCURATE Electronic

Voting Technology Workshop (2006). (Soon available here: http://josephhall.org/HallJosephResume.html) 26 See the news section of http://www.automarkts.com/ for a sample of reports on the use of the AutoMark. 27 The AutoMARK marks up optical scan ballots but does not come with an optical scanner. They would

have had to create an end-to-end system or convince a vendor to let them use their equipment and testing

materials during certification. DESI has formally objected to the AutoMARK being used and certified with

its equipment.
(cc) 2006, Joseph Lorenzo Hall, Some rights reserved. This work is licensed under a

Creative Commons Attribution-NonCommercial-NoDerivs 2.5 License:

http://creativecommons.org/licenses/by-nc-nd/2.5/

5 Implications

By examining the current slate of VVPAT designs on the market, we can see what

implications their failings have for future designs. To alleviate the serious concerns with 

ballot secrecy and privacy of reel-to-reel systems, VVPATs must not be stored in a serial

manner. VVPATs should be produced and cast individually or the casting mechanism

should slice VVPATs or record and store VVPATs in a manner that is non-serial, nondeterministic and hopefully reasonably random.

To allow for repeated and manual manipulation of VVPATs, to ease storage requirements

and to meet requirements for retention set by US federal law, VVPATs should be

recorded on thick paper stock, like that which has been used for optical scanning 

equipment for many years.

VVPATs should support hand-counting operations and provide for optical scanning of

voter-verified marks. Optically scanning VVPAT records and comparing their totals with 

electronic records could provide relatively cheap first-order recounts or routine random

audits, as long as the mark that is being scanned is something that the voter would have

verified. For hand counting, the VVPAT record needs to support operations such as

stacking VVPATs in piles and easily registering ballot choices.

On the policy side of the equation, we need to lower barriers to innovation. There is

clearly a lot of innovation in how smaller vendors approached VVPAT mechanism

design. Lowering or streamlining barriers that smaller vendors face will be key to 

diffusing this innovation into the market.

The need for voters to examine their VVPATs should be part of voter education

campaigns and poll worker training to emphasize its importance as an audit trail. The

frequent critique of VVPAT technology that few voters examine the contents of their

VVPAT shouldn’t be so surprising. Voters are facing increasingly complex voting

technologies; where there was once one ballot and a simple process, there are now two

ballots and a more complicated process. The research into this area must be extended to 

understand how we can better incentivize examining VVPATs.

6 Conclusion

VVPATs are an important part of making computerized elections transparent. They

provide for recovery when electronic records are corrupted and they provide a

mechanism that short-circuits the need to trust the computerized system. Where

innovation in general happened slowly in the US market before the 2000 election

debacle, we need it to happen much faster in this new era. The poor design of the major

vendor’s VVPAT systems and the manner in which their second-generation DRE systems

have been retrofitted with VVPAT capabilities is evidence of how certain values – such 

as security, usability and auditability – need to be designed into the system from the start.

Considering how important transparency-supporting mechanisms such as VVPAT are,

we need to learn from the failings of current designs and incentivize and catalyze

innovation in future designs.