Millions of Americans are voting in today’s midterm elections, and most of them are doing it the old way: marking paper ballots that sit under chain-of-custody protocols and, in some cases, statistical audits afterward. Which raises a fair question. Your bank is an app. Your tax return is an app. The signature on your mortgage is an app. Why is your vote still a physical object? As Fredrik Dahlgren explains in a new post at the security firm Trail of Bits, the short answer is security. The longer and more interesting answer is that the cryptography is not the problem.
Because the cryptography here is genuinely good, and Dahlgren’s walkthrough treats it seriously. Modern protocols can deliver the two things you’d most want from an election: individual votes stay secret, and the final tally is independently verifiable. Helios is a complete voting protocol of exactly this kind, aimed deliberately at lower-stakes, low-coercion elections rather than high-stakes public ones — the International Association for Cryptologic Research famously uses it to elect its own board. ElectionGuard, Microsoft’s system, is meant for real public elections, but tellingly not as a replacement for paper: it is a cryptographic verification layer bolted onto traditional voting infrastructure, and it has been tested alongside paper-based systems in College Park, Maryland, Preston, Idaho, and Fulton, Wisconsin. Even the people building the best version of this stuff keep insisting on paper underneath it.
To see why, look at what any election is actually asking for. Voter privacy must hold even if a voter wants to prove how they voted — say, because someone is paying them. Ballot integrity must hold even though ordinary voters don’t carry cryptographic keys and can’t sign anything, and even though the machines and servers handling their vote might be compromised anyway. Nobody may vote twice, but you can’t check that by linking ballots to voters, because linking ballots to voters is the thing you just promised not to do. And everyone has to be able to trust — ideally verify — that the final count reflects what voters intended. A 2018 National Academy of Sciences report, which Dahlgren cites, concludes that internet voting shouldn’t be used in general elections because “no known technology guarantees the secrecy, security, and verifiability of a marked ballot transmitted over the Internet.”
Paper handles the first three of those requirements almost laughably well, through what amounts to physical theater. You prove who you are to a poll worker. You receive a ballot with no name on it and a private booth to mark it in. You hand it over yourself and watch it go in the box. Each of those controls can be attacked, of course. But attacking them at national scale is extremely expensive, extremely difficult and — the technical term here is lovely — noisy: someone tends to notice busloads of impostor voters. It’s the fourth requirement, trust in the tally, where paper is weakest, and where voters mostly have to rely on election workers’ honesty plus chain-of-custody controls plus post-election audits. That is also exactly where the cryptography can help, which is the whole point of ElectionGuard-style verifiability.
Electronic systems, meanwhile, add a failure mode that paper simply does not have. A supply-chain compromise or an unfixed 0-day vulnerability scales. One flaw, replicated across thousands of identical machines in hundreds of jurisdictions, could in principle let a single person swing an election — and, depending on the system, do it without detection. The paper equivalent doesn’t exist: there is no pen you can backdoor such that marking it changes ballots in forty states at once. This is why the security community talks about “software independence,” the principle that it is not enough for voting software to be correct and secure — you will never fully know that it is — but that any wrong outcome caused by the software has to be detectable by evidence that doesn’t depend on the software. In practice, that evidence is a paper record a human can recount.
The cryptography itself is worth a minute, because the design problem it solves is a nice one. You want ballots encrypted before they leave the voting machine, so nobody can read them in transit. Fine. But encrypted to whose key? If the answer is a key held by the backend server, then the server can decrypt each ballot as it arrives, and your secret ballot is a secret only from everyone except the people counting it. The elegant answer in systems like Helios and ElectionGuard is to split the private key among N trusted election officials, so that a quorum of t+1 of them must cooperate to decrypt anything, and to use homomorphic encryption — a scheme where you can add up ciphertexts to get the encryption of the sum. The server totals the encrypted ballots without ever opening them, and the trustees decrypt exactly one thing: the final tally. As long as N−t officials stay honest, no single ballot is ever exposed from the moment it’s cast to the moment it’s counted. Technically, both systems encrypt each choice with a variant of exponential ElGamal; decryption yields g^x rather than x, which is normally hard to invert, but since the number of votes is small, you can just brute-force the exponent. The math, in other words, is sorted.
Anyway. The residual problem is not the math but everything around it: the laptop the voter votes on, the server that stores the ciphertexts, the software update that ships to ten thousand machines on a Tuesday. The state of the art, then, is a system in which impeccable cryptography proves that the pile of encrypted ballots was counted correctly, while a pile of actual paper proves that the encrypted ballots were the real ones. You go to all that trouble with threshold keys and homomorphic tallying, and at the end of it the critical security component is still the same one it was in 1870: a piece of paper, in a box, that everybody can see.