Voter verifiable paper audit trail (VVPAT) or verified paper record (VPR) is a method of providing feedback to voters who use an electronic voting system. A VVPAT allows voters to verify that their vote was cast correctly, to detect possible election fraud or malfunction, and to provide a means to audit the stored electronic results. It contains the name and party affiliation of candidates for whom the vote has been cast. While VVPAT has gained in use in the United States compared with ballotless voting systems without it, hand-marked ballots are used by a greater proportion of jurisdictions.

As a paper-based medium, the VVPAT offers some fundamental advantages over an electronic-only recording medium when storing votes. A paper VVPAT is readable by the human eye and voters can directly interpret their vote. Computer memory requires a device and software which is potentially proprietary. Insecure voting machineSee page 3 of: records could potentially be changed quickly without detection by the voting machine itself. Auditable paper ballots make it more difficult for voting machines to corrupt records without human intervention. Corrupt or malfunctioning voting machines might store votes other than as intended by the voter unnoticed. A VVPAT allows voters to verify their votes are cast as intended, an additional barrier to changing or destroying votes.

The VVPAT includes a direct recording electronic voting system (DRE), to assure voters that their votes have been recorded as intended and as a means to detect fraud and equipment malfunction. Depending on election laws, the paper audit trail may constitute a legal ballot and therefore provide a means by which a manual vote count can be conducted if a recount is necessary.

In non-document ballot voting systems – both mechanical voting machines and DRE voting machines – the voter does not have an option to review a tangible ballot to confirm the voting system accurately recorded their intent. In addition, an election official is unable to manually recount ballots in the event of a dispute. Because of this, critics claim there is an increased chance for electoral fraud or malfunction and security experts, such as Bruce Schneier, have demanded voter-verifiable paper audit trails. Non-document ballot voting systems allow only a recount of the "stored votes". These "stored votes" might not represent the correct voter intent if the machine has been corrupted or suffered malfunction.

As of 2024, VVPAT systems are used in countries including the United States, India, Venezuela, the Philippines, and Bulgaria. In the U.S., 98.5 percent of registered voters live in jurisdictions offering some form of paper ballot, whether hand-marked or VVPAT. Only 1.4 percent use electronic systems with no paper record.

History

In 1897, responding to a question from Rhode Island Governor Charles W. Lippitt about the legality of using the newly developed McTammany direct-recording voting machine, Associate Justice Horatio Rogers of the Rhode Island Supreme Court noted that a voter casting a vote on such a machine without a written record "has no knowledge through his senses that he has accomplished a result. The most that can be said, is, if the machine worked as intended, then he ... has voted."Horatio Rogers, (19 R.I. 729) opinion of the Justices in re voting machine: dissent. Reports of Cases Argued and Determined in the Appellate Division of the Supreme Court of Rhode Island, Vol. XIX, E.L. Freeman & Sons, Providence (1898); 732–735, quotation from the bottom of page 734. This observation remains at the center of concerns with ballotless DRE voting machines today.

In 1899, Joseph Gray addressed this problem with a mechanical voting machine that simultaneously recorded votes in its mechanism and punched those votes on a paper ballot that the voter could inspect before dropping it in a ballot box. Gray explained that "in this manner, we have a mechanical check for the tickets [ballots], while the ticket is also a check upon the register [mechanical vote counter]."Joseph A. Gray, Voting-machine, , issued Mar. 7, 1899; quoted from lines 103-105, page 2. This check is only effective if there is an audit to compare the paper and mechanical records.

The idea of creating a parallel paper trail for a direct-recording voting mechanism remained dormant for a century until it was rediscovered by Rebecca Mercuri, who suggested essentially the same idea in 1992.Rebecca T. Mercuri, Physical verifiability of computer systems, Proc. 5th International Computer Virus and Security Conference. Reposted on the web with added notes in 2005. The Mercuri method, as some have called it, was refined in her Ph.D. dissertation in October 2000; in her final version, the paper record is printed behind glass so that the voter may not take it or alter it.Rebecca T. Mercuri, A better ballot box, IEEE Spectrum, Oct. 2002; pp. 46–50.

The first commercial voting systems to incorporate voter verifiable paper audit trail printers were the Avante Vote Trakker and a retrofit to the Sequoia AVC Edge called the VeriVote Printer.Douglas W. Jones and Barbara Simons, Broken Ballots, CSLI Publications, 2012; see Section 5.5, pp. 111–115. Avante's system saw its first trial use in 2002, and in 2003, the state of Nevada required the use of VVPAT technology statewide and adopted the Sequoia system. It is notable that, in Avante's design, the shield preventing the voter from taking the paper record was an afterthought, while in Sequoia's design, the paper record for successive voters were printed sequentially on a single roll of paper.

Voter-verifiable paper audit trail was first used in an election in India in September 2013 in Noksen (Assembly Constituency) in Nagaland. The VVPAT system was introduced in 8 of 543 parliamentary constituencies as a pilot project in the 2014 Indian general election. VVPAT was implemented in Lucknow, Gandhinagar, Bangalore South, Chennai Central, Jadavpur, Raipur, Patna Sahib and Mizoram constituencies.8 seats having VVPAT facility VVPAT along with EVMs was used on a large-scale for the first time in India, in 10 assembly seats out of 40 in 2013 Mizoram Legislative Assembly election. VVPAT -fitted EVMs was used in entire Goa state in the 2017 assembly elections, the first time that entire state in India saw the implementation of VVPAT. A VVPAT system was introduced in all 543 Lok sabha constituencies in the 2019 Indian general election.

Case study: U.S. presidential election in Georgia 2020 In July 2019, after legal challenges and concerns about the security and reliability of its aging electronic voting machines, Georgia officials approved a $107 million contract with Dominion Voting Systems to equip all 159 Georgia counties with new ballot-marking devices that provide a paper ballot for every vote cast (VVPAT). The upgrade was completed in time for the 2020 Georgia Republican and Democratic presidential primaries.

The system proved critical during the general election in November 2020. A razor-thin margin of victory for Joe Biden (0.23 percent or 11,779 votes)—the first by a Democratic presidential candidate in the state since 1992—automatically triggered a statewide audit, made possible by the new auditable paper ballot system. The audit found several human errors at the county level, netting Trump 1,274 votes. At the Trump campaign's request, this was followed by a full statewide hand recount of the paper ballots, which confirmed the result.

Starting in 2002 with the statewide adoption of DREs and as recently as the 2016 election, the lack of a system producing auditable paper ballots would have made a recount impossible. The VVPAT system allowed officials to cross-check electronic results with paper records, confirming the accuracy of the final vote count and refuting claims by President Trump in a January 2, 2021 phone call with Georgia Secretary of State Brad Raffensperger that the count was inaccurate.

In additional to providing transparency, Georgia's new VVPAT system helped counter a strong disinformation campaign by facilitating a total of three cross-confirming counts—initial vote, audit, and hand recount. This increased voter confidence, providing a reliable method to verify the results during the intense scrutiny of the 2020 election. A survey by the Center for Election Innovation & Research conducted before and after the election found a smaller-than-expected drop in Georgia voters' confidence (from 90% in October 2020 to 85% in January 2021) that their votes would count as intended.

Application

Various technologies can be used to implement a paper audit trail. Attachment of a printer to direct-recording electronic (DRE) voting machines that print paper records stored within the machine. Such designs usually present the record to the voter behind a transparent surface to enable a voter to confirm a printed record matches the electronic ballot. The records can be manually counted and compared to the electronic vote totals in the event of a dispute. The solution linking electronic ballot images and the voter-verified paper record with randomly generated unique voting session identifier is covered by patents issued and pending. Attachment of a printer to DRE voting machines that print paper records on special paper with security features. The printed page contains both a plain text record and a simple barcode of the voter's selections. This page is the official ballot that is then fed through a scanner into a locked ballot box so that all originals are saved in case of the need for a recount or audit. The electronic record from the DRE is compared with the barcode scanner record and in case of any discrepancy, the paper ballots are used to determine the official vote, not the electronic record. The voter has the ability to proofread the ballot before it is placed into the scanner/lockbox and have it voided if there is any error, just as has always been possible with existing manual voting systems. Attachment of a printer to DRE voting machines that print an encrypted receipt that is either retained by the voter or stored within the machine. If the receipt is retained, the receipts can be manually counted and compared to the electronic vote totals in the event of a dispute. These systems have not been used in elections in the United States. Creation of an encrypted audit trail at the same time the electronic ballot is created in a DRE voting machine, a form of witness system. The audit trail can be accessed and compared to the electronic vote totals in the event of a dispute. Use of precinct-based optical scan or mark-sense tabulators instead of DREs. In this simple and cost-effective system, voters fill out paper ballots which are then counted electronically by a tabulator at the precinct, similar to the technology used to score standardized tests. Optical scan machines have been in use for decades, and provide a voter-verified audit trail by default. Tabulators can detect overvotes at the poll so that the voter can be given the opportunity to correct a spoiled ballot.

Systems that allow the voters to prove how they voted do not conform to the generally accepted definition of voting by secret ballot, as such proof raises the risk of voter intimidation and vote selling. As such, systems that allow such proof are generally forbidden under the terms of numerous international agreements and domestic laws.

Professor Avi Rubin has testified in front of the United States House Committee on House Administration in favor of voting systems that use a paper ballot and disfavoring systems that use retrofitted VVPAT attachments. He has said on his personal blog that "after four years of studying the issue, I now believe that a DRE with a VVPAT is not a reasonable voting system."Today's Congressional hearing, March 7, 2007 from Avi Rubin's blog