CitizensOversight () RaymondLutz

This Page: copswiki.org/Common/M2060

Recent federal actions, including the seizure of ballots and election data from Fulton County, GA, and Riverside County, CA, have highlighted how election records may become the subject of investigative seizure when discrepancies are alleged. This situation underscores the importance of ensuring that election jurisdictions maintain secure, independent copies of critical election records so that transparency, verification, and public confidence can be preserved even if physical records or systems are removed from local custody or lost, such as due to natural disaster.

Secure Snapshot Backups

Election offices should secure backups of data exported from election systems when that data becomes available in the normal workflow. These may be snapshots of all ballot images up to that point or incremental data backups if they are available.

When available, they should export two copies of the ballot images scanned so far and store them in two separate secure off-site safes located in secure government buildings. Maintaining two identical backups in two separate secure locations provides resilience against both physical loss and investigative seizure. USB drives are relatively inexpensive, compared with the cost of losing precious ballot data.

Suggested Procedures:

Scanning at Polling Places:

When ballot scanners are closed, ballot image data and Cast Vote Record (CVR) data can be transferred to the Election Management System (EMS) and then snapshot backups can be created. Normally, this means there will be at least one backup after early voting is completed, and then one or more after data is returned and uploaded to the EMS after the close of polls on election day.

Central Scanning:

Snapshot backups can be created at the end of each day of scanning of mail ballots and provisional ballots when they are processed.

Other Data: Where possible, the election office should also back up CVRs, e-pollbooks, logs, and other digital records, including the final set of ballot images.

Where possible, election management systems should produce and publish SHA-256 hashes or digital signatures for each data export. Publishing hashes does not reveal the data itself.

Disaster Recovery and Continuity

Even if an Election Management System were removed from service, ballot images and related data could still be analyzed using the same brand of equipment in another jurisdiction, or third-party auditing platforms capable of tallying ballot images across vendor systems.

Election offices: We respectfully encourage your office to consider piloting these practices for some existing records or for an upcoming primary or special election and incorporating them into standard operating procedures for November.

VOTERS: We need your help! Not all election offices will know about this initiative. Please join our effort by contacting your election official and asking them to make backups!