This article explains what an electronic voting machine is, what types exist, how they differ and what criteria should guide the choice of the most suitable system for each context.
What is an electronic voting machine
An electronic voting machine is a device that allows the voter to select their vote on a digital interface and records that vote electronically. The term is used broadly in public debate, but strictly speaking it refers to DRE (Direct Recording Electronic) systems: devices that record and count votes directly in their internal memory or in an associated digital storage system.
In these systems, the goal is to replace the entire paper ballot and manual counting process with an entirely digital record, promising greater counting efficiency. However, the way each model handles vote backup and voter verification varies considerably, and those differences have direct consequences for public trust and the auditability of the process.
Types of electronic voting machines and their differences
The most relevant distinction between in-person electronic voting systems comes down to a concrete question: is there a physical backup of the vote that the voter can verify before depositing it?
DRE voting machine without paper backup
In this model, the voter selects their choices on a touchscreen and the vote is saved directly in the device's memory. No physical ballot is generated that the voter can see, verify or deposit in a traditional ballot box.
The operational advantage is clear: counting is immediate and paper-related costs are eliminated. However, this design has limitations that have sparked debate in multiple jurisdictions.
Auditing the process depends exclusively on the software and the device's internal digital records. If there is any doubt about the integrity of the results, there is no independent medium against which to check the electronic data. The voter has no way to confirm for themselves that their vote was recorded correctly beyond what the screen shows them. And in case of dispute, there is no possibility of a manual recount ballot by ballot.
These limitations have led several countries and states that adopted pure DRE machines to later migrate to models with a documentary backup.
DRE voting machine with paper receipt (VVPAT)
Some DRE systems incorporate a module that prints a paper receipt of the vote cast. The voter can see the receipt through a window in the device, but generally does not handle it or deposit it in a ballot box. The paper is stored on a roll inside the machine as a backup record.
This model improves auditability compared to pure DRE, since there is a paper trail that can be used for verification. However, the voter's level of control over their vote remains limited: they can see the receipt but cannot remove it, verify it independently or deposit it in a separate ballot box.
Electronic Single Ballot (BUE)
The Electronic Single Ballot represents a different approach. In this system, the voter selects their vote on a terminal with a touchscreen, but the terminal does not store the vote. Instead, it prints the selection on a paper ballot in legible text and records the same information on an RFID chip embedded in that same ballot.
The voter removes the ballot, visually verifies that what is printed matches their intent and can also hold it up to a reader to confirm that the chip's information matches the paper. They then fold the ballot and deposit it in a traditional ballot box, exactly as in a manual election.
This design places the voter at the center of process control. The physical ballot is the source of truth in case of dispute, and the dual paper and digital record enables cross-audits. The terminal is ready for the next voter without retaining any data.
Criteria for choosing the right system
The decision about which type of electronic voting system to implement must be based on a rigorous analysis that considers the needs of the electoral authority, the legal framework of the jurisdiction and public trust expectations. The following criteria are the most relevant in that evaluation.
Public auditability
Does the system allow political parties, observers and independent experts to audit every stage of the process? Can they review the software, inspect the hardware and verify the results independently? A system that concentrates all evidence in internal digital records offers fewer audit possibilities than one that generates a physical documentary backup accessible to overseers.
Voter verifiability
Can the voter verify for themselves that their vote was recorded correctly? The existence of a physical ballot that the citizen reviews before depositing it in the box is the most direct and understandable verification mechanism. It requires neither technical knowledge nor trust in the internal workings of the device.
Possibility of independent recount
Is a manual recount possible in case of doubts or disputes? In systems with a physical ballot, a ballot-by-ballot recount is possible at any time. In pure DRE systems, the recount is limited to re-reading the data stored in the same device that generated it.
Ballot secrecy and non-traceability
Does the system guarantee that it is impossible to link a vote to the voter's identity? Voter identification must occur outside the terminal, and the ballot must contain no personal data. This requirement is met in both DRE models and the BUE, but the way each system separates identity and vote deserves specific review during the evaluation.
Operational risk and contingency
What happens if the device fails during election day? In a pure DRE system, a failure can mean the loss of votes stored in memory if there is no backup. In the BUE, votes already cast are on the physical ballots deposited in the box, regardless of the state of the terminal. This difference has direct implications for the contingency plan the electoral authority must prepare.
Public trust
Does the system's design inspire trust among citizens and political actors? The experience of multiple jurisdictions shows that the presence of a verifiable physical backup significantly reduces resistance to the adoption of electoral technology. Citizens trust a system more when it lets them see and touch their vote before depositing it.
Why the BUE stands out as the best alternative
Evaluated against these criteria, the Electronic Single Ballot model offers a balance that pure DRE systems cannot match.
The BUE maintains the efficiency of the digital record to speed up counting, but does not depend exclusively on that record to guarantee the integrity of the results. The paper documentary backup works as the primary source of truth. The voter is the first auditor of their own vote. Overseers can verify at the station that the electronic data matches the physical ballots. And in case of dispute, a manual recount is always possible.
In addition, COMITIA's BUE operates with terminals that do not store the vote, that work without network connections during election day and that boot via secure boot to guarantee the integrity of the software being run. These design decisions minimize the attack surface and reinforce the independence of each polling station. The BUE also includes an assisted voting module for voters with visual or motor disabilities, reinforcing its character as a system accessible to any citizen.
COMITIA operates under ISO/IEC 27001 and ISO/IEC 27701 certifications issued by TÜV Rheinland, which attests that its security and privacy management processes meet international standards verified periodically and independently.
The right decision depends on the context
There is no universally superior electronic voting system. The choice depends on the legal framework, the electoral culture, the available infrastructure and the trust expectations of each jurisdiction.
What can be affirmed is that, for electoral authorities that prioritize auditability, citizen verifiability and the possibility of an independent recount, models with a physical documentary backup offer guarantees that purely digital systems cannot replicate. The BUE represents the fullest expression of that approach: technology at the service of the electoral process, with paper as the backup and the citizen as the first auditor.