Custody is continuous accountability, not a vault
When people worry about what happens to their ballot after they drop it in the box, they usually picture a single vulnerable moment — a locked room someone might break into overnight. Real ballot security works nothing like that. It is not one vault; it is an unbroken chain of documented handoffs, and its strength comes from the record, not from secrecy.
Every time ballots change hands or location, three things happen: someone signs for them, the seals are recorded, and the counts are logged. String enough of these together and you get a trail where any interference — a ballot added, removed, or swapped — has to break a seal number, forge a signature, or throw off a total that someone else already wrote down. That is the whole idea. Custody does not try to make tampering impossible. It makes tampering visible.
This is the same logic that governs how a national result is built from local counts: security by layered, observable steps rather than by a single trusted authority.
What a seal actually does
A tamper-evident seal is a numbered, single-use strip or lock that cannot be removed and re-applied without showing damage. On its own, a seal is a small thing. Its power comes from being written down: the seal number goes into a custody log, the log is countersigned, and from then on the physical seal and the paper record have to agree.
So a seal does not stop a determined thief from opening a box. What it does is guarantee that if they do, the number on the box will no longer match the number in the log — and that mismatch is a documented anomaly that officials and observers are specifically trained to look for.
| Control | What it does | What a break looks like |
|---|---|---|
| Numbered tamper-evident seals | Bind a physical container to a logged number | Seal number on the box ≠ seal number in the log |
| Two-person integrity | No single official is ever alone with ballots | A handoff with only one signature |
| Custody log / transfer form | Records who held ballots, when, under what seal | A time gap with no recorded custodian |
| Reconciliation | Matches ballots to recorded voters | More ballots than voters, or fewer |
| Observer access | Independent eyes follow the ballots | Observers barred or removed from the room |
The numbers have to reconcile
The quietest and most powerful custody control is arithmetic. Before ballots are counted, officials reconcile them: the number of ballots has to line up with the number of voters the poll book recorded, the number of ballots issued has to line up with the number returned and spoiled, and for postal voting, the number of ballots has to match the number of valid return envelopes.
A break in the chain of custody almost always shows up here first, as a reconciliation gap. That is why serious manipulation of physical ballots is so hard: you cannot simply add a stack of ballots to a box, because the count would then exceed the number of people recorded as having voted, and that discrepancy is exactly what the canvass and reconciliation stage exists to catch.
Two real tests: when the chain holds, and when it is blocked
The value of custody is easiest to see by comparing two elections where it went in opposite directions.
Georgia, United States, 2020. After a close result, the state conducted a full hand recount of every paper ballot. Because the chain of custody had preserved an intact paper record — one physical ballot for every vote — the machine count could be checked directly against paper, and it matched to within ordinary human error. Federal election-security officials called the election the most secure in American history and stated there was no evidence any voting system changed votes. This is the deepest reason the claim that voting machines secretly switched votes collapses: the paper existed, custody held, and the two agreed.
Belarus, 2020. The opposite. Authorities did not publish station-level result protocols, and independent observers were effectively shut out — the OSCE's election body was not invited in time to observe. With the chain opaque from top to bottom, the official result handing the incumbent roughly 80% could not be independently verified. Note what the problem was: not a specific proven swap, but the absence of a checkable chain. When custody is hidden, verification becomes impossible — and that opacity is itself the red flag.
How to tell whether the chain held
You do not need to be an official to judge whether a ballot's chain of custody is trustworthy. You ask whether the system is built to be checked:
- Are custody procedures published in advance, before anyone knows who won?
- Are seal numbers logged and reconciled, not just applied?
- Can independent observers from competing sides follow the ballots?
- Is reconciliation data — ballots versus voters — released, so outsiders can re-add it?
- Are ballots retained long enough for recounts, risk-limiting audits, and court challenges to reach them?
Where the answers are yes, a claim of secret, undetectable ballot tampering has to explain how it evaded every one of those layers at once. Where the answers are no, the right response is not to assume fraud — it is to treat the missing chain as the thing that most needs fixing.