What breaks when election jurisdictions rely on fax machines or email attachments for ballot transmission?

Fax and email-based transmission introduce weak controls, poor traceability, and a higher chance of misdelivery or manipulation. They also make it harder to prove that ballots moved through a secure and consistent process. In practice, those methods create operational fragility and leave officials with less confidence in the integrity of the electronic ballot return path.

Why fax and email attachments break the ballot return chain

Fax and email attachments break more than convenience, they break the security properties that election officials need from a ballot transmission channel. A ballot return path should support authenticity, integrity, traceability, and consistent handling. Once a process depends on a fax queue or an emailed file, those properties weaken because the channel is lossy, hard to verify end to end, and easy to misroute.

That creates a practical control problem: officials can no longer rely on the transmission method itself to prove who sent the ballot, whether the content stayed intact, or whether it arrived in the right workflow state. The issue is not just that the medium is old, it is that the medium was never designed to give strong evidence of secure delivery or tamper resistance.

Ballot transmission also becomes operationally brittle. Fax failures, attachment filtering, file corruption, duplicate submissions, and mailbox forwarding rules all introduce ambiguity that must be resolved manually. In an election setting, ambiguity is a security issue because it slows verification, increases exception handling, and makes it harder to demonstrate that every ballot followed the same process.

What weak controls and poor traceability look like in practice

Fax and email are especially weak when the receiving side needs to answer basic assurance questions: Was the ballot received once, in full, by the intended office, and preserved without alteration? Those questions are easy to ask and hard to prove with legacy transmission methods. Logs may show a send attempt, but they rarely provide durable, independent evidence of message integrity or controlled handoff.

Attachments add another layer of failure. A file can be detached from context, renamed, forwarded, or stored outside the intended queue. Even when the message is legitimate, the attachment path can bypass consistent review steps, version control, or identity-bound workflow checks. That makes the process harder to audit and easier to dispute.

For elections, this matters because confidence is part of the control objective. A system that cannot consistently show where a ballot came from, how it was handled, and whether it stayed unchanged is operationally fragile even if no one can prove active tampering. For background on the broader identity and secrets exposure problem that often accompanies weak transmission workflows, see Ultimate Guide to NHIs, What are Non-Human Identities.

Risk and Threat Considerations

Weak transmission methods create a real exposure window for misdelivery, spoofing, unauthorized forwarding, and post-send manipulation. Even when the ballot itself is not directly altered, the process can lose evidentiary value, which is enough to create dispute risk and undermine confidence in the return path.

Failure mechanism: Fax and email depend on intermediary systems that can queue, resend, redirect, filter, or transform content without giving election officials strong assurance of end-to-end integrity and receipt. That makes the workflow vulnerable to both accidental loss and adversarial abuse of trust boundaries.

Impact: The jurisdiction may face difficult adjudication decisions, higher manual review load, inconsistent treatment of ballots, and weaker defensibility if the process is challenged. In practical terms, the less provable the chain of custody, the more the jurisdiction must compensate with exception handling and retrospective evidence gathering.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, CIS Controls v8 and NIST SP 800-63 set the technical controls, while ISO/IEC 42001:2023 define the regulatory obligations.

Framework	Control / Reference	Relevance
NIST CSF 2.0	PR.AC-1 — Identity Management, Authentication and Access Control	Ballot return needs controlled, attributable access to the receiving workflow.
	PR.DS-1 — Data-at-Rest Protection	Ballot files and transmitted content need integrity and confidentiality safeguards after receipt.
	DE.CM-1 — Security Continuous Monitoring	Transmission failures and suspicious rerouting must be observable in the ballot intake path.
Recommendation — Enforce authenticated access to ballot intake systems and restrict who can submit or handle returns. Protect received ballot records with integrity controls and controlled storage. Monitor ballot transmission workflows for anomalies, missing receipts and delivery failures.
CIS Controls v8	8 — Audit Log Management	Traceability problems in fax and email workflows require durable logging and review.
	16 — Application Software Security	Electronic ballot handling depends on controlled intake systems that resist tampering and misuse.
Recommendation — Centralise and review logs for ballot receipt, forwarding and exception handling. Harden ballot intake applications to preserve content integrity and workflow state.
NIST SP 800-63	3.1 — Digital Identity Guidelines: Proofing and Authentication	Election intake must establish trustworthy sender and handler identity where electronic submission is used.
Recommendation — Require stronger authentication and proofing for any electronic ballot return channel.
ISO/IEC 42001:2023	4.2 — Understanding the needs and expectations of interested parties	Election operators must align channel design with the assurance needs of voters and officials.
Recommendation — Set explicit assurance requirements for any AI or automated election support workflow.

Practitioner Guidance

What to verify: Treat the return channel as a control, not just a transport. Verify whether the process produces durable receipt evidence, preserves content integrity, and prevents uncontrolled forwarding or reformatting. If it cannot answer those questions cleanly, the workflow is too fragile for high-confidence ballot handling.

Decision rule: If the channel cannot show who sent the ballot, where it was received, and whether the content was preserved in a controlled state, do not treat it as equivalent to a secure submission path. The burden shifts to the jurisdiction to add compensating controls, and those controls often become harder to operate than the original process.

Practitioner takeaway: The core problem is not the technology label, it is the loss of verifiable custody and integrity. A ballot return process should be rejected whenever the transmission method makes proof of secure handling depend on assumptions instead of evidence.