A ballot marking device is a voting system device that helps a voter mark a paper ballot, usually by presenting selections on a screen and printing the marked ballot. It records choices onto paper for later scanning or counting, and may include accessibility features such as audio or sip-and-puff input.
What a ballot marking device does
A ballot marking device is a computer-assisted voting device that helps a voter produce a paper ballot with their selections recorded on it. The security significance is not the ballot marking step alone, but the fact that the device sits at the point where voter intent becomes the paper record used for scanning and tabulation.
That makes the device part of the election system's trust chain. It must present choices accurately, preserve ballot secrecy, and avoid introducing errors, tampering opportunities, or usability barriers that could affect how a voter marks the ballot.
How ballot marking devices fit into election workflows
Most deployments use the device as a front-end interface rather than the final count mechanism. The voter makes selections on the screen, the device prints a marked paper ballot, and that paper is later scanned or otherwise counted under election procedures. This design can improve accessibility while still preserving a physical record for audit and recount purposes.
The important operational point is that the printed ballot becomes the authoritative artefact, not the transient on-screen state. That means election administrators need clear procedures for setup, ballot configuration, chain of custody, and post-election reconciliation between what the device displayed and what was printed.
Security properties that matter most
Because ballot marking devices translate voter choices into the durable paper record, integrity and correctness are the core security properties. A display defect, software fault, malicious configuration change, or printer issue can alter the paper ballot or confuse the voter about what was actually recorded.
Accessibility features are also security-relevant because they affect whether every eligible voter can independently and privately cast a ballot. Features such as audio output or alternative input methods must be designed so they do not expose selections to bystanders or create hidden failure modes during ballot marking.
Physical security matters as well. These devices are often deployed in polling locations with limited time for inspection, so tampering, unauthorized media insertion, maintenance access, or insecure storage can become practical risks if controls are weak.
Verification, auditing, and public trust
Ballot marking devices are usually judged by what can be verified after the fact. Election teams look for paper consistency, ballot configuration accuracy, system logs where available, and evidence that the device behaved as intended during the voting period. The paper ballot enables recounts and risk-limiting audits, but only if the election process treats that paper as the record of record.
Public confidence depends on transparency around certification, testing, poll worker procedures, and post-election review. Voters do not need to understand the internal software to trust the device, but they do need assurance that the printed ballot reflects their intent and that irregularities can be detected and investigated.
Risk and Threat Considerations
Ballot marking devices create a concentrated integrity risk because a single software or configuration failure can affect many ballots before anyone notices. The main concern is not only deliberate tampering, but also misconfiguration, printer errors, accessibility workflow mistakes, and voter confusion that can lead to silent mismarking.
Failure mechanism: A device can misrender selections, print an incorrect ballot, expose selections during assisted use, or produce output that later diverges from voter intent, which makes reconciliation and auditing harder.
Impact: Even when the downstream tabulation system is separate, compromised or unreliable ballot marking can undermine election integrity, erode voter confidence, and trigger disputes that are difficult to resolve after ballots are cast.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Secures administrator access to voting equipment and election-support systems. |
| AU-2 — Audit Events | Supports logging of device configuration, maintenance, and ballot-processing events. | |
| CM-3 — Configuration Change Control | Controls ballot definition and software changes that affect printed ballot integrity. | |
| Recommendation — Enforce strong authentication for staff and administrators who configure or maintain ballot marking devices. Log material ballot device events so election officials can review changes and anomalies. Require formal approval and testing before changing ballot device software or definitions. | ||
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | Applies hardening and baseline control to deployed voting devices and supporting systems. |
| Recommendation — Harden ballot marking devices and lock them to approved configurations before election use. | ||
| NIST CSF 2.0 | PR.DS-01 — Data-at-rest is protected | Protects ballot definitions and stored election data from unauthorized alteration. |
| Recommendation — Protect stored ballot data and related election records from unauthorized modification. | ||
Practitioner Guidance
Why practitioners should care: Election officials should treat the printed ballot and the configuration that produced it as the critical control point. The practical question is whether voters can verify the paper record independently and whether staff can detect device, printer, or setup problems before they affect voting.
What to watch for: Pay attention to ballot definition changes, inaccessible or inconsistent ballot previews, printer alignment problems, unexplained rebooting, and any gap between what voters see and what appears on the paper ballot. Those are the conditions most likely to create invisible integrity failures.
Practitioner takeaway: The safest ballot marking device is one whose output can be checked by the voter, validated by the election process, and audited against the paper record after polling closes.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org