Some consequences of paper fingerprinting for elections

Recent research has demonstrated that individual pieces of paper can be fingerprinted and reidentified later at low cost, using commodity scanners. We consider the consequences of this fact for electronic voting. The most obvious consequence is negative: the ability to fingerprint paper endangers the secrecy of ballots in any system that keeps paper records of individual ballots, including standard optical scan and DRE-VVPAT systems. We characterize the resulting risks and discuss when and how they can be mitigated. Less obviously, the ability to fingerprint paper can also have positive consequences, by enabling certain new kinds of post-election audit procedures, both to compare electronic records to the corresponding paper records and to detect the use of forged ballot stock. Paper reidentification presents new challenges for election officials, but careful consideration of its implications now may allow us to preserve ballot secrecy and strengthen election integrity.