You can judge how secure your state’s voter registration system is by reading what the state publishes and requesting what it does not: audit reports, list maintenance procedures, vendor contracts, and access and incident policies.
Documented findings and written procedures count as evidence. Screenshots and viral posts do not.
How can an ordinary citizen tell whether a state’s voter roll is secure?
You can tell by checking four things in writing, how the system is built, how records enter and leave it, who runs the software, and who checks the work.
No public score rates a state’s voter roll, so the assessment comes from documents. Each document answers a narrow question, and the picture builds from there.
Some details will stay hidden, and that is legitimate. States commonly withhold technical specifics such as network layouts, because publishing them would help attackers.
What you can reasonably expect is the existence of written policies, independent review, and a paper trail showing that problems were found and fixed.
Keep your goal modest. You are testing whether the state’s own records support or contradict a specific claim, whether that claim says the system is airtight or says it is riddled with fraud.
What does a voter registration system actually include?
A voter registration system is more than one database.
Federal law under the Help America Vote Act requires each state to maintain a single, computerized, statewide voter list, and around that list sit several connected parts:
- The central database that holds each voter’s record
- An online registration portal and paper application intake
- Connections to other agencies, such as the motor vehicle office, that supply new registrations and address changes
- Accounts for state and local election staff who add, edit and remove records
- Exports that feed the poll books used at polling places and the mailing of ballots
- Data-sharing arrangements with other states to find people registered in two places
Each connection is a place where errors or unauthorized changes can enter, so each one deserves its own question.
It also helps to keep this system separate from voting machines and vote counting. Those are different systems with different audits, and mixing them up is one of the most common ways security claims go wrong.
Which public documents show how a state protects its voter rolls?
Several kinds of public documents describe a state’s protections, and most can be found without filing anything. Start with these:
- State auditor or inspector general reports. These review how an agency manages its systems and often include findings and the agency’s written response.
- The election office’s published procedures. Look for a list maintenance manual, an election security plan, or training materials for county staff.
- Federal survey data. The Election Administration and Voting Survey from the U.S. Election Assistance Commission reports registration and removal figures by jurisdiction, which lets you compare your state’s numbers with its own history and with other states.
- Legislative records. Committee hearings and budget requests often reveal known problems and what the election office asked for in order to fix them.
- Court filings and settlements. Lawsuits over a state’s registration practices put procedures and internal records on the public docket.
- Third-party security assessments. If your state publishes any, even in summary form, read them. If it says assessments exist but publishes nothing, that is worth a records request.
When you find a report, read the findings and the response together. A finding with a dated corrective action is a different story from the same finding repeated in the next report.
How do list maintenance procedures create or reduce risk?
List maintenance procedures create risk in both directions, because removing the wrong records and keeping the wrong records are both failures.
The National Voter Registration Act requires states to make reasonable efforts to keep lists accurate, and it also limits how and when records can be removed.
It further requires states to make records of their list maintenance programs available for public inspection, which is the legal basis for many requests in this area.
Read the written procedure and look for answers to these questions:
- What data sources trigger a removal or a flag, such as death records, change-of-address data, or jury and court records?
- How is a match confirmed? Matches built on partial identifiers can flag two different people as one.
- Who approves a removal, and is the approval logged?
- What notice does the voter receive, and how long before the record is cancelled?
- How are mistakes corrected, and how quickly?
- Does the state track how often its matches turn out to be wrong?
A procedure with clear sources, a human review step, notice to the voter and a log of every change is harder to abuse and easier to audit.
A procedure that is vague, undocumented or run entirely by an automated script is a risk regardless of how good the intentions are.
Beware of arguments built on raw totals. A roll can contain inactive or outdated records for legitimate reasons, since states are required to follow notice periods before cancelling them.
Comparing registration totals with census population estimates also mixes numbers that are counted in different ways. Neither comparison demonstrates fraud without more evidence.
What can vendor contracts and software details tell you?
Vendor contracts tell you who operates the system, what they are obligated to do, and what happens when something goes wrong.
Many states buy or license their registration software from a private company, and others build their own.
Either way, the contract or interagency agreement is usually a public record, and many states post contracts in an online procurement portal.
When you have a contract, check for these terms:
- Where the data is hosted and who holds the data if the contract ends
- Security requirements the vendor must meet, and whether independent testing is required
- Breach notification duties, how fast the vendor must tell the state, and what the state must then disclose
- Rules on subcontractors who might touch the data
- Audit rights, meaning whether the state can inspect the vendor’s practices
- Backup and recovery requirements
- Contract length, renewal terms and amendments, since a system running on repeated extensions may signal a stalled replacement project
You will not learn exploitable technical details from a contract, and you should not expect to. You will learn whether the state wrote security duties into the agreement and kept a right to verify them.
A contract that says nothing about breach notification or testing is a gap you can point to with a page number.
Treat claims about a vendor with the same standard. A statement about who owns a company or where its servers sit should cite a contract, a corporate filing or an audit report.
A claim with no document behind it is a rumor, even if it is repeated often.
Which red flags are worth chasing, and which are noise?
Worth chasing are problems that appear in the state’s own records and can be tied to a specific document.
Noise is anything you cannot trace to one. Run each claim through a short test, can you find the primary document, does it actually say what the claim says, is it current, and does it concern the voter roll rather than voting machines or vote counting?
Worth chasing:
- An audit finding that recurs in successive reports without a documented fix
- No written procedure for removals, or a procedure the office cannot produce on request
- No log of who changed which record
- A vendor contract with no breach notification or testing requirement
- An incident the state acknowledged in one place but left out of another
- Sudden unexplained jumps in removals or new registrations in official data, especially without a stated cause
Usually noise:
- A single screenshot of an error in one voter’s lookup result
- Large totals of inactive records presented without the state’s notice rules
- Viral posts about leaked or “exposed” voter data that cite no official confirmation or document
- Claims about a vendor that cite no contract, filing or report
- Comparisons between states that ignore different laws on registration and list cleaning
One single record error is a reason to ask how errors get fixed. It is not evidence that the whole system is compromised, and a thorough reader says so.
How do you file a records request or raise a concern with your election office?
Send a written request to the custodian of the records, which is usually the secretary of state or state board of elections for statewide systems and the county election office for local procedures.
Cite your state’s public records law by name, and for list maintenance records, cite Section 8(i) of the National Voter Registration Act as well.
Public records laws differ by state in deadlines, fees and exemptions, so check yours before you send. A strong request is specific.
Name the document type, the date range and the format you want:
- The current written procedures for voter list maintenance, including any manual given to county staff
- Records of list maintenance programs for a stated period, such as the number of removals by reason
- The contract and amendments for the voter registration system, along with any security assessment summaries
- Audit reports on the system and the agency’s written responses
Expect redactions. Offices commonly withhold personal voter data and technical security details, and a good response names the exemption it relied on.
If the answer is a refusal, ask for the legal basis in writing. If the cost estimate is high, narrow the request rather than abandoning it.
To raise a concern, write to the election office with the document and page you are relying on, state what you think it shows, and ask for a written response. Keep copies of everything.
If the office does not answer, the state auditor, your legislators and the relevant committee are the next places to take a documented question. The guide on how to audit local government without a law degree or a press badge walks through the same request-and-follow-up routine for other agencies.
Where does checking your own registration fit in?
Checking your own registration confirms that your record is correct, and it is the one test that takes a few minutes.
It tells you about your name, address and status. It does not tell you how the system behaves overall, since one correct record says nothing about how removals or vendor oversight work.
Use it alongside the document review. If your record is wrong, that is a concrete case to cite when you ask the election office how errors are corrected.
The guide on how to check voter registration safely and avoid third-party traps explains how to reach your state’s official lookup without handing your information to a lookalike site.
Visit the Resources page for the civic research tools that help you pull public records and audit reports yourself.
Then leave a comment below sharing what you found or what you plan to check in your own state.