On Election Day this November, about 1 in 4 Americans will vote using a device that never lets the voter see a copy of his or her vote on paper.
The idea of relying on such machines has troubled some security experts for years. And this year the stakes may be even higher, because one candidate is charging that the election is rigged, and government officials have warned that state election systems have been targeted by foreign hackers with ties to Russia.
Five states exclusively use voting machines that lack the kind of independent paper trail needed to do a convincing recount, according to a nonprofit, nonpartisan group called Verified Voting. Those states are New Jersey, Delaware, Georgia, Louisiana and South Carolina.
"And then there are another nine states that have paperless voting machines in some jurisdictions," says Pamela Smith, president of Verified Voting.
In Pennsylvania, considered a battleground state, those machines are used in a majority of counties.
"On a scale of all of the states, I would say that Pennsylvania would be my biggest concern," says Smith.
Pennsylvania also worries Avi Rubin, a computer security expert at Johns Hopkins University. "What do we do if, at the end of the election, it comes down to Pennsylvania and there's a challenge saying, you know, these machines were corrupted?" Rubin asks. "We can't do recounts. We don't have paper ballots. We just have to live with those machines."
But Gerald Feaser, director of elections and voter registration for Pennsylvania's Dauphin County, thinks the paperless machines have a lot of advantages and are a dependable, time-tested technology. His county started using the Danaher 1242 paperless voting machine back in 1985, he points out.
"When I first turned 18 and started voting myself, this was the first machine I ever voted on," says Feaser. "This is the only voting machine I've ever known."
He points to the plug in the electric outlet and says this is the only connection this machine has with the outside world. And while a hacker could try to sneak into a warehouse or polling place to tamper with the hardware, Feaser says his county's nearly 500 machines get thoroughly checked out and then get numbered security seals before they are delivered to polling places.
"I could take this voting machine, drop it off in the middle of Red Square in Moscow, and the Russians couldn't hack into it," says Feaser.
At the end of election night, the machine spits out a long paper receipt showing the total votes recorded for each candidate. But that kind of paper trail is not the kind of paper backup you really need, say experts in voting security. Without a hard copy of the individual ballot that each voter checked, they maintain, it's not possible to do a legitimate recount.
"They don't have a separate record that the voter got a chance to see and confirm was correct at the time that they voted," says Smith, who notes that this type of machine gives you "nothing independent of the software in the machine."
Computer security specialists note that many jurisdictions use equipment provided by a small number of vendors.
"So an attack that works against one county will work against many counties," says Dan Wallach, a computer scientist at Rice University who studies voting machine security.
Plus, other nations are surely aware of how the Electoral College system works and could target battleground states in clever ways, says Wallach, adding that he finds it disquieting when election officials simply dismiss concerns.
"Because that suggests some people don't understand what it means to be facing a nation-state adversary," he says. "It's important to take the threat seriously."
Federal officials have warned that this year foreign hackers have targeted the voter registration systems in multiple states. And the Department of Homeland Security recently offered to help states review their election systems for vulnerability.
"We in Pennsylvania thought that that was a good idea — to take advantage of those services," says Marian Schneider, Pennsylvania's deputy secretary for elections and administration
She says she has confidence in local officials' commitment to a fair and smooth election.
"I think the rhetoric about cheating and rigging is very irresponsible," says Schneider.
When asked if, in the event of a challenge, Pennsylvania would be able to do a convincing recount or audit, she replies that "the systems will be examined at that point. At this point it's really speculation."
After all, state law doesn't trigger a recount unless the difference between candidates is very, very small — just one half of 1 percent of the total votes cast.
State officials in Pennsylvania certify voting systems that counties purchase and use, Schneider says.
"We're committed to making sure that voting systems are secure, accurate and verifiable going forward," she says.
But it is expensive to run elections. If the legacy voting systems are going to be replaced with something different, Schneider notes, "there needs to be a significant infusion of cash."