Riverbend mayor, one machine's readings altered: evidence account
In plain words
The count under plurality elected Ames.
A comparison audit then compared sampled paper ballots to their machine records at a 10% risk limit.
The sample supports the outcome.
No sampled paper ballot disagreed with its machine record.
The hand reads came from the file, not from a sealed box.
3 devices were checked against the published software fingerprint; reader-3 did not match, so its readings are not relied on and its precinct is counted from the paper held for it.
The re-reading of precinct-3 elects Bell. That reading is the outcome that stands, in place of the reported winner Ames.
The reported outcome it replaces rested on reader-3, a machine whose software failed the check.
No container custody was supplied.
Outcome status: preliminary. Software tallies stay preliminary until an audit on the record confirms them or a full hand count of the record replaces them.
How the sample was chosen
This seed names no sealed machine records and no published box list. This account does not show the sample was chosen before anyone could see the ballots.
The contest
Title: Riverbend mayor, one machine's readings altered
Candidates: Ames, Bell, Cruz.
Records in this count: 60.
Ballot file: comparison-altered-machine
Source: Synthetic committed CVRs. No real election was counted.
Sixty ballots, twenty to a precinct, one reading machine to a precinct. The papers hold Ames 22, Bell 28, Cruz 10. reader-3 recorded ten of its Bell papers as Ames, so the machine readings report Ames 32, Bell 18, Cruz 10. Each row is one physical ballot; `paper` is present only where the paper differs from the machine reading. This is a fixture, not a sealed container.
Where the records sat:
| Batch | Ballots |
|---|---|
| precinct-1 | 20 |
| precinct-2 | 20 |
| precinct-3 | 20 |
No container custody was supplied.
What was configured
Configuration version: comparison-failed-software-check-plurality-v1.
Configuration fingerprint (SHA-256): e2f10fd4d7abca9e73d10a99f4651002aff4716c13af7d3879140a760d0eaed7.
Counting rule: plurality.
Ballot rules used: Two or more marks at one rank end the ballot there; 2 ranks in a row left blank end the ballot; a candidate marked again lower down counts as a rank left blank.
Ballot file: comparison-altered-machine. A third party with this file can rerun the count.
Audit: ballot-level comparison risk-limiting audit. Public seed: finds-nothing-61. Risk limit 10% (used in the audit math).
Plain-language configuration (check against statute intent):
Configuration version: comparison-failed-software-check-plurality-v1
Fingerprint (SHA-256): e2f10fd4d7abca9e73d10a99f4651002aff4716c13af7d3879140a760d0eaed7
Election: Riverbend mayor, one machine failed its software check
Voting opens: 2026-10-23T08:00:00.000Z.
Voting closes: 2026-10-23T14:00:00.000Z.
A demonstration configuration over synthetic committed CVRs. No real election was counted under it.
The machine readings report Ames. The simulated papers elect Bell. One machine, reader-3, failed its software check.
The software record, the box list, and the device checks are a published sample record. No one observed a real device or physical custody of any box.
Contests and candidates:
Riverbend mayor, one machine failed its software check (mayor): Ames; Bell; Cruz.
Counting rule: plurality (most first choices).
Tiebreak: not used under this counting rule.
Ballot rules (how marks become a ranking):
Two or more marks at one rank: the ballot counts up to that rank and no further.
A candidate marked again lower down: that rank counts as a rank left blank.
2 ranks in a row left blank: the ballot counts up to there and no further.
A mark for anyone not on the ballot: a mark, so the rank is not blank, but never a vote.
Audit risk limit: 10%. A risk-limiting audit that runs under this configuration stops when the sample confirms the outcome at that limit, or sends the contest to a full hand count.
How a ballot is counted and how an audit stops are fixed by this version. Changing any of the lines above requires a new version id.
Device software checks
Published software fingerprint (SHA-256): 999bb56bcce27510e8493336666bc85313f7afe5b653ad1049d044635f111116.
Marker software: 5b6999af59b3dc8d55dc2679aa3c481427bff8fba37edda392112f412967c45e.
Reader software: d37fc8aae9680b6243bfe0a1ff3b6f8a7a62d1528de9d914831f2f6b89debf7d.
| Device | Program | Fingerprint read | Result | When read |
|---|---|---|---|---|
| reader-1 | reader | d37fc8aae9680b6243bfe0a1ff3b6f8a7a62d1528de9d914831f2f6b89debf7d | matches | 2026-10-23T07:59:00.000Z (before voting opened) |
| reader-1 | reader | d37fc8aae9680b6243bfe0a1ff3b6f8a7a62d1528de9d914831f2f6b89debf7d | matches | 2026-10-23T14:02:00.000Z (after voting closed) |
| reader-2 | reader | d37fc8aae9680b6243bfe0a1ff3b6f8a7a62d1528de9d914831f2f6b89debf7d | matches | 2026-10-23T14:09:00.000Z (after voting closed) |
| reader-3 | reader | 9563610fa8ba4589ed85a3cfabd3e12f636578770da148e20d6bc1963d83037d | does not match | 2026-10-23T14:17:00.000Z (after voting closed) |
reader-3 did not match: the software read from it is not the published software, so its readings are not relied on and its precinct is counted from the paper held for it.
A device whose recorded software checks all match is relied on as far as this check reaches. It compares source files, not the runtime, operating system or firmware under them, and nothing here shows that anyone but the publisher rebuilt the software from its source. This check sends no precinct to the paper on account of a device whose checks all match.
This account records the fingerprint the observer read from each device. It does not show how she read it; a device's own report of its software cannot be relied on.
The count
What follows is the counting account under plurality, including every intermediate step.
What was counted
Ballots in this count: 60.
Ballots from: Synthetic committed CVRs. No real election was counted.
Sixty ballots, twenty to a precinct, one reading machine to a precinct. The papers hold Ames 22, Bell 28, Cruz 10. reader-3 recorded ten of its Bell papers as Ames, so the machine readings report Ames 32, Bell 18, Cruz 10. Each row is one physical ballot; `paper` is present only where the paper differs from the machine reading. This is a fixture, not a sealed container.
How the marks on a ballot were read:
Two or more marks at one rank: the ballot counts up to that rank and no further.
A candidate marked again lower down: that rank counts as a rank left blank.
2 ranks in a row left blank: the ballot counts up to there and no further.
A mark for anyone not on the ballot: a mark, so the rank is not blank, but never a vote.
The rankings the ballots form, and how many ballots form each. A candidate a ranking does not name is ranked last on those ballots.
| Ranking | Ballots |
|---|---|
| Ames | 32 |
| Bell | 18 |
| Cruz | 10 |
The count
Each ballot counts once, for the candidate it marks first.
| Candidate | First choices | Share |
|---|---|---|
| Ames | 32 | 53.33% |
| Bell | 18 | 30.00% |
| Cruz | 10 | 16.67% |
Ballots counting for a candidate: 60.
Ballots marking no candidate: 0.
Ballots stopped by two or more marks at their first rank: 0.
Ames is elected with 32 first choices, more than any other candidate.
Records with no mark, by contest and by machine
At the close of polls, the share of records with no mark in each contest, by contest and by machine. Leaving a contest blank is a voter's right; an outlier below is a question about the ballot or the machine, not a verdict.
| Contest | Records | With no mark | Share |
|---|---|---|---|
| mayor | 60 | 0 | 0.00% |
| Contest | Machine | Records | With no mark | Share |
|---|---|---|---|---|
| mayor | reader-1 | 20 | 0 | 0.00% |
| mayor | reader-2 | 20 | 0 | 0.00% |
| mayor | reader-3 | 20 | 0 | 0.00% |
The audit
This is the ballot-level comparison test in Lindeman and Stark, A Gentle Introduction to Risk-limiting Audits (2012), section III.B. Risk limit 10%. It is the Kaplan-Markov product (Stark 2010, super-simple comparison) for a plurality, winner versus runner-up. A majority is not required.
A risk-limiting audit does not prove the outcome is right. It has a large chance of forcing a full hand count when the outcome is wrong. If the outcome is right, this test cannot change it.
Reported winner: Ames with 32 first choices. Runner-up: Bell with 18.
Ballots N (every CVR, including undervotes and invalids): 60. Diluted margin m = (32 - 18) / 60 = 23.33%. Max overstatement per ballot u = 2. Inflator gamma = 1.03905. U = 2 gamma / m = 8.9061.
Each draw multiplies the P-value bound by (1 - 1/U) / (1 - o / (2 gamma)). Stop and confirm when the bound is at most 0.1. Stop and count every ballot by hand when the remaining ballots cannot confirm, or when the draw cap is hit without confirming.
Public seed: finds-nothing-61
Commitment fingerprint (SHA-256): a35e7c5f592e8ed90652412d522f92bcacee0a761c8a033610df17a60ae834ad
Committed at: 2026-09-08T00:00:00.000Z
A sealed collection was loaded and its fingerprint verified, but commitment was not required for this run.
This account does not claim the CVRs were sealed before the seed.
Ballot 1 is the first CVR. Sampling is with replacement, SHA-256 of "seed,draw,attempt" mapped onto 1 through N.
The hand read of each drawn ballot is simulated from the per-ballot paper ranking on the fixture (the CVR ranking, when paper is omitted). That is a fixture, not a sealed container. A live audit replaces each simulation with a person reading the paper at that place.
Ballot manifest:
| Batch | Ballots |
|---|---|
| precinct-1 | 20 |
| precinct-2 | 20 |
| precinct-3 | 20 |
No container custody was supplied.
Draws:
| Draw | Index | PaperId | Machine | Batch | Place | CVR | Paper | o | Factor | P-value |
|---|---|---|---|---|---|---|---|---|---|---|
| 1 | 7 | paper-7 | reader-1 | precinct-1 | 7 | Ames | Ames | 0 | 0.8877 | 0.8877 |
| 2 | 58 | paper-58 | reader-3 | precinct-3 | 18 | Cruz | Cruz | 0 | 0.8877 | 0.7880 |
| 3 | 42 | paper-42 | reader-3 | precinct-3 | 2 | Ames | Ames | 0 | 0.8877 | 0.6996 |
| 4 | 20 | paper-20 | reader-1 | precinct-1 | 20 | Cruz | Cruz | 0 | 0.8877 | 0.6210 |
| 5 | 29 | paper-29 | reader-2 | precinct-2 | 9 | Bell | Bell | 0 | 0.8877 | 0.5513 |
| 6 | 13 | paper-13 | reader-1 | precinct-1 | 13 | Bell | Bell | 0 | 0.8877 | 0.4894 |
| 7 | 5 | paper-5 | reader-1 | precinct-1 | 5 | Ames | Ames | 0 | 0.8877 | 0.4344 |
| 8 | 2 | paper-2 | reader-1 | precinct-1 | 2 | Ames | Ames | 0 | 0.8877 | 0.3857 |
| 9 | 57 | paper-57 | reader-3 | precinct-3 | 17 | Cruz | Cruz | 0 | 0.8877 | 0.3424 |
| 10 | 1 | paper-1 | reader-1 | precinct-1 | 1 | Ames | Ames | 0 | 0.8877 | 0.3039 |
| 11 | 6 | paper-6 | reader-1 | precinct-1 | 6 | Ames | Ames | 0 | 0.8877 | 0.2698 |
| 12 | 27 | paper-27 | reader-2 | precinct-2 | 7 | Ames | Ames | 0 | 0.8877 | 0.2395 |
| 13 | 60 | paper-60 | reader-3 | precinct-3 | 20 | Cruz | Cruz | 0 | 0.8877 | 0.2126 |
| 14 | 3 | paper-3 | reader-1 | precinct-1 | 3 | Ames | Ames | 0 | 0.8877 | 0.1887 |
| 15 | 59 | paper-59 | reader-3 | precinct-3 | 19 | Cruz | Cruz | 0 | 0.8877 | 0.1675 |
| 16 | 33 | paper-33 | reader-2 | precinct-2 | 13 | Bell | Bell | 0 | 0.8877 | 0.1487 |
| 17 | 22 | paper-22 | reader-2 | precinct-2 | 2 | Ames | Ames | 0 | 0.8877 | 0.1320 |
| 18 | 58 | paper-58 | reader-3 | precinct-3 | 18 | Cruz | Cruz | 0 | 0.8877 | 0.1172 |
| 19 | 42 | paper-42 | reader-3 | precinct-3 | 2 | Ames | Ames | 0 | 0.8877 | 0.1040 |
| 20 | 19 | paper-19 | reader-1 | precinct-1 | 19 | Cruz | Cruz | 0 | 0.8877 | 0.0924 |
Draws examined: 20. Final P-value bound: 0.0924.
The P-value bound is at most 0.1, so the sample reached the audit threshold, but confirmation is blocked because reader-3 failed the software check, so the reading from the paper, not the sample, decides its precinct. Outcome status: preliminary. Software tallies stay preliminary until an audit on the record confirms them or a full hand count of the record replaces them.
Re-reading precinct-3
A device failed the software check, so its precinct is read from the paper held for it, whatever the sample found.
reader-3 failed the software check: the reader software fingerprint read from it does not match the published one, so its readings are not relied on.
The record read here is the paper held for each of the 20 ballots in precinct-3, counted together with the machine readings from the other precincts.
Ballots read: 20.
The reading counts them under plurality, the rule this contest was counted under. What follows is that reading, step by step, so a reader holding the published ballots can rework it.
Each paper is read from the record file, as the sampled papers were. That is a fixture, not a sealed container. A live hand count replaces every one of these readings with a person reading the paper.
Re-reading precinct-3: what was counted
Ballots in this count: 60.
How the marks on a ballot were read:
Two or more marks at one rank: the ballot counts up to that rank and no further.
A candidate marked again lower down: that rank counts as a rank left blank.
2 ranks in a row left blank: the ballot counts up to there and no further.
A mark for anyone not on the ballot: a mark, so the rank is not blank, but never a vote.
The rankings the ballots form, and how many ballots form each. A candidate a ranking does not name is ranked last on those ballots.
| Ranking | Ballots |
|---|---|
| Bell | 28 |
| Ames | 22 |
| Cruz | 10 |
Re-reading precinct-3: the count
Each ballot counts once, for the candidate it marks first.
| Candidate | First choices | Share |
|---|---|---|
| Bell | 28 | 46.67% |
| Ames | 22 | 36.67% |
| Cruz | 10 | 16.67% |
Ballots counting for a candidate: 60.
Ballots marking no candidate: 0.
Ballots stopped by two or more marks at their first rank: 0.
Bell is elected with 28 first choices, more than any other candidate.
The outcome the record supports
The re-reading of precinct-3 elects Bell. That reading is the outcome that stands, in place of the reported winner Ames. Outcome status: preliminary. Software tallies stay preliminary until an audit on the record confirms them or a full hand count of the record replaces them.
The reported outcome it replaces rested on reader-3, a machine whose software failed the check.
What was found
Decision: confirmed.
There were no CVR/paper disagreements in the sample.
The machines that read the sampled ballots:
| Machine | Where its sampled ballots sat | Ballots drawn | Disagreed |
|---|---|---|---|
| reader-1 | precinct-1 | 9 | 0 |
| reader-2 | precinct-2 | 4 | 0 |
| reader-3 | precinct-3 | 5 | 0 |
Every machine in this sample agreed with the paper held for each of its sampled ballots: reader-1, reader-2 and reader-3.
Custody: none supplied. No container custody chain was recorded or verified.
Why it stopped
Decision: preliminary (confirmation does not cover a device that failed the software check).
The sample reached the audit stopping threshold on the machine readings, which include those of a device that failed the software check. The reading from the paper, not the sample, decides the outcome.
Outcome status: preliminary. Software tallies stay preliminary until an audit on the record confirms them or a full hand count of the record replaces them.