But what if you could vote however you wanted to vote? Which could mean at home or, if you’re a person with a disability, with the assistance of specialized hardware? What if you could go online later and ensure your vote was your vote, and that it counted? What if you could write your own piece of software to do a recount of, or audit, your small town’s mayoral election instantly?

That’s the vision of ElectionGuard, a new project by Microsoft, which debuted this summer at the Aspen Security Forum. ElectionGuard is an open code standard, that anyone can audit, freely use, and plug into, to create secure digital voting machines that remove many of the barriers of voting. Microsoft teamed up with Tucker Viemeister, a renowned industrial designer who spent years at prestigious firms including Frog, Smart Design, and Rockwell Group designing devices like hair dryers and coffee makers, to build something of a concept car for the future of voting—mostly out of off-the-shelf parts.

ElectionGuard is less a response to conspiracies about voter fraud, and more about trying to make voting in the United States more modern and equitable. In this sense, it fits into Microsoft’s broader strategy to push inclusive, universal design that accommodates the needs of many different types of users. “This is our Hello World app,” says RC Carter, director of strategic projects at Microsoft who led the project. “We took it upon ourselves to do it seriously, and build a system . . . as if we were a voting system company.”

Rethinking secure ballots

To rethink voting, you need to rethink the ballot as a secure, auditable technology. Today, tallied votes literally live in the hands of election officials, in machines or on paper. Tomorrow, however, Microsoft imagines a sort of digital paper trail that anyone could access.

This new type of voting system is only possible because a cryptology researcher inside Microsoft built a totally new security standard. That standard allows everyone’s votes to be encrypted, so that their privacy stays, well, private. But votes can still be tallied without being decrypted (and therefore susceptible to tampering or prying eyes). The code for this system would live on Github. And much like you can create apps for the iPhone by plugging into its software development kit (SDK), anyone can create apps to plug into ElectionGuard, to tally results. That means the whole idea of private recounts of paper ballots would be a thing of the past. The data could be public, and analyzed, instantly.

“Think of it as a parallel election that’s releasable to the public, and retrievable by the public, in an encrypted format that protects the secrecy of the voter,” Carter says. Existing voting machine companies would theoretically be able to plug into ElectionGuard to run it in parallel with their own machines and processes, like a digital backup.

And if voters wanted to get more granular with the data, and actually see that their vote was cast correctly, they can. Each voter would receive a private key at the time of voting, sort of like a case number you get when you call any customer service. After an election is over, you go online, enter the number, and check your vote.

Crucially, ElectionGuard’s actual voting application doesn’t require Windows, or even an active internet connection at polling places. It can run right in a Chrome browser (a standard which was recently supported by Microsoft). Its data can be uploaded to a private and local, or national, server once voting is done. For a digital product, ElectionGuard is designed to operate largely in a safe, or a black box.

Building a better voting machine

So what would the experience of voting with ElectionGuard actually be like? It starts with a sleek voting machine. Viemeister designed a machine with a smooth white case that protects the electronics inside from easy tampering. “The way we designed this was, you flip the thing on its back, then you can take the bottom off, then all the components are accessible from that,” says Viemeister. It’s not tamper-proof, but it’s reasonably secure. “We figured someone unscrewing six screws is going to ring some bells with the election official.”

Within the case, there’s an Xbox Adaptive Controller and a Surface tablet. They’re both Microsoft products, but they don’t have to be. “We need to do that in order to get this prototype done as fast as we could,” says Viemeister. “But it plays into the fact that any election district could cobble together their own hardware to build the thing.”

However, the Adaptive Controller, an Xbox product that debuted last year to make gaming more accessible to people with different disabilities, makes a good fit for a voting machine. The controller has two giant physical buttons you can use instead of the Surface touchscreen, and a D-pad for moving up, down, left, and right. These giant buttons require very little dexterity for someone with limited mobility to operate. And given that a poorly calibrated touchscreen can record incorrect votes—and has in the recent past—physical buttons make a lot of sense in voting machines. “The whole idea of universal design is it’s just good for everybody,” Viemeister says. “I think people are going to look at those big buttons there and think, ‘This is what I need to vote,’ instead of people with disabilities being like, ‘Great, I can use this to vote.”

But the design is still mindful of the needs of people with disabilities. As Carter points out, many people with disabilities today are forced to ask for special, accessible machines to vote, which takes up a big chunk of their time when they want to get in and out of a polling place like anyone else. An added bonus of the Adaptive Controller is that it has extra ports for voters to bring their own specialized hardware like the sip and puff mouth controllers often used by paraplegic people. These open ports don’t pose a security concern, Carter says. They aren’t USB plugs that connect to a central computer and allow access to the memory or hard drive. These are ports that only connect to the controller. So the only thing you can take control of with a plug-in device is the controller itself.

Vote at home (sort of)

The machine also includes a QR code scanner, like what airlines use to scan your phone when you’re boarding a plane. With a QR code system, you could actually fill out your ballot at home, taking as much time as you like. Then you could generate a QR code that contains all your ballot’s data. When you get to your polling place, you scan it, the votes appear on the screen, and all you need to do is double check them. For jurisdictions that legally require paper ballots, Viemeister designed a printer cover—literally a case that goes over the printer found at polling places—to allow people to print out their ballot, while protecting the printer from tampering.

Imperfect UX

ElectionGuard might still seem a bit clunky in a world where we can do almost anything from our couch with our smartphones. But voting is simply too steeped in different bureaucracies, and the security risks are too numerous, for there to be one do-it-all app that gets the job done overnight. Any new voting solution needs to be multifaceted, offering various ways to satisfy every municipality and preferred voting style. “We try to balance all the concerns,” says Carter. “There’s a phrase our team uses, ‘maximum agreement.’ How do you find maximum agreement?”

ElectionGuard is going into limited pilot trials at unannounced polls next year. Polling places are already gearing up for the 2020 election, so don’t expect to see ElectionGuard all over the place by then. But Microsoft is hoping its open source system can start better serving voters—and American democracy itself—by 2021.