That's an interesting point. We could require voting software and hardware be open-source, but I guess there's still opportunity for it to be tampered with dur

That's an interesting point. We could require voting software and hardware be open-source, but I guess there's still opportunity for it to be tampered with during its deployment an operation. Hardware and software are complicated, so it's not as easy for the average worker at the polling location to verify. We could have a solution where the hardware and software are developed independently and both include logic to independently verify the other's authenticity... but that's still open to attack vectors (however difficult they may be). All that said, the urn system you described does not reflect any experience I've had. I've always been asked to fill out a single paper form with choices for multiple offices and submit the form to either a ballot box or a worker at the polling location. That complicates the tallying process, but I can definitely see how it is still easier to audit than a voting machine.