  A recent debate among election experts has considered whether electronic
ballot marking devices (BMDs) have adequate security against the risks of
malware. A malicious BMD might produce a printed ballot that disagrees with a
voter's actual intent, with the hope that voters would be unlikely to detect
this subterfuge. This essay considers how an election administrator can create
reasonable auditing procedures to gain confidence that their fleet of BMDs is
operating correctly, allowing voters to benefit from the usability and
accessibility features of BMDs while the overall election still benefits from
the same security and reliability properties we expect from hand-marked paper
ballots.
