1. Which question would the download answer?
A public election download can be useful without answering every question about an election. A table of contest totals lets readers check addition. A more detailed file might let them compare different ways of summarizing selections. A description of the publication process can explain why some information appears in one product and not another. Those are different contributions to public understanding. Calling all of them transparency, without specifying the question each can answer, makes a difficult argument less precise.
The same problem arises with privacy. A release described as private might contain less detail, exclude an entire class of information, or be available only through a limited review arrangement. Those choices do not have identical consequences for readers. A useful public explanation should say what was provided, what was withheld, and what conclusions the supplied evidence supports. It should not turn the existence of a download into proof of an election outcome, or the absence of a download into proof that an outcome is wrong.
This article concerns that publication problem, not how to identify voters. No actual cast-vote dataset, voter list, ballot image or individual voting history was obtained for the examples. Every number in the fictional Maple examples below is invented. There are no people, addresses, timestamps or real precincts behind them. The exercises compare mathematical summaries and publication records, not methods for linking a real person's identity to a ballot.
Begin with a deliberately modest question: can a reader reproduce a stated contest total from a particular release? That question has a denominator, a file version and a calculation. It is narrower than whether every eligible ballot was included or every selection correctly interpreted. Another question might concern whether a published table contains enough detail for a proposed research comparison. That is narrower than whether the comparison is lawful, wise or free of privacy risk. Keeping these questions separate allows an office to explain useful evidence without pretending that one file settles the entire election.
A release therefore needs something like an evidence contract with its audience. Not a legal contract, and not a substitute for applicable law: a plain account of its purpose and boundaries. Which totals can be reproduced? Which comparisons are intentionally unavailable? Which differences from another published product are expected? What would count as a genuine discrepancy requiring clarification? Readers deserve those answers before being asked to choose between unrestricted detail and unexplained secrecy. The important object is not the largest possible spreadsheet. It is a comprehensible relationship between the question, the permitted information and the conclusion.
2. A record is not automatically a person
NIST's cast-vote-record common-data-format work describes electronic selection records and interoperable exchange between election systems. Its executive summary says records are usually created per ballot sheet, not universally one per voter. The publication record identifies Version 1.0 as published November 19, 2019; the associated web rendering is dated March 2020. These are format materials, not a nationwide authorization to publish every field. NIST publication record NIST CVR format executive summary
The EAC's voter-roll privacy explainer, last updated January 3, 2023, distinguishes participation history from ballot choices. Its description of voter files concerns such information as elections participated in and, depending on the state, party affiliation or voting method—not a record of which candidate someone selected. That dated explanation is used here for the distinction, not as a current fifty-state legal directory. EAC voter-roll privacy explainer
Consider a fictional Maple documentation packet that stipulates one hundred participating ballots, each consisting of two sheets. Its export contains two hundred sheet records. The packet assigns Contest One to the first sheet and Contest Two to the second. Each contest has one hundred eligible opportunities for a selection. Dividing either contest's selections by two hundred would answer a question about all exported sheets, not the stipulated contest population. There is no contradiction between two hundred records and one hundred ballots in this example.
Suppose Contest One has fifty-four choices for Amber, forty-one for Blue and five entries labeled no counted selection. Those three numbers sum to one hundred. Amber's share of the two named choices is fifty-four divided by ninety-five, about 56.84 percent. Amber's share of all one hundred contest opportunities is 54 percent. The two percentages use different denominators. Neither should be printed simply as the share of voters without defining which population is intended.
An analyst looking only at the filename might describe the two hundred entries as two hundred votes. A second analyst might divide fifty-four by two hundred and announce a 27 percent share. Both would be importing an unsupported interpretation into the arithmetic. The release's basic documentation could prevent that error without adding any personal detail: explain the unit, the contest population and the meaning of each category. This is a concrete case where better documentation delivers more analytical value than another column of raw observations.
Now imagine that the same directory also contains a hundred-row contest summary and a two-hundred-row sheet export. Their row counts differ by design. A reviewer can reconcile them at the appropriate level rather than treating a mismatch in file length as evidence of missing ballots. The important comparison is between stated units. No conclusion about a real jurisdiction follows from Maple's structure, and no real export should be forced into it merely because the numbers look familiar.
3. Two official records, two bounded legal propositions
In its April 28, 2026 majority opinion in Honey v. Lycoming County Offices of Voter Services, the Pennsylvania Supreme Court held that the CVRs at issue were not the contents of ballot boxes or voting machines under the Election Code and therefore were not exempt from disclosure on that basis. Footnote 13 expressly left undecided the disclosure of CVRs clearly linking ballot contents with personally identifying data. The holding and that reservation belong together. Pennsylvania Supreme Court majority opinion
North Carolina's Numbered Memo 2022-01, updated July 16, 2026, describes individual voted-ballot records, including CVRs, as confidential, with specified exceptions for court orders or an elections board handling a protest or investigation. It separately says records revealing how a particular voter voted require a court order. That is North Carolina guidance, not a rule inferred for other states. North Carolina State Board of Elections memo
These documents are useful because they resist the shortcut of treating a technical file type as its own legal answer. For a public reader, a release explanation should identify the authority actually relied upon, its date, the record at issue and any unresolved boundary. The fact that another jurisdiction produced a file with the same extension does not establish that two requests involve the same legal question. This article does not advise anyone whether a particular records request must be granted.
A fictional Maple publication note might instead say only that the data were released because courts support transparency. That sentence would be poor evidence even if its author sincerely favored openness. Which court? Which record? Which issue was decided? A useful correction would attach a dated decision and summarize its actual reach. Another note might say privacy law forbids all election information. That is equally unhelpful unless the applicable authority and requested information are identified. General enthusiasm and general anxiety are not substitutes for a record-specific explanation.
There is also a temporal problem. A publication made under one documented decision cannot be understood solely by reading a later website banner. A reader needs to know which explanation accompanied the original release, what subsequently changed and whether an updated statement concerns the same file. Preserving those distinctions makes disagreement more productive: people can challenge a stated rationale instead of speculating about an absent one.
For the rest of the article, Maple is not placed in either state. Its exercises do not assume legal permission to disclose a real file. They ask what a proposed product would show if it were lawfully available. That separation matters: a mathematically useful release can still require a legal decision, and a legal decision can leave important questions about readability and analytical usefulness unanswered.
4. Identical totals can describe different underlying patterns
The first Maple exercise has twelve fictional ballots and two fictional contests. Each contest has two possible selections, labeled Amber and Blue in the first contest and Circle and Square in the second. There are no blanks in this particular exercise. The purpose is to compare information content, not to model turnout or political behavior.
In Version A, six ballots pair Amber with Circle and six pair Blue with Square. In Version B, three ballots use each of the four possible pairs: Amber with Circle, Amber with Square, Blue with Circle and Blue with Square. Both versions report six Amber and six Blue selections. Both also report six Circle and six Square selections. A published total for each contest would therefore look identical in the two versions.
Yet a question about the combination of selections has different answers. In Version A, six ballots contain the Amber–Circle pair. In Version B, three do. The aggregate contest totals alone cannot tell a reader which of these stipulated arrangements generated them. That is a simple limitation of the released information. It is not evidence that either version occurred in a real election, and it does not identify anyone.
This distinction helps define a request for more detail. Someone checking whether the first contest totals twelve already has enough information in the marginals. Someone asking how selections coincide across contests does not. Those are different research purposes. An office's explanation can acknowledge the second question without claiming that publication of the first table answers it. Equally, the second research purpose should be stated openly rather than smuggled into a request described only as checking the addition.
Now give a fictional newsroom both versions as training exercises but remove their labels. Its arithmetic script prints the same four totals for each. The script has done exactly what it was written to do. If the newsroom concludes that the files contain identical information, the mistake is in the interpretation of the test, not necessarily in the code. A test can correctly confirm one property while leaving another unexamined.
The same lesson applies to publication claims. Reproducing aggregate totals demonstrates agreement for those totals, under the selected definitions. It does not establish equivalence of all possible analyses. A release note should name the preserved properties rather than say nothing was lost. Conversely, a reader should not label the release useless merely because it does not preserve every relationship. It may be sufficient for the first stated question and insufficient for the second.
These are not competing verdicts about whether transparency matters. They describe two levels of information. A serious discussion starts by naming the desired level and then examining whether its public value justifies the proposed release within the relevant constraints. The twelve invented ballots make that choice visible without involving a single real voter.
5. A broader group can reverse an apparent comparison
Consider a separate Maple exercise with two administrative groups, East and West. These are arbitrary fictional labels, not actual places or demographic groups. East has forty contest opportunities, of which thirty are Yes and ten No. West has sixty opportunities, of which twenty are Yes and forty No. A combined table reports fifty Yes and fifty No out of one hundred.
The combined 50 percent Yes share is correct. It does not describe either group's share: East is 75 percent Yes and West is about 33.33 percent. The aggregate is weighted by the number of opportunities. Taking the simple average of those two percentages produces approximately 54.17 percent, not 50 percent, because the groups are different sizes. Publishing one combined category therefore changes which comparisons are visible, while the total remains fully reproducible.
Suppose the publication's announced purpose is to show the combined count. The combined table serves that purpose exactly. Suppose instead its headline says that it allows comparisons between East and West. It plainly does not. No appeal to greater simplicity can supply the missing comparison. An honest note would say that the two groups were combined and that separate group estimates cannot be recovered from this product alone. It need not characterize that limitation as either a scandal or a triumph.
There is an additional distinction between an omitted number and a number that is zero. A blank space in a group column should not silently become zero in a reader's calculation. In this exercise, replacing West's unavailable Yes value with zero would produce a fabricated total of thirty. The public product has not said thirty; the analyst has invented a value. Documentation should distinguish unavailable, inapplicable and numerically zero rather than require readers to infer meanings from an empty cell.
A useful assessment of a broader grouping would therefore compare the proposed table with the questions it is meant to answer. Combined counts, overall percentages and a reconciliation to an announced total may remain possible. Group-specific rates and comparisons may not. That is an observable change in analytical capability, not a single numerical score called transparency. It can be discussed honestly without assigning motives to the people proposing the change.
The example also warns against a dramatic but unsupported headline: the broader table does not show that both groups were evenly divided. It shows that their combined count was evenly divided. Public understanding is improved when the release and its readers keep that sentence intact.
6. A withheld value needs a meaningful label
The Census Bureau's business-data privacy explainer, revised September 22, 2026, describes withholding selected table cells and sometimes additional cells so the protected value cannot be derived from the others. This is statistical disclosure guidance, not an election-release rule. A tiny fictional illustration: a total of twenty beside a published cell of twelve leaves the other cell equal to eight, even if printed as withheld. With two withheld components totaling eight, several pairs remain possible; that alone is not a privacy guarantee. Census disclosure-avoidance explanation
For Maple's public communication, the immediate issue is the meaning of the displayed symbol. Does it indicate that the office did not collect the value, that the value is not applicable, that it is not included in this release, or that a calculation failed? Those are operationally different explanations. A reader should not have to treat a single dash as all four.
Imagine a separate fictional publication-quality log covering thirty requested table cells. Twenty-two are published as numbers, five are deliberately omitted from this product, two were never part of the stated scope and one has a formatting error. A banner saying eight cells are missing would combine unlike cases. The log instead identifies twenty-nine cells with an explained publication status and one requiring correction. That is a useful service-quality observation, not a claim that the release is 96.67 percent private or that the election is 96.67 percent accurate.
If the formatting error is fixed, the correction should describe that change without implying that the five deliberately omitted cells have now been supplied. A revision can improve the product while leaving its original limits unchanged. This is why an explanatory label and a revision record matter as much as the visual presence of a number. They prevent a routine publishing problem from being misread as a change in the underlying count.
7. Restricted review is a different kind of public evidence
NIST's September 2023 de-identification guidance treats the data-sharing model as a substantive choice. It discusses public releases, synthetic data, query interfaces and nonpublic protected environments, while warning that a tool which merely masks information may not provide adequate de-identification. These are approaches to managing disclosure risk, not permission to disregard a jurisdiction's election-records rules. NIST SP 800-188
Suppose a fictional Maple assessment produces a report stating that an authorized reviewer compared selected totals inside a restricted environment. The public receives the report, not the underlying detailed file. A reader can scrutinize what the report says was examined, what the expected values were and how discrepancies were described. The reader cannot claim to have independently rerun the comparison merely because the report's conclusion is favorable.
That distinction need not make the report worthless. Consider a report with six announced checks. Four have displayed inputs, calculations and outputs. One is marked not completed because the relevant documentation was unavailable. One is described only by a sentence saying that it passed. Those six entries offer three different levels of visible evidence. A count of five passes out of six would conceal the difference between a reproduced calculation and an unsupported assertion of completion.
A more informative summary would say that four calculations can be inspected in the public report, one check has an unexplained result and one remains incomplete. If additional documentation later supports the fifth check, the report's public evidentiary content has improved. Nothing in that development implies that the underlying election changed, or that the earlier incomplete check was a failed test. The publication has changed what outsiders can reasonably verify.
The fictional report can also specify the exact scope of its conclusion. If the reviewer compared totals for three named contests, it should not be summarized as a review of every contest. If the review used a particular export version, later changes require explanation rather than automatic inheritance of the earlier conclusion. These are ordinary relationships between a claim and the evidence supporting it, not a demand to expose protected information.
For a journalist, the useful question is therefore not only who had access. It is what that access produced in a form the public can evaluate. A signed statement, a reproducible aggregate calculation and a detailed account of an unresolved question are not interchangeable. Each can contribute something, but none should be advertised as the others. A publication can be candid about this distinction without disclosing the detailed records themselves.
An office considering such an arrangement would still need actual legal and institutional authority. Maple's scenario supplies no authority and recommends no particular access program. It illustrates how to describe the resulting evidence honestly if a permitted review occurs. The point is to avoid converting a limitation on access into a limitation on precise reporting.
8. The order of a file and the contents of a file
The EAC's approved VVSG 2.0, dated February 10, 2021, includes a ballot-secrecy principle and requirements aimed at preventing association between voter identity and selections. Its discussion also addresses information revealing casting order. Those are voting-system requirements within that standard's scope, not a complete public-records policy for every jurisdiction. VVSG 2.0, Principle 10
A small Maple exercise illustrates a narrower mathematical point. File A lists six invented category values in the order Amber, Blue, Amber, Amber, Blue, Blue. File B lists Blue, Amber, Blue, Amber, Blue, Amber. Each contains three of each category. Their positions differ, but their category totals agree. No chronology is attached to either sequence. Neither is a record of actual voting order.
A reader comparing the first line of each file will find a difference. A reader comparing the six-line category counts will find agreement. Both observations are true, and neither alone explains why the files differ. A publication note that describes a change in presentation order can prevent a line-by-line comparison from being mistaken for a change in totals. The note would still need evidence that the proposed explanation fits the actual transformation; a plausible story is not proof.
Now consider File C, another invented sequence with two Amber and four Blue entries. A display-order explanation cannot reconcile it with File A, because rearranging the six entries cannot change their category counts. This provides a bounded test of a publication claim. If a release note says only the order changed, but the relevant counts also changed, the note is incomplete or wrong for that comparison. No allegation about the cause follows automatically. The files may concern different scopes or versions, or a publishing mistake may require correction.
This exercise is not a privacy technique. It does not show that rearranging real records makes them safe to publish, and it offers no procedure for recovering real voting order. It establishes only which observations are invariant under a stipulated reordering of an invented list. That limited result is useful when evaluating a publisher's explanation, but it should not be promoted into a general assurance of anonymity.
For a release designer, the communication task is to identify the relationship being claimed. Was the product reordered, regrouped, relabeled, corrected or generated from a different source version? Those words describe different operations. Saying that the data were cleaned is not enough. Even where the underlying detailed data cannot be public, a precise explanation of the transformation can make the published product easier to interpret.
The public interest lies in avoiding two opposite mistakes: calling every changed line a changed vote, and calling every unchanged total proof that nothing relevant changed. The right comparison follows from the declared purpose of the product, not from whichever test happens to produce the most reassuring result.
9. A mathematical privacy claim needs its own specifications
NIST's March 2025 guidance on differential privacy explains that a guarantee depends on more than a single headline parameter. The unit being protected matters, and guarantees using different units are not directly interchangeable. Its discussion also treats implementation pitfalls and the relationship between parameters. Merely saying that noise was added does not identify the guarantee being claimed. NIST SP 800-226
For a fictional documentation review, imagine two reports bearing the same short label, privacy protected. Report One defines its protected unit; Report Two leaves that line blank. A comparison that ignores the missing definition cannot establish that the reports promise the same thing. In Maple's earlier two-sheet example, a sheet, a ballot and a contest entry were different counting units. A technical privacy description would likewise need to state its unit rather than borrow the word record without explanation.
That observation does not require readers to implement a privacy mechanism. It asks whether the advertised claim is specified well enough to be assessed. Consider an invented procurement demonstration that displays three sample charts. A presenter says the charts prove that a privacy product is suitable for election publication. The charts may demonstrate that a program can produce graphics. They do not, by themselves, supply the missing specification, validate its implementation or establish that the proposed election use is lawful.
A better public report would keep separate the demonstrated artifact and the claimed property. It might say that the demonstration successfully generated three charts from an artificial input and that the privacy assessment remains a separate question. This is a more useful account than either praising the demonstration as a complete solution or dismissing every resulting chart as meaningless. The demonstration has a real but bounded accomplishment.
There is a separate evidentiary boundary around official totals. An experimental research product, a simulated training table and an official election statement should not share an ambiguous label. If an illustrative chart contains perturbed or artificial values, its caption must not invite readers to interpret them as the certified count. This article does not recommend modifying official vote totals, deploying a particular privacy method or treating a mathematical guarantee as a substitute for legal permission.
The practical lesson for readers is to demand the claim's object. Is the report describing an algorithm, one implementation, a demonstration, a public data product or an official outcome? A number attached to the wrong object can be precise and still mislead. The most valuable clarification may be a sentence defining the object, not an additional decimal place in the presentation.
10. A correction should explain what changed and what did not
Return to a wholly fictional Maple contest with three categories: Amber, Blue and no counted selection. Release One contains 520, 470 and 10 respectively, totaling one thousand contest opportunities. Release Two contains 518, 472 and 10, again totaling one thousand. The differences are minus two for Amber, plus two for Blue and zero for the third category.
Several statements about those numbers are possible, but they do not mean the same thing. The total number of opportunities is unchanged. Two category totals changed. The sum of the absolute category differences is four. In a stipulated example where two entries move from Amber to Blue, two entries explain that four-unit absolute difference. Calling it four additional ballots would be an error: the same transfer appears once as a subtraction and once as an addition.
The arithmetic by itself does not establish that such a transfer actually occurred. That is only one hypothetical explanation. A change in labels, a corrected summary or a different inclusion rule could require a different account. A release note should identify the real explanation and the records supporting it rather than invite readers to infer a cause from the deltas alone. Maple supplies no real event to investigate.
Suppose a fictional correction notice states that the second release fixes a transposed summary entry, while the associated detailed source export remains unchanged. Then the public claim concerns a reporting product, not a change to underlying selections. A reviewer would look for a comparison supporting that specific account. If the notice instead says that the underlying interpretation was updated, the explanation must address that different operation. The two notices cannot be treated as interchangeable just because their displayed totals happen to match.
A good archive would also distinguish a release date from an effective scope date. A file published on a Tuesday might summarize an earlier frozen set of records. A Wednesday publication might correct only explanatory text. Without those distinctions, a reader could interpret the newer timestamp as proof of newer underlying data. The fix is not to conceal timestamps. It is to explain what each one dates.
For Maple's fictional public directory, imagine three downloadable items: a data table, a category dictionary and a correction note. The dictionary changes the description of the third category from blank to no counted selection, while leaving all values unchanged. That is a meaningful clarification of language, not an additional ten votes. Readers who archived the earlier dictionary need a way to recognize the change and assess whether it affects their prior interpretation.
A correction process earns credibility by being specific about such differences. It need not promise that no mistake will ever occur. It should make it possible to locate the mistake, understand its scope and distinguish the corrected product from earlier versions. Those are concrete publishing responsibilities. They do not require anyone to publish an individual's choices or make claims about an election that the available evidence cannot support.
11. A practice dataset can teach the format without becoming evidence
An invented training file is useful precisely because its contents can be explained in full. Maple's twelve-ballot examples have no hidden real-world population. Their creator knows how many entries were placed in each category, can predict every total and can provide an answer key. This makes them appropriate for teaching the difference between marginals and joint patterns. It does not make them evidence about how any community voted.
Imagine an original Maple training packet with four exercises. The first contains eight entries that should all be read as valid category values. The second includes two deliberately unsupported category labels. The third omits a required explanatory heading. The fourth has a summary total that does not match its listed values. These are invented publishing exercises, not tests of a real voting system. Their expected outcomes are specified before a reader tries them.
A reader's spreadsheet successfully adds the first file. In the second, it silently drops the two unsupported labels. In the third, it guesses a denominator. In the fourth, it reports the mismatch. The exercise has revealed four different behaviors: correct calculation, unreported omission, unsupported interpretation and useful discrepancy detection. A single statement that the spreadsheet passed two of four tests would obscure what actually happened.
The answer key can instead identify the exact observable result for each case. The first calculation matches its expected total. The second needs an explicit error or explanation rather than silent disappearance of entries. The third lacks enough information for the claimed percentage. The fourth correctly signals a disagreement without diagnosing its cause. These conclusions are grounded in the invented packet and do not claim compatibility with any official schema or real export.
Such exercises can improve public discussion because they make disagreements reproducible. Two readers can examine the same harmless input and determine whether their difference comes from arithmetic, an interpretation or an undocumented assumption. There is no need to obtain real ballots to demonstrate that a blank field should not automatically become zero, or that an unspecified denominator cannot support a meaningful percentage.
The presentation must maintain the boundary. A practice file should announce its fictional status in its title and accompanying text, not only in a distant disclaimer. Its examples should not be assigned actual precinct names or presented beside real results in a way that invites accidental reuse. If a chart from the exercise is copied into a presentation, the artificial-data label should travel with it.
This article's examples are hand-designed arithmetic illustrations, not synthetic samples fitted to confidential voter records. That distinction is important: there is no underlying election population whose properties they purport to preserve. Their value is instructional, not statistical representativeness. A reader who learns to ask better questions from them has gained something useful without being asked to treat a fabricated result as news.
12. Evaluate the release against a visible question list
A final Maple exercise brings the discussion back to the public purpose. Suppose a proposed release advertises six questions it will help answer. Three concern arithmetic: reproducing contest totals, confirming category totals sum to the stated population, and calculating a clearly defined percentage. One concerns comparisons between broad administrative groups. One concerns combinations of selections across contests. One concerns the reason for a change between two published versions.
The proposed product contains contest totals, a category dictionary and a dated correction note. Under these stipulated conditions it can answer the three arithmetic questions and the version-change question, if the correction note actually supplies the promised explanation. It cannot answer the two detailed comparison questions because the required information is absent. Calling that four out of six is a description of the chosen question list, not a universal transparency score.
The list itself can be challenged. A researcher might reasonably argue that a group comparison is central to the intended project. Another reader may care mainly about reproducing the published total. Those are disagreements about the value and scope of a release, not necessarily disagreements about arithmetic. Making the question list visible allows the argument to occur at the right level. It also prevents a publisher from choosing easy checks after the fact and claiming that every meaningful use has been served.
Privacy constraints should be described alongside those purposes, not buried in an unrelated notice. A public explanation can identify the classes of information excluded from the product and the resulting limitations without exposing the excluded material. It can also distinguish a current release decision from a promise about future products. A statement that a particular comparison is unavailable today does not establish that it must be unavailable forever, or that it can safely be added tomorrow.
The explanation should also make room for an unresolved question. If the office cannot yet reconcile a published count, that uncertainty deserves a specific status rather than a reassuring generality. If a requester asks for information beyond the release's lawful scope, the response should identify the applicable boundary rather than imply that the requested analysis has already been performed. A precise not answered is more informative than a vague complete.
None of Maple's exercises assigns a probability that an election is correct or that a release is private. They compare known fictional inputs, declared publication purposes and observable outputs. Their conclusions remain at that level. The real work of applying law, evaluating privacy risk and administering an election requires the appropriate institutions and evidence; an explanatory spreadsheet does not replace them.
The strongest transparency argument is therefore not that every possible detail must be public. It is that public claims should be inspectable at their stated level. The strongest privacy argument is not that readers must accept unexplained omissions. It is that protecting a secret ballot and explaining an election are both serious obligations. A well-described release lets the public see what can be checked, what cannot and why the difference matters. That is a more durable basis for trust than either an indiscriminate data dump or a promise that the missing context does not matter.