Briefing · Provable Custody

Slide 1 · BORN BETWEEN 2 GENERALS LLC

Provable Custody

Why mail-ballot disputes cannot be settled with better recordkeeping — and what would settle them instead
Mail-Ballot Lifecycle Token Service · ProofCore August 2026

Slide 2 · 8–12

Print vendor
USPS outbound
Voter
USPS inbound or drop box
Receiving & logging
Signature verification
Sorting & batching
Extraction
Tabulation
Retention storage
Each transfer generates a record. Each record is held by the party that performed the transfer.

Slide 3 · THE CONSTRAINT IS LOGICAL, NOT OPERATIONAL

What offices already do
More forms. More signatures. Two-person integrity. Video coverage. Chain-of-custody paperwork at every handoff.
These are good practices. Jurisdictions that adopt them run better elections.
Why it still does not settle a dispute
Every one of them produces another record held by the same party.
No quantity of self-held documentation can resolve a dispute in which the holder is an interested party.
This is why custody arguments recur cycle after cycle. Both sides are behaving reasonably given a record format that cannot adjudicate between them.

Slide 4 · AN ENGINEERING FAILURE, NOT A CHARACTER FAILURE

Only one of them ends an argument.
Election officials have been absorbing the reputational cost of a design gap in the tools they were given. The records are almost always accurate. They simply lack a property — tamper-evidence verifiable by an outside party — that no amount of professional diligence can supply.

Slide 5 · PRECEDENT

01
Forensic laboratories
Evidence integrity decides whether a case survives challenge in court.
Sealed, signed, timestamped transfer records — verified independently at trial.
02
Pharmaceutical supply
A counterfeit or diverted drug must be detectable across a global chain.
Serialized units with cryptographically verifiable custody at every handoff.
03
Financial audit
A ledger controlled by the audited party cannot audit that party.
Append-only journals, external attestation, independent reconciliation.
The common pattern: stop asking the custodian to be trusted, and give the custodian a way to be checked.

Slide 6 · THE ARCHITECTURE, AT THE LEVEL OF GUARANTEES

1
Append-only
Records are added, never modified or deleted. A correction is a new record referencing the original — the discipline a general ledger has used for six hundred years.
2
Signed at the moment of the event
Each transfer is attributed to a specific role and key when it occurs, not reconstructed afterward. Fabrication becomes distinguishable from contemporaneous record-keeping.
3
Externally anchored
A short commitment to the whole record is published periodically. Any later alteration to any earlier record breaks it visibly. This is the property that closes the trust gap.

Slide 7 · INCLUSION PROOF

The proof establishes
This specific custody event, for this specific ballot envelope, was part of the record the office published at that time — and that record has not been altered since.
The voter checks it with a tool the election office does not control.
A challenger who verifies and finds it correct becomes your strongest advocate. Design the interaction so they can.
The election official stops having to be believed and starts being able to be checked.
For an honest administrator, being checkable is strictly better than being trusted.

Slide 8 · STATED WITHOUT HEDGING

Does not reveal how anyone voted.
Custody is envelope-level. The link between voter and ballot is severed at extraction by design.
Does not verify a ballot was counted correctly.
Tabulation is a separate system, audited separately — typically by a risk-limiting audit.
Does not establish a ballot was legitimately cast.
Eligibility and signature verification are separate processes with separate controls.
Does not prevent tampering.
It makes tampering detectable. Nothing here is tamper-proof, and any vendor using that word should be asked what they mean.
Overclaiming is the fastest way to destroy the trust this is meant to build.

Slide 9 · WHY THIS IS PROCURABLE NOW

Voting systems
Equipment that marks, casts, or tabulates votes.
Governed by VVSG 2.0. All new EAC certifications must be to VVSG 2.0. Vendors are working through multi-year recertification.
Election systems — where custody sits
Does not mark, cast, or tabulate.
Outside the VVSG boundary by design. VVSG 2.0 in fact requires election systems be air-gapped from the voting system.
Consequence: a county can procure custody infrastructure on a standard software timeline. The corresponding obligation — with no federal certification to lean on, the jurisdiction’s own technical evaluation has to be substantive.

Slide 10 · COMPLIANCE POSTURE

Framework
What it covers
Status
SOC 2 Type II
Operating effectiveness of controls over time
Readiness underway
StateRAMP
Cloud authorization for state & local government
Path selection
NIST SP 800-53 Rev. 5
Control catalog, Moderate baseline
Mapped
Independent pen test
Adversarial validation by a third party
Scheduled
52 U.S.C. §20701
22-month federal retention of election records
In development
FedRAMP is deliberately absent. It authorizes cloud services sold to federal agencies and is not the applicable framework for county or state election infrastructure.

Slide 11 · STATED PRECISELY

Built and tested
Event log core: append-only storage, event signing, Merkle anchoring, role-based access, managed key integration, offline scanner sync, envelope encryption.
The production entrypoint refuses to start rather than fall back to in-process keys.
In progress
22-month retention policy engine.
HSM vendor selection.
SOC 2 Type II.
StateRAMP path.
Third-party penetration test.
Not yet done
Deployment in a live federal election.
We are seeking two pilot jurisdictions for the 2027 cycle, and will say so plainly rather than implying operational history we do not have.

Slide 12 · ECONOMICS

PER REGISTERED VOTER / YEAR
Track $0.20–0.30
Postal ingestion, notifications, status portal
Custody $0.40–0.55
+ append-only log, signed events, custody reporting
Proof $0.60–0.75
+ anchoring, inclusion proofs, public verifier, audit support
Typical funding: HAVA funds, state election security grants, county general fund.

Slide 13 · ROLLOUT

01
Beachhead
Months 0–12
Two paid pilots in mature vote-by-mail counties, 75k–400k voters. One with public naming rights. Colorado is the priority state.
02
Scale
Months 12–30
Fifteen to forty counties. State clerk associations become the channel — one association presentation reaches every county at once.
03
Statewide
Months 30+
One statewide award is worth twenty county contracts. Large flagship jurisdictions enter here, with references and a completed pen test behind us.
Channel: Election Center (CERV certification) · NASED · NASS Corporate Affiliate · state clerk associations · USPS Election Mail Programs

Slide 14 · THE ASK

Discounted pricing, in exchange for permission to name the jurisdiction publicly, a written reference, and a joint conference presentation.
We are looking for a customer who will let us be examined. A product whose premise is that claims should be checkable rather than trusted cannot reasonably ask to be adopted on trust.
Kristen Hall, Founder · Born Between 2 Generals LLC · bornbetween2generals.com