Every few years, a familiar argument comes around like a comet: You need an ID to buy a beer, board a plane, or rent a jet ski. Why not to vote?
It is a good line. It has survived decades of political combat because it appeals to something most of us feel in our bones — that important things should require proof. I don’t think people who make this argument are acting in bad faith. I think they are running a mental model that fits almost everything else in modern life and happens not to fit this one thing.
The model is the point-of-sale transaction. You show up, you present credentials, the clerk decides, the transaction clears. Bar, airport, bank teller. Identity is verified at the moment of the exchange, because there was no moment before the exchange in which to verify it. The bartender has never met you and will never see you again. He has one shot.
Elections don’t work like that, and here’s the thing: they never did. An election is not a point-of-sale system. It is an asynchronous, stateful database with a months-long onboarding process, a distributed write phase, and collision detection. Once you see it that way, the ID debate stops looking like a fight about how much security we want and starts looking like a design review — one in which the proposed feature has already been implemented somewhere else in the stack.
Ask any engineer where the identity check belongs in a system like this and you’ll get the same answer: at account creation, not at every login.
That’s precisely where it sits. When you register to vote, you hand over a driver’s license number or the last four digits of your Social Security number, plus your name and date of birth. Under the Help America Vote Act, that data gets run against the state motor-vehicle database and, where necessary, against Social Security Administration records. States also periodically scrub their rolls against vital-records data to remove the deceased, and against interstate crosscheck systems to catch people who’ve moved.
By the time you walk into a gymnasium in November, the system has already decided who you are. The credential check is done. It happened in July, in a database, against federal and state records, with more rigor than a poll worker squinting at a laminated card could ever apply in eleven seconds.
This is not a loophole. It’s the architecture. And it’s the same architecture you rely on every day. Your bank verified your identity when you opened the account — documents, SSN, address history, the whole ceremony. It does not re-verify your birth certificate every time you swipe. It checks a token against a pre-authorized record. Nobody calls that a security failure. We call it a well-designed system.
Here’s where the intuition really goes sideways. When the poll worker asks for your name and address, most people hear prove who you are. That’s not what’s happening. She’s not establishing your identity from scratch. She’s running a lookup.
Your name and address are composite search keys. They locate one row in a poll book, which is itself a geographically sharded slice of the state’s master file. She isn’t authenticating you. She’s finding you.
And the address is doing a second job that has nothing to do with security at all. In American elections, geography determines what you’re entitled to vote on. Your address routes you to the right ballot style — the correct school board, the correct city council seat, the correct state house district. Get the address wrong and the system doesn’t hand a ballot to an impostor; it hands the wrong ballot to the right person. Address collection is a routing function that people have mistaken for a security function, which is roughly like assuming your ZIP code is your password.
The best security feature in the voting system is the one nobody talks about, because it’s boring: the poll book records that you voted.
The moment your name is found, your state flips. has_voted goes from false to true. It sounds trivial. It is the entire ballgame.
Consider what an in-person impostor actually has to do. He must know the exact name and current registered address of a real voter in the specific precinct he’s standing in. He must know that this person hasn’t voted yet — and won’t show up later. He must do it in a room frequently staffed by neighbors, retirees, and the sort of civically-minded volunteers who have lived on that street for thirty years and know exactly who lives at 412 Maple.
If he gets any of that wrong, the system throws an exception. The real voter arrives, the poll book shows the record already marked, and the machinery of anomaly-handling engages: a provisional ballot, a signature comparison, an investigation, a referral. Not a quiet failure. A loud one, with a paper trail and a prosecutor at the end of it.
There’s a further layer most people don’t think about: the signature. In no-ID and mail-in contexts, your signature functions as the authentication token — compared against a baseline pulled from your registration form or DMV file. It’s an imperfect check, and reasonable people argue about how it’s administered. But “no ID” has never meant “no credential.”
Security engineering isn’t about eliminating every conceivable attack. It’s about ranking attacks by how much damage they do per unit of effort, and then spending your finite budget from the top of that list down.
So rank them.
In-person impersonation. To move a statewide race by 10,000 votes, you need 10,000 people to each commit a felony, in person, at 10,000 separate locations, each correctly guessing an unvoted registrant, none of them getting caught, none triggering a collision, all of them keeping quiet forever. The effort scales linearly with the payoff, and the detection risk compounds. This is the worst crime in America on a risk-adjusted basis. It has the operational profile of stealing a car by pushing it home.
Attacking the database. One person, one intrusion, thousands of records altered or deleted in an afternoon. Effort is constant; damage scales without limit. This is where a rational adversary goes, which is why our actual documented election-security incidents have overwhelmingly involved networks, vendors, and voter files rather than guys in fake mustaches.
Attacking the process. Insider access, chain-of-custody gaps, coordinated absentee-ballot harvesting — the schemes that have actually overturned American elections, like the 2018 North Carolina Ninth District race, which was thrown out over a mail-ballot operation. Note that a photo-ID requirement at the polling place would not have prevented a single one of those ballots.
Voter ID is a control aimed squarely at the least scalable item on the list. It imposes real friction on millions of authorized users to harden the one attack surface the architecture already defends — while doing nothing for the two surfaces where the actual adversaries live.
Let me concede what deserves conceding. Most Americans have ID, and most who don’t can get one. Requiring it is not an outrage, and in the majority of states that now have some ID requirement, elections run fine. Public confidence has independent value, and if a rule makes people trust the count, that’s a real benefit even when the rule is technically redundant. I’d rather argue with someone who believes that than pretend the position is unserious.
But confidence built on a misdiagnosis is fragile. If we tell people that ID is what makes elections secure, we’ve taught them that elections without it are insecure — which is false, and which sets us up to relitigate this comet every four years while the actual attack surface goes underfunded.
Here’s the upbeat part, and I mean it: the system is better engineered than its critics or its defenders usually admit. Verification at onboarding, geographic routing, state-change collision detection, signature tokens, provisional-ballot exception handling, paper audit trails. That’s a defense-in-depth design that would pass review at most companies I’ve worked with.
Any engineer will tell you that the most expensive kind of patch is one that adds friction, generates support tickets, and fixes a bug that closed years ago — all while the real vulnerability sits three layers down in the stack, unpatched, with a queue of motivated adversaries.
We’re arguing about the doorman. The window is open around back.