DHS plans urgently needed to address identified challenges before 2020 elections [pdf]

They are not. For one thing elections are run at the state level.

What you describe is not that different from Australia's preferential system afaict, aside from people at one district potentially having different ballots.

Australian ballots are not always simple, and you vote for your local representative so each district has a different one. Often you will have multiple ballots to complete, and some have the choice between above or below the line voting (where above you select some preferences and below you select all preferences, where all may be over 100 boxes).

Parties often hand out small leaflets outside the voting locations with instructions for above the line voting, which is typically a list of around 6 preferences in order.

Despite this, voting in Australia is done with paper, and we have live coverage with real-time counts on election night. Paper works quite well, computers really aren't necessary.

Digital records kept by precinct tabulators are audited using the paper ballots. These machines read and retain the voter's original ballot for later inspection. if the ballot is machine-marked (done for voters with certain sensory/mobility limitations) the paper copy is produced for the voter's (or assister's) inspection prior to tabulation.

This is perhaps the #1 misunderstanding of electronic voting technology that I encounter and frustrates me endlessly: the most widely used electronic voting method in the US, precinct tabulators, are a paper-ballot based system. The only change from the "traditional" approach to voting in the US is that the OMR is moved from the county elections office to the precinct polling place, which simplifies handling of the paper ballots. The paper ballots remain the "source of truth" and are retained for audit, the machine just tabulates the ballots immediately after the voter turning them in, instead of a courier delivering the ballot box to the central office for tabulation. Precinct tabulators include multiple safeguards against tampering which are far from perfect but reasonably effective against most common attacks - ultimately the safeguard against tampering is the same as it always has been, that the ballot box must be kept under watch of sworn election officials to protect the integrity of the paper ballots. Exact handling of the ballot boxes vary by jurisdiction, in this state they are entrusted to the state court system for retention for several years and can be retrieved and opened for auditing by order of a judge.

Risk models for precinct tabulators are generally ballot stuffing, tampering with software in the supply chain, tampering with election configuration, or tampering with an individual OMR, such as in the polling place (this is by far the case that gets the most attention, even the security community seems to have largely not noticed the first three). Ballot stuffing is generally prevented by use of a machine "unlock" procedure (using a cryptographic token in the most common system) and review of the paper audit tape against the pollbook and/or voting permits generated by the pollbook (number of ballots on tape must match number of issued permits and the number of voters recorded as voted by the pollbook, these are independent checks in my jurisdiction although they should always be equivalent - checking both ways is actually a means of auditing the pollbook). Tampering with individual tabulators is relatively easily discovered by auditing the ballots using a different machine, which is the normal recount process in this jurisdiction. Tampering with tabulator configuration (likely by compromise of the election management system used to program the machines) can be detected by inspecting the paper audit tapes which include the machine configuration, which is normally conducted by a university political science department in this jurisdiction. This political science department also inspects the audit tape totals to audit the central office tabulation where the machine counts are added.

Tampering with tabulator software in the supply chain is by far the most difficult and concerning case. In every case I have ever seen, tabulators are never connected to the internet. However, they are connected to a configuration system which may be internet connected, and could offer a (not easy but possible) route to tampering with their software. It is more likely that such tampering would occur prior to delivery of the machine or perhaps during storage. If done carefully it could be very difficult to detect by any audit method except for a hand-count of ballots. In this jurisdiction and, according to NCSL in the majority of US states, a hand-count is performed on a subset of ballots as part of the normal post-election audit process, and should detect this type of tampering unless the effect is very small.

To be clear, some direct recording electronic or DRE machines are a major concern because there is no paper ballot for independent auditing. The term DRE can be confusing because some DREs produce a voter-verified paper audit trail or VVPAT which is essentially a machine-marked paper ballot which is shown to the voter prior to tabulation. These machines are considered DRE rather than precinct tabulators because they directly record the voter's preferences from the marker rather than scanning a paper ballot, however, because a paper ballot is retained they are mostly equivalent to precinct tabulators, with the downside that voters may not scrupulously verify the VVPAT since they were not required to mark it manually. Only about 28% of voters according to Pew vote using DRE machines, and according to Verified Voting about one quarter of those machines produce a VVPAT. This would suggest that about 21% of registered voters live in jurisdictions where there is no paper audit trail. This is definitely highly concerning, but is a significantly lower proportion of voters than most people who discuss this issue seem to think.

The popularity of DRE equipment increased significantly after the Help America Vote act because DRE machines contain significantly more advanced accessibility features (e.g. blind and mobility-impaired voter modes) and HAVA required jurisdictions to upgrade to machines with these features. However, HAVA does not require DRE at all. Jurisdictions which centrally count ballots or use precinct tabulators can offer voters with accessibility needs a "ballot marker" which they insert their ballot into. After assisting the voter, the machine marks their ballot and returns it to them, allowing them or an assister to verify the ballot's correctness. In my experience most disabled voters prefer to have a human such as a family member or sworn election official assist them in marking their ballot anyway, since it is easier than learning to use the machine's accessibility interface modes, but the ballot marking machine offers them the option of complete privacy. In the case of perhaps the most popular precinct tabulator, ImageCase, the ballot marker is the same machine as the tabulator to save space and equipment maintenance. In this case the machine returns the ballot to the voter after marking for inspection and the voter reinserts the ballot into the same machine for tabulation.

Focusing on all electronic voting methods, including precinct tabulation, as an evil, like a large portion of people in the tech community currently do, has significant downsides. Precinct tabulators, and OMR tabulation more generally, has significant advantages in terms of cost, accuracy (assuming no tampering, as in the majority of cases), and timeliness of results. Further, precinct tabulators have advantage to voters. Precinct tabulators generally sound an alert and return the ballot to the voter if there are problems tabulating it. This prevents votes being lost due to marking errors or damage to the ballot. Precinct tabulators confirm to the voter on a display that their ballot has been successfully tabulated, providing them with a higher level of confidence that their ballot will be counted than central tabulation provides.

This has been a very long comment, but this is a topic about which I am extremely passionate. Those involved in advocating for changes in the mechanics of the US election system must be sufficiently knowledgeable of the actual methods and machines in use to make reasoned arguments. This includes knowing the difference between precinct tabulation of paper ballots and DRE, and especially DRE with no VVPAT. Unfortunately it seems that most of the time they do not. It doesn't help that the media and even technical experts (although not technical experts in voting) regularly conflate OMR, precinct tabulation, and DRE, and generally contribute to an impression that the majority of US voters leave no paper trail even when that is untrue.

Were I president of the world, I would like to see legislation which mandates the use of a voter-marked paper ballot. This allows the significant advantages of precinct tabulators while ensuring the ability to audit the election by hand. I would further like to see legislation which requires that all jurisdictions hand-count a portion of ballots as an audit, possibly using the tiered method used in some states in which the size of the audit sample increases as the margin in a race gets smaller, eventually leading to a full hand count (this is essentially a more systematized version of the automatic recount legislation that already exists in many states).

This is somewhat complicated when many people are arguing against the use of any technology in the voting process, while unaware that technology (namely centralized OMR, which is essentially strictly inferior to precinct tabulators) has been in use since the '60s and widespread since far before the introduce of problematic DREs, and unaware of the controls in place to prevent and detect tampering with these systems. Electronic voting simply does not mean that there is no auditable paper ballot - in the strong majority of cases there is. Let's focus on the real problem, which is DRE with no VVPAT (with DRE in general being desirable to eliminate due to the limitations of VVPAT), and not cause election authorities to feel that they need to hold onto their unauditable DRE systems because the public acts like the only viable alternative is a full hand-count, which is prohibitively expensive by orders of magnitude to US elections authorities which generally suffer from severely limited funding.

Edit: besides fixing spelling, on a reread I realize that I should emphasize that precinct tabulators are connected to an election management system (which may be internet connected depending on the jurisdiction) prior to the election in order to program them. In some cases this is a direct network connection but more often it's a memory card that's moved from the election management system to the tabulator. They are not connected to anything during actual tabulation or at any time before the audit tapes and results card are removed. It is a sensible policy to require election management systems to be disconnected from the internet, and DHS has focused in on this issue closely in their work.

Introduction of electronic voting in the US was primarily motivated by the Help America Vote Act of 2002 which required that election authorities more effectively accommodate the needs of voters with sensory and mobility needs. Previously used election methods were generally inoperable by individuals with such disabilities unless they had a second person enter their votes for them, which is considered a compromise of the right to a secret ballot. Electronic voting systems offer extensive accessibility modes designed for voters who are vision impaired and/or have limited mobility, such as reading the ballot aloud and supporting a sip/puff or two-paddle input device. As I discuss in more length in another comment it is quite possible to meet these needs using a paper ballot system (by use of a ballot marking machine or BMM which may be integrated into the tabulator), but direct recording electronic (DRE) systems are less expensive to operate and in some cases purchase. So, unfortunately, many election authorities, forced by HAVA to replace their equipment on an extremely limited budget, opted for the cheapest option. These election authorities now cannot afford a complete replacement of their voting systems and so may be "locked in" to a DRE system by their vendor.

To improve US elections administration, it is imperative to address the severe funding limitations faced by most election authorities that may leave them little or no choice over the methods they use.

Keep in mind that mail-in ballots are counted by centralized OMR which generally provide the voter less assurance that their vote was successfully tabulated than a precinct tabulation system. For example, a mail-in ballot that is erroneously marked or overvoted (too many choices in a race) may need to be simply discarded for that question, while a precinct tabulator will reject such a ballot and return it to the voter for correction or to be spoiled (replaced). Mail-in voting systems also generally use a permit system to allow voters to check online that their ballot was received, but the need to maintain a secret ballot means that permits (actually the outer envelope usually) and ballots are separated at tabulation and so mail-in voters have less assurance that their ballot actually made it to the tabulator than voters in precinct tabulation jurisdictions where they insert it themselves.

All of this said, the convenience and accessibility of mail-in voting is extremely beneficial and so an ideal solution may be a hybrid arrangement in which voters have the option of mailing in their ballots or submitting them for immediate tabulation at a precinct or early polling location. This system actually exists in several states although the "mail-in option" tends to actually be an extension of absentee voting (basically, you are allowed to vote absentee by mail even if you just want your ballot sent to your own house inside of the jurisdiction), but awareness of the mail-in voting option could be significantly improved.