Direct democracy runs on signatures nobody can check at scale

A ballot initiative qualifies when enough registered voters sign a sheet of paper, and the state confirms it by comparing handwriting against a signature card that may be decades old. That method is simultaneously too weak to stop a determined forger and too strict on honest voters whose handwriting has changed. Both failures come from the same missing step.

Picture a county clerk's office in August. A campaign has just delivered boxes containing a hundred and eighty thousand signatures, and the threshold is a hundred and twenty two thousand. The clerk has a statutory deadline measured in weeks, a small team, and a job that consists of drawing a random sample, pulling each signer's registration record, and deciding by eye whether two marks were made by the same hand.

Some of those marks were made by someone who registered to vote in 1994 and has not signed anything with a pen since. Some were made in a supermarket car park against a clipboard held at an awkward angle. Some, in a small number of documented cases, were copied out of a publicly available voter roll by a circulator who was being paid for each line on the sheet.

The clerk cannot reliably tell these apart. Nobody could. And the decision they make determines whether a measure reaches the ballot, which means it will be challenged in court either way, by the campaign if it fails and by opponents if it passes.

How are ballot petition signatures actually verified?

The process is more interesting than it sounds, and the failure points are not where most people assume.

The threshold

Qualification rules vary widely by state, but the shape is consistent: a campaign must gather signatures from registered voters totalling some percentage of a previous statewide vote, sometimes with geographic distribution requirements across counties or districts, inside a fixed window. Because a predictable share of raw signatures will be invalid for entirely innocent reasons, campaigns routinely gather a substantial cushion above the threshold. The National Conference of State Legislatures maintains the comparative requirements, and Ballotpedia tracks them per measure.

That cushion is worth dwelling on, because it tells you how bad the verification problem already is. Campaigns budget for a large fraction of honest signatures to be thrown out. Nobody treats this as a scandal. It is simply the accepted error rate of the method.

The circulator

Signatures are gathered by circulators, who may be volunteers or paid staff. Paid circulation is lawful in many states, and attempts to ban it have run into constitutional problems, because petitioning is protected activity and restrictions on it get scrutinised. Circulators typically sign an affidavit attesting that they personally witnessed each signature.

That affidavit is the only assurance in the entire chain that the person who signed was actually present. It is a self attestation by the party with the financial incentive, which is the same structural weakness we described in approvals that are really just mailbox proofs. It is an assertion, not evidence.

The sample

Few jurisdictions verify every signature. Most draw a statistically valid random sample, project the validity rate onto the whole submission, and certify or reject accordingly, with a full count sometimes triggered when the projection lands near the threshold. This is sound statistics applied to an unsound measurement. Sampling correctly estimates the rate at which the verification method returns valid, which is not the same thing as the rate at which the signatures are genuine.

The comparison

The verification itself is handwriting comparison. A clerk, usually not a trained forensic document examiner, looks at the mark on the petition and the mark on file, and forms a judgment. The exemplar may be years or decades old. It may have been captured on a signature pad that flattened the stroke into something unrecognisable. The signer may have developed arthritis, or learned to sign in a different script, or simply never had a consistent signature in the first place.

Why does paying per signature produce fabricated signatures?

Not because circulators are unusually dishonest. Because of where the incentive sits relative to where the verification sits.

A circulator paid per signature captures the full value of each line immediately. The cost of an invalid line falls later, on the campaign, diffused across the whole submission, and is indistinguishable from the ordinary background invalidity everyone budgets for. That is close to a textbook description of a control gap: the person with the incentive to inflate is not the person who bears the cost of inflation, and the detection mechanism cannot attribute a specific bad line back to them within any useful timeframe.

Prosecutions for petition fraud have been brought in multiple states in recent years. Reporting between 2024 and 2026 described attorney general investigations and criminal charges in several jurisdictions including Nebraska, Utah and California, and election bureaus in states such as Michigan have flagged circulators previously associated with fraudulent submissions reappearing in later cycles. We describe these categorically rather than case by case, because the specifics vary across contemporaneous local reporting and the details matter less than the pattern: the fraud methods that recur are copying names from publicly available voter rolls, outright forgery, and paying people small sums to sign under someone else's name.

All three defeat handwriting comparison for the same reason. The forger is producing a mark that will be compared against an exemplar the clerk also finds ambiguous. The method has no discriminating power at the point where it is most needed.

Why is signature matching both too weak and too strict?

This is the heart of it, and it is why the usual reform proposals go wrong.

Run the two failure directions side by side. In the first, a forged signature is accepted, because a clerk under deadline pressure comparing two ambiguous marks will not reliably catch a competent forgery. In the second, a genuine signature is rejected, because that same clerk comparing a genuine but changed signature against a stale exemplar cannot distinguish it from a forgery either.

They are the same measurement error viewed from opposite sides. And the second one is a civil rights problem, not an inconvenience. Concerns about signature matching in election administration are long standing and well documented in litigation and advocacy: rejection rates fall unevenly on younger voters whose signatures are still forming, on older voters and voters with disabilities whose motor control has changed, on voters who learned to write in another script, and on voters who signed their registration card so long ago that the exemplar barely resembles them. Where a cure process exists, notice periods are short and contact details are often out of date.

So the honest statement of the problem is this. The current mechanism admits fraud and excludes citizens, and every reform that pulls one lever moves the other in the wrong direction. Tighten the matching standard and more genuine voters are disenfranchised. Loosen it and more forgeries qualify. Ban paid circulation and you burden the legitimate campaigns that cannot field volunteers, which in practice means the ones without institutional backing.

Look at the last column. It moves both failure directions at once, which no adjustment to the matching threshold can do. That is the entire argument for changing the mechanism rather than tuning it.

What would a petition signature that cannot be forged look like?

Offered as a design proposal, not a shipped product, and only for jurisdictions whose law permits electronic petitions. Most do not. More on that in the limits.

The voter signs, on their own device, a payload that names the exact petition and the moment:

{
  "action":      "petition.sign",
  "petition_id": "STATE-2026-INIT-0043",
  "text_hash":   "sha256 of the exact petition text as circulated",
  "signed_at":   "2026-09-30T15:42:08Z",
  "district":    "county or district for distribution requirements",
  "voter_ref":   "reference the clerk resolves against the roll",
  "nullifier":   "one way value scoped to this petition only"
}

Three fields do the work. The text_hash records what the voter actually agreed to, which addresses the complaint that circulators sometimes describe a measure as something other than what it says. The nullifier is a value derived so that the same human produces the same value for this petition and an unlinkable value for any other, which gives per petition uniqueness without building a registry of who signs what. And signed_at is bound into the signature, so an entry cannot be backdated into a closed window.

The clerk's verification becomes a function rather than a judgment:

def verify_entry(entry, roll, published_key, seen_nullifiers):
    payload = canonical_json(entry["payload"])

    # 1. Is this a real, unaltered signature over this petition?
    if not ed25519_verify(published_key, entry["sig"], sha256(payload)):
        return "invalid"

    # 2. Did they sign the text that was actually filed?
    if payload["text_hash"] != FILED_PETITION_TEXT_HASH:
        return "signed different text"

    # 3. Has this human already signed this petition?
    if payload["nullifier"] in seen_nullifiers:
        return "duplicate"
    seen_nullifiers.add(payload["nullifier"])

    # 4. Eligibility is NOT established here. It comes from the roll.
    if not roll.is_registered(payload["voter_ref"], payload["district"]):
        return "not a registered voter in district"

    return "valid"

Step four carries a warning that belongs in bold in any pilot document. A presence signature proves that a unique living human was there and signed this text once. It says nothing whatsoever about whether that human is a registered voter in the relevant district. Eligibility comes from the state's voter roll and can come from nowhere else. Anyone who conflates the two is selling something, and we have written the general version of that caution in uniqueness without identity.

Note also that the nullifier construction described here relies on selective disclosure techniques that are on our roadmap rather than shipped. What is shipped today is the presence signature and the offline verifiable receipt. A pilot could run with a simpler uniqueness mechanism at some cost to unlinkability, and should say so plainly rather than describe capabilities that do not exist. You can see the shipped presence flow in the one human, one entry demo.

The objections that deserve a real answer

These are strong. A post that waved at them would not be worth reading.

Coercion

A signature gathered on a device held by a circulator, in the circulator's presence, is a different act from one made privately. The person may feel watched, hurried, or unable to decline. This concern is legitimate and it applies to paper clipboards too, but a device flow can make it worse by adding an aura of officialdom.

There is an important nuance that is usually missed. Petition signatures are, in most jurisdictions, public records, unlike ballots, which are secret. That difference matters for the analysis: the objection to petition coercion is not a ballot secrecy objection, because there is no secrecy to protect. It is a pressure objection, and the mitigation is different. A design should let the voter complete the signature on their own device rather than the circulator's, and should make declining silent rather than something the circulator observes.

The digital divide

Any device based mechanism excludes people without devices, and those people are disproportionately older, poorer and rural, which is to say disproportionately the people whose access to direct democracy is already thinnest. This is not solvable by making the app better. It is only solvable by keeping the paper route open on equal terms.

The constitutional burden

Courts scrutinise restrictions on petitioning. A state that made electronic signing mandatory would be imposing a new precondition on protected activity, and would deserve to lose. This is the strongest argument in the whole debate and it points clearly to one conclusion: a supplementary optional path is defensible, and a mandatory replacement is not. The burden of proof sits on anyone proposing to change how democratic access works, and it should be a heavy one.

Honest limits

Law is the gate, not technology. Most states require wet signatures on initiative petitions, and electronic signature statutes commonly carve out particular document classes, with election law varying state by state. In most jurisdictions this proposal is currently illegal, and no amount of cryptographic elegance changes that. This is a policy argument aimed at the minority of jurisdictions that already permit electronic petitions, and a pilot design for a clerk willing to run one.

It does not establish eligibility. Stated again because it is the most likely misreading. Presence and uniqueness are not registration. The roll remains authoritative.

Fraud may be a minority of invalidity. An honest pilot has to measure this. If the great majority of rejected signatures are honest voters failing a bad comparison rather than forgeries, then the strongest case for this change is the disenfranchisement side, not the fraud side, and the argument should be made that way round. We do not know the split, and neither does anyone else with published data.

Nothing here stops a campaign from lying about the measure. The text hash records what was signed. It does not record what the circulator said it meant.

Manav has no election deployments. No pilot, no clerk, no jurisdiction. Treat this as an argument, and hold it to the standard of one.

What a clerk or campaign could actually pilot

1. Establish whether your jurisdiction permits electronic petition signatures at all. This single question ends the conversation in most states, and knowing the answer is worth an afternoon.
2. Publish your current invalidity breakdown. How many rejected signatures were duplicates, how many not registered, how many failed comparison. Almost nobody publishes the third number separately, and it is the one that matters.
3. Measure cure outcomes. Of the signatures rejected on comparison and subsequently cured, how many turned out to be genuine? That is a direct estimate of the method's false rejection rate.
4. Run the text hash idea on paper first. Print a short verification code derived from the filed text on every sheet. It costs nothing and addresses bait and switch complaints immediately.
5. Pilot in parallel, never as a replacement. Any electronic path runs alongside paper with identical legal weight, or it should not run.
6. Instrument the circulator level data. Validity rate per circulator, published in aggregate. Most fraud cases in the public record involve circulators whose numbers were visibly anomalous before anyone acted.
7. Write the coercion mitigations into the pilot rules. Signing completes on the voter's own device, declining is silent, and no circulator sees the outcome.
8. Commit to publishing the results even if they are unflattering. A pilot that can only succeed is not a pilot.

Frequently asked questions

How are ballot petition signatures verified, and can it be done electronically? In most jurisdictions, election officials draw a random sample and compare each handwritten signature against the mark on the voter's registration record, projecting the validity rate onto the full submission. A handful of jurisdictions permit electronic petition signing. Where it is allowed, an electronic petition can require a present voter's device signature bound to the exact petition text, which is checked arithmetically rather than by subjective comparison.

Is paying circulators per signature legal? Paid petition circulation is lawful in many states, and outright bans have faced constitutional challenges because petitioning is protected activity. Some states restrict the per signature payment structure specifically rather than paid circulation generally. The rules vary considerably, so the answer depends entirely on the jurisdiction.

Why do so many valid signatures get rejected? Mostly because handwriting comparison is unreliable. A registration exemplar may be decades old, captured on a low quality signature pad, or made before the voter's handwriting changed through age, disability or habit. Rejection rates fall unevenly on younger voters, older voters, voters with disabilities and voters who learned to write in another script, which is why signature matching has been the subject of sustained litigation and advocacy.

Would electronic signing make petition fraud impossible? No. It would make forgery and roll copying fail deterministically, because there would be no valid receipt to produce, and it would make duplicate signing detectable without a central registry. It would not stop a campaign from misrepresenting a measure, and it would not verify that a signer is a registered voter, which still requires the state's roll.

Does this create a database of who signed which petition? It should not, and a design that did would be worse than the status quo. The proposed uniqueness value is scoped to a single petition, so the same person produces an unlinkable value for every other petition. Note that this relies on selective disclosure techniques that are on our roadmap rather than shipped today, which any honest pilot proposal must state.

Should electronic petition signing replace paper? No. Any mechanism that requires a device excludes people who do not have one, and those people are already the least well served by direct democracy. A supplementary optional path that runs alongside paper with equal legal weight is defensible. A mandatory replacement would impose a new precondition on protected political activity and should fail.

Sources

1. National Conference of State Legislatures, ballot measure signature requirements and circulation rules by state: ncsl.org
2. Ballotpedia, signature requirements, certification outcomes and petition litigation by measure: ballotpedia.org
3. US Election Assistance Commission, election administration guidance and data: eac.gov
4. National Association of Secretaries of State, state election official resources: nass.org
5. Uniform Law Commission, Uniform Electronic Transactions Act and its exclusions: uniformlaws.org
6. W3C, Web Authentication Level 3, the specification behind device bound signatures: w3.org
7. Manav developer documentation, presence signatures and offline verifiable receipts: manav.id/docs

A verification method that cannot tell a forgery from an old man's changed handwriting is not strict or lenient. It is simply not measuring the thing it claims to measure.