An electronic voting system includes a vote security device (VSD), a user interface for presenting a ballot to a voter, and an audit trail printer operatively coupled to the VSD. The printer prints an audit trail ballot only in response to verifying encrypted and/or digitally signed messages received from the VSD that indicates the voter's ballot selections. The printer is structured to allow the voter to view but not access the audit trail ballot. The voter is able to accept or reject the audit trail ballot using the user interface. If the ballot is rejected, the VSD causes the printer to print a rejection indicator on the ballot, and if the voter accepts the ballot, the VSD causes the printer to print an acceptance indicator on the ballot. A digitally signed record of the voter's ballot selections is generated and stored.