I worked on the 2002 model. It stored the signed voting data on a removable CF card which was under a tamper proof seal. After installation the machines were kept physically secure and, during the election they are never under the supervision of a single person. After the election the machines are returned to local elections authorities (if they are too late, they are invalidated) where the memory card is read and totalized.

We designed a vote printer that would allow the voter to see a paper copy before storing it, but it was never used.