Last updated on December 17, 2013

The secrecy of the vote is seen as one of the fundamental principles required in the conduct of democratic elections. Failure to secure the secrecy of the vote opens the possibility for voters to prove how they have voted, facilitating voter coercion and vote buying.²¹ Both of these practices undermine the free expression of the will of the voter and the possibility for election results to reflect the will of the voters.

If implemented properly, the paper-based system of voting effectively protects the secrecy of the vote. In the case of electronic counting, the same protections that currently exist for the hand counting of paper ballots should be applied. Electronic voting, however, introduces a number of additional ways secrecy can be violated. Voting machines record the choices cast on them by voters, and these votes may be recorded in the order in which they are cast with a timestamp. This means if someone knows the order in which voters cast their ballots on a voting machine or the time at which a voter cast their ballot and has access to the record of voting on the machine, they could determine the choices made by each voter.

Appropriate procedures restricting access to logged transactions on the voting machine would reduce this threat to the secrecy of the vote. In countries that have experienced authoritarian trends, these issues are likely to generate suspicions among citizens concerning breaches of ballot secrecy, and extra steps may be required to establish public confidence. 

Other developments with electronic voting machines are increasing the threat to the secrecy of the vote. While the VVPAT is a vital tool in building confidence in the use of electronic voting machines and in providing an audit mechanism, it can also be implemented in such a way as to undermine the secrecy of the vote. Some VVPAT systems have a roll of paper on which the voter’s choices are printed. As the choices are printed sequentially, this can be used with the order in which voters cast their ballots on the voting machine to determine the content of each person’s vote. Access to the paper audit trail cannot be restricted in the same way as with electronic records on voting machines, since the audit trail is meant to be taken out and checked against the electronic record of the voting machine.

However, not all VVPAT systems function in this way. Some voting machine paper audit trails operate a cut-and-drop system where the printed vote is cut from the roll of paper and drops into an internal ballot box within the voting machine. This ensures that audit records are randomized in the same way as placing a paper ballot into a physical ballot box.

A potential, final challenge to the secrecy of the vote from electronic voting machines comes from the most recent developments with voting machines, whereby the machines also conduct voter identification. Most voting machines still rely on a physical process for voter identification and authentication, with polling staff checking voter names against a voter list separate from the voting machine. This means voter identification data and vote data are held in completely separate processes (the former through a manual process and the latter through an electronic process), which are never linked in any way, making it impossible to link voting data to the voter.

More recent voting machines are also fulfilling the function of voter identification and authentication. This identification can be by simply entering an ID number or passcode for the voter, or it can be through the voting machine scanning a biometric attribute of the voter and identifying them from a list of approved voters. Clearly, when the voting machine identifies the voter, it possesses both pieces of information required to break the secrecy of the vote and could retain the link between the two. 

Technical solutions are readily available to ensure it is not possible to link voter data with the value of their vote. However, EMBs will need to adequately address concerns by stakeholders that this link is still maintained and that the secrecy of the vote is not violated.

While challenges related to the secrecy of the vote with electronic voting machines can be resolved, it is important that electoral stakeholders are cognizant of them and take all necessary steps to ensure the secrecy of the vote when considering the use of voting machines. At the same time, observers should evaluate whether any aspect of the process might challenge this fundamental principle.

^{21 For more detailed information on this topic, please refer to the following sections in Part 2: Legal and Procedural Frameworks; Procurement, Production, and Delivery; Security Mechanisms; Election Day (Set-Up, Testing, Security, Troubleshooting); and Internet Voting.}

NEXT:

Accountability