Private voting

Your vote is your final, official choice. It is different from saying what matters to you, and different from telling people what you think. A vote decides who holds office or whether a measure passes.

In My Vote Forward, your vote is always secret. There is no setting that makes it public, no button to share it, and no record that links you to your choices. That rule cannot be changed by you, by an administrator, or by anyone who pays.

It is important to be clear about one more thing. These websites do not conduct official votes. The demo shows what a ballot screen might look like, using simulated data. Real official voting would need legal authority, independent testing, and approvals that do not exist for this project.

Defined terms

Vote. A choice recorded on an official ballot in an election run by a legally responsible authority.

Full official ballot. Every contest and question a particular voter is eligible to decide in a given election, as set by the responsible authority. A full ballot can include candidate contests at several levels of government and ballot measures.

Ballot secrecy. The requirement that no one can link a voter to their ballot choices, and that the voter cannot prove those choices to someone else. The second half matters: if a voter can prove a choice, that proof can be demanded or bought.

Verification. Evidence that ballots were recorded and counted as cast. Verification can be individual (a voter checks something about their own ballot) or public (anyone can check the tally).

Authentication. Proving control of an account or credential. Authentication is not the same as eligibility. See Identity and registration.

Eligibility. The legal right to vote in a specific contest, determined by the responsible authority under its law.

Operational status. Whether a capability actually exists and is authorized for use. For official voting in this project, the status is: not operational, not authorized.

The vote is a separate decision

The framework keeps the vote apart from priorities and opinions for three reasons.

It decides. Priorities and opinions are inputs. The vote is the decision itself, under law. Mixing a decision with inputs would let informal signals masquerade as official results.

It is the most attractive target. Because the vote decides, it is what coercers and buyers want to control. The secret ballot was adopted to address exactly that. The Australian Electoral Commission notes that until the 1850s "people voted publicly, which left them vulnerable to intimidation and coercion," and that the reform became known as the "Australian ballot" ¹. The full history is in The secret ballot.

Its secrecy is a recognized right. The Universal Declaration of Human Rights says elections "shall be held by secret vote or by equivalent free voting procedures" ². The International Covenant on Civil and Political Rights requires elections "held by secret ballot, guaranteeing the free expression of the will of the electors" ³.

An opinion can be shared on purpose. A vote cannot. That asymmetry is deliberate: an opinion is expression, and the person can weigh the cost of sharing it. A ballot is a decision whose integrity depends on no one being able to verify it was cast a certain way.

Hypothetical example. A worker's supervisor says, "Show me your ballot screen before you submit." If the system allowed a ballot to be shared or displayed with a confirmation that proves the choice, the supervisor's demand would have teeth. The framework's rule is that no such proof exists to be demanded. Whether any remote system can fully prevent pressure in the room is a separate and unsolved problem. See Intimidation.

The full official ballot

The framework's long-term ambition includes the full official ballot, not only measures. A voter in a single election may face contests for federal, state, county, city, school, and special district offices, plus statewide and local measures. In the United States, the Census Bureau's 2022 Census of Governments counted 90,837 local governments ⁴, and one address can fall within several of them. A full ballot is therefore specific to each voter's address.

Three limits follow for this project:

1. The ballot comes from the authority. The framework does not write ballots, decide what appears on them, or assign voters to districts.
2. Candidate research is limited to the official guide. For candidate contests, research material is limited to the relevant official ballot guide for the voter's area and ballot. The framework does not rate, endorse, or match candidates, and does not infer candidate positions.
3. Nothing is decided here. A demo ballot is a teaching tool, labeled as simulated.

Secrecy and verification as requirements

A trustworthy election has to meet two requirements that pull against each other.

• Secrecy: no one can connect a voter to a choice, and the voter cannot prove a choice.
• Verification: voters and the public can confirm that ballots were recorded and counted correctly.

Paper systems manage the tension physically: a voter marks a paper ballot in private, drops it in a box, and the paper can later be counted or audited without knowing who cast it. Electronic and remote systems must achieve the same result with software, cryptography, and procedure, and every added channel adds new risks.

Expert bodies have set high bars here. In 2018 the National Academies of Sciences, Engineering, and Medicine recommended that "Elections should be conducted with human-readable paper ballots," that "Internet voting should not be used at the present time," and that states "mandate a specific type of audit known as a 'risk-limiting' audit." It also stated that "no current technology can guarantee their secrecy, security, and verifiability" for ballots returned over the internet ⁵. That assessment is dated and scoped to its time; it is cited as the standing expert caution, not as a permanent verdict on all future technology.

Standards work continues. The U.S. Election Assistance Commission adopted Voluntary Voting System Guidelines 2.0 on February 10, 2021 ⁶, and has announced a process, with technical support from NIST, to evaluate cryptographic end-to-end verifiable protocols. Those protocols aim to let voters confirm their ballots were "cast as intended" and "recorded as cast," and to provide "a publicly verifiable tabulation process" ⁷. The EAC is explicit that an approved protocol is not a certified system: systems using such protocols must still be evaluated against "all applicable requirements from the VVSG 2.0" ⁷.

Signing in is also not voting eligibility. NIST's Digital Identity Guidelines, SP 800-63-4, released in final form in July 2025, cover identity proofing, authentication, and federation as distinct problems ⁸. A passkey or fingerprint can show that the person holding a device unlocked an authenticator. It does not show that the person is eligible to vote in a contest, and it does not show that no one is standing beside them. See Hardware.

Current status: not operational

To be precise about the present:

• The websites do not conduct official votes. No official ballot is issued, cast, or counted on myvoteforward.org or the demo.
• The demo uses simulated data and a simulated ballot. It may show the shape of a ballot screen. Nothing done there is a vote.
• No certification exists. Using encryption, a cloud provider, biometrics, or a published standard as a reference does not make anything certified or compliant. VVSG adherence in the U.S. is voluntary "except in select states where it is required by their own state law" ⁶, and certification is a separate formal process this project has not entered.
• No single switch can enable official voting. Official use would require legal authority from a responsible jurisdiction, independent evaluation, accessible alternatives, audit procedures, and dispute resolution, all of which are outside this project's control. See Security and Jurisdictions.

The framework treats secure official voting as a research and requirements program. That program is described in the Trust chapters.

Evidence

• Normative and legal texts: ballot secrecy is an international human rights standard ^{2 3}.
• History: public voting exposed voters to intimidation and coercion, and the secret ballot was adopted in response ¹.
• Expert assessment (2018): paper ballots, risk-limiting audits, and no internet return of marked ballots at that time ⁵.
• Current standards activity: VVSG 2.0 and the EAC's end-to-end protocol evaluation process ^{6 7}.
• Identity guidance: identity proofing and authentication are separate assurance problems ⁸.

Competing interpretations

"Technology can now deliver secure remote voting." Some researchers and vendors argue that end-to-end verifiable cryptography makes remote voting feasible. The EAC's protocol process shows the idea is being taken seriously ⁷. Critics answer that verifying the math does not secure the voter's device or protect the voter from someone in the room.

"Secrecy should yield to transparency." Another view holds that public voting would end disputes because everyone could check. The historical record of intimidation under public voting is the main answer ¹, and international standards reflect it ³.

"An educational site should not discuss official voting at all." Some will argue that describing a future official ballot creates confusion. The framework's position is that the ambition is real and should be stated, together with an equally clear statement that it is not operational and not authorized.

Application to this framework

• The vote is separate from priorities and opinions in data, interface, and rules.
• Ballot privacy cannot be switched off. There is no ballot-share button, no public vote history, and no person-to-ballot research product.
• The demo ballot is labeled as simulated on every screen.
• The framework names requirements (secrecy, verification, eligibility, accessibility, coercion resistance, availability, audit, dispute resolution) and does not claim to meet them.
• No absolute guarantee is offered: not "zero fraud," not "fully anonymous," not "100% secure."

Unresolved questions

• Can remote official voting resist household or employer coercion? See Intimidation.
• Which verification methods preserve secrecy and remain understandable to ordinary voters? See Audits and verification.
• How should accessible voting and assisted voting fit a secrecy model without weakening it?
• How would one voter's full ballot be assembled across overlapping jurisdictions without errors? See Identity and registration.
• What independent body would evaluate an implementation, and under which jurisdiction's law?