Secrecy: no one can link a voter to a ballot

Ballot secrecy is the requirement that no one, including the people running an election, can link a voter to their ballot choices, and that the voter cannot prove those choices to someone else. The first half protects privacy. The second half protects freedom: if a vote can be proved, it can be bought or demanded. My Vote Forward keeps anything ballot-like strictly secret and separate from the opinions people choose to publish.

Definition

The site glossary defines secrecy as the requirement that no one, including the operator, can link a voter to their ballot choices, and that the voter cannot prove those choices to someone else (see the short entry in the glossary). International law makes it a standard for genuine elections: Article 25 of the International Covenant on Civil and Political Rights requires elections “held by secret ballot, guaranteeing the free expression of the will of the electors”.⁠¹ The U.S. Voluntary Voting System Guidelines 2.0 (VVSG 2.0) make it a design principle: Principle 10 states that “the voting system protects the secrecy of voters’ ballot selections”.⁠²

The two halves have names in the research literature. Privacy is the inability of others to learn a vote. Receipt-freeness and coercion resistance concern the voter’s inability to prove a vote. Juels, Catalano, and Jakobsson define a scheme as coercion-resistant if it is “infeasible for the adversary to determine” whether a coerced voter complies with the adversary’s demands.⁠³

Origin and history

Open voting was the norm in many places into the nineteenth century. The Australian Electoral Commission notes that until the 1850s “people voted publicly, which left them vulnerable to intimidation and coercion,” and that the “Australian ballot,” now known as the secret ballot, was the response.⁠⁴ In the United States, the Congressional Research Service reported in 2024 that “provisions for a secret ballot appear in all states’ laws or constitutions”.⁠⁵ The full account, including the debates over whether secrecy weakened public accountability, is in Secret ballot.

How secrecy is protected and checked

Secrecy is protected by procedures and by design. At a polling place, a private booth, a ballot without names, and mixing of cast ballots in a box break the link between voter and choice. Federal law requires voting systems to let the voter “verify (in a private and independent manner) the votes selected,” and to give voters with disabilities “the same opportunity for access and participation (including privacy and independence) as for other voters”.⁠⁶

Secrecy has to coexist with checking. Audits examine ballots without knowing whose they are. End-to-end verifiable voting systems give voters a receipt that, in the VVSG 2.0 description, “allows them to verify their vote was included in the outcome but does not reveal to anyone how they voted”.⁠² The hard cases are remote voting and small groups. Remote voting removes the supervised booth, so a family member or employer may watch. Small contests can reveal votes through totals alone: if a precinct reports one vote for a candidate, its voter may be identifiable.

Common confusions and neighboring terms

• Secrecy vs. privacy of data. Data privacy limits who can see personal information. Ballot secrecy goes further: even the voter must be unable to prove the vote.
• Secrecy vs. anonymity. A voter is identified when checking in; secrecy requires that the ballot cast afterward cannot be traced back.
• Secrecy vs. verification. Verification checks that ballots were counted as cast; well-designed verification never reveals individual choices.
• Secrecy vs. coercion. Secrecy is a main defense against coercion, but it does not remove the social pressure that produces it.
• Secret ballot vs. published opinion. A person may publish an opinion; publishing a vote would defeat the protection secrecy provides to everyone.

How My Vote Forward uses the term

My Vote Forward treats ballot secrecy as non-negotiable. A ballot cannot be made public through the framework, and published opinions are held apart from anything ballot-like so that a public statement cannot serve as proof of a vote. Before any real aggregate release, the framework requires a documented privacy design that sets minimum group sizes, because totals for tiny groups can reveal individuals. See Private voting, Intimidation, and Privacy. The demo shows only a simulated sample ballot.

Unresolved questions

• Can any remote voting design offer coercion resistance comparable to a supervised booth, and at what cost to usability?
• How small may a reported group be before totals risk revealing individual votes?
• Should people be allowed to publish an opinion that matches a pending ballot item, given that it may signal how they intend to vote?