The Secret Ballot

Ben Adida

Ben Adida

— 5 min read
The Secret Ballot
Photo by Arnaud Jaegers / Unsplash

Imagine yourself back in time, in November 2006. There are flip phones, but no iPhones or any other smartphones. Your county probably doesn't have a web site. And it's time to vote. In Waldenburg, a small town in Northeast Arkansas with 80 voters, Randy Wooten, a local resident, is running for Mayor.

Election day happens uneventfully, and the votes are tallied – on a Tuesday night of course. On Wednesday morning, Roxanne, Randy's wife, goes to city hall to the check the results. Because there is no web site to check. She's surprised by the results, so she gives her husband a call:

Randy did you vote for yourself?

she asks.

Of course I did! Why would you ask me that?

he responds.

"Well, you got zero votes."

Now, zero votes, that's something. It's a small town, but still. Lots of things could have gone wrong. Lots of questions to ask about the voting system, the potentially erroneous reporting of results, etc. But for now, let's focus on ballot secrecy.

Why ballot secrecy? Well, let's think about this one for a second. If Roxanne had to ask Randy whether he voted for himself to sanity check that 0-count, then it must mean she didn't vote for him! If she had, she would have already known, before talking to him, that the count was wrong.

Now, this is a little bit funny, of course, to think about how even Randy's own wife didn't vote for him, but actually it's important. There's obviously no requirement to vote for your spouse: you may love them dearly and still think they'd make a terrible mayor. We have a secret ballot because it's okay not to vote for your spouse! When you choose not to vote for your spouse, there shouldn't be a way for them to find out, ever. Even if they win the election and control the voting system, even if all the records are produced, there should be not a single trace of who voted for what candidate.

We want voting to be such that the government, your school, your employer, or even your spouse can't know how you voted. We need that secret ballot because that's the only way to ensure everyone is voting their conscience, free of undue influence. And to get that, we need to effectively give voters plausible deniability. They should be able to claim they voted for someone, and that should be perfectly believable, even if it isn't true.

No other aspect of your life works this way. People often compare voting to banking or healthcare, and those comparisons are just plain wrong. In banking, you think your accounts are highly confidential... but they're not secret from the bank, obviously. And if you buy a home, there are straightforward ways to prove your bank balance to qualify for a mortgage. So, banking is not nearly as secret as your ballot.

What about healthcare? You may think your health record is very private, and it is, but your doctors obviously have access to it. It wouldn't be a very useful health record if they didn't. And, heaven forbid, something happens to you and you're unconscious, much of the hospital staff has access to your medical record if needed. That's nothing like your ballot, which no one has access to, ever, no matter what.

Ballot secrecy is dramatically more strict than any other aspect of our lives.

Interestingly enough, it wasn't always this way. For the first 100 years of American Democracy, casting a ballot was a public act, witnessed by your neighbors, friends, and enemies. What do you think happened? Exactly what you expect: people got paid to vote a certain way. Voting became a secret act in 1892. Just 135 years ago.

Here's a painting of American elections prior to the secret ballot: notice the voter in the red shirt being sworn in, verbally speaking his vote so the two people sitting in the back can record it (on redundant records maybe?) Notice the man on the left getting served an alcoholic beverage – almost certainly as payment for his vote.

The County Election by George Caleb Bingham. borrowed from A Brief Illustrated History of Voting by Douglas W. Jones.

If voting was a public act, implementing a voting system would be very easy. You'd maintain a list of voters and the vote they cast. Anyone would be free to audit that list to check that their own vote was recorded properly and to count all the votes for themselves.

Because of the secret ballot, there's a tension between secrecy and verifiability. Everything that's hard about voting derives from the secret ballot requirement.

Let's walk through it together. Picture yourself voting. First, your identity is checked. Then, you're handed a paper ballot – and here there are variations on exactly how you fill out your paper ballot, but let's put those aside for a second. You fill out your ballot. If you make a mistake, you'll need to spoil that ballot and exchange it for a new one. That's because there's a separation between the identity check and the ballot to ensure there's never any record of how you voted. But of course that means election administrators need to keep track meticulously of every ballot handed out, and why they can't hand you a new one unless you surrender the one where you made a mistake.

You then place your marked ballot into the tabulator, and that act marks a clear delineation between your identity and your ballot. Everyone can see you voting, and hopefully no one can see what you voted for. Then, as you let that ballot be scanned by the tabulator, your ballot is now detached from your identity. From there on, that ballot box must be watched with care. No extraneous ballot should be added, and no ballots should be removed. That set of ballots is going to be counted, potentially recounted later, and likely audited. Maintaining a clean chain of custody on those ballots is of paramount importance because, if the chain of custody is broken, there is no reasonable way to recover!

This is the foundational complexity of voting. Ballot secrecy makes everything hard. So much harder than you might imagine if you haven't thought about it.

Okay, let's get back to Randy. It's worth pointing out that, fun jokes aside, Roxanne does eventually claim that she did, in fact, vote for him. And he found a few other people who claimed to vote for him. Of course, we'll never know if they're telling the truth, maybe they were just trying to spare his feelings. Maybe Randy voted for someone other than himself because he didn't actually want to be mayor! So many possible scenarios... and because of the secret ballot, we can never know what happened.

That said, the story doesn't end here. Because the vendor of that voting machine investigated and concluded their machine was good, that it must have been human error. I guess, we have to trust the voting machine? And the vendor? We'll talk about that in our next post.

[You can also listen to this article in podcast form]

References