Secret ballot

Why must a vote be cast in secret when almost everything else in a democracy is done in public?

Almost everything else a democracy does is done in the open. Debates are recorded, legislators' votes are published, judgments are reasoned in public, and we treat that openness as the guarantee of honesty. Then, at the one moment where power actually changes hands, the system does the opposite — and hides the act so thoroughly that even you cannot demonstrate afterwards what you did. Why would a tradition that insists on transparency everywhere else build a room designed to produce no record?

Take the obvious answer first: secrecy protects the voter from retaliation. True, but incomplete — and following the gap is what makes this interesting.

Suppose the state offered secrecy as a right you could waive. You may vote privately, or you may ask for a receipt proving how you voted. That seems more free, not less. Trace what happens.

Your employer, landlord, or the local party organiser now has something he did not have: a request he can make. He asks for the receipt. What does your refusal tell him? That you voted the other way — because anyone who voted his way would happily prove it. The moment proof is possible, silence becomes evidence. Optional secrecy is therefore not optional at all: those who most need protection are exactly those whose refusal is most revealing.

So secrecy must be compulsory. You may not prove how you voted, not because the state distrusts you, but because a system in which you could prove it is one in which you would be required to. Hence ballots may not leave the polling station, spoiled papers must be surrendered, and photographing a marked ballot is an offence in many jurisdictions.

Now ask what compulsory secrecy destroys. A vote-buying arrangement is a contract, and like any contract it needs verification: I pay, you deliver, and I must be able to check that you delivered. Coercion has the identical structure — a threat only works if the threatener can tell whether it was obeyed. Remove verification and neither survives. The buyer is left offering money for something he cannot confirm, and the rational voter takes the money and votes as he pleases, which quickly makes the buyer stop offering.

The state has not made vote-buying illegal and then policed it. It has arranged the physical process so that the promise cannot be made in enforceable form. The mechanism works by destroying information — and it works on both parties, including the one it protects.

Does the history bear this out? The details are the argument. Before reform, voting in many places was viva voce — you declared your choice aloud to the clerk, and Kentucky retained this until 1891. Where paper was used, parties printed their own tickets, distinguishable by colour, size, and typeface, obtained from a party worker and deposited under observation, so the paper itself was the receipt. The reform adopted in Victoria and South Australia in 1856, known thereafter as the Australian ballot, changed four things together: the ballot is printed by the state, lists every candidate, is issued at the polling place, and is marked in a screened booth. Each element removes one way of proving your choice. Britain's Ballot Act followed in 1872, and American states adopted the system rapidly from 1888.

Three refinements connect the steps.

The first is that this is a commitment device, and a familiar kind. It works exactly as constitutional entrenchment does — by removing an option from your future self so that nobody can make you exercise it. The voter is protected not by being given a choice but by being denied one.

The second is that the protection is only as good as the moment it covers. Every arrangement that lets a ballot be marked away from the supervised booth reopens the hole: postal voting, proxy voting, and voting at home under a family member's eye are where coercion demonstrably persists, and it is why several European countries restrict postal voting far more tightly than the United States does. The booth is not a symbol. It is the part that does the work.

The third is that the design has a real cost, and it is not merely theoretical. Because you cannot prove how you voted, you also cannot check that your vote was counted as cast — the property that would make an election individually auditable is the same property that would make it sellable. Cryptographic voting research treats this directly under the names receipt-freeness and coercion-resistance, seeking systems that let you verify the total without producing anything you could show a buyer, and the difficulty of achieving both is a live problem rather than a solved one. There is also a standing minority argument, associated with the republican tradition, that secrecy licenses voting on motives one would be ashamed to defend — so the reform bought protection at some cost in accountability.

• Why legislators' votes are recorded on the opposite reasoning, and what distinguishes the two cases.
• How end-to-end verifiable voting schemes try to give a voter confidence without giving them a receipt.

Every term the collection defines is gathered in the glossary.