Secret Ballot Software in Australia: How to Protect Voter Privacy and Election Integrity

People are more likely to trust an election when they know their vote is private.

But privacy is only half of the equation.

An organisation also needs to know that only eligible people voted, that nobody voted more than once where the rules require one vote, that the ballot was counted correctly and that the result can be explained if it is challenged later.

That creates an apparent problem:

How do you prove an election was properly conducted without being able to see how individual people voted?

A well-designed secret ballot solves this by separating voter authentication and election administration from the actual voting choice.

This is one of the most important principles behind secure secret ballot software in Australia.

The goal is not to make an election impossible to scrutinise. The goal is to make the process auditable without making individual votes identifiable.

What is a secret ballot?

A secret ballot is a voting process designed to prevent a person’s voting choice from being linked back to them.

The concept is familiar from Australian elections.

The Australian Electoral Commission describes the secrecy of the ballot as a fundamental protection allowing voters to make their own choice privately. Its processes are designed to prevent ballot papers from being matched to the identifying information used to establish voter entitlement.

The same principle can apply to organisational elections.

A secret ballot may be appropriate for:

The exact requirements depend on the organisation and the rules governing the particular vote.

For some Australian election frameworks, secrecy is specifically required. For example, the Fair Work (Registered Organisations) Act 2009 requires relevant registered organisation election rules to provide for secret ballots where a ballot is required, together with provisions dealing with the conduct of the ballot and scrutineers.

That does not mean every Australian organisation is subject to the same requirements.

The first step is always to establish what rules apply to the particular election.

Why ballot secrecy matters

A secret ballot does more than protect someone’s privacy.

It can also protect the integrity of the decision itself.

Imagine an association electing a new president.

If members believe administrators can see how they voted, some may feel pressure to vote a particular way. The pressure does not have to be explicit. It can come from workplace relationships, committee politics, professional relationships or simply concern about how a particular person might react.

A genuinely secret ballot reduces that risk.

Members can make their decision without having to prove their choice to anyone else.

That is one reason secrecy is such a long-standing feature of Australian elections. The AEC describes the secret ballot as a mechanism that protects an individual’s freedom to make their own voting decision.

For organisations, the same principle can help create confidence in member elections and sensitive ballots.

Secret does not mean unauditable

This is where many organisations get confused.

Some people assume that if a ballot is anonymous, nobody can verify what happened.

That is not correct.

A well-designed secret ballot can provide evidence that:

What should remain private is the connection between an individual voter and their voting choice.

The distinction is critical.

You should be able to audit the election without being able to identify how Sarah voted.

How does secret ballot software work?

The exact technology differs between providers, but the underlying concept is straightforward.

There are effectively two different questions:

Question 1: Is this person entitled to vote?
The system needs enough information to establish voter eligibility. This might involve:

Question 2: What did the person vote for?
For a secret ballot, that information should be protected from being linked back to the voter’s identity.

The system therefore needs to handle voter authentication and ballot data in a way that preserves secrecy.

The precise technical architecture matters.

An organisation should not simply accept the statement that a platform is “anonymous”. It should understand how anonymity is maintained and who, if anyone, can access the underlying records.

Voter authentication and ballot secrecy are different

This is probably the most important technical distinction to understand.

Authentication answers: Is this person authorised to vote?

Ballot secrecy answers: Can anyone determine how this person voted?

A secure system needs to address both.

For example, suppose an association has 1,000 eligible members.

The organisation needs to know which members have been issued voting credentials and which members have already voted. Otherwise, it may be impossible to enforce the election rules.

But once a member submits a secret ballot, the organisation should not automatically be able to open an administrative screen and see:

John Smith — voted for Candidate A.

That would defeat the purpose of the secret ballot.

The system should instead provide the organisation with appropriate participation and election records while protecting the voter’s actual selection.

The voter roll is the foundation

Secret ballot security starts before voting opens.

The organisation needs a reliable voter roll.

That means establishing:

This is particularly important for member-based organisations.

For example, NSW Government guidance for incorporated associations states that the constitution should specify member voting eligibility and the resolutions that can be determined by postal or electronic ballot.

The technology cannot decide these questions for the organisation.

Those decisions come from the governing rules.

The software should then implement them consistently.

What happens when a voter logs in?

The voter authentication process needs to establish that the person accessing the ballot is entitled to participate.

Depending on the election, the process might use a unique credential, secure link, password, PIN, SMS verification or another method.

The important thing is that authentication should not automatically expose the voter’s eventual selection.

This is where purpose-built election systems can differ significantly from ordinary survey tools.

A survey application may be designed to collect responses from identified users.

A secret election may require something more sophisticated: verify the voter, record participation, protect the ballot and preserve the separation between identity and choice.

Preventing duplicate voting

A secret ballot still needs controls against duplicate voting.

For a one-person-one-vote election, the system should know that a voter has already participated.

But that does not mean the system needs to retain a permanent record saying what that voter selected.

The distinction can be maintained through appropriate election architecture.

A practical example:

1. A member is authenticated against the approved voter roll.
2. The system establishes that the member has not previously voted.
3. The member receives access to the ballot.
4. The member submits their vote.
5. The system records participation while protecting the ballot choice from being linked back to the member.
6. The member cannot use the same voting entitlement again.

The exact implementation depends on the technology and ballot design.

But the principle is worth understanding before selecting a provider.

What should an administrator be able to see?

This is an important question to ask during procurement.

An administrator may legitimately need to know:

They may not need to know:

Good role-based access controls should reflect these differences.

The administrator responsible for uploading the voter list does not necessarily need unrestricted access to ballot information.

A communications administrator does not need access to confidential election records.

A scrutineer may need election reports without receiving unrestricted administrator privileges.

Limiting access is part of protecting voter privacy.

Audit trails: proving what happened without revealing votes

An audit trail is one of the most valuable features of a modern ballot system.

But the audit trail needs to be designed carefully.

Useful records may include:

The purpose is to create a reliable history of the process.

The audit trail should not become a back door into individual voting choices.

For a secret ballot, the objective is: auditable process, confidential choice.

That distinction should be discussed with the voting provider before the election starts.

Can a secret ballot be independently scrutinised?

Yes.

Secret does not mean nobody can observe or verify the process.

The Australian Electoral Commission provides a useful real-world example. Scrutineers can observe and verify aspects of Australian electoral processes while ballot secrecy is maintained. AEC procedures are specifically designed to prevent identifying information from being matched with the ballot paper during relevant stages of the count.

Organisational elections can apply the same general principle.

A scrutineer might be able to review:

They do not necessarily need access to identifiable individual voting choices.

For registered organisations, the Fair Work (Registered Organisations) Act specifically provides for rules covering scrutineers in relation to secret ballots.

What about electronic ballots for incorporated associations?

State-based rules can be very specific.

For example, NSW incorporated associations can use postal, electronic or combined ballots for certain resolutions where the applicable requirements are met.

NSW Government guidance states that where an electronic ballot is secret, the returning officer must ensure the member cannot be identified from the electronic ballot paper. It also requires electronic ballot information and reports to be reviewed when determining the result and requires voting records to be securely stored for at least eight weeks after the ballot closes.

This illustrates an important point.

Secrecy and recordkeeping are not opposites.

The organisation can retain records needed to establish how the ballot was conducted while still protecting the identity of individual voters.

Protecting personal information

An online secret ballot will often involve personal information.

That may include:

Where the Privacy Act and Australian Privacy Principles apply, organisations need to consider how that information is collected, stored, accessed, disclosed and eventually disposed of.

OAIC guidance on APP 11 states that APP entities must take reasonable steps to protect personal information from misuse, interference and loss, as well as unauthorised access, modification or disclosure. The guidance also covers technical and organisational measures, third-party providers, access security and destruction or de-identification when information is no longer required, subject to applicable exceptions.

This matters when an organisation uses an external voting provider.

Ask:

These are governance questions as much as technical ones.

Encryption is necessary, but it is not enough

Encryption is often one of the first security features mentioned by voting providers.

It matters.

But encryption alone does not make a secret ballot trustworthy.

An organisation should also consider:

A useful way to think about it is this: Encryption protects information. Election controls protect the integrity of the vote.

You need both.

Protecting administrator access

The people running the election can represent a security risk if access is poorly controlled.

A platform should therefore limit administrative privileges and provide appropriate controls around privileged accounts.

For example, it may be reasonable for one administrator to manage voter records while another person has access to reporting.

Neither should automatically have unrestricted access to confidential ballot data.

The Australian Cyber Security Centre’s Essential Eight includes restricting administrative privileges as a core cyber security mitigation strategy.

The principle is simple: Give people the access required for their job, not access to everything.

What happens after voting closes?

Election security does not end when the final vote is counted.

The organisation needs a process for handling the resulting records.

Depending on the ballot, this may include:

The retention period should be based on the applicable legislation, rules, contractual arrangements and legitimate governance requirements.

For example, NSW incorporated association ballot rules specify minimum retention requirements for voting rolls, ballot papers and electronic ballot records.

Where privacy obligations apply, organisations should also avoid retaining personal information indefinitely without a legitimate reason.

Security includes the end of the information lifecycle.

Secret ballot software vs ordinary survey software

A generic online form can collect answers.

That does not necessarily make it suitable for an election.

A formal secret ballot may require:

Requirement	Generic survey	Purpose-built secret ballot
Controlled voter roll	May require manual work	Designed around voter eligibility
Unique voting entitlement	Limited	Core election function
Duplicate-vote prevention	Varies	Core control
Secret ballot	Often configuration-dependent	Designed into ballot architecture
Voter authentication	Basic to advanced	Election-specific
Anonymous voting	May be limited	Designed around ballot secrecy
Proxy handling	Usually limited	Can be incorporated into election rules
Preferential voting	Often limited	Can support election-specific counting
Audit trail	Response/activity logs	Election-focused records and reporting
Scrutineer access	Usually not designed for it	Can be built into election administration
Formal result reporting	Basic	Election-specific

The important point is not that every election needs sophisticated software.

It is that the tool should match the governance requirements of the ballot.

Common mistakes when running a secret online ballot

Calling a ballot anonymous without testing the system
Ask how anonymity actually works. Who can access the database? Can administrators connect participation records to ballot selections? Are audit logs capable of revealing individual choices? These questions matter.

Sending one shared voting link to everyone
A shared link makes it much harder to establish individual voting entitlement and prevent duplicate participation. Individualised access is generally more appropriate where the rules require controlled voting.

Treating the voter roll as an ordinary mailing list
The voter roll determines who has voting rights. It deserves election-level controls.

Allowing too many administrators
More access means more opportunities for mistakes or inappropriate disclosure. Keep privileges limited.

Forgetting about proxies or voting weights
A secret ballot still needs to implement the actual voting rules. If proxies, weighted votes or different membership classes apply, they need to be addressed before the ballot opens.

Assuming auditability means revealing votes
It doesn’t. The process can be audited while individual choices remain confidential.

Changing election settings during voting without a record
If something genuinely needs to change, there should be a documented process. Unrecorded administrative changes can undermine confidence even if the final count is technically correct.

A practical checklist for choosing secret ballot software

Before selecting a provider, ask the following:

Voter privacy

Authentication

Security

Auditability

Privacy and data handling

Election governance

If the provider cannot answer these questions clearly, that is a warning sign.

Where Vero Voting can assist

Vero Voting provides online voting and election services for organisations that need to manage formal elections and ballots while maintaining voter privacy and election integrity.

Its voting services can support controlled voter access, anonymous voting, audit reporting and different election configurations, depending on the requirements of the ballot.

Vero also states that its information security management system is certified to ISO/IEC 27001:2022 and that it has completed a SOC 2 Type II audit. Those forms of independent assurance can provide useful evidence when an organisation is assessing a provider’s security controls.

For organisations planning a secret member ballot, the discussion should start with the rules rather than the software.

First determine: Who can vote?

Then: What voting method applies?

Then: How must the vote remain secret?

Finally: What evidence will the organisation need to demonstrate that the result is correct?

Once those questions are answered, the technology becomes much easier to evaluate.

Key takeaways

A secure secret ballot is not simply an online form with names hidden.

It needs to balance two requirements: Protect the voter’s choice. Prove the election was conducted properly.

The strongest processes typically include:

The best secret ballot software does not make the election invisible.

It makes the right things visible.

The organisation should be able to demonstrate that the correct people voted, that the rules were followed and that the result is accurate — without revealing how individual members voted.

If your organisation is planning a confidential member election, AGM vote or formal ballot and needs help assessing the right voting process, contact Vero Voting for any assistance or request a demonstration.

7. Sources

The following official sources were used to verify the article’s Australian privacy, ballot secrecy and electronic voting claims: