A secret ballot sounds simple when it is on paper.

A voter receives a ballot, marks their choices in private, folds it, and puts it into a ballot box. Later, the votes are counted and the result can be scrutinised without revealing who voted for whom.

Online voting is more complicated.

An organisation still needs to know that an eligible member has voted. It may need to prevent someone from voting twice. Election officials may need to demonstrate that the final result is accurate. At the same time, nobody should be able to look at the voting record and determine how an individual voted.

That creates a fundamental question:

Can an online vote be both secret and verifiable?

Yes — but only if the voting system is designed to separate voter identity from voting choices while retaining enough evidence to verify the integrity of the election.

This distinction is particularly important for Australian organisations conducting elections, member ballots, committee elections, union ballots, association votes and other governance processes.

What does a secret online vote actually mean?

A secret ballot does not necessarily mean that the voting system knows nothing about the voter.

That is an important distinction.

A well-designed online election may need to authenticate a person before they vote. For example, the system might establish that:

But authentication does not have to mean that the person’s identity is permanently attached to their selections.

The objective is to create a separation between two pieces of information:

“Who is entitled to vote?” and “How did that person vote?”

Those are different questions and, for a secret ballot, they should be handled differently.

The Australian Electoral Commission uses a similar principle in its handling of declaration and postal votes. Voter entitlement is checked, but processes are designed so that ballot papers cannot subsequently be matched to the voter’s identifying information. The AEC describes this separation as a way of preserving the secrecy of the vote.

The same underlying principle is useful when thinking about anonymous online voting.

Anonymous does not mean unverifiable

One of the biggest misconceptions about anonymous voting is that secrecy requires the election to become impossible to audit.

It doesn’t.

There are actually two different things to verify.

1. Verify the election process

An organisation should be able to establish things such as:

2. Protect the individual vote

At the same time, the organisation should avoid creating a record that allows someone to say:

“Member 4827 voted for Candidate B.”

These objectives are not contradictory.

The challenge is architectural: the system needs to provide evidence about the election without creating evidence that exposes individual voting choices.

This is the central idea behind verifiable electronic voting research. The goal is to allow verification that a final result correctly reflects the votes cast while maintaining voter privacy. Research from the Australian National University, for example, describes end-to-end verifiability and voter privacy as fundamental security properties that must be achieved together.

How can an online voting system keep votes secret?

There is no single technology that automatically makes an election anonymous.

Instead, secrecy is usually achieved through a combination of system design, access controls, data separation, cryptography, operational procedures and audit mechanisms.

A practical online election might work broadly like this:

Step 1: Establish voter eligibility

The system identifies the member or voter and confirms that they are entitled to participate. This could involve a unique voting credential, secure authentication, a member database or another controlled method of voter verification. At this stage, the system knows who the voter is.

Step 2: Issue voting access

The voter receives access to the ballot. The important part is what happens next. The credential used to establish eligibility should not simply become a permanent label attached to the person’s ballot selections.

Step 3: Record the vote separately

The voter’s selections are recorded as part of the ballot while the system prevents the voting record from being exposed as an identity-to-choice mapping. This separation is one of the most important design considerations when assessing an anonymous online voting platform.

Step 4: Preserve an audit trail

The election should still produce evidence about what happened. For example, an audit trail may record system events, election configuration, timestamps, ballot processing events and other information needed to investigate irregularities. But an audit trail should not defeat ballot secrecy. An audit log that effectively says “Jane Smith selected Candidate X” is not a good secret-ballot design simply because the log is secure. Security and secrecy are related, but they are not the same thing.

The role of audit trails

Auditability is often misunderstood in online elections.

People sometimes assume that a good audit trail means keeping every piece of information indefinitely.

That is not necessarily the case.

For a secret ballot, the better question is: What evidence do we need to demonstrate that the election was conducted correctly without retaining unnecessary information that could reveal individual votes?

This is where data minimisation becomes relevant.

The Office of the Australian Information Commissioner (OAIC) says APP 3 limits the collection of personal information to information that is reasonably necessary for an organisation’s functions or activities. Its updated guidance also specifically discusses taking a data-minimisation approach.

A voting system should therefore be designed around the information genuinely required for the election rather than collecting everything simply because the technology makes it possible.

What should an online voting audit trail contain?

The precise design depends on the election, but useful audit information might include evidence relating to:

The key is to distinguish between evidence about the process and information about an individual voter’s choice.

A robust audit trail should help answer “Did the election operate correctly?” without unnecessarily answering “Who voted for whom?”

Can administrators see how someone voted?

For a genuinely secret ballot, administrators should not have ordinary access to a report that links individual voters to their selections.

This is one of the first questions an organisation should ask when evaluating an online voting platform.

Don’t simply ask: “Is the voting anonymous?”

Ask: “Can any administrator, election manager or system operator reconstruct an individual voter’s selections?”

Then ask how the platform prevents it.

That distinction matters because a system can describe itself as “anonymous” while still retaining technical information that could potentially be used to reconstruct voting activity.

A proper assessment should consider the entire data flow, not just the wording used on the voting screen.

Authentication and anonymity can coexist

This is perhaps the most counterintuitive part of anonymous online voting.

A secret election does not necessarily require completely anonymous access.

In fact, many organisational elections need some form of authentication because the organisation has to establish voter eligibility.

Imagine an incorporated association with 2,000 members conducting a committee election.

The organisation needs to know:

But after the ballot is submitted, the organisation may not need to know which candidates that particular member selected.

The system therefore needs to establish eligibility without unnecessarily exposing the ballot.

That is a much more useful way to think about anonymous online voting than simply asking whether a voter enters their name.

Why privacy matters in online elections

Ballot secrecy is not only an election-security issue. It can also intersect with privacy obligations.

The Privacy Act 1988 and Australian Privacy Principles regulate how covered organisations handle personal information. The OAIC’s current guidance states that the APPs cover matters including collection, use, disclosure, security and access to personal information.

APP 2 also deals specifically with anonymity and pseudonymity. It generally requires APP entities to give individuals the option of not identifying themselves, or using a pseudonym, when dealing with the entity about a particular matter, subject to exceptions such as legal requirements or impracticability.

That does not mean every organisational election must legally be anonymous.

Voting requirements depend on the organisation, governing legislation, constitution, rules, election procedures and the particular type of ballot.

But privacy should be considered when deciding what voter information an online voting system collects, stores and exposes.

The danger of linking voter identity to ballot choices

Suppose an organisation stores this information:

The organisation can still establish participation, but the voting records are separated from individual choices.

That architecture is much closer to what a secret ballot is trying to achieve.

The exact technical implementation will vary, but the principle is straightforward.

Common mistakes when choosing an anonymous voting system

Mistake 1: Assuming a hidden name field makes voting anonymous
Removing a voter’s name from the results screen does not necessarily make the underlying ballot anonymous. The organisation should understand what information is stored behind the interface.

Mistake 2: Confusing encrypted data with anonymous data
Encryption protects information from unauthorised access. It does not automatically prevent authorised systems from knowing who cast a particular vote. A database can be highly encrypted while still containing an identity-to-vote relationship.

Mistake 3: Keeping excessive logs
Logs can be valuable for security and troubleshooting, but unnecessary logging can create privacy risks. For example, if a platform records enough information to reconstruct the relationship between a voter session and a particular ballot, the election may not provide the level of secrecy expected by participants.

Mistake 4: Treating the administrator as automatically trustworthy
A secret ballot should not depend entirely on one administrator promising not to look at the data. Good governance reduces the opportunity for inappropriate access through system design, permissions, separation of duties and controlled processes.

Mistake 5: Thinking auditability requires identifiable votes
It doesn’t. An election can be auditable without making every voter’s choice identifiable. The AEC’s electoral processes demonstrate the broader principle: election integrity involves extensive checking, tracking and scrutiny while processes are deliberately designed to preserve vote secrecy.

What makes an online vote genuinely verifiable?

When assessing a platform, look beyond marketing terms such as “secure”, “anonymous” or “encrypted”. Ask practical questions.

What about end-to-end verifiable voting?

For organisations running highly sensitive elections, the concept of end-to-end verifiability is worth understanding.

In broad terms, an end-to-end verifiable voting system aims to provide evidence that:

At the same time, the system should not reveal the voter’s selection to others.

This is a sophisticated area of election technology and cryptography. It should not be reduced to a simple claim that a platform is “blockchain voting” or “encrypted voting”.

In fact, the research literature highlights how challenging it is to achieve strong verifiability and voter privacy simultaneously.

For most associations, companies, unions and member-based organisations, the practical priority is not necessarily implementing the most academically advanced voting protocol. It is choosing a system whose security model, privacy controls and auditability are appropriate to the risks of the election.

Anonymous online voting for AGMs and member elections

Secret voting can be particularly useful when the outcome could influence relationships within an organisation.

Consider a committee election where members are voting on:

If members believe their choices can be identified, they may alter their behaviour. That can undermine the value of the ballot.

The purpose of a secret ballot is not simply to hide information. It is to give members confidence that they can exercise their voting rights without fear of retaliation, pressure or social consequences.

For companies, meeting and voting procedures must also be considered alongside the Corporations Act 2001 and the company’s constitution. ASIC notes that companies must follow the applicable rules governing meetings and resolutions, and that failure to follow those rules can affect the validity of decisions.

For virtual and hybrid meetings, ASIC also emphasises that members should have a reasonable opportunity to participate and engage with the meeting.

The technology is therefore only one part of the governance framework.

Where Vero Voting can help

For organisations running elections or member ballots, the challenge is rarely just collecting votes.

The harder part is designing a process that members can trust.

Vero Voting provides online voting and ballot services designed for organisations that need secure participation, controlled voter access and reliable election records.

For a secret ballot, the relevant questions should always be broader than simply whether voting takes place online. Organisations should consider how voter authentication, ballot secrecy, auditability, administration and reporting work together.

Vero Voting’s approach is particularly relevant where an organisation needs a structured election process without having to build and manage the underlying voting infrastructure itself.

For complex elections, it is also worth discussing the election rules and voting requirements before the ballot opens. Getting the process right before voting starts is considerably easier than trying to resolve an ambiguity after the result has been announced.

A practical checklist for selecting anonymous online voting software

Before selecting a platform, ask the provider:

If the provider cannot clearly explain how secrecy and verification coexist, that should be a warning sign.

Key takeaways

Anonymous online voting is not an impossible contradiction.

The strongest systems recognise that voter authentication and ballot secrecy are different functions.

An organisation may need to know that a particular person is entitled to vote without retaining a permanent record of that person’s voting choices.

The goal is not to make the election completely invisible. It is to make the right things visible.

Election administrators should be able to demonstrate that the process worked properly. Members should be able to trust that their individual choices remain secret.

That balance — privacy for the voter, evidence for the election — is at the heart of a credible online ballot.

If your organisation is considering an anonymous online election, AGM ballot or member vote, Vero Voting can help you work through the requirements and demonstrate how the voting process can be structured.

If you’re planning an anonymous online election, AGM ballot or member vote and want to understand how voter privacy, security and verification can work together, contact Vero Voting or request a demonstration to discuss your requirements.

Sources