Secure Online Ballots in Australia: What Makes an Online Voting Process Trustworthy?

When an organisation moves a ballot online, the first question is often: Is it secure?

That sounds straightforward. It isn’t.

Security in online voting is not just about encrypting a website or putting a padlock in the browser. A trustworthy online ballot needs to deal with several things at once: who is allowed to vote, how voters are authenticated, whether someone can vote more than once, how the ballot is kept secret, who can access election data, and whether there is enough evidence to verify the result afterwards.

That last point is often overlooked.

A voting system should not only prevent problems. It should also leave behind enough reliable evidence to demonstrate that the election was conducted properly.

For Australian organisations running member elections, board elections, AGM votes, workplace ballots, association elections or other formal votes, that combination of security, privacy, authentication and auditability is what makes an online ballot trustworthy.

What makes an online ballot secure?

There is no single feature that makes an online ballot secure.

A strong voting process uses multiple controls that work together.

Think of it as a chain:

Eligible voter → secure access → authenticated vote → protected ballot → accurate count → auditable result

If one part of that chain is weak, the overall process can be weakened.

For example, a beautifully encrypted voting website does not solve the problem if an organisation sends the same generic voting link to every member.

Likewise, a system may have excellent voter authentication but still be unsuitable for a secret ballot if administrators can see how individual people voted.

Security needs to be considered across the entire voting lifecycle.

1. Start with the voter roll

The security of an online ballot starts before the first voting link is sent.

The organisation needs to establish who is actually entitled to vote.

That might be:

The exact eligibility rules depend on the organisation and the vote.

A secure platform cannot compensate for an incorrect voter list.

If an ineligible person receives voting credentials, or an eligible person is accidentally left off the list, the problem began before authentication even took place.

A good election process therefore treats the voter roll as a controlled election record rather than simply an email marketing list.

Before voting opens, administrators should confirm:

This is one of the least glamorous parts of online voting.

It is also one of the most important.

2. Voter authentication needs to be appropriate to the risk

Once the voter list is established, the system needs a sensible way to confirm that the person accessing the ballot is entitled to vote.

There are many ways this can be done.

Depending on the election, authentication may involve:

There is no universal authentication method that is appropriate for every ballot.

A small internal committee vote and a highly contested organisational election may have very different risk profiles.

The important question is: Does the authentication method provide an appropriate level of confidence that the person voting is the person entitled to vote?

Australian cyber security guidance identifies multi-factor authentication as one of the Essential Eight mitigation strategies and provides guidance around stronger authentication and the protection of privileged access. The Australian Signals Directorate also emphasises that no single set of controls guarantees protection from every cyber threat.

For an online voting provider, the same principle applies: security should be layered rather than dependent on one control.

3. Prevent duplicate and unauthorised voting

Authentication is only part of the problem.

The voting system also needs to enforce the organisation’s voting rules.

For a one-person-one-vote election, for example, the system should prevent a voter from submitting multiple votes.

That sounds obvious, but the mechanics matter.

The system should be able to distinguish between:

Someone attempting to access the ballot and Someone who has successfully cast their permitted vote.

It should also handle practical situations such as a voter losing their invitation, requesting assistance or attempting to use a second device.

A good system should have a defined process for dealing with these situations rather than relying on administrators to make ad hoc decisions.

For more complex elections, the rules can be different.

A voter may have multiple votes, voting weight may apply, or a proxy arrangement may affect how a vote is exercised.

The technology needs to reflect the governing rules.

4. Ballot secrecy is different from voter authentication

This is one of the most misunderstood parts of online voting.

An organisation may need to know who is entitled to vote without knowing how that person voted.

Those are different requirements.

Consider a secret board election.

The organisation needs to establish that a particular member is eligible and has not already voted. But after the vote is cast, the member’s voting preference should not simply be available to administrators through an ordinary database screen.

A properly designed secret ballot separates voter authentication and participation records from the anonymous ballot wherever the election requires secrecy.

This is not unique to online voting.

The Australian Electoral Commission uses processes designed to preserve ballot secrecy while still conducting checks on voter entitlement and ballot integrity. Its published material describes controls designed to prevent voter information from being matched back to an individual’s vote.

The same underlying principle is valuable when designing an organisational online ballot: Verify the voter without unnecessarily exposing the vote.

5. Protect the ballot while it is being transmitted

An online ballot involves information moving between a voter’s device and the voting system.

That information needs to be protected against interception and unauthorised access.

Organisations should ask prospective providers about:

Avoid treating the word “encrypted” as the end of the security conversation.

It is one control within a broader security architecture.

The OAIC’s guidance on Australian Privacy Principle 11 is useful here. For organisations that are APP entities, reasonable steps to protect personal information include technical and organisational measures covering areas such as ICT security, access security, third-party providers, data breaches and information lifecycle management.

6. Administrator access can be just as important as voter access

When people think about voting security, they tend to focus on hackers breaking into voter accounts.

There is another risk worth considering: What can an authorised administrator do?

A person with excessive administrative privileges may potentially be able to change election settings, access sensitive information or interfere with parts of the voting process.

That is why good systems use role-based access and limit administrative privileges.

For example, the person responsible for communications may not need access to election results.

The person managing the voter roll may not need unrestricted access to ballot data.

A scrutineer may need access to specific reports without needing administrator privileges.

The Australian Cyber Security Centre’s Essential Eight specifically addresses restricting administrative privileges and recommends that privileged access be limited to what users and services actually require.

This is a simple governance principle: People should have the access they need to perform their role, and no more.

7. Audit logs are essential for trust

A final result is not the same thing as an auditable election.

Suppose a member challenges an election six weeks after it closes.

The organisation says: “The system counted the votes correctly.”

That may be true.

But what evidence can it produce?

A useful audit trail may record events such as:

The precise information that should be retained depends on the election and applicable requirements.

The key principle is that the organisation should be able to reconstruct the important parts of the process without compromising ballot secrecy.

Audit logs are therefore not simply a technical feature.

They are evidence.

8. Auditability does not mean exposing individual votes

There is a common misconception that an election is only auditable if someone can trace every vote back to the person who cast it.

That is the wrong approach for a secret ballot.

A trustworthy system should be able to answer questions such as:

It should not need to answer: Which candidate did John Smith vote for? if the ballot is intended to be secret.

The strongest approach is to make the process verifiable without making the individual vote identifiable.

9. Keep a clear separation between identity and vote data

For a secret online ballot, one of the most useful design principles is separation.

One set of records can establish:

A separate set of records can contain:

The system should be designed so that the two cannot simply be joined by an administrator to reveal individual voting choices.

The exact architecture will vary between providers and ballot types, but organisations should ask about this directly during procurement.

Don’t settle for: “Yes, the ballot is anonymous.”

Ask: How is anonymity technically maintained?

That question produces a much more useful answer.

10. Security monitoring matters after launch

A secure ballot platform should not simply be configured on Monday and forgotten about until Friday.

Security involves ongoing monitoring.

Providers should be able to explain how they monitor systems for unusual activity and how they respond if something goes wrong.

Useful questions include:

The Australian Cyber Security Centre’s guidance includes logging, protection of event logs and incident response as components of a broader security approach.

For an election provider, these controls should be considered alongside the specific requirements of the voting process.

11. Data retention is part of security

Another issue organisations sometimes overlook is what happens after the ballot closes.

It is tempting to keep everything indefinitely.

More data does not necessarily mean better governance.

For organisations covered by the Privacy Act, APP 11 includes an obligation to take reasonable steps to destroy or de-identify personal information when it is no longer needed for a permitted purpose, subject to exceptions such as legal retention requirements. The OAIC also recommends considering security across the information lifecycle, from collection through to destruction or de-identification.

The organisation should therefore establish:

This is particularly relevant for elections involving sensitive membership or employee information.

12. Independent security assurance is worth asking about

A provider can tell you its system is secure.

That is useful.

Independent assurance is better.

When evaluating a voting provider, ask whether its security controls have been independently assessed or certified.

For example, ISO/IEC 27001 relates to an organisation’s information security management system. SOC 2 Type II provides assurance over controls operating during a defined period.

These are not magic guarantees.

No certification makes a system immune from attack.

But independent assurance can give an organisation additional evidence when evaluating a provider’s security programme.

The important thing is to understand what the certification or audit actually covers rather than treating a logo on a website as proof of everything.

13. What should you ask an online voting provider?

Before choosing a provider, ask questions that go beyond features.

Voter security

Ballot secrecy

System security

Auditability

Data and privacy

Assurance

The answers should be specific. If the response is simply “our platform is secure”, keep asking questions.

14. Security is only one part of a trustworthy ballot

A technically secure platform can still produce a poor election if the governance process around it is wrong.

For example:

These are governance failures rather than hacking incidents.

That distinction is important.

A trustworthy online ballot combines good technology with good election administration.

The organisation needs to establish the rules first and then configure the system to implement them.

15. Different ballots have different security requirements

There is no single “secure online voting” configuration suitable for every Australian organisation.

A board election may require confidential preferential voting.

An AGM may require live voting, proxies and weighted votes.

A member ballot may need a secret vote and multiple participation channels.

An employee vote may have eligibility requirements linked to a particular group of employees.

A strata vote may involve specific voting entitlements and proxy arrangements.

The appropriate security controls need to fit the voting rules and the consequences of the result.

This is why choosing software based purely on a feature checklist can be risky.

The question is not: Does this platform have online voting?

It is: Can this platform securely implement our particular voting rules and produce evidence that the process was conducted correctly?

16. Where Vero Voting can assist

Vero Voting provides online voting and ballot services for Australian organisations running elections, AGMs, member ballots and other formal voting processes.

Its online voting services include voter authentication, anonymous voting, encryption, transaction logging, monitoring and reporting, together with audit processes designed to provide evidence of how the ballot was conducted.

Vero also states that its information security management system is certified to ISO/IEC 27001:2022 and that it has completed a SOC 2 Type II audit. These provide additional independent assurance around its information security controls, rather than being presented as a guarantee that no security incident could ever occur.

For organisations considering a secure online ballot, the useful conversation is therefore not simply about whether voting can be moved online.

It is about how the entire process will work:

Who can vote → how they authenticate → how their ballot remains private → how votes are counted → what is recorded → how the result can be verified.

That is the standard worth aiming for.

Key takeaways

A trustworthy online ballot needs more than a secure login.

The strongest processes combine:

Most importantly, security and auditability should work together.

An election should protect voters from unauthorised access while giving the organisation enough evidence to demonstrate that the final result is accurate.

That is what makes an online ballot trustworthy.

If your organisation is considering an online election, AGM vote or member ballot and wants to understand how security, voter authentication and auditability can work together, contact Vero Voting for any assistance or request a demonstration.

Sources

The following are the primary Australian authority sources used to verify the security, privacy and governance principles discussed above: