Online Voting Security and Ballot Secrecy Explained

Online voting keeps the ballot secret by storing two things separately: the voter register, which records who has voted, and the ballot box, which contains the votes without names. The system can therefore stop anyone from voting twice without being able to say who chose what. Encryption, access controls and an audit trail add further protection. This page explains the main principles, the remaining risks and the questions to ask a provider.

The five requirements of a secret online ballot

Election security usually rests on five principles, which apply online as well as on paper.

Principle	Meaning online	How systems address it
Eligibility	Only people on the voter register can vote	Personal credentials, sometimes a second factor
One person, one vote	Nobody can vote twice	Register marks voters as having voted
Secrecy	Nobody can link a ballot to a voter	Separate storage of identity and vote, encryption
Integrity	Votes cannot be changed or added unnoticed	Encryption, signatures, logs, sealed ballot box
Verifiability	Voters or observers can check the result	Receipts, audit reports, independent tally

How identity and vote are separated

When you log in, the system checks your credentials against the voter register. Once you cast your vote, two things happen independently: the register marks you as having voted, and your ballot is placed in the ballot box without your identity. Many systems encrypt the ballot on your device or immediately on arrival, and only decrypt the ballots together at the end of the election. Some use multiple keys held by different members of an election committee, so that no single person can open the box early.

This is the main difference from a survey tool. A survey stores each response as a record, often with an email address, a login or an IP address attached. Our guide to anonymous polls explains how to reduce that link in a survey, but for contested elections dedicated software is the safer choice.

Verifiability: trust, but check

On paper, observers can watch the ballot box and the count. Online, that is harder, so researchers have developed ways to make the process checkable:

• Cast as intended: the voter can confirm that the ballot reflects their choice.
• Recorded as cast: the voter can check, for example with a receipt code, that their ballot is in the ballot box.
• Counted as recorded: anyone can check that all ballots in the box were tallied correctly.

Systems offering all three are called end-to-end verifiable. Many products for organisations implement only parts of this. Ask providers which of these checks they support.

Certification: what exists

In Germany, the Federal Office for Information Security (BSI) has published a Common Criteria protection profile with basic security requirements for online voting products (BSI-CC-PP-0037), intended for non-political elections such as those of associations or bodies. Products can be certified against it by accredited testing. Certification applies to a specific software version and configuration, so always check which version a certificate covers. The BSI website publishes certified products.

Outside Germany, providers often refer to information security standards such as ISO/IEC 27001 for their organisation, to penetration tests or to independent audits of a specific election. These statements differ in scope, so read them carefully.

The risks that remain

No online system is free of risk. The main weak points are not usually the server but the edges:

• The voter’s device: malware on a phone or laptop could in theory manipulate what is displayed or sent.
• Coercion and vote buying: at home, someone may watch you vote. Some systems allow voters to vote again, with only the last vote counting, to reduce this.
• Credentials: if access codes are forwarded or sent to shared mailboxes, eligibility checks fail.
• Administrators: poorly separated roles, weak passwords or shared admin accounts undermine everything else.

These risks are one reason why public elections in most European countries are still held on paper. For internal elections in clubs, associations or companies, the balance usually looks different: the alternative is often a postal ballot, which has weak points of its own.

Questions to ask a provider

1. How exactly are identity and vote separated, and can administrators see individual votes?
2. Are ballots encrypted, and who holds the keys?
3. Where is data hosted, and is a data processing agreement available?
4. Which independent certifications, audits or penetration tests can you document, and for which version?
5. What verification options do voters and the election committee have?
6. What report does the election committee receive at the end?

Our software comparison summarises what providers state about these points, and the board election guide and the overview of how online voting works show where security fits into the process.