Secret ballots online: what the voting system must guarantee

When a ballot must be secret

Most bylaws say that votes are taken by show of hands unless a member demands a written ballot. "Written" in practice means secret. For elections to the board a secret ballot is often the default, and for sensitive items such as expelling a member or a large financial commitment it is wise to offer one before anyone asks. Check the wording of your bylaws: some let any single member demand it, others require a certain number of members behind the request.

Online, making a ballot secret is no harder than making it open. It is a setting the chair chooses per item. The hard part is being sure the system actually delivers what the word promises.

Two things at once

A secret ballot has to guarantee two things that pull in opposite directions. It must prove that every vote came from an eligible member and that each member voted only once. And it must make it impossible, for everyone including the administrator, to see how any individual voted.

A survey tool can do one or the other. Either it is anonymous, in which case nobody can check that only members voted, and only once, or it records who answered, in which case the vote is not secret. It cannot do both, and that is the whole difference between a form and a ballot. The guide on Google Forms and Doodle goes through this in more detail.

A voting system solves it by separating eligibility from the vote. The right to vote is tied to the member and is used up when the vote is cast. The vote itself is stored without any reference to who cast it. The result can be counted, the number of voters can be proven, and the record shows who voted, but not what they voted.

Questions to ask a vendor

• Can the administrator see individual votes in a secret ballot? The answer must be no. Ask whether that holds in the database, not only in the interface.
• How is one vote per member enforced? Personal links or logins, never a shared link.
• What does the record show? Eligible voters, votes cast, the result, timestamps. Not names linked to choices.
• Can a member change their vote while the ballot is open? Useful, but only the last vote may count, and the earlier one must be discarded rather than kept alongside.
• Can the ballot be reopened or edited after it closes? It should not be, and any change should be visible in the record.
• Where is the data stored, and when is it deleted? In the EU for a European association, with a retention period agreed in advance.
• Can weighted votes be secret? In a housing association with votes per share, the weight travels with the vote, and the system must still hide who cast it.

If a vendor cannot answer these plainly, assume the answer is the one you did not want.

Running the ballot

Announce clearly when the ballot opens and when it closes. Show the number of votes cast on screen while it runs, so everyone can see it moving, and give people enough time. One minute is not enough for a room of two hundred people looking for their phones. Two or three minutes, with a warning before closing, is usually right.

At a hybrid meeting both the people in the room and those at home vote on their own device, so the ballot is secret for everyone in the same way and no slips need to be counted afterwards. This is easier than a fully physical meeting, where paper ballots are handed out, collected and counted by two tellers.

Members without a device can still take part. Keep a few paper ballots in the room, let the tellers count them in the usual way, and have the chair enter the totals into the system as an addition. The record then shows the combined result with a note of how many votes were on paper.

Open votes are still the norm

A secret ballot is not better than an open one; it is simply necessary in some situations. For approving the accounts, electing the chair of the meeting and most practical proposals, an open vote is faster and more transparent. In an open vote the record shows who voted what, just as a show of hands would. Choose per item, and do not make everything secret out of caution; it makes the record less useful when a decision is questioned.

For board elections, on the other hand, secret is the sensible default even where the bylaws do not require it. Nobody should have to vote against a neighbour in public.

What to keep afterwards

Attach the record to the minutes. For a secret ballot it shows the number of eligible members, the number who voted, the distribution of votes and the timestamps for opening and closing. That is enough to defend the result. What it cannot show is how any one person voted, and that is the point.