The Glass Ballot Box

Every election asks the public to accept that millions of private choices became one correct outcome. Most of us never see the path in between. We see the input, our own vote, and the output, the result. The rest is a chain of procedures, machines, software, storage and people that voters have no way to inspect.

That is normally fine. People trust the officials, the observers and the rules. But once doubt spreads, more facts do not fully fix it, because the public is no longer only asking who won. It is asking how anyone can be sure the system did not get it wrong, or lie. Follow one ballot and you can see where that doubt gets in.

That is the core of the crisis. An election is not just a count. It is a public claim, and claims need evidence. The rest of this paper asks how much evidence an election can produce without ever revealing how any one person voted.

In most voting systems today, a voter cannot independently confirm three things: that their vote was recorded the way they meant it, that it was included in the count, and that the count matches the recorded votes.

Even when officials do everything right, there is a visibility gap. Nobody can personally follow their ballot, so the system leans on institutional trust, reputation and reassurance after the fact. Computer security stopped working that way a long time ago. Good security assumes that things will fail, and builds systems where failures can be detected and proved.

The cryptographer Ronald Rivest and his colleague John Wack put the idea in one sentence: a voting system should be software independent, meaning that no undetected bug or tampering in its software can produce an undetected change in the result.1 The statistician Philip Stark and the computer scientist David Wagner went further and called for evidence-based elections: an election should produce convincing evidence that it found the real winners, or say that it cannot.2

The question becomes whether elections can move from trust to verification. Try weighing it yourself.

Suppose a losing side disputes a result decided by 2.0 percentage points. With a black box, the only answer officials can give is “please trust us”. With paper records and an audit, they could check about 15,000 randomly chosen ballots and give the dispute a statistical answer.

A glass ballot box does not mean transparent votes. That would destroy the secret ballot, which democracies fought hard for. It means transparent proof. The goal is easy to state and hard to build: let voters and the public check that an election was counted correctly, without letting anyone learn how a particular person voted.

Systems built this way are called end-to-end verifiable. The election produces evidence that the tally is right, and each voter can check that their own ballot is in it.3 Cast a ballot below and look at what the public is shown.

The idea has been studied for more than four decades, since David Chaum's 1981 work on untraceable communication, which introduced the mix network.4 It is no longer only theory. In November 2009 voters in Takoma Park, Maryland, elected their mayor and city council with Scantegrity II, the first time an end-to-end verifiable system with ballot privacy was used in a binding government election; 1,728 people voted.5

Verifiable voting usually comes down to three checks. Cast as intended: the voter can confirm the system captured what they meant. Recorded as cast: the voter can confirm their ballot made it into the public record. Tallied as recorded: anyone can confirm the published ballots were counted correctly.

The last one is the real shift. Verification stops being private. It becomes public, and the result becomes something that can be checked independently by anyone, including people who distrust the officials. Run all three.

The first check is the trickiest, because a voter cannot see inside the machine. The cryptographer Josh Benaloh proposed an elegant answer in 2006.6 After the machine seals your ballot, it asks whether you want to cast it or challenge it. If you challenge, the machine must open that sealed ballot and prove what it contained; that ballot is then spoiled, and you vote again. A machine cannot know in advance which ballots will be challenged, so if it cheats it risks being caught every time.

If just 10% of voters challenge, a machine that alters 50 ballots gets away with it 0.52% of the time. Here c is the share of voters who challenge and n is the number of altered ballots.

The obvious idea is to give every voter a receipt so they can prove their vote was counted. It has a dangerous side effect. If the receipt shows who you voted for, then vote-buying becomes enforceable, coercion becomes easier and the secret ballot collapses. A boss, a gang or a family member can demand to see it.

So the receipt has to be designed with care. It should let you check that your ballot was included without letting you prove to anyone else how you voted. That is the paradox a glass ballot box sets out to solve: you can check the system, but you cannot sell your vote. Play the buyer.

Real systems use several tricks to keep receipts private: codes printed in invisible ink that only reveal a random confirmation code, as in Scantegrity, or tracking codes linked to an encrypted ballot that a voter cannot decrypt alone, as in Microsoft's ElectionGuard.5,7 In every case the receipt proves inclusion, not content.

Verifiable designs publish a public record of sealed ballots and the mathematical proofs that go with them. Anyone can audit the tally from that record without learning how individuals voted. This is the glass part: you can see that the ballots exist, you can see they were processed correctly, and you can see that the result follows from the record. Elections move from “please trust us” to “here is the evidence”.

The record below is real. It runs on a small server built for this paper. Cast a ballot on the phone: your browser seals it, the server adds it to a hash chain, and you can then check, on your own device, that every ballot on the ledger is linked correctly and that yours is among them.

The ledger is a hash chain, an idea that goes back to Stuart Haber and Scott Stornetta's 1991 method for time-stamping documents so nobody could backdate them.8 Each entry carries the fingerprint of the one before it. Change any past entry and every fingerprint after it stops matching. Try it.

Blockchain keeps coming up in election debates because it is tamper-evident: once something is written, history is hard to rewrite. But elections need far more than a tamper-evident log. They need secure vote capture, secrecy, resistance to coercion, correct counting and auditability.

If a compromised device records the wrong vote, a blockchain will preserve that wrong record perfectly, forever. That is not a hypothetical. When researchers at MIT examined Voatz, a blockchain-based voting app used by some overseas voters in West Virginia's 2018 election, they found weaknesses in the phone app and servers that could have let attackers alter or expose votes before anything reached the chain.9 The clean way to put it: a ledger can be one way to host the public record, but verifiability is the actual security idea. Test the layers.

If ballots are sealed, how can anyone count them? One answer is homomorphic encryption, used in systems such as Helios and ElectionGuard.7,10 With exponential ElGamal encryption, multiplying sealed ballots together produces a sealed total. Only the total is ever decrypted.11

The other classic answer is the mix network. Sealed ballots pass through a series of servers. Each one shuffles the batch and re-randomises every ballot so it looks completely different, then proves it did so honestly. After a few rounds nobody, including the servers, can link a ballot to the voter who cast it, but the ballots can be opened and counted.4 Try to keep your eye on yours.

Much election security rests on a practical foundation: paper ballots a human can read, or a paper record the voter has checked, plus audits that can catch a wrong outcome. A risk-limiting audit manually checks a random sample of paper ballots. It is designed so that if the reported winner is wrong, the audit is very likely to say so. If the evidence is weak, the sample grows, up to a full hand count.12

The point is not paper against cryptography. The point is evidence that cannot be faked at scale. One widely used method, BRAVO, was published by Mark Lindeman, Philip Stark and Vincent Yates in 2012.14 It draws ballots one at a time and keeps a running score:

Here s is the winner's reported share of the two-way vote and \alpha is the risk limit, the largest chance the audit is allowed to confirm a wrong outcome. The authors found that across 255 US state presidential contests from 1992 to 2008, the median expected sample was just 307 ballots per state.14 Run one.

With a reported margin of 10.0 points and a risk limit of 5%, a BRAVO audit expects to check about 598 ballots if the result is right. Halve the margin and the work roughly quadruples.

India runs the world's largest elections on electronic voting machines, first tried in 1982 and used in every constituency since 2004, with paper audit trails (VVPATs) added from 2013. In April 2024 its Supreme Court rejected petitions to count every VVPAT slip, keeping the check of five randomly chosen machines per assembly segment, while ordering symbol-loading units to be sealed and allowing losing candidates to request checks of the machines' burnt memory.15 The debate is exactly the one this paper describes: how much evidence is enough, and who gets to see it.

Verifiable election designs have been studied for decades, and modern toolkits now make parts of them practical: publishing evidence, supporting voter checks, improving audits and strengthening transparency without giving up secrecy. Helios, released in 2008, made open-audit voting available on the web for low-coercion settings such as university and society elections.10 In November 2022 voters in Preston, Idaho, could choose to vote with ElectionGuard in a general election, a pilot run with Microsoft, Hart InterCivic, MITRE and Enhanced Voting.7

Online voting is a separate and harder question. Estonia has offered internet voting since 2005, and in its 2023 parliamentary election more than half of all votes, 51%, were cast online.16 Many security researchers remain wary of internet voting for high-stakes elections; a 2018 report from the US National Academies recommended paper ballots and risk-limiting audits and advised against internet voting until much stronger guarantees exist.17

None of this means the world has solved voting. It means there is a credible path from opaque systems to evidence-producing ones, and from disputes settled by trust to disputes settled by verification. Walk through how we got here.

A healthy future looks something like this: paper records as an anchor of truth, audits that scale confidence with evidence, and cryptographic verification that lets anyone check the tally without exposing a single vote. Each layer covers the others' blind spots. Paper survives software failures. Audits turn paper into statistical confidence. Cryptographic proofs let every voter and every observer check the arithmetic.

The real test is what happens on the night a result is challenged. Pick a system and face the dispute.

The result is a new standard for public trust, and it fits on one line.

You don't have to believe the system. You can verify it.

Alongside this paper I built a working prototype of the ideas in it: candidates, commitment-based ballots, an append-only hash chain stored in a real database, receipt look-up, chain verification, an election snapshot when polls close, and exportable audit proofs. It runs on Cloudflare Workers with a D1 database. You can open it, cast ballots, close the election and audit it yourself.

Raj, A. (2025, June). The glass ballot box: Verifiable voting without giving up the secret ballot. The Build Journal Research Supplement, No. 2. https://abhnv.in/p2/

@article{raj2025glassballot,
  author  = {Raj, Abhinav},
  title   = {The Glass Ballot Box: Verifiable Voting Without Giving Up the Secret Ballot},
  journal = {The Build Journal Research Supplement},
  number  = {2},
  year    = {2025},
  month   = jun,
  url     = {https://abhnv.in/p2/}
}