🤖 AI Summary
Public release of individual ballot images in elections poses significant voter privacy risks, particularly through re-identification via linkage with voter registration records. Method: Using the 2020 general election in Maricopa County, Arizona, as a case study, we introduce the novel concept of “vote revelation” and develop a linkage analysis framework coupled with a quantitative privacy risk model grounded in real-world voter registration and ballot data. Contribution/Results: We find that privacy risks are highly concentrated among provisional and federal-only voters—not uniformly distributed—and that ballot disclosure reveals only 0.17% of voters’ choices, marginally below the 0.05% revelation rate under current aggregate reporting by precinct and voting method. This work formally characterizes the privacy–transparency trade-off arising from linking anonymized ballots with public voter rolls, corrects the misconception of widespread re-identification, and provides empirical grounding and methodological tools for evidence-based election data disclosure policies.
📝 Abstract
After an election, should election officials release a copy of each anonymous ballot? Some policymakers have championed public disclosure to counter distrust, but others worry that it might undermine ballot secrecy. We introduce the term vote revelation to refer to the linkage of a vote on an anonymous ballot to the voter's name in the public voter file, and detail how such revelation could theoretically occur. Using the 2020 election in Maricopa County, Arizona, as a case study, we show that the release of individual ballot records would lead to no revelation of any vote choice for 99.83% of voters as compared to 99.95% under Maricopa's current practice of reporting aggregate results by precinct and method of voting. Further, revelation is overwhelmingly concentrated among the few voters who cast provisional ballots or federal-only ballots. We discuss the potential benefits of transparency, compare remedies to reduce privacy violations, and highlight the privacy-transparency tradeoff inherent in all election reporting.