by William Wade Dudley wrote a letter in October 1888. He was treasurer of the Republican National Committee, and he spent that autumn worried about Indiana, where the presidential race would turn on voters of no settled loyalty, men the campaigns called floaters. Floaters drifted to whichever side paid. His instructions to an Indiana county chairman were precise. “Divide the floaters into blocks of five, and put a trusted man, with necessary funds, in charge of these five, and make him responsible that none get away and that all vote our ticket.” A Democratic mail clerk on the Ohio and Mississippi Railroad had noticed the heavy mail flowing from Republican headquarters to Indiana Republicans. He opened one letter and passed it to his party. The Indianapolis Sentinel printed the letter on October 31, 1888, under a banner headline.
Dudley’s plan worked because the product was inspectable. Political parties printed their own ballots, known as tickets, and the tickets differed in color and size, so a watcher could tell one party’s paper from another’s. A buyer did not need to trust the man he paid. He needed eyes near the ballot box. The trusted man watched his five floaters hand in the correct colored slips, and payment followed delivery. Where observation grew difficult, the market innovated. In the scheme known as chain voting, the first voter smuggled a blank ballot out of the polling place, and the buyer marked it. Each successive voter cast the pre-marked sheet and smuggled out a fresh blank, proving the relay had not broken.
Prices survive in the record. Indiana floaters went for as little as two dollars and as much as twenty when races tightened. A 1905 study of a New York City election estimated that 170,000 people had sold their votes at a going rate of five dollars. These are not figures of speech. Gilded Age elections ran a functioning spot market in other people’s citizenship, and the market worked because every sale produced proof.
The reform that broke this market arrived from Australia. Louisville adopted the Australian ballot for city elections in 1888, the first American city to do so, and Massachusetts passed the first statewide law that same year, using it for state offices in November 1889. The system sounds modest. Government prints a uniform ballot listing every qualified candidate. A voter marks it inside a private booth. No observer can connect the paper to the person. By the turn of the century, 38 states had adopted the reform. South Carolina completed the national list in 1950.
Kentucky held out in one respect. The state clung to viva voce voting, the courthouse practice of announcing your choices aloud to a clerk who wrote them down beside your name, until a new constitution abolished the shout in 1891. Owensboro held the last local election under the old system in December 1892, and the Messenger, the local paper, noted what was ending. The election would be “the last opportunity the voters will ever have of walking up and expressing their votes openly.”
The receipt is an old and useful tool. It ended the argument about whether you paid. Double-entry bookkeeping is built from such slips, and so is the citizen’s lever against the merchant and the tax collector. Documentation is how the small hold the large to account, and the instinct to extend that protection everywhere deserves a hearing before it is refused.
The refusal turns on a detail that is easy to miss. A receipt usually protects the person who receives it. The grocer’s slip proves you paid, and it shields you because the grocer is the one who could deny the sale. A voting receipt points the other way. It proves how its carrier voted, so it serves whoever can compel the voter to produce it: the employer who hints at layoffs, the creditor holding the note. It arms the domineering spouse who controls the door. What shields the customer in a store endangers the citizen in a polling place, because the power relation runs the other way.
John Stuart Mill made the strongest case against secrecy before secrecy arrived. In a chapter of Considerations on Representative Government, published in 1861, he argued that voting is a trust rather than a right. “His vote is not a thing in which he has an option,” Mill wrote. “It has no more to do with his personal wishes than the verdict of a juryman.” A public vote, like a public verdict, answers to the community it binds. Mill conceded that secrecy is “justifiable in many cases, imperative in some.” He granted it whenever “the mischievous power of the Few over the Many is increasing.” He believed the power of coercing voters had declined and was declining, though, so he held that secret voting should remain the exception in political affairs, and publicity the rule.
That argument deserves respect. Its engine is accountability through visibility, the same logic we praise everywhere else. The flaw is directional. Visibility polices whoever can be punished by whoever is watching, and in any actual electorate the watching runs downhill. A published vote disciplines the mill hand whose employer favors the other candidate. The employer’s own published vote costs him nothing. Mill imagined publicity disciplining the powerful. In practice it disciplined the dependent. Britain weighed his advice and refused it, adopting the secret ballot with the Ballot Act of 1872, the year before his death.
Computers brought the problem back a century later. Cryptographers had spent the 1980s designing elections a skeptic could verify. Josh Benaloh’s 1987 Yale doctoral dissertation showed how voters might confirm a tally without trusting the officials who ran it. Yet the early verifiable schemes shared a defect. Benaloh named it with Dwight Tuinstra in a paper published by the Association for Computing Machinery in May 1994. Prior protocols, they wrote, let voters “carry away from the protocol receipts which can be used to prove to others how they voted.” That defect “enables vote buying and coercion which are impractical in current physical election systems due to the ‘plausible deniability’ offered by a voting booth.” Their answer was the first verifiable election design “in which participants are unable to prove to others how they voted.”
Their mechanism is easier to describe than to build. Encryption scrambles each ballot at the moment of casting. Public mathematics lets any observer confirm that the scrambled ballots were tallied honestly. The voter walks away with confirmation that a ballot entered the count and with nothing that decodes what the ballot says. Even a voter who wants to sell cannot furnish evidence of delivery. That is the property they called receipt-freeness.
American law has protected this kind of inability for centuries. The Fifth Amendment forbids the state to compel a person to furnish evidence against himself: the accused cannot be made to satisfy the prosecutor’s demand for proof from his own mouth. Spousal privilege and the seal of the confessional recognize that certain relationships die if testimony can be extracted from them. Britain offers an example from inside the polling station itself. Every British ballot carries a printed serial number, and poll workers record that number against the voter’s entry on a corresponding number list, so a fraudulent vote can, in principle, be traced. The lists are sealed. Only a court order, in a prosecution or an election petition, can open them, and the Law Commission has recommended that the lock remain where it is. The trace exists as an instrument of last resort. No British voter ever holds a copy of anything.
The booth still leaks at one point. The voter now carries a camera through the curtain. A photograph of a marked ballot gives the buyer his proof of delivery back. New Hampshire saw the risk early. A 1911 statute barred any voter from letting a ballot “be seen by any person, with the intention of letting it be known how he is about to vote.” In 2014 the legislature extended the prohibition to digital images, with a fine of up to $1,000. State Representative Timothy Horrigan sponsored the bill. He said it would prevent situations where a voter could be coerced into posting proof that he or she voted a particular way.
New Hampshire’s law did not survive the First Amendment. Three voters under investigation for posting ballot photographs sued. Among them was a state house candidate named Brandon Ross, who had posted his marked ballot on Facebook with the caption “Come at me, bro.” In August 2015 the federal district court struck the statute down, finding no evidence of vote buying or voter coercion in New Hampshire since the late 1800s. The legislature’s only supporting anecdote was secondhand: a claim that one major party had paid Saint Anselm College students fifty dollars each in the 2012 election. Judge Sandra Lynch’s panel for the First Circuit affirmed in September 2016, holding that an abstract fear cannot sustain a broad restriction on political speech. The Supreme Court declined to hear the state’s appeal in April 2017.
Both sides of that case were right about something. The courts were right about the record: New Hampshire could not produce a single modern market in photographed votes. The legislature was right about the mechanism: a verified image is the instrument a buyer would demand. Election law scholar Richard Hasen warned that striking the ban could revive the old commerce. Something else went unspoken in the ruling. No statute can confiscate the supply of proof any longer, because every voter carries a camera. What remains enforceable is the demand. Buying a vote is a federal crime. Coercing one is a federal crime. The photograph is protected speech.
Employers do not need the photograph to exist. The possibility is enough. In October 2012, Koch Industries’ paper subsidiary Georgia-Pacific mailed what it called a “voter information packet” to all 45,000 of its employees. The cover letter warned that many employees might “suffer the consequences” of the wrong result. A list of company-endorsed candidates came with it, Mitt Romney at the top, plus an anti-Obama editorial by Charles Koch and a pro-Romney one by David Koch. Westgate Resorts’ chief executive sent his 7,000 employees an email warning that a vote for Obama would endanger their jobs. None of this was illegal. The Citizens United decision in 2010 had swept aside the rules that once barred employers from electioneering directly to their own workers.
Murray Energy supplied the era’s most quoted sentence. In August 2012 the company shut down its Century Mine near Beallsville, Ohio, so workers could attend a Romney rally. They had to be there, and they lost the day’s pay while the mine stood idle. Miners who complained called a radio show, and company executive Rob Moore answered them on the air: “Attendance was mandatory, but no one was forced to attend the event.” Everyone understood what it meant. No employer in 2012 asked to inspect a ballot. None had to. Workplace pressure needs no proof to work. Proof would make it enforceable. It is not enough to let someone make a private decision when a more powerful person can demand evidence of that decision afterward.
Some new systems went the other way and promised the receipt as a feature. West Virginia piloted a blockchain-based phone app called Voatz in 2018 for military and overseas voters, people who live under someone else’s authority, and counties in several other states followed. A blockchain is a ledger built to prove events to anyone who reads it. In February 2020, MIT researchers published the first major public security analysis of the app. They found vulnerabilities that could let an adversary “alter, stop, or expose a user’s vote.” Someone merely watching the network traffic could recover a voter’s secret ballot. West Virginia dropped the app within weeks.
The Voatz failure cut in two directions. The app was insecure, and its premise was inverted. Making every ballot provable to a remote observer is the outcome serious election design works to prevent. The paper-trail movement in the United States understood the difference years earlier. A voter-verified paper record is checked by the voter and retained by the polling place; it never leaves the room in the voter’s hand. End-to-end verifiable systems such as Helios, presented at a USENIX security symposium in 2008, refine the same insight mathematically. The voter receives a tracking code tied to an encrypted ballot. The code confirms that the ballot entered the tally. It discloses nothing about the contents.
This faith in traceability reaches well past elections. We are told, in domain after domain, that more traceability means more trust. Cash is the counterexample in your pocket. A banknote settles a transaction and remembers nothing, which is why the dissident and the tip jar rely on it, and why someone fleeing a violent household may depend on it. Every proposal to retire cash in favor of fully ledgered money is a proposal to make each purchase provable to whoever can demand the log. Some demands will be legitimate. The question is who holds the power to make them. A freedom that can be exercised only with evidence on hand is a licensed freedom, and licenses can be inspected and revoked.
Dudley’s blocks of five needed colored paper and a watcher. The booth took both away. What an American polling place hands you today is a small sticker reading I VOTED: proof of attendance, silence about content, the one receipt a democracy can safely issue. The objective is not an unverifiable count. It is a verifiable count without a marketable certificate of obedience. The curtain closes and the pencil moves, and voters walk out with empty hands. The country counts them without quoting them.
Leave a Reply