[Paper Review] Privacy Violations in Election Results

Shiro Kuriwaki, Jeffrey B. Lewis+1 more|arXiv (Cornell University)|Aug 8, 2023

Internet Traffic Analysis and Secure E-votingComputer Science3 citations

TL;DR

This paper empirically evaluates the privacy risks of releasing cast vote records—individual ballot records—after U.S. elections. Using Maricopa County, Arizona’s 2020 data, it finds that vote revelation affects less than 0.2% of votes, with only 0.17% of voters potentially exposed across contests, suggesting cast vote records can be released without significantly compromising ballot secrecy.

ABSTRACT

After an election, should election officials release a copy of each anonymous ballot? Some policymakers have championed public disclosure to counter distrust, but others worry that it might undermine ballot secrecy. We introduce the term vote revelation to refer to the linkage of a vote on an anonymous ballot to the voter's name in the public voter file, and detail how such revelation could theoretically occur. Using the 2020 election in Maricopa County, Arizona, as a case study, we show that the release of individual ballot records would lead to no revelation of any vote choice for 99.83% of voters as compared to 99.95% under Maricopa's current practice of reporting aggregate results by precinct and method of voting. Further, revelation is overwhelmingly concentrated among the few voters who cast provisional ballots or federal-only ballots. We discuss the potential benefits of transparency, compare remedies to reduce or eliminate privacy violations, and highlight the privacy-transparency tradeoff inherent in all election reporting.

Motivation & Objective

• To empirically assess the extent of vote revelation under different election reporting regimes, including public release of individual cast vote records.
• To evaluate whether releasing granular, precinct- and method-coded cast vote records poses a significant threat to ballot secrecy.
• To examine whether current practices like adding random noise to results are necessary or disproportionate given actual privacy risks.
• To identify structural and procedural reforms that could further reduce privacy violations without undermining transparency.
• To inform the transparency-privacy tradeoff in election administration with data-driven insights from a real-world jurisdiction.

Proposed method

• Utilized the complete set of individual-level cast vote records from Maricopa County, Arizona, in the 2020 general election.
• Modeled vote revelation by linking anonymous ballot choices to public voter files containing names, addresses, and turnout status.
• Measured the probability of unique linkage across different reporting regimes: aggregate precinct results, precinct- and method-coded cast vote records, and full individual ballot records.
• Analyzed the distribution of privacy risk across voters, focusing on small or split precincts and rare ballot styles.
• Evaluated the impact of alternative redistricting and voter file modifications on reducing linkage potential.
• Used statistical analysis to estimate the proportion of votes that could be uniquely linked to individuals under various scenarios.

Figure 1 : Schematic of Potential Privacy Violation by Vote Revelation. Panel A shows a Venn diagram of how quasi-identifiers could link sensitive vote choice to non-sensitive personally identifying information. Panel B depicts our definition of precincts and ballot styles in an example of an area s

Experimental results

Research questions

• RQ1 What is the actual extent of vote revelation when cast vote records are publicly released?
• RQ2 How does the privacy risk of releasing precinct- and method-coded cast vote records compare to releasing only aggregate results?
• RQ3 Which voter subgroups are most at risk of vote revelation, and why?
• RQ4 Can structural reforms such as redistricting or voter file modifications reduce privacy violations without compromising transparency?
• RQ5 Is the current practice of adding random noise to results justified by actual privacy threats?

Key findings

• The public release of cast vote records could reveal the vote choices of approximately 0.0003% of voters for President in Maricopa County’s 2020 election.
• About 0.17% of the 2 million voters in the study could have their vote revealed in at least one of the 60 contests they participated in.
• Releasing cast vote records coded by precinct and vote method is no more revealing than releasing standard aggregate precinct and method results.
• Privacy risks are not uniformly distributed; voters in small or split precincts and those using rare ballot styles face higher risks.
• The risk of vote revelation is low enough that shielding all cast vote records from public access may be disproportionate to the actual privacy benefit.
• Structural reforms such as reducing the number of small reporting units and modifying voter file attributes could further reduce privacy vulnerabilities.

Figure 2 : Contests with More Revelation . A boxplot showing the fraction of eligible votes revealed by unanimous results in the precinct–method reporting regime. Each point represents a contest, and we group together contests by type. The solid bars indicate the median, the box indicates the first