Blockchain voting: why election-security experts remain cautious

What an election has to achieve

Public elections combine requirements that pull in different directions:

• Eligibility — only registered voters can vote, and each can vote only once.
• Secrecy — nobody, including the authorities, can link a ballot to a voter.
• Integrity — every valid ballot is counted as cast, and nothing is added or removed.
• Verifiability — voters, observers and courts can check that this happened.
• Coercion resistance — a voter cannot prove to anyone how they voted, so votes cannot be bought or forced.
• Accessibility — everyone entitled to vote can do so, including people with disabilities.

Finally, the result must persuade the losing side. An election that is correct but not trusted fails one of its main purposes.

What a ledger could add

Researchers in cryptographic voting have long used the idea of a public "bulletin board": an append-only record on which encrypted ballots are posted, so that voters can check their ballot was recorded and observers can verify the tally mathematically. A blockchain is one way to build such a board, offering a record that no single party can quietly rewrite. Proposals for blockchain voting usually build on this idea.

Why experts are cautious

The device problem

In remote voting, the ballot is filled in on a personal phone or computer. If that device is infected with malware, it can display one choice to the voter and send another. A ledger records whatever the device submits; it cannot know what the voter intended. Protecting millions of personal devices against well-funded attackers is not currently feasible.

Secrecy versus verifiability

If voters receive a receipt that proves how they voted, the same receipt can be shown to someone paying for votes or pressuring the voter. Cryptographic schemes can let voters check their ballot without producing such proof, but they are complex, and voting from home makes it impossible to guarantee that nobody is watching.

Identity and eligibility

Before a vote is cast, the system must confirm who is voting. That depends on identity registers and authentication, which sit outside the ledger and are attractive targets.

Paper and audits

Many election-security experts favour systems in which an error in software cannot change the outcome undetectably — often called software independence. In practice this usually means voter-verified paper ballots and statistical audits that compare a sample of paper with the electronic count. A purely digital ledger offers no independent paper record to fall back on.

Recovering from failure

If a serious flaw is found after an election, there must be a way to establish the correct result. With paper ballots, they can be recounted. With an internet voting system, a compromise may leave no reliable evidence of what voters actually chose.

Where ledgers can play a smaller role

Some uses carry lower stakes: internal votes in associations or companies, non-binding consultations, or publishing official results and audit logs so that they cannot be quietly changed. In these settings a ledger may be a reasonable tool, provided its limits are understood.

Questions to ask about any voting technology

These questions apply to every electronic voting system, whether or not it uses a blockchain:

• Can the result be checked without trusting the software or its vendor?
• Is there an independent record — usually voter-verified paper — that can be audited and recounted?
• How does the system stop a voter from proving to someone else how they voted?
• What happens if the system fails or is attacked while voting is under way?
• Has the system been opened to independent security researchers, and were their findings published?

This explainer describes how a technology is used outside finance, for general education. It is not a recommendation to acquire, sell or hold any crypto-asset and is not financial or legal advice.