Are there proposals for preserving ballot secrecy when a candidate scores 100% in a very small polling station?

Question

In the 2020 United States Presidential Election in Dixville Notch, New Hampshire, Joe Biden received 5 votes and Donald Trump received 0 votes. Biden received 100% of votes cast.

In the 2016 United States Presidential Election in Kalawao, Hawaii, Hillary Clinton received 14 votes, Jill Stein 5, and Donald Trump 1 vote. Trump almost received 0% of votes cast.

There are probably rural places where the result is reversed and the Republican candidate may get 100% of the vote.

Apparently, Gir Forest in India had exactly one voter.

In the 2013 Falkland Islands sovereignty referendum, only 3 people voted No.

When at least two or three votes are cast for an alternative there is still somehow a secret ballot, but when 100% votes for a single alternative, the principle of the secret ballot is violated. The secret ballot is guaranteed by the Universal Declaration of Human Rights, Article 21.3 (emphasis mine):

The will of the people shall be the basis of the authority of government; this will shall be expressed in periodic and genuine elections which shall be by universal and equal suffrage and shall be held by secret vote or by equivalent free voting procedures.

(since this declaration is universal, it applies worldwide, including in the United States; moreover, the United States voted in favour of this declaration in the United Nations and was leading in drafting the text in the first place, so arguably it should apply in the United States; however, I don't know if it's actually a law)

Are there any systems or proposals for systems to mitigate this problem? I could imagine either a rule that voting precincts must have a minimum size (in the extreme case of a precinct with one voter, their vote could never be secret), or where any precincts with 100% for any candidate must be grouped after the election with others such that the result is less than 100% (effectively merging precincts after the election; voters could still verify the combined result but not the individual result per precinct, but secrecy were maintained).

(the counterpart, preventing any results where a candidate receives 0%, is probably not feasible, due to obscure candidates who may receive less than 0.01% of the vote nationwide, and thus 0 votes in many precincts; but with larger precincts, the nationally winning candidate getting 0% of the vote should be unlikely)

Answer 1

By your reasoning, polling stations would have to be big enough to make a "mixed" outcome highly likely. That goes against the principle that polling stations should be local if possible, near enough that people can vote in person without undue travel.

No size is perfect, and the possibility of a secret vote becomes more important where one votes for the unpopular candidate, not the popular candidate. In the Kalawao example, one voter bucked the neighbourhood trend and went for Trump, and it is impossible to tell which of the 20 really did it.

Publishing only aggregated numbers goes against the principle that citizens should be able to do the math themselves. Poll watchers are legal in many places, and a grassroots group could try to add their own tallies, that gets harder if they cannot compare with the official numbers step by step.

Answer 2

The secret ballot is a design principle with various procedures and rules that flow from that principle. But, it is not a rule of independent legal force itself, so it can't be violated when quirky circumstances cause someone's voting choice to be disclosed.

Answer 3

Ballots are secret to prevent powerful people from applying economic and social pressure on a large scale: e.g., so that someone like (say) Jeff Bezos or Elon Musk cannot threaten to fire any of the thousands of their employees who might vote for the 'wrong' party. That threat to livelihood is far more effective at quelling the vote that any more direct threat from the opposing party. People will willingly confront an opponent, but balk at the loss of career or social status.

In the kind of polling stations this question asks about — comparatively remote communities of a small number of people — these considerations don't really apply. There aren't many secrets in such communities to begin with, nor is there the kind of power base that makes social and economic pressure a problem. Most everyone knows most everyone else, they all have a good idea how each person is going to vote, and any surprises or misjudgments are more likely to result in arguments in the local grocery store or bar than in any economic or social penalties. If the grocery owner fires his stock-boy because he thinks the stock-boy voted the wrong way, that is not much of a threat to the stock-boy or the community as a whole.

Ballot privacy is far more important in large communities that have broad diversity and complex, abstract social interconnections. Small towns are small towns; things are 'personal' there, and that 'personal' interaction offsets any purely political differences.

Answer 4

This problem is well known and doesn't have a simple solution that makes everyone happy.

One commonly applied solution (apparently not in the USA, though) is to not publish results from small communities or even from individual voting stations at all, but to publish aggregate regional results. For the local area that includes three villages, or for the district of the city that includes several voting stations.

There is no perfect secrecy on these things in all cases, however, especially for remote places that count locally. If your community has 10 people with voting rights, there's a pretty good chance that 2 or 3 of the same people will be doing the counting.

Answer 5

You could print 10000 fake votes for each candidate, shuffle them and deliver them to all the polling stations.

At the end, you just subtract 10000 from the state result of each candidate.

If this is worth the effort is a different question.

Answer 6

I doubt it's literally illegal, but I do agree this effectively makes votes not anonymous. Its hard to argue otherwise since we know each person's vote.

And this is a problem, because if voting isn't anonymous, it is more likely that people are pressured into changing their vote, especially in small villages where people tend to watch eachother closely.

This is a problem with privacy in general. You couldn't identify me by city + age, but if I were 117 years old, or lived in Buford Wyoming, then city + age is suddenly excessive information. It's generally a hard problem to solve for all edge cases.

Some things that may help against this:

• Make sure there are more (expected) votes per voting location, by eliminating some rural voting locations.
• Try to predict voting outcomes and if a very homogeneous result is expected, move/merge voting locations to have more votes or more diverse votes.
• Instead of actually merging voting locations, merge the votes with other locations before counting starts.
• After counting, if the result is nearly homogeneous, merge counts with another location before reporting. People who were present for counting will still know. And everyone will still know the result was nearly homogeneous because the merge happened.
• Do not release actual counts, just a winner. Probably increases the chance of fraud by a lot.
• Somehow hide who has voted where. But I don't see a practical way to do that.
• Add noise, in a way that does not affect the outcome, like @JFabianMeier's answer.

Some practical problems with solving this:

• Voting should be accessible, so there should be a lot of voting locations, also in sparsely populated areas.
• Fraud should be hard, so it helps if people can observe the counting process, and regional results are known (so counters can check them).
• Anything you do based on expected votes could go wrong (maybe 200 eligible voters live nearby but only 3 actually voted).
• Anything you do based on actual votes (like merging results) is too late to hide results from those present when counting.
• Just because the result is not unanimous does not mean it is anonymous. If only 2 people voted differently, then I only need to know two people's votes to know everyone's (e.g. me and my wife might be those two).
• On a purely theoretical level, you cannot 100% guarantee anonimity while releasing vote counts, because there is a theoretical possibility that everyone everywhere votes the same way. Not a practical concern in the USA at all.

In the end, the organisers have to balance different principles. Probably making voting accessible to remote areas and preventing fraud won out against edge-case-anonimity.