Votebeat is a nonprofit news organization reporting on voting access and election administration across the U.S. Sign up for Votebeat Texas’ free newsletter here.
When Pam Anderson was a county elections clerk in Colorado about a decade ago, she worried about whether the state’s increasingly transparent election process had made it possible to link a ballot to the voter who cast it.
As a test, she asked her staff in Jefferson County to see whether they could find a ballot that she had cast in a previous election.
It took them less than 20 minutes.
“It was a big revelatory moment to know this could be possible,” said Anderson, now an election administration expert and consultant.
Since then, Colorado has taken steps to protect a voter’s right to a secret ballot: Election officials there remove the voting method and polling location from public reports detailing voter participation. The state has invested in training election officials to redact information from the records it releases publicly, and purchased technology to help make those redactions more efficiently, Anderson said.
Such measures could help point the way forward for Texas, where recent laws enacted in the name of increasing election transparency have made it possible — in limited instances — to use public records and data to determine how individual voters voted.
The vulnerabilities came into public view last month, after a right-wing news site published what it said was the ballot a former Texas GOP chair cast in this year’s Republican primary. Votebeat and The Texas Tribune were able to verify that the private choices some voters make in the voting booth could be identified using public, legally available records.
Texas Secretary of State Jane Nelson and her staff were aware of the risk that voters’ choices could be exposed to public discovery, and election administrators across the state had been warning about it.
But it wasn’t until after the Votebeat and Texas Tribune report that Nelson’s office and Texas Attorney General Ken Paxton issued emergency guidance to election officials, instructing them to stop releasing information that can help expose how people voted.
This week, Nelson’s office quietly issued an additional directive that will require even more redactions and aim to limit opportunities for members of the public to cross-reference records and pinpoint a particular voter’s ballot.
The guidance from Nelson and Paxton adds to the burdens on local election officials to figure out what information they have to redact in a given case to prevent records from being used to link individual voters with a specific ballot or ballot image.
Limiting threats to ballot secrecy is a complex task
Other states have already contended with the tension between ballot secrecy and transparency. Striking the right balance between those two goals, experts say, is neither quick nor easy.
To fully protect all voters’ private choices, Texas will need to provide additional support and resources to local election administrators whose voting systems, equipment, and recordkeeping procedures vary by county, experts said.
Anderson, who was the Republican nominee for Colorado secretary of state in 2022, said election officials will need time to work through the problem, taking into account all the specifics that apply — everything from the types of voting systems used in the state and the turnout in individual elections to the types of documents election officials must release.
Some local election officials said the state’s initial guidance to redact was too broad. Redacting “is not an easy fix and it can’t be a cookie-cutter thing for everyone,” said Trudy Hancock, the Brazos County elections administrator.
During a House Elections Committee hearing earlier this month, Christina Adkins, head of the elections division in the Texas Secretary of State’s Office, acknowledged during questioning that county clerks and election officials performing redactions would still have access to records that could tie a voter to their ballot.
“That’s why I think that this is a short-term solution, and why there needs to be some bigger discussions about how to prevent this issue from occurring on the front end of the election,” Adkins said.
The latest guidance from Nelson’s office, obtained by Votebeat earlier this week, will require more redactions. It prohibits counties from using electronic poll books — the equipment used to check in voters at polling sites — to generate and print numbers on ballot paper. That stems from concern that such numbers, which link the ballots to the device used to check in the voter, could later be cross-referenced with other information to pierce ballot secrecy.
This directive will force multiple counties including Dallas, Travis, and Williamson to quickly change their procedures and revamp their worker training in a presidential election year. Some counties will also have to order new paper ballot stock in order to comply, an unexpected expense. That new ballot stock will be sequentially numbered, and those numbers will then have to be redacted in order to avoid creating yet another ballot secrecy risk.
How some states balance transparency and privacy
The U.S. adopted the secret ballot in the late 19th century in an attempt to address issues of vote-buying and voter intimidation For decades, election officials across the country have striven to find the best ways to protect voters’ ballot secrecy.
Following the passage of the Help America Vote Act of 2002, election technology evolved, chain-of-custody procedures improved, more jurisdictions switched to using paper ballots, and election records became much more detailed. These are the changes that prompted Anderson’s request to her staff more than a decade ago.
In areas with very small voter precincts and low turnout, the risk of identifying how someone voted also increased. And the way in which election-related data is disclosed can add to the risk.
In Colorado, an effort to allow 16-year-olds to vote in school district elections four years ago failed over ballot privacy questions. The issue was that only a small number of teens in each precinct would have obtained the specific ballot style for school district elections, making it easier to tie such voters to individual ballots.
In Texas, when someone voted and by what means are considered public information. Each county reports what kind of ballot — in-person, mail, provisional, overseas — a voter cast and whether they voted early or on election day. Many other types of information are also available through open-records requests, or published online, including data from electronic poll books used at individual voting precincts; “cast vote records,” the electronic representation of how voters voted; and ballot images, which are copies of actual ballots as marked by voters.
The push to make more records public grew in Texas after the 2020 presidential election as conspiracy theories about the outcome took hold in the state.
In contrast, other states have sought to limit the availability of election information to help safeguard ballot secrecy.
Colorado no longer publicly reports election participation by vote method or by location, in part because so few people vote in person there. In addition, the election officials in the state combine and shuffle small batches of ballots to protect anonymity, a technique often used with military and overseas voters.
North Carolina in 2002 banned the public release of cast vote records and voted ballots. This year, a May primary had such low turnout that the State Board of Elections also removed precinct-level results from its website “so that people couldn’t use that and our voter history data to see how individuals voted,” said Patrick Gannon, the public information director for the North Carolina State Board of Elections.
With some election data, North Carolina officials are permitted to insert “statistical noise” in certain areas before publishing results, Gannon said. For instance, if all voters in a particular North Carolina precinct voted for the same candidate, the state would add a small, random number of votes to the other candidates in the published vote totals for that precinct — but not in the official, certified results.
That way, “no one could use our precinct data and voter history data to determine how any individual voted,” Gannon said.
The U.S. Census Bureau uses a similar method in its data to protect privacy.
When elections officials employ this tactic, vote counts in specific precincts will differ slightly from those in the final results, which some experts have said could be misleading.
But “if state officials did not add statistical noise to the precinct sorted data, any person could use that dataset, combined with our voter history dataset, to determine how certain people voted in certain situations,” Gannon said, underscoring that the practice does not alter the official results. “We only insert statistical noise where absolutely necessary.”
Research looks into sources of potential breaches
Experts say election officials seeking to protect ballot secrecy should first understand how exactly a voters’ ballot could be exposed, so they can decide what information really needs to be withheld.
“A lot of the times when we talk about the secret ballot, we don’t really specify how the secret ballot could be violated,” said Michael Morse, an assistant professor of law at the University of Pennsylvania whose research focuses on voter registration and election administration.
The key is understanding the mechanism that threatens the secret ballot so that the fix is properly tailored to the threat, he said.
Morse’s most recent research, with political science professors Jeff Lewis at the University of California, Los Angeles, and Shiro Kuriwaki of Yale University, examines the extent to which releasing certain election records — such as cast vote records — can identify voters and their ballot choices.
They found that for 99.8% of Maricopa County voters in Arizona’s 2020 general election, the release of ballot records did not lead to the revelation of any vote choice. Morse and his colleagues showed that a vote would be revealed there only if all voters in a “reporting group” — for example, a single precinct, or those who voted by a certain method within a precinct — are unanimous in their choice of a particular candidate.
Florida tries to limit this risk by aggregating results in some cases. Election officials there typically report election results by precinct and vote method. But if there are fewer than 10 voters who cast ballots in a particular precinct using a particular method, then by law, election officials report only the aggregated precinct-wide results.
This type of aggregation rule doesn’t work perfectly, Morse and his colleagues explained.
“It suppresses some results that would not lead to vote revelation, but might not suppress a few that could,” he said
Morse and his colleagues point to longer-term measures, such as redistricting, as potentially more effective solutions.
“Lining up the district lines for multiple offices to avoid split precincts would increase the number of voters per precinct and thus reduce the extent of revelation,” he said.
Texas election officials have proposed a similar long-term solution that would require the Texas Legislature to increase the minimum number of registered voters allowed in voting precincts. Currently, county election precincts must have at least 100, but not more than 5,000 voters. However, in some large counties, a precinct can have as few as 50 voters.
The Texas Legislature will resume in January.
Local election officials take on a new burden
By law, Texas election officials are already required to redact identifiable information in election records such as Social Security numbers, state-issued identification numbers, and phone numbers. But the recent guidance from the Texas Secretary of State’s office said they’re obligated to do more, if necessary, to protect voter privacy, though they might need to seek guidance from the state attorney general to know whether they’re doing too much.
That means an added burden on local election officials.
“It’s time consuming, and it requires additional effort on the part of the election administrator, who is working on behalf of the voter to help maintain their privacy and anonymity,” said Tammy Patrick, CEO for programs at the National Association of Election Officials.
Hancock, the election administrator in Brazos County, home to College Station and Texas A&M University, said lawmakers should consider the time and resources that redactions have required in recent years. Hancock’s office is one of many election departments across the state that have been flooded with public information requests seeking granular election data. And although her office gets help from the county’s public records department, most of the state’s smaller counties do not have that support — or funding for software to help with redactions.
“A department with only two people on staff would have to handle that themselves. They’d also be under a time crunch to respond, and they’d also be in the middle of running an election,” Hancock said. “So you would either have to hire somebody to come in and redact that stuff, or they would have to take the other person to stop their duties to redact.”
The concern is not only about time, workers, or resources, she said, but also about figuring out exactly what to redact.
“You never know what information people are going to use to connect the dots,” she said. “What’s to stop one person from requesting one thing, another person requesting another thing, another person requesting another thing, and then they all work together to connect those dots?”
Natalia Contreras covers election administration and voting access for Votebeat in partnership with the Texas Tribune. Natalia is based in Corpus Christi. Contact her at ncontreras@votebeat.org
