Two important areas of data secrecy concerns must be addressed to maintain the integrity of a secure voting system, while also preserving every individual’s confidence to vote their conscience without fear of harm. These two concerns are of focused importance due to the sensitivity of maintaining data privacy while also preserving the ability to secure the voting system and assure that the accurate record of the will of the people is reflected in all election results.

Balancing Secure Voter Privacy requirements, along with the necessity of assuring illegal votes do not remain in election results when election fraud is discovered is of critical importance. We cannot have a free, fair, transparent, and secure voting system without establishing this balance between privacy and disclosure. Leaning too harshly in favor of one side of this issue or the other will result in the corruption of the election system.

Understanding best practices in these two areas are very important to preserving access to the vote of all citizens and to confirm the true uncorrupted will of the people is reflected in the election results. In this regard, the following best practices are available to preserve the right of the people to a Secure Voting System.

First,

State, County, and Local law must provide privacy protection for individuals who would be placed in harm’s way by exposure to their location. This is especially important as it relates to Voter Registration Lists and Voter Participation Lists. To account for this concern, most US States have laws that provide an Address Confidentiality Program (ACP). Many of these state programs provide substitute (fake) addresses to protect the location privacy of these protected classes of individuals. The list of Address Confidentiality Program participants includes the following qualified classes:

1. Domestic Violence Victims

2. Violent Crime Victims

3. Sexual Assault Victims

4. Stalking Victims

5. Human Trafficking Victims

6. Witness Protection Program participants

7. Law Enforcement Officers

8. Judges, prosecutors, and court personnel

9. Additional citizens who meet legislature-defined proof of pending harm through the exposure of their location.

State, County, and Local law treats the location of these individuals as classified and redacts from public records request information that aids in locating these individuals. This redaction applies to both the Voter Registration Lists and Voter Participation Lists:

1. State, County, and Local law protects individuals on the ACP list by publishing the ACP fake address for the individual in the public record of the State Voter Registration list.

2. State, County, and Local law protect individuals on the ACP list by redacting the person’s name from the public information of the precinct-level voter participation list. To account for this gap in the public records information is provided that provides the public access to the number of ACP voters who voted in each precinct.

Due to the risk to election integrity that a secret voter list establishes, strict observation and oversight measures are enacted to maintain Voting System Integrity while also providing the required secure voting confidentiality needed for this group to participate in voting without fear of harm. When best practices are being followed, State law places the responsibility of maintaining and managing the Address Confidentiality Program (ACP) in the State's Attorney General’s office. As the Attorney General's office is managed by a single individual, additional oversight is provided to assure the unbiased management of the program. State, County, and Local Law vests strict oversight powers in the Balanced Election Management Office. To participate in the management and oversight of this program an individual must have appropriate classified information clearance.

Finally, any audit activity of the Attorney General’s office and/or the Election Management Office that is related to the ACP program and requires discovery of the true addresses of the protected individuals requires participants of the audit who will be provided this information to receive the appropriate classified information clearance.

State, County, and local rules for obtaining this classified information are defined by the legislature.

Second,

The voting security right to vote without fear of retaliation for the vote one cast is critical to the integrity of a secure voting system. In modern large-scale elections, an advanced ballot chain of custody from creation to election certification is critical. It is impossible to validate election results and ensure that election fraud of any kind that caused illegal ballots to enter the count, does not remain in the count. In the field of security, we call this remediation. Election Fraud Remediation is the action of remedying election corruption by reversing and stopping the damage to the election results after election fraud has been discovered. Balancing secure voting confidentiality with the necessity to remediate fraudulently cast ballots is critical to the successful establishment of legitimate corruption-free voting systems.

State, County, and Local laws must make safeguards to protect the privacy of the votes an individual casts in a manner that allows for the ability for classified clearance level auditors to confirm the results of the election and to determine the impact and scope of corruption discovered after the polls have closed. This requires ballot chain of custody from creation through election results certification, including the custody of the voter. Without maintaining the ballot custody record of the individual voter’s possession in the chain of custody record, election fraud performed by a ballot caster leading up to the ballot casting is impossible to remediate after the break in the chain. In this case, this alters the number of ballots cast and consequently the results of the election, leaving no means to remediate the corruption. Likewise, investigating the source of illegally cast ballots after they have been cast has no means to remediate the corruption when the ballot chain of custody is broken. Both problems are especially present when the ballot chain of custody is broken at the moment the ballot is cast. The moment of truth. No chain of custody record at the time of casting is a serious security flaw. In this case, we cannot remediate election corruption tied to illegally cast ballots after they have been cast. Unremedied election fraud that impacts the vote tallies of an election makes an election corrupt and uncertifiable. To provide true election integrity, modern Voting Security best practices are outlined here to balance the necessity to remediate and stop the breaking of the Ballot Chain of Custody, while also securing the confidentiality of every voter’s vote:

State, County, and Local laws must treat all voters with identical confidentiality protection as it relates to identifying what ballot a voter cast after the ballot has been cast.

State, County, and Local laws classify information that traces a vote cast back to the casting voter as classified information and requires that this information is never published in public records. Viewing this information requires security clearance as defined by the legislature. This classified information is referred to as the Voter to UBID Correlation Records.

State, County, and Local law require separation of duty and separation of preservation as it relates to Voter to UBID Correlation Record entries, and this is accomplished by requiring the separation of the record of the voter’s ballot chain of custody from the ballot. That is, from the ballot you cannot identify who cast the ballot and from the ballot chain of custody you cannot see how the voter voted. Through the legal policies and procedures defined by the legislature, the same person having both pieces of this information is not required for any legal election activity; this is accomplished through the separation of duties and the separation of the two components that make up the secure record keeping process, the Voter ID and the Ballot. A record with the Voter ID and UBID is maintained separately from the Ballot with its UBID. Maintaining this separation of records facilitates the required separation of election duties fixing the chain of custody chain and preserving the confidentiality of the voter's vote.

State, County, and local law requires that once a legal ballot is provided to a legal voter the UBID is noted in the Voter Participation Check-in Record by the election worker providing the ballot to the voter. The UBID is added to the Voter Participation Check-in Record in a way that facilitates the easy removal of the UBID from the Voter Participation Check-in Record for public record requests of the Voter Participation Check-in Record with the UBID redacted and not published. The UBID is added to the Voter Participation Check-in Record in a way that facilitates the easy removal and destruction of the UBID from the record at the designated date that it is required to remove this from the Voter Participation Check-in Record as determined by the Legislature.

State, County, and local law establishes strict data security restricted access classifications for the possession of the Voter ID to UBID Correlation record. All records requests without legal security clearance, as defined by the legislature, are redacted so that the UBID to Voter Correlation is not discoverable or published without security clearance. The UBID portion of the Voter ID to UBID Correlation Record is not published for public consumption and is redacted from any legal public records requests. Voter Participation Public Records requests do not include the UBID from the record.

State, County, and Local law requires the record of the Voter’s Ballot Custody to be deleted with no preservation of the record within three months of election certification. The only way this record deletion can be delayed is by approved legal grounds being met as defined by the legislature. Such legal delays are strictly tied to ongoing legal proceedings and/or ongoing election and voting system audits, as well as legal activity resulting from these legally allowed procedures that were initiated before the deadline and are critical to the completion of the ongoing legal proceedings and/or legal audit. The means to apply for this extension are defined by the legislature with strict restrictions in place to prevent unnecessary extensions.

State, County, and local law strictly restricts access to the Voter to UBID Correlation records for the sole purpose of remedying illegally cast ballots through the investigation of known election fraud that is specifically tied to identified illegally cast ballots and/or identified illegal voters who committed Election Fraud.

Finally,

State, County, and local law hold the Election Office and Election Workers accountable for data leaks related to Secret Election-related data that they have access to. Any person found guilty of knowingly distributing this information without legal clearance to do so is guilty of Election Fraud. Legislature has empowered the courts to punish such Election Fraud to the full extent available under the law as outlined by the Legislature.

State, County, and local law grant immunity to citizens who receive information through public records requests and then share the information they receive through the public record request from the government body that provided the public records. It is reasonable for a citizen to assume all non-redacted information received through a public record request is legal to share. It is the responsibility of government officials not to leak classified information in response to public record requests.