At least that's how it worked last night, when I was an election judge in Hennepin County, MN.

You must still somehow ensure that no one ever looks in that envelope. Otherwise, it may be possible to determine how someone voted from the spoiled ballots. For example, suppose that there are only 3 spoiled ballots, all of which are for one candidate. Now, everyone who saw those three people put their ballot in the envelope knows how they voted. This violates the right to an anonymous vote.

To prevent this, the invalid ballots need to be destroyed somehow. If they aren't, someone might read them. You could wait until the end of the election, then shred or burn the envelope, but it still needs to be done. However, if the voter is allowed to shred his own invalid ballot, then he doesn't have to hope that no one will look in the envelope when he leaves the room.

The main requirements must be that: (a) no invalid ballot can ever be viewed by anyone other than the voter, and (b) no invalid ballot gets cast as valid.

I'm again relying on the large, dangerous men to prevent elections tampering, including any deliberate shredding of valid ballots. That should be obvious: they're in a separate box, far from the shredding machine.

It occurs to me that a more dangerous issue with all computer/electronic based systems is the risk of a hidden logging system. It would be easy to sneak in a section of code (or a custom set of electronics) that only activated on election day. It could secretly record that a vote took place at a given time, and who was voted for. It could be hidden as part of the debugging code, for example.

With the timing information in hand, you'ld then just need to keep track of what person voted at which time. An observer at the polls with a watch and notepad could do that part. By cross referencing the time with the person, you now know how everyone voted.

--
Ytrew

The solution to this problem used in our precinct is:
1. The envelope is opaque.
2. All election judges agree verbally to and sign a written oath saying that they will follow the election rules and not commit fraud or hinder the election process.
3. We are told not to look in the envelope, so we don't.
4. There are two election judges from different parties present at the ballot table at any time, to reduce the likelyhood of fraud.

It's a low-tech solution, but it works. Destroying any ballots (even spoiled ones) is a bad idea; keeping them allows the total number of ballots issued to be accounted for, which provides a cross-check on any electronic counting or hand counting that is done. It's hard enough accounting for all the ballots without any ballot sinks present!

Destroying any ballots (even spoiled ones) is a bad idea; keeping them allows the total number of ballots issued to be accounted for

Then, how do you guarantee that no one ever (even accidentally) looks at the spoiled ballots when they count them? You have to open the envelope to count the contents, which eliminates the benefit of an opaque envelope, and telling people not to look inside it.

The oaths don't guarantee that officials will be honest. If someone is corrupt enough to try to cheat, the odds are good they'll be willing to lie as well. You're probably a very honest person, which is why this didn't occur to you. :-)

The election judges may both be interested in finding out how the spoiled ballots were cast. Voter anonymity is more important to the voter than to any given party.

In short, the risk is a potential loss of voter anonymity. The cost of avoiding that risk is to lose a useful but unnecessary piece of accounting. I say the spoiled ballot accounting has to go, because the guarantee of anonymity is a fundamental right of the voter, whereas an accounting for uncast ballots is not.

--
Ytrew