The Hybrid Voting System I've Been Sketching Out

Did my vote actually go to the candidate I picked? And why can't I check that for myself?

Let me get one thing out of the way first. This isn't a post backing any party or political position. It's not a post arguing that election fraud is real, either.

It's closer to me scribbling out whether the distrust piling up around our current election systems could be solved with technology and better service design.

Lately, if you follow political content in Korea and the US, the phrase "election fraud" comes up over and over.

Some of it is serious—claims that deserve to be checked against hard evidence. Some of it is unverified conspiracy or rumor. But setting aside what's actually true, isn't the real problem that this many people can't bring themselves to trust the results in the first place?

An election isn't a religion that demands your faith.

It's a system where anyone should be able to verify the outcome.

Paper ballots are safe. But to the voter, they're a black box

The method we're all used to is the paper ballot.

Paper is powerful. A human can check it with their own eyes, and if something goes wrong, you can pull the ballots back out and recount. That's a genuinely huge advantage.

But from the voter's seat, the story shifts a little.

The moment you drop your ballot into the box, your vote vanishes into a kind of black box. How it's stored, transported, sorted, and counted after that—an ordinary citizen can't really follow along and verify each step.

I'm not saying there's no process. There is one. I'm saying that, at eye level, the process just isn't visible enough.

And no, flipping everything over to fully online voting on your phone or PC isn't the answer either.

Identity theft, malware, server attacks, insider tampering, system errors—the attack surface explodes.

Shredding the paper and installing an app doesn't automatically upgrade democracy.

So my question narrowed down to one thing.

Can an individual directly confirm that the vote they cast was recorded correctly—and that it actually made it into the final count?

The hybrid online-offline system I came up with

What I sketched out isn't fully online voting.

It's not voting from your couch or a café on your phone. You still show up to a designated polling place, and a verified official checks your ID and your actual identity, exactly like today. Up to here, nothing changes.

What changes is the marking step. Instead of paper, you cast your vote on a dedicated digital device that's cut off from any external network.

When you pick one of candidates A, B, or C, the system issues an anonymous unique code for that vote. No name attached. No national ID number. It's handed to you in a form only you can see.

At the same time, it prints a paper record so you can confirm your choice with your own eyes. You check that the paper matches what you picked, then drop it in the box.

Once counting is done, the anonymized voting records (personal data stripped out) and the tally get published.

You look up the unique code you received and confirm that your vote made it into the pool being counted. And because the full tally record is public, anyone—citizens, journalists, parties, developers—can recompute each candidate's total and check it.

Three main upsides.

1. You can confirm your vote didn't just evaporate

Right now, once your ballot is in the box, there's essentially no way for you as an individual to check what happened to it.

With a unique code, you can personally verify that your vote was registered and included in the total.

Instead of "trust the result," it becomes "go check it yourself."

2. Anyone can recount the totals from scratch

If you publish not just the final numbers but the full anonymized record, anyone can recompute each candidate's total from the ground up.

Rather than taking the election authority's numbers at face value, multiple independent parties can reproduce the same result.

The outcome isn't locked inside one organization's server—it's verified out in the open.

3. Every step can leave a log

A digital system can record where and when a vote happened, which device was used, how the data was processed, when the count took place.

If you log when data was created, when it changed, and which system touched it, tracing the cause gets far easier when something breaks.

But even the logs can't be owned by a single organization. The election authority, parties, courts, civic groups—independent parties each need to hold the same records to shrink the room for manipulation.

But there was a giant bomb hidden in this system

At first I thought: publish the unique code and the candidate it picked, side by side. Most transparent option, right?

The deeper I dug, the more I found a fatal flaw.

The voter can use their own unique code to prove to someone else who they voted for.

Someone could pay you to vote for a specific candidate, then demand your code. A company or organization could pressure people to vote a certain way and make them submit proof.

That opens the door to vote-buying and voter coercion.

Letting the code be looked up only once doesn't fix it either. A screenshot or a single photo, and it's over.

On top of that, if a person's identity and their unique code are directly linked inside the system, an insider or hacker could trace who a specific person voted for.

You'd be trying to boost transparency and end up shattering the secret ballot instead. The worst possible outcome.

So here's the problem that actually needs solving

The end goal of this system isn't simply "publish the code and the candidate."

It sounds a little contradictory, but it has to satisfy both of these at once:

• I have to be able to confirm my vote was counted correctly.

• But I must not be able to prove to anyone else who I voted for.

For that, you have to fully separate identity-verification data from the actual voting data.

Identity checks are used only up to the moment a voter is issued a one-time right to vote. After the vote is cast, personal information and vote content can never be linked back together.

And the unique code shouldn't be a receipt that shows who you picked. It should confirm exactly one thing: that your vote made it into the overall tally.

Cryptography actually studies this, under names like end-to-end verifiability, receipt-freeness, and coercion resistance.

The terms look intimidating, but the core is simple.

Your vote should be verifiable—but not for sale.

And even with a digital system in the mix, I think you absolutely have to keep the paper record.

If the digital data and the paper record disagree, the paper is the source of truth, and you randomly re-count ballots and match them against the electronic tally.

You don't blindly trust the electronic system, and you don't blindly trust the paper. You make the two watch and check each other.

Turns out I wasn't the only one thinking about this

After happily writing all this up on my own, I went digging through the research—and the short version is that smart people have been chewing on this exact problem for a long time. (Naturally. Did I really think I'd be saving the world solo?)

One system in particular, Scantegrity II, is eerily close to what I'd drawn up. It uses paper ballots, but each marking oval is printed with a confirmation code in invisible ink—fill the oval with a special pen and the code appears. The voter jots that code onto a receipt and later checks online whether their code showed up correctly in the tally. The key part: the receipt alone tells you nothing about who they voted for. The codes are cryptographically unlinkable from the candidates, so the secret ballot holds.

Which means the exact thing I was fretting over—"wait, you can't be able to sell this" (receipt-freeness)—was already solved.

It was even used in real mayoral and city council elections in Takoma Park, Maryland, in 2009 and 2011—reportedly the first time end-to-end verification actually ran in a binding election for public office.

What impressed me more was the dispute resolution. If a voter claims their vote was recorded wrong, the system lets them prove it—without revealing who they picked. I hadn't even thought that far ahead.

There are other end-to-end verifiable systems like Helios, though that one's built for low-coercion settings like electing a university president (it doesn't aim for coercion resistance). Microsoft's open-source ElectionGuard offers similar verifiability as an SDK.

So no, I didn't invent some shiny new technology. Honestly? Relieved. It's proof the direction wasn't totally off.

Which makes the next assignment clear: figure out why well-designed systems like these still haven't been rolled out at scale in real elections—what walls they hit (cost, trust, politics, usability).

This isn't a finished solution

I'll be honest: this idea is less a finished national election system and more a personal exploration of the space somewhere between old-school paper and 100%-online voting.

Hacking prevention, identity separation, guaranteeing the secret ballot, blocking vote-buying and coercion, recovering from failures, accessibility for elderly and disabled voters. The pile of unsolved problems is enormous.

There might be another giant hole I've missed entirely.

Still—compared to telling people "just trust the results," a direction where voters can verify their own vote and the full tally themselves seems more than worth digging into.

Election systems aren't trusted because they're perfect.

They earn trust because when something goes wrong, you can find it; you can re-check the records; and you don't have to blindly believe any single person or institution.

Not "trust us." "Check it yourself."

That's where I think a transparent election system starts.

Wrapping up

I'm planning to keep tinkering with this idea on my own, patching it bit by bit.

And honestly, I've got one tiny ambition tucked away.

If I keep at this long enough, maybe one day I get a call from a US number and hear something like:

"This is the White House. The Donald Trump President would like a briefing on your voting system."

Of course, if that call actually came, I'd deliberate for about three seconds, decide it's a phishing scam, and hang up.

If they call a second time, then I'll open my laptop.

Right after I put together the English slides, obviously.