Updated version now published at: https://blog.siv.org/2025/08/overrides
To be able to trick would-be vote-buyers, and protect against threats of physical coercion.
So if Putin or Xi offers you $1000 to vote for their puppet candidate, you can (1) make it look like you did, (2) take their money, but then (3) cast a secret replacement vote with your real choice.
With all 3 of these important risks strongly protected against:
You cast the replacement in-person, using paper.
You work with the in-person election administrators to securely “downgrade” your SIV vote into an in-person paper replacement.
At the end of the election, they post a new ZK Proof with the updated post-cancellation totals. Normal voters never need to deal with this, only in the extremely slim chances enough cancellations take place to affect outcomes, all the Zero-Knowledge Proofs can be audited and verified by everyone.
Although highly illegal, it is already physically possible w/ paper voting to record a video of oneself voting a particular way (especially with vote-by-mail ballots), to send to a 3rd-party Vote Buyer as proof. One slight reassurance raised is that these videos could be faked, using Hollywood magic or modern deepfake AI. Unlike paper voting, SIV provides unforgeable digital proof of vote-cast-and-counted-as-intended. This new Secret-Cancellation capability is like a cryptographic equivalent to the deepfake video, adapted for SIV votes. And easy for voters to use.
In the e-voting world, Estonia is often cited as a leader, since they have offered digital voting in every government election since 2006. Specifically as a deterrent against vote-selling, they have also long offered a similar “cast replacement override" option. But unfortunately, as far as we can tell, their approach has sacrificed vote-tally integrity, i.e. admin can secretly cheat. And introduced vulnerabilities to malware on voters’ own devices secretly stealing votes. Our approach is inspired by theirs, but adds strong cryptographic guarantees against cheating, privacy-protecting auditability, and can't be used by on-device malware.