Which Election Data Actually Has a Confidentiality Lifetime?
Harvest-now-decrypt-later is a real threat, but it does not apply equally to every election record. Most election data needs integrity, availability, or ballot secrecy—not decades of cryptographic confidentiality. The exceptions deserve more attention precisely because the category is narrow.
Post-quantum vendors often begin with a dramatic assertion: election data encrypted today may be collected now and decrypted by a quantum computer later.
That is technically possible wherever quantum-vulnerable public-key cryptography protects information in transit or at rest. It is not, by itself, a useful election-risk assessment.
Harvest-now-decrypt-later matters only when three conditions exist:
- An adversary can obtain the encrypted data or network traffic now.
- The encryption depends on a public-key mechanism vulnerable to a future cryptographically relevant quantum computer.
- The underlying information will still be sensitive when decryption becomes possible.
The third condition is frequently ignored.
Results do not have a long secrecy life
Election results are not intended to remain confidential. Election officials publish unofficial results after polls close and continue updating them while eligible ballots are counted. The results remain unofficial until canvassing, audits, and certification are complete, after which officials publish the official outcome.
Before the polls close, premature disclosure of partial totals can create operational, legal, and public-confidence problems. During that interval, confidentiality may matter. But this is a short confidentiality window measured in hours or days—not decades.
After publication, post-quantum confidentiality adds little to the results themselves. An adversary who stores encrypted result transmissions and decrypts them years later learns information already made public.
The enduring security requirement for results is integrity.
Ballots are secret, not simply confidential
Ballots require more careful language. A secret ballot is protected by preventing the voter's identity from being associated with the voter's selections. VVSG 2.0 requires voting systems not to accept identifying information about a voter and not to create records that associate voter identity with voter intent, choices, or selections.
This is stronger—and structurally different—from encrypting a database.
If a voting system correctly separates voter identity from ballot selections, decrypting an anonymous ballot in the future may reveal the selections recorded on that ballot, but it should not reveal who cast it. The fundamental privacy control is unlinkability.
That does not make access controls around ballots irrelevant. Cast-vote records, ballot images, and other records of voter intent may be restricted under state law and election procedures. However, it changes the quantum-risk analysis.
The dangerous interval
Some election workflows create temporary associations between a voter and a ballot package. Mail-ballot administration may track that a particular voter received and returned an envelope. Signature-verification and cure processes necessarily operate on voter-associated materials before the voted ballot is separated from its identifying envelope.
This creates a real but bounded confidentiality issue. If an adversary captures encrypted voter-associated ballot data before the identity link is destroyed—and if the ciphertext and association remain available for years—future decryption could violate ballot secrecy. That risk deserves priority because the harm would be permanent.
Voter registration is different
Voter registration records are the clearest election-administration case for long-lived confidentiality. Registration systems may contain names, residential and mailing addresses, dates of birth, driver's-license or state-identification numbers, partial Social Security numbers, phone numbers, email addresses, voter identifiers, protected-status information, and digitized signatures.
Some voter-file information is already public or available to qualified political, governmental, or research users. Public fields do not acquire a long confidentiality lifetime merely because a jurisdiction encrypts the database.
The nonpublic fields are different.
Government identifiers, complete dates of birth, contact information, protected addresses, and identity-verification data can retain value for identity theft, impersonation, social engineering, harassment, stalking, account recovery, and targeting for many years. Unlike an election-night result, these records do not become harmless when the canvass ends.
These records possess a genuine confidentiality lifetime.
Signatures are the strongest case
Digitized voter signatures deserve the highest priority. Election offices use signatures to authenticate voter-registration records, mail-ballot envelopes, ballot applications, petitions, cure documents, and other voter correspondence.
A signature image is not merely another biographical field. It is a reusable specimen of a person's handwritten authenticator. That creates a long and asymmetric exposure. An election official may need to retain the signature for years and use it repeatedly. A voter cannot easily revoke and replace handwritten signing habits the way an administrator can rotate a password or certificate.
For Q-RET, voter signatures should therefore be treated as a distinct cryptographic asset class with high confidentiality sensitivity, long or indefinite useful life, repeated authentication use, difficult revocation, and high harm from bulk compromise.
A defensible data classification
Election officials can evaluate post-quantum confidentiality through four categories:
| Data Category | Primary Need | Lifetime |
|---|---|---|
| Published results | Integrity | None after release |
| Anonymous ballots & CVRs | Ballot secrecy | Variable |
| Voter registration PII | Confidentiality | Years to decades |
| Digitized signatures | Confidentiality & auth | Long-lived |
| Protected addresses | Safety | Potentially indefinite |
What does not belong at the top
A credible post-quantum program should state what is not a harvest-now-decrypt-later priority:
- Official results after publication.
- Anonymous cast-vote records where no voter association can be reconstructed.
- Public audit reports and certification records.
- Public-facing training and procedural materials.
These assets may still require integrity, availability, provenance, or records-management safeguards. Excluding them from the long-term confidentiality category does not mean they are unimportant. It means post-quantum confidentiality is not the control objective.
Electora position: Most election records do not need decades of cryptographic confidentiality. Results become public, while ballot privacy should rest primarily on unlinkability rather than permanent secrecy of anonymous selections. The strongest harvest-now-decrypt-later cases are long-lived voter-registration PII, digitized signatures, protected addresses, and voter-associated records. Q-RET should prioritize those assets—and treat integrity migration as a separate, equally important problem.