The ballotid and userid is encrypted using the voters' private key. Only the voter can view the ballot and prove the ballot belongs to their user account.
There are heuristic searches that may need to be defended against with additional anonymizing of data.
I read the whitepaper, but some details are not clear.
If "only the voter" can "prove that the ballot belongs" to him or her, then how can a third-party, an auditor, prove that there was absolutely no possibility of fraud and that the result is provably accurate?
People that check know that their vote has been counted. What about people that don't care? Someone could be voting for them. Or maybe they voted and their vote wasn't counted. Is it assumed that everyone should check?
