Let's say we have a group of $n$ people voting about which one of them should be their leader. They choose to vote by ranking, that is, by giving each member a number of points between $1$ and $n$, such that no two people have the same number of points. The winner will be the one who gets the most points (ignoring the possibility of a draw).
One big problem is that the people don't trust each other, and that there's personal feuds between many of them. This is why they don't want to have their vote known by anyone else within the group, so they give an external judge the task of collecting the votes and publishing the results.
Still this doesn't seem fair, since the external judge could be bribed to manipulate the results, so the group not only wants to see the results, but also wants to be able to see if their personal vote has been modified. They wish for a system, such that if everybody from the group confirms that their vote hasn't been manipulated, that everybody in the group is assured that the total is fair.
So in short, their ranking system should have to following properties:
- Anonimity: none of the members could suspect what any of the other members voted$^†$,
- Transparency: Every voter is able to check whether his vote has been manipulated,
- Fairness: If nobody says his vote is manipulated, everybody should be assured the result is fair.
Could this be done?
$†)$ Of course this is with some margin; if person $A$ didn't receive more than one point from anyone, he could of course deduce that everybody gave him a single point. However, if at least one other person gave him more than a single point, it should be impossible for him to suspect who gave him a single point and who gave him more.
So far I've come up with the idea to let everybody hand in the votes together with a (unique) secret password, and then publish the results by showing each password together with the associated ranking. While there is no certainty about who voted what, there can still be a lot of suspicion based on this method, since the ranking itself contains (suggestive) information about who submitted it:
Let person $A$ be wildly unpopular. He obviously wants himself to win, so he gave himself all the points. At the same time everyone else gave $A$ only one point. Also let there be a feud between $A$ and person $B$, so $A$ gave only a single point to $B$. For $B$ it then seems pretty obvious which ranking is from $A$, and therefore he will get angry at $A$ for giving him a single point. Obviously this is one of the things we wish to prevent.
Even worse is that it could be $C$ who was the actual submitter of the vote from $A$ I just described, and that $C$'s only goal was to create a fight between $B$ and $A$, since $C$ knew that $A$ was well aware of his unpopularity and had decided he would lose anyway, which led him to give himself only one point and let the maximum number of points go to his favourite choice. $A$ could debunk $B$'s suspicion by telling $B$ his secret password, but this could lead to new feuds, since $A$ might have ranked $B$'s best friend very low, etc, etc.
So while this system seems to have the desired properties, it isn't completely anonymous.
Disclaimer: I am by no means an expert on voting systems, so anyone who could provide me with corrections on terminology or point out why my system is completely flawed / impossible anyway, is very welcome to do so.