I don't want anyone to be able to look at my vote and know who did it. That's a powerful tool for thugs and tyrants.
Edit: thanks for all these clarifications!
Thus, if they audit they can be sure the ballot was cast by a legitimate voter.
If you don't tie ballots to voters, you go full Florida where they just keep "finding" boxes of prefilled ballots.
You MUST tie a ballot to a voter if you want your elections to have any integrity at all. There is no other way to prevent double voting, voting out of precinct, etc.
Broward county, 2016 election. They found a box of filled out ballots at the airport return in a rental car trunk... never a word about it again. Same county, defying a judges orders, the police stopped anyone from entering/auditing the count under direction of then admin Brenda Snipes.
Guess who oversaw Bush / Gore recount? Brenda Snipes.
What is the definition of insanity again?
A lock generally needs to be stronger than the motivation of a would be thief. In this case we are talking about controlling the disposition of trillions of dollars so there probably isn't a lock in the world that is good enough.
Based on prior stories many of the machines aren't merely not good enough they are quite laughable and indeed often so old that no parts can be sourced anywhere because they haven't been made in decades.
There's no way to do that without tying the voter to the vote somehow. Why not hash the voter ID + a secret of your choosing and store that with the vote? Then, even if counting by hand, you can verify your vote was indeed cast for X candidate.
I would rather be able to verify that my vote was cast to the desired candidate than to have a strictly anonymous (but unverifiable) voting system.
EDIT: Mail in voting is skimmed with little to no risk. Oops, lost 1% of that zip code...
Assume a million votes are cast in an election. To move the needle 1%, you need 10,000 votes. And let's assume a single fake voter can realistically cast ten votes in different precincts, considering vote time and travel time (they can't just keep coming to the same precinct, for fear of recognition).
So you need 10,000 fake registrations, that must match real addresses, and you need 1000 people working all day at fake voting. One voter out of every thousand would be working for this conspiracy.
Now, you need to do this in complete secrecy. Nobody can talk. Nobody can gather evidence. They can't go to the police, or the media. Even one leak is enough to not only ruin the scheme, but create a nationally known scandal. And if it can be connected in any way to a particular political party, that party's name would be dragged through the mud across the country.
It's insanity. No one could safely pull it off.
You know what can be pulled off, though? Voter suppression. Make it much more difficult for certain categories of voters to actually vote. Such as poor people who might not have ID (or might hesitate to use it). Then, convince a large swath of the public - people like you - that this is about security, not suppression. That form of election manipulation is now seen as patriotism, not corruption.
I can see that happening maybe a few times, but it seems ineffective on a large scale.
If they already voted? "Oops, I forgot."
If they haven't voted and come in later, so what? You're long gone.
This may sound laborious and slow but it should be enough to block repeat voting, IMHO.