Purpose of Anonymity

This post is an edited and extended version of my comments to Robin Wilton's post The Department of Perverse Consequences.

Campaigners are eloquent on the dangers that threaten anonymity and privacy: administrative inquisitiveness, gratuitous leaks, fraud. But what exactly is the purpose of anonymity and privacy? What are the benefits to the individual and to society? Indeed, does society benefit in any way from anonymity and privacy, or does this debate expose a fundamental conflict of interest between society (so-called "public interest") and the individual?

Here's the example from Robin's blog: anonymity of voting in elections. Robin mentions the fact that camera phones were banned from the polling booths in the recent Italian elections. Obviously this ban doesn't actually prevent voters from selling their votes - votes were being bought and sold long before cameras were invented - but the lack of photographic evidence reduces the economic efficiency of the transaction.

In this example, anonymity has a specific social purpose - to protect voters from improper influence, and to protect the democratic system from being bought by the highest bidder. In other words, it is a security mechanism, whose purpose is to counter certain specific forms of vulnerability and abuse.

If anonymity is merely a security mechanism, it is a means-to-an-end rather than an end-in-itself. Any claim of the form "security mechanism X protects against vulnerability Y" raises a number of questions of effects and effectiveness.

• How effective is X at protecting against Y?
• What alternative mechanisms could be devised to protect against Y?
• What other effects does X have?
• In particular, how does X-preventing-Y affect the wider sociotechnical system?
• Overall, does the prevention of Y provide sufficient justification for X?

And it is not obvious that anonymity is the only or best way of protecting individual voters and the electoral system from bribery and corruption. After all, we often protect systems against bribery and corruption by a security mechanism that appears to be based on exactly the opposite principle: transparency and openness. There is also an apparent conflict between the principle of anonymity and the principle of non-repudiation - the "stand-up-and-be-counted" principle. So why is anonymity appropriate for some situations, and transparency and non-repudiation for others?

We can try to answer this question by looking at the other effects of anonymity. One likely possibility is that anonymity makes it easier to change your mind, because you don't have to explain or justify your change of mind to other people, whereas delegates who are publically committed to a political position need to construct an elaborate rationalization before they can change position or party. Anonymous elections can therefore respond more quickly to the tide of public opinion, and elected politicians get a more rapid judgement from the electorate. It is of course debatable whether this is a Good Thing or not.

On this argument, anonymity is not just a security mechanism, but a system feature that affects the dynamic behaviour of the electoral system in an interesting way.

In this post, I have talked purely about the possible social benefits of anonymity. Obviously there may also be arguments for anonymity in terms of individualism, but for the time being I'll leave those arguments for Robin and others to articulate ...