A secure device for electronic voting employs a write-once vote-recording medium. The medium has an initial writing mode in which data can be written but not read and a subsequent reading mode whereby data can be read but writing is permanently disabled. Once switched from the writing mode to the reading mode, it cannot be switched back. A hardware mechanism provides successful write confirmation The medium can be installed like a cartridge into a vote-recording device. The voting device provides encryption/authorization that combines polling parameters with voter information to produce a "fuse string". For each vote, a fuse string is written to the array. The poll is "closed" by switching the medium to "read" mode, preventing further modification or tampering. To read out the results of the poll, an auditor enters "password" information to decode/decrypt the recorded information.