"Scantegrity II Municipal Election at Takoma Park: The First E2E Binding Governmental Election with Ballot Privacy"
http://static.usenix.org/event/sec10/tech/full_papers/Carbac...
With the prior Punchscan system, voter privacy is accomplished thru hash collisions. Hiding your ballot in a herd of ballots cast. A trick that works only if your herd (precinct) is large enough and your ballots are simple enough. Definitely would not work (protect voter privacy) in my jurisdiction.
Side note about IRV, as used in Maryland Park: It's now a non-starter. After the handful of well-studied experiments, election administrators are dead set against it. Ballots are complicated, voter education is tough, and IRV necessitates electronic tabulation, which rules out legally required manual recounts. (My jurisdiction often gets over 500k ballots. IRV is not feasible here.)