Sensus satisfies the first part of the privacy property well, but does not satisfy the second part at all. Given the above assumptions, it is not possible for any party to link a ballot to the voter who cast it. However, Sensus does nothing to prevent a voter from proving that he or she voted in a particular way.