The Returning Officer
This page is about campaigns created as a secret ballot: ballots recorded without the member's address.
What it does not hide, and what it does not protect against:
- It does not stop you from showing somebody how you voted, or somebody from watching you vote. If you could be pressed to prove your vote, this is not protection against that.
- In a small group the result can show how people voted: a unanimous result shows everybody’s vote.
- Whether you voted is not written down, but it can show. The number of ballots is public as it grows, batch by batch: in a small group, or at a quiet hour, one more ballot next to who was online points to a person. The relayer sends ballots at fixed times, every half hour, and a question group leaves only when at least five ballots of that same group are waiting (five on this site’s relayer; an operator can set another number); it never puts two question groups into one transaction, and until a vote’s last half hour it sends one group of a vote a minute. So at a fixed time your ballot reaches the blockchain as one among at least five ballots of its question group, and four of those may belong to people acting together, who know their own and so know yours. In the last three minutes before the end the least number is one: where fewer than five people answer a group in a half hour, those ballots wait until then and leave however few they are, and a voter who is the only one of a group in that last stretch leaves alone. After the end, when the ballots are opened, a batch whose ballots all say the same tells what each of its voters chose to whoever can tell who was in it: reckoned with each ballot as an independent draw, a batch of five is unanimous about one time in three on a question that splits 80 to 20 (6 times in 100 at 50 to 50, 59 in 100 at 90 to 10). Batching makes linking harder; it does not make it impossible. A ballot that waits for those last three minutes may not be recorded: a transaction sent then can fail, and nothing extends a vote. Several ballots of yours for different groups can reach the blockchain minutes apart or, when few people vote, together in the last three minutes before the end, each among the ballots of its own group.
- Logbook could work out how you, by name, voted. One service receives your ballot from your network address, pays for your other actions in the community from that same address, serves your encrypted list of communities, and sees you sign in. So Logbook, or Cloudflare, which hosts it and carries every one of those requests, could put them together: this member, this ballot. After the vote ends the ballot is opened by whoever this vote lets open it (in a vote that opens for everyone: anyone), and then it is: this member, this vote. Logbook keeps no table that says so. It does keep, for two days, half of what such a table needs: daily counters of its sponsor, named by keyed hashes of your address in the community and of your network and written in one moment (what it stores is listed under Data Storage). The other half, which ballot came from which network, passes through its relayer and is not stored by it. What stands in the way is that, not mathematics. A second relay run by somebody else, which would prevent it, does not exist yet.
- Before the end your answers can be read by the key servers this vote names, if enough of them act together; whoever created the vote chose them, and a creator who runs them reads the count as it goes. You can also open your own ballot early and show it.
- Your passkey is kept by your device’s passkey provider (Apple, Google, a password manager), which may copy it to your other devices. Whoever can use your passkey can vote as you and work out which ballots are yours.
- A device with malware can read what the passkey derives. So can a changed copy of this page, and this page is served anew on every visit by Logbook and by Cloudflare, which hosts it: either could serve a changed one. So can a browser extension that reads this page. The operators of the Sui node and of the indexer this page asks see which vote your network address reads, and when; the page asks them for whole lists (every ballot of the vote, the whole roll, the whole part of the list of ballot keys that yours lies in), not for your ballot or your key alone.
- This page gives you no receipt when the relayer takes your ballot in time; when it does not, the page offers the ballot as a file, and that file is one. Your passkey is a receipt in every case: at any later time it can work out again which ballots are yours. Whoever makes you use it, or takes it over, learns how you voted in past votes of this kind.
- What you write can identify you: your style, a fact only you know. Nothing hides that.
#Who the Officer Is
Every such campaign names a returning officer when it is created: a key. By default it is the creator's own address in the community, kept by the page in the creator's browser. It can instead be a public key that never enters this site.
- The officer is you, in this browser: the key that fixes the roll is kept by this site’s page. Whoever controls the page you open can fix a roll in your name.
- The officer is a key that never enters this site. The roll is fixed only by a signature made with it, outside this page.
#The Roll and the Inspection
After creation the roll is drawn up on the blockchain in steps, from the member records. Anyone may send the steps; nothing is chosen. Until it is closed, what goes onto the roll is decided by the groups contract, which Logbook can upgrade: the roll is only as right as that contract was while the steps ran. When it is closed it stands for the inspection time the creator chose. From then on nobody can add to it, a member can find their key on it, and anybody can recompute it.
The campaign's page recomputes the roll in the officer's browser and shows: how many members were eligible, how many of them have no ballot key (they cannot vote in this campaign), the number of leaves, the number of distinct keys, and the root. It also reads the box's own list of leaves and compares it leaf by leaf; when that list cannot be read in full, the page signs nothing and says that reading failed, which is not a fault of the roll.
#The Officer's Duty
An important vote should have its root compared with a second tool, run on your own machine against a full node and an indexer you choose. The tool recomputes the roll from the member records and prints its root, its size and the sentence to sign. It comes with the next release of the Logbook SDK (@logbookprotocol/sdk on npm). The release on npm today does not have it and its source is not public, so today it cannot be had; this page says so instead of printing a command you could not run. It is Logbook’s own code, not somebody else’s implementation: it guards against a changed copy of this page, not against an error the two share. If the two differ, do not sign, and do not rely on either until the difference is explained.
The comparison is recommended on every fixing and never required by the page. From 1,000 leaves the page asks for a tick: "I compared the root with a second tool, or I knowingly did not."
Read the size against what you know: "117 on the roll; our list has 119 members, two without a ballot key".
#Signing
The roll is fixed by the officer's signature over one sentence that names the box, the root and the size. The page shows the sentence in full, and offers the button to sign only after the inspection time has passed, by the blockchain's clock.
Signing is the decision. A signature, once made, is public for good and fixes this roll in anybody’s hands; it cannot be taken back. The button on this page signs and sends in one step, and a signature made elsewhere fixes the roll as soon as anybody sends it. The vote can be called off only before the signature is sent; once the roll is fixed there is no withdrawal.
#Before an Election: the Relayer's Least Batch
A recommendation, not something this page checks: before an election, ask whoever runs the relayer what its least batch is. A question group leaves at a fixed time only with that many ballots; this site’s relayer is set to 5, and for an election about 25 is advised where the turnout carries it (with N voters over H hours expect about N/(2H) ballots a half hour, and take no more than half of that). In the last three minutes before the end the least number is 1 whatever was set.
#Calling a Vote Off
Before the roll is fixed, and before the end, the officer can call the vote off by signing another sentence. No ballot is then ever taken; the campaign is made again if the vote is still wanted. A wrong roll that is noticed after it was fixed cannot be changed: the organisation declares the vote void and runs another.