# A shadow ballot at your AGM — an invitation

*To the committee of Heeley Bank Allotment Society, Sheffield. This is a letter, kept
in the open like everything else in this project:
[github.com/GlassOnTin/civic-kernel](https://github.com/GlassOnTin/civic-kernel).*

We would like to run a **shadow ballot** alongside one vote at your AGM — the treasurer
election, or any motion you choose. Your meeting runs exactly as it always has, and the
show of hands decides, exactly as it always has. Alongside it, members who want to also
cast a sealed electronic ballot from their phone or the club laptop. The shadow result
decides nothing. Afterwards, anyone — a member, a rival, a stranger on the internet —
can check the whole shadow election from the published record and see that nobody could
have rigged it. We want to learn what confuses real people and what breaks in a real
season; you get to watch a vote checked to the bottom, and you keep the tools.

One admission before anything else: you will notice the demonstration club in every
page linked below is called *Heeley Bank Allotment Society*. It is imaginary — its
sixty members, its treasurer race, its little scandals were all invented when this
prototype was first built, and the name was borrowed from the neighbourhood. Nothing
in it is about your society or any real person. Now that we are writing to the real
Heeley Bank, we owe you that up front — and if the borrowing is unwelcome, we will
happily rename the fiction.

## What it would look like

**In the weeks before the AGM.** Each member who wants to join the shadow ballot opens
a web page — no app, no account — which makes them a secret and a public line of text.
They keep the secret; they hand the public line to whoever keeps your membership
register, in person or by email. The register certifies it: about five minutes per
member, and the register's own judgment about who is a member is the only membership
check there is — same as today. Members can appear in the published record by name or
just as a plot number; their choice, yours to offer.

**Three small favours from outside the committee.** Two neighbouring societies (or the
federation) act as *witnesses*: three times during the season, someone there spends five
minutes checking and countersigning a fingerprint of the record, on a web page with
nothing to install — that is what makes it impossible for anyone, including us and
including your committee, to quietly rewrite history. Three people act as *trustees*, holding the keys that unseal the final total —
any two suffice, and no one of them (and no computer anywhere) can unseal anything
alone. And your newsletter or noticeboard prints three lines after the close: the
record's final fingerprint, which is what stops history quietly changing afterwards.

**At the AGM.** Hands go up and are counted, as always. That is the result. Anyone who
wants to also casts the shadow ballot: a couple of minutes on a phone, or at the club
laptop. Before sealing, a member can challenge the device to open the envelope it just
made, to catch a phone that lies — the page explains this itself. Ballots are handed in
as small files (sent by email, or saved straight onto the club laptop): the person
collecting them can see who handed one in — like seeing who posts a letter — but nobody,
including the collector, can see what any envelope says.

**Afterwards.** The committee closes the box; the trustees unseal only the total; the
witnesses countersign the final record; the newsletter prints the fingerprint. The
record is published, and every member gets one link where their own browser re-checks
the whole election — every ballot's proofs, the count, the fingerprints — and a box
where they can look up *their own* ballot and see it was counted, without the record
ever naming them. Then we all compare it with the show of hands and talk about what was
confusing, what was slow, and what a club would actually want.

## What it asks of people

- **The register / secretary:** roughly an afternoon in total, spread across the season
  — the enrolment certifications plus a handful of short commands, each one printed in
  the runbook, and we walk you through them (or sit alongside you).
- **Each member who opts in:** about ten minutes, once — enrol, then cast.
- **Each witness:** three five-minute email exchanges across the season.
- **Each trustee:** ten minutes at the start (making and swapping their keys), five at
  the end (answering the tally).
- **Nobody:** any money. There is nothing to buy, no account to create, and the
  software is public and stays public.

## What this is not — said plainly

- **Not the decision.** The hands decide. If every computer involved caught fire
  mid-meeting, your AGM would be unaffected.
- **Not a product.** It is a research prototype, built in the open, with its
  limitations written down next to its claims. You would be the first real community
  to use it, which is precisely what we are asking for — and what the record it
  publishes will honestly say.
- **Not secret about what it publishes.** The published record contains the enrolled
  list (names or plot numbers, as each member chooses), the sealed ballots, and the
  arithmetic that proves the count. It never links any ballot to any member — not to
  us, not to the committee, not to anyone reading it in fifty years. But it is public,
  permanently, and members should know that before enrolling.
- **Not a privacy risk beyond that.** No member data leaves the club except that
  public record. The one honest asymmetry: whoever collects the ballot files knows who
  handed one in (not what it says) — we say this on the ballot page itself rather than
  hoping nobody notices.
- **Not magic.** A member can check their own vote was counted; they cannot prove to
  anyone else how they voted — there is deliberately nothing to show a buyer or a
  bully. If someone is watching over a member's shoulder, the member can simply vote
  again later: the last ballot counts and the re-vote is invisible.

## If you are curious before saying yes

Ten minutes with a cup of tea, in any current browser:

- **Check a finished election yourself:**
  [glassontin.github.io/civic-kernel/verifier.html](https://glassontin.github.io/civic-kernel/verifier.html)
  — our demo club's election, every check running in your browser, including looking up
  one voter's ballot by their (deliberately public, demo-only) secret.
- **Cast a ballot into the demo:**
  [glassontin.github.io/civic-kernel/cast.html](https://glassontin.github.io/civic-kernel/cast.html)
  — the same page your members would use.
- **The whole design, in plain speech first:**
  [glassontin.github.io/civic-kernel/architecture.html](https://glassontin.github.io/civic-kernel/architecture.html) — every
  section opens as one plain sentence; the detail is there if you want it. Every term
  of art has a one-line definition in the project README.

If the committee is willing, we would start with a half-hour chat and a demonstration
at the clubhouse — one where you vote in a real (demo) election and then watch us try
to rig it and get caught; the run sheet is public too:
[`clubhouse-demo.md`](clubhouse-demo.md). If the committee is not willing, we would
genuinely value hearing why — that is a finding too.

*Ian Williams — everything in this letter, including the letter, lives at
[github.com/GlassOnTin/civic-kernel](https://github.com/GlassOnTin/civic-kernel);
direct contact details come with the copy we hand you.*