Why should anyone trust the operator of this framework?

You should not trust My Vote Forward, or any operator of a civic system, on its word alone. The framework’s position is that trust should rest on evidence that does not depend on the operator’s honesty: published methods, versioned questions, a visible correction record, and, for any future official vote, independent audits of records that voters could check. These educational websites run no elections, so the trust they ask for today is narrow: that the explanations are accurate and the sources real. Who would independently oversee a real deployment, and how its operator could be removed, is unresolved.

The objection in its strongest form

The objection is that the operator of any participation system holds every lever. It writes the questions, chooses the subjects, runs the servers, writes the code, computes the aggregates, and publishes the results. It can see patterns no one else can see. If it wanted to shade a result, delay a release, or quietly edit a question, it would usually be the only party able to notice. Promises of neutrality cost nothing, the critic says, and every organization that ever abused a public trust made them.

The strongest form of the objection is about verification, not motive. Even an honest operator can be wrong, hacked, pressured by a funder, or replaced by a less scrupulous successor. Software can contain errors no one finds for years. A system that asks to be trusted because its people are good has no defense when the people change. And a civic project with political subject matter will be accused of bias from every direction no matter what it does, so it needs evidence that persuades people who already distrust it.

Why the objection matters

The objection matters because My Vote Forward publishes aggregate priorities and explains political subjects. If readers cannot verify that what is published is what was collected, or that explanations are accurate, the framework’s outputs are worth no more than the reader’s opinion of its operator. In politics, that means half the audience will dismiss any result they dislike. Trust that depends on reputation also fails exactly when it is most needed: when a result is surprising or unwelcome.

Defined terms

• Operator: the person or organization that runs the websites and data systems. Today that is My Vote Forward, for these educational websites and the demo only.
• Software independence: the property that an undetected error or change in software cannot cause an undetectable change in an election outcome.
• Risk-limiting audit: a statistical check of an election outcome against voter-verifiable records, with a large chance of correcting a wrong outcome.
• Append-only log: a public record to which entries can be added but not silently changed or removed.
• Independent oversight: review by a party that the operator does not control and cannot dismiss.

Evidence

Election practice: check outcomes against records voters verified. Mark Lindeman and Philip Stark describe a risk-limiting audit as “a method to ensure that at the end of the canvass, the hardware, software, and procedures used to tally votes found the real winners”.⁠¹ They are careful about its limits: risk-limiting audits “do not guarantee that the electoral outcome is right, but they have a large chance of correcting the outcome if it is wrong”.⁠¹ The method depends on an audit trail that voters had a chance to verify; “Systems that do not produce voter-verifiable paper records, such as paperless touchscreen voting systems, cannot be audited this way”.⁠¹ They ground this in software independence, citing Rivest and Wack: “An undetected change or error in voting system software should be incapable of causing an undetectable change or error in an election outcome”.⁠¹

Colorado offers a working example. The Colorado Secretary of State reports that in the 2017 Coordinated Election, “all of the counties that use machines to tally votes performed the first statewide risk-limiting audit” in the state, and that the random seed used to select ballots is “generated by rolling 20 ten-sided dice during a public meeting”.⁠² The public dice roll is a small design choice with a large point: no one, including the operator, can choose which ballots get checked.

Expert recommendations. In 2018 the National Academies recommended that “States should mandate a specific type of audit known as a ‘risk-limiting’ audit prior to the certification” of election results, and that elections use human-readable paper ballots.⁠³

Public logs outside elections. Certificate Transparency, specified by Google engineers in RFC 6962 in 2013, publishes web security certificates in “publicly auditable, append-only, untrusted logs,” built with Merkle trees, so that “anyone” can “audit certificate authority (CA) activity”.⁠⁴ The design does not ask anyone to trust the log operator; it lets anyone detect if the log was altered. The RFC is marked experimental and has been superseded by RFC 9162.⁠⁴

Statistical independence. The UN Fundamental Principles of Official Statistics say statistical agencies “need to decide according to strictly professional considerations” on methods, and must “present information according to scientific standards on the sources, methods and procedures of the statistics”.⁠⁵ The Venice Commission’s electoral code requires that “An impartial body must be in charge of applying electoral law”.⁠⁶

How comparable systems have handled it

Comparable systems combine three tools. Elections rely on independent or impartial administration, records voters can verify, and public audits.⁠^1,2,6 Statistical agencies rely on professional independence and published methods.⁠⁵ Internet infrastructure relies on public, append-only logs that anyone can check.⁠⁴ What they share is that trust is moved from a person to a process that outsiders can inspect. None of them claims the process is perfect; Lindeman and Stark state outright that audits do not guarantee correctness.⁠¹

The Swiss e-voting program adds a fourth tool: the Federal Chancellery commissions independent examinations of the system and its operation.⁠⁷ Outside examination is only as strong as the examiner’s independence and the publication of what it finds.

Competing interpretations

One interpretation holds that process transparency is sufficient: if methods, versions, and logs are public and checkable, the identity and motives of the operator stop mattering. On this view, the framework’s job is to make every claim verifiable.

A second interpretation holds that transparency is necessary but not sufficient, because most people will never check anything. They will trust or distrust based on who runs the system and who funds it. On this view, independent governance, such as a board the operator cannot control, matters more than technical verifiability.

A third interpretation is skeptical of both for a private initiative: only a public authority with legal accountability, courts, and elected oversight should run anything that touches official voting. On this view, an educational project should stay educational, and the question of trusting its operator with real votes should never arise.

What the framework answers

My Vote Forward’s current answers are:

• Every material factual claim on these websites is cited where it occurs, and the site’s source list is built from a claim ledger that records the source and supporting passage for each claim (see about).
• Pages show a version and review date. Corrections are published in the changelog.
• Subject lists and question sets are versioned, with who proposed and reviewed each version (see governance).
• Release packages carry a checksum so anyone can confirm they hold the published version, and corrections are new versions with the earlier one kept visible (see published releases).
• Privileged administrative actions are logged as metadata without political answer content, and routine administrators cannot browse individual political responses (see governance and security).
• Any future official vote would require voter-verifiable records and independent audits, not operator assurances (see audits and verification).

Where the objection still wins

The objection wins on governance. Today, the operator is also the reviewer of its own subject lists, the decider of its own corrections, and the only party with administrative access. There is no independent board, no outside auditor, and no mechanism for removing the operator. Checksums and changelogs let readers detect some changes, but only if they look, and only for what the operator chooses to publish. For any future official use, the framework names requirements it does not meet.

Unresolved questions

• What independent body could oversee a real deployment, and who would appoint and fund it without creating a new conflict?
• How could an operator be removed or replaced, and what would happen to the data?
• Could public append-only logs be used for question versions and releases in a way ordinary readers could check?
• What should happen if the operator and an independent reviewer disagree?

Related

• Governance
• Audits and verification
• Published releases
• Security
• Who funds it?
• Hard questions