Published releases: scheduled, reviewed, and the same for everyone

In plain words

If many people share what matters to them, the group picture can be useful to the public, to reporters, and to officials. But a group picture can also leak. If you can slice the data finely enough ("people on this street, aged 40, who chose this"), you can sometimes find one person.

So My Vote Forward does not offer a live data tap. Instead, it publishes releases: fixed packages that are checked first, published at a set time, and identical for everyone. Each release explains exactly what was asked, who answered, who did not, and how the numbers were made. If a mistake is found, a corrected version is published next to the old one, so the fix is visible.

Today there are no real participant releases. The demo uses only labeled, synthetic (made-up) data to show how the process works.

Defined terms

• Release package. A fixed set of files (data tables, methods, manifest) approved for publication at a stated time.
• Manifest. A document listing what a release contains: identifier and version, whether it is synthetic, creation and publication time, question versions, population and denominator, missing or excluded data, methods, rights, checksum, and relationship to earlier versions.
• Denominator. The group a percentage or ranking is computed over. A result without a denominator cannot be interpreted. See measurement.
• Disclosure risk. The chance that published statistics can be used to learn something about an identifiable person.
• Embargo. The period before a release's scheduled time, during which the package must not be reachable by anyone outside the release process.
• Correction. A new, versioned release that supersedes an earlier one, with the change and reason stated.
• Synthetic data. Data generated for demonstration that describes no real person. See the glossary.

Evidence

Aggregates can be reverse-engineered

The U.S. Census Bureau, explaining its 2020 disclosure protection approach, cites its simulated attack on 2010 data: "We perfectly reconstruct 2010 Census records for 97 million people, correctly inferring race and ethnicity for 3.4 million vulnerable population uniques" ¹. The Bureau's page now states that its information "is no longer current" and that the Bureau "is evaluating alternative approaches to comply with the U.S. Department of Commerce's administrative order prohibiting the use of noise infusion" ¹. The research result shows the danger of releasing many detailed tables. The policy change shows that the right protective method is contested even among expert institutions. A participation framework cannot assume a solved method; it must document whatever method it uses and why.

Public statistics carry professional obligations

The UN Fundamental Principles of Official Statistics, endorsed by the General Assembly on 29 January 2014, state that "individual data collected by statistical agencies for statistical compilation ... are to be strictly confidential and used exclusively for statistical purposes" (Principle 6), that agencies "are to present information according to scientific standards" (Principle 3), and that they "are entitled to comment on erroneous interpretation and misuse of statistics" (Principle 4) ². My Vote Forward is not a statistical agency, and these principles do not apply to it as law. They describe a well-tested professional standard for releasing public numbers.

What a responsible release discloses

The American Association for Public Opinion Research's Code requires, for publicly released results, that researchers "name the sponsor of the research and the party(ies) who conducted it," disclose "the exact wording and presentation of any measurement tool from which results are reported," "be specific about the decision rules used to define the population," "explicitly state whether the sample comes from a frame selected using a probability-based methodology," "disclose the dates of data collection," describe modes of data collection, report "estimates of sampling error" for probability samples, and "describe how the weights were calculated" ³. Full disclosure of these items is due "at the time results are released" ³.

These requirements bear directly on participation data, which typically comes from people who chose to take part. An opt-in group is not a probability sample, and its results do not describe a whole population without strong assumptions. See measurement and collective priorities.

Wording is part of the data

Pew Research Center notes that "even small wording differences can substantially affect the answers people provide," and that "earlier questions can unintentionally provide context for the questions that follow" ⁴. A release must therefore name the exact question version and presentation order, and must not merge answers from different wordings as if they were the same question. See question design.

Consent and withdrawal

Where consent is the basis for using data, EU law provides that a person "shall have the right to withdraw his or her consent at any time," and that withdrawal "shall not affect the lawfulness of processing based on consent before its withdrawal" ⁵. Cited here as a well-developed standard, not a compliance claim, this matches a practical fact: a release already downloaded cannot be recalled. Withdrawal can stop inclusion in future releases. See consent.

Competing interpretations

Open data versus controlled release. Open data advocates argue that raw, granular data enables independent analysis and accountability. Privacy researchers point to reconstruction attacks ¹. The framework chooses controlled, documented releases with no arbitrary slicing, and accepts that some analyses will not be possible.

Live scoreboards versus fixed releases. A live tally invites gaming: coordinated groups can watch numbers move and respond. A fixed release reduces that feedback loop but delays information. The framework publishes simulated or real collective priorities only through releases, and never shows on-site opinion percentages or vote totals.

Who interprets? Statistical agencies claim a right to comment on misuse ². Others argue that the publisher should release and step back. The framework publishes methods and corrections, and may note misinterpretations, but claims no control over outside interpretation.

Application to this framework

The release pipeline, as required by the project specification:

1. Prepare the package from approved data only.
2. Validate the schema and provenance.
3. Review privacy and the consent basis. Before any real respondent release, a documented privacy design must set statistical methods and minimum group sizes.
4. Approve the release by a named role, recorded in the audit log.
5. Hold until the scheduled time, stated in UTC with a display time zone. The package must not be exposed early through static files, scripts, caches, feeds, previews, alternate hosts, or guessable URLs. Schedule enforcement happens on the server, not in the browser.
6. Publish the same immutable version to everyone at once.
7. Correct by publishing a new version that names what changed and why, while the earlier version stays visible with a superseded label.

Boundaries:

• No raw-data API. No live polling endpoint, no arbitrary demographic query service, no individual records, no individual opinions, no ballots.
• No on-site scoreboard. After a release, the site does not display opinion percentages or vote totals. Collective priorities are the explicit exception, and only as released.
• Synthetic first. The demo's release packages contain only clearly labeled synthetic data. Current demo users cannot opt into a real program, because none exists.
• Election law wins. Official election results belong to the responsible authority and its legal publication duties. Release rules here cannot override election law. See jurisdictions.
• Integrity checks. Each package carries a checksum so that anyone can confirm they hold the published version. See audits and verification.

Unresolved questions

• What minimum group size, suppression rule, or noise method is appropriate for small districts, given that expert institutions disagree ¹?
• How should a release describe an opt-in population so that readers do not mistake it for public opinion as a whole?
• Who should approve a release, and should an outside reviewer sign off on the privacy design? See governance.
• How long should superseded versions remain available, and how should a correction reach people who downloaded the earlier one?