How Your Vote Is Protected — Security, Privacy and Constitutional Integrity
THE PEOPLE MUST CONTROL THE VOTE. NO ONE MUST CONTROL THE PEOPLE THROUGH THE VOTE.
Vox Populi est Sui Iuris — The Voice of the People is Sovereign.
The Phoenix Charter proposes to place permanent constitutional authority in the hands of the electorate. Such a system can succeed only if people can trust the processes through which their decisions are recorded, counted and implemented.
A voting system is not trustworthy merely because it displays totals, requires a password or describes itself as secure. It must protect the eligibility of participants, the secrecy of their choices, the integrity of recorded votes and the independence of the final result.
Above all, the system must prevent those administering it from acquiring the power to change what the People have decided.
THE ADMINISTRATOR MUST NEVER BECOME THE AUTHOR OF THE RESULT.
This page explains the protection standards Phoenix intends to apply across its participation systems. It distinguishes ordinary website polls from an official statutory referendum and from the proposed constitutional voting arrangements that would follow lawful adoption.
Current status: The existing Phoenix Petitions & Polls facility provides ordinary online participation functions. It has not been presented as an independently certified constitutional voting system. The additional protections described below are requirements for further development, assessment and implementation, not a claim that every feature is already operational.
Contents
- The Principles of a Protected Vote
- Verifying Eligibility Without Creating a Surveillance System
- Separating Your Identity From Your Vote
- Preventing Duplicate, Altered or Fabricated Votes
- Rules That Cannot Be Changed to Manipulate the Result
- Independent Scrutiny and Verifiable Results
- Protecting Personal Information
- Accessibility and Freedom From Coercion
- Disputes, Failures and Recovery
- Who Protects the Constitutional Process?
- Existing Polls, Pre-Votes and Official Referendums
- The Final Safeguard — Accountability to the People
1. The Principles of a Protected Vote
Every legitimate voting process must answer several fundamental questions.
Who was entitled to participate? Was each participant counted only as permitted by the applicable rules? Was the question presented fairly? Was the response recorded accurately? Could the result have been changed without detection? Was the final outcome determined under the rules announced before voting began?
These questions apply whether the decision concerns a community petition, an ordinary public poll, the proposed Phoenix referendum or a future exercise of constitutional Standing Power.
The protection required increases with the authority of the result. An informal opinion poll may need relatively simple safeguards. A decision capable of directing government or altering constitutional arrangements demands a far more rigorous legal, technical and independent verification framework.
The greater the authority carried by a vote, the stronger the protection surrounding it must be.
2. Verifying Eligibility Without Creating a Surveillance System
A credible voting system must determine whether a participant is entitled to take part in the particular decision.
Eligibility does not mean the same thing in every situation. A public consultation may welcome responses from anyone. A local proposal may concern residents of a particular area. A statutory referendum is governed by the electorate defined in its legislation. A future constitutional decision would follow the electorate and eligibility requirements established by the Constitution.
The verification system must therefore match the purpose of the vote.
For a constitutionally binding decision, it must be possible to establish that the relevant voting entitlement is valid and has not been unlawfully duplicated.
But verification must not become an excuse to compile unnecessary records of a person’s movements, purchases, relationships, medical history or political activities.
Identity and eligibility information should be limited to what is necessary for the particular lawful purpose. Access must be restricted, and retention must be justified.
VERIFY THE RIGHT TO VOTE — NOT THE PERSON’S RIGHT TO LIVE FREELY.
3. Separating Your Identity From Your Vote
One of the most important safeguards is the separation between establishing that somebody may vote and revealing how that person voted.
In a secret-ballot process, administrators may need to confirm that a participant is eligible and has not already used the relevant entitlement. That does not mean every administrator should be able to associate the person’s identity with their chosen answer.
The proposed constitutional voting system must be designed so that verification and ballot handling are separated wherever secrecy is required.
Public records may demonstrate that a valid ballot was accepted and counted without publishing the identity and voting preference of the individual who cast it.
This requires more than hiding names from a results page. The underlying storage, administrative permissions, audit processes and technical design must be examined to determine whether individual choices can actually be reconstructed.
The precise method must be independently assessed before any claim of genuine ballot secrecy is made.
Some ordinary public petitions involve named expressions of support and therefore serve a different purpose from secret constitutional voting. Participants must be told which type of record they are creating before they submit it.
A PERSON MUST NOT BE REQUIRED TO PUBLICLY EXPOSE THEIR POLITICAL CHOICE TO EXERCISE THEIR CONSTITUTIONAL RIGHTS.
4. Preventing Duplicate, Altered or Fabricated Votes
A voting total is meaningless if the same entitlement can be counted repeatedly, if votes can be added by administrators or if recorded responses can be changed without detection.
For constitutionally binding participation, the system must be capable of checking the validity of each voting entitlement, preventing unlawful repeated use and maintaining an accurate record of accepted ballots.
The voting process must account for incomplete submissions, rejected ballots, interruptions and any permitted changes of response.
Where a decision allows participants to change their answer during an open voting window, the published rules must state how the earlier response is superseded and how the final valid response is counted. A person must not accidentally gain two votes because the system permits an amendment.
Administrators must not be able to manufacture support by manually adjusting displayed totals. Changes to records or system configuration must be controlled, logged and available for authorised scrutiny.
A future implementation may employ tamper-evident records and independent reconciliation. Any such protection must be tested in operation rather than assumed from its technical description.
ONE VALID ENTITLEMENT MUST PRODUCE NO MORE THAN THE VOTING WEIGHT PERMITTED BY THE CONSTITUTION.
5. Rules That Cannot Be Changed to Manipulate the Result
Before a binding constitutional vote opens, the electorate must be able to inspect the exact question, the available answers and the rules determining its outcome.
Those rules must identify the eligible electorate, the opening and closing times, any required quorum, the approval threshold, the treatment of abstentions and invalid responses, and the procedures for ties, recounts and disputes.
Different constitutional powers may require different safeguards. A public direction concerning an administrative matter may not require the same procedure as an amendment to the Constitution.
Whatever the prescribed rules, they must not be silently altered during voting to produce a result preferred by the government, the Guardian, a political party or the platform operator.
Any lawful correction to a published question or procedure must be documented and handled under predetermined rules. Where a substantive alteration changes what people were asked to decide, earlier responses cannot simply be reinterpreted as votes on the new question.
The constitutional framework must also protect fundamental rights from being overridden merely because a numerical threshold has been reached.
THE PEOPLE DECIDE UNDER RULES KNOWN IN ADVANCE — NOT RULES CHANGED AFTER THE RESULT IS KNOWN.
6. Independent Scrutiny and Verifiable Results
Trust cannot depend solely upon assurances from the organisation administering a vote.
The system must allow appropriate independent scrutiny of its procedures, eligibility controls, accepted ballots, counting method and published result, while preserving protected personal information and ballot secrecy.
Independent review must be capable of identifying discrepancies between submitted responses, accepted votes, rejected attempts and final totals.
The records must be sufficient to establish whether the declared outcome follows from the applicable voting rules.
For constitutional decisions, the proposed arrangements should provide for independent technical examination, controlled access to necessary evidence, documented findings and lawful procedures for challenging irregularities.
A voting result should not be declared final merely because a website has displayed a winning option.
The Constitution would need to define when certification occurs, who may challenge the result, which authority determines disputes and what happens if material irregularities are discovered.
Where the law provides for independent courts to review constitutional disputes, their jurisdiction must remain protected.
THE RESULT MUST BE CAPABLE OF VERIFICATION WITHOUT REVEALING THE PRIVATE CHOICES OF INDIVIDUAL VOTERS.
7. Protecting Personal Information
A person’s political opinions are among the categories of personal information receiving additional protection under UK data-protection law.
Where political preferences are connected to an identifiable person, the processing must have a valid lawful basis and an applicable special-category condition. Security, minimisation, transparency and appropriate retention safeguards are necessary.
The voting system must not collect information simply because it may prove commercially valuable later.
Data collected to verify voting eligibility should not be silently repurposed for marketing, political profiling, commercial targeting or unrelated surveillance.
Personal information must not become the property of a third party merely because it supplies the technical infrastructure.
Any transfer or sharing of information must have an appropriate legal basis and be explained to the people affected.
A participant must be able to access the relevant privacy information and understand what is collected, why it is needed, who is responsible for it and how the applicable data-protection rights can be exercised.
Read the Information Commissioner’s Office guidance on specially protected information.
THE PEOPLE’S VOTES MUST NEVER BECOME A COMMERCIAL DATABASE OF THEIR POLITICAL BELIEFS.
8. Accessibility and Freedom From Coercion
Constitutional participation must be available through arrangements that take account of disability, limited internet access, technological barriers and different levels of literacy or technical confidence.
A system that requires every participant to own a particular smartphone, subscribe to a service or surrender unnecessary biometric information risks excluding people from exercising rights that belong to them.
The proposed constitutional arrangements must provide practical, secure and accessible participation methods consistent with the adopted Constitution.
Assistance must not become an opportunity for another person to control or discover a secret vote.
Voters must remain free from intimidation, threats and financial inducements designed to control their choices.
A constitutional vote must not be linked to the granting or withholding of healthcare, food, employment, housing, banking or other essential services.
The same protections apply to those who oppose Phoenix, abstain from participation or criticise the constitutional proposal.
THE FREEDOM TO VOTE INCLUDES THE FREEDOM TO DISAGREE WITHOUT FEAR OF PUNISHMENT.
9. Disputes, Failures and Recovery
No technology should be treated as incapable of failure.
Connections can be interrupted, servers can become unavailable, software can contain defects and attempts may be made to interfere with the administration of voting.
The proper response is to establish reliable safeguards and recovery procedures before the system is entrusted with legally binding decisions.
The proposed constitutional framework must define how voting is suspended or restored when necessary, how valid ballots remain protected, how affected participants are treated and how an interrupted voting period may lawfully be extended or repeated.
It must also explain what happens when an irregularity is serious enough to undermine the validity of a result.
Neither the government nor a private platform operator should be able to cancel an inconvenient outcome by claiming a technical failure without independent examination.
Likewise, a defective result must not be certified simply because someone wishes to avoid the inconvenience of a recount or fresh vote.
THE FAILURE OF A DEVICE MUST NEVER BECOME THE FAILURE OF THE PEOPLE’S CONSTITUTIONAL AUTHORITY.
10. Who Protects the Constitutional Process?
The Phoenix constitutional proposal separates the People, the House of the Electorate, the Civic-Crowd-Device, the Guardian and independent courts.
These are not interchangeable functions.
10.1 The People
The People are the source of sovereign constitutional authority under the proposed settlement. Their authority does not belong to an inventor, political party, government or technology provider.
10.2 The House of the Electorate
The House is constituted by the electorate itself. It is the constitutional means through which the People would exercise their collective authority under the adopted rules.
10.3 The Civic-Crowd-Device
The Civic-Crowd-Device is proposed as the practical mechanism for administering participation, recording valid contributions, testing prescribed thresholds and producing authorised outcomes.
Its function is administrative and technical. It does not possess sovereignty.
10.4 The Guardian
The Guardian would protect the integrity of constitutional processes according to the functions and limits established by the Constitution.
It must not acquire the power to determine political outcomes, override the electorate’s lawful decisions or become a substitute government.
10.5 Independent Courts
Independent courts would continue to protect rights, determine legal disputes and provide remedies under the applicable constitutional framework.
Neither a voting majority nor a private computer system should replace the lawful determination of individual rights or criminal responsibility.
THE PEOPLE HOLD THE AUTHORITY. THE INSTITUTIONS PROTECT THE PROCESS. THE DEVICE RECORDS AND ADMINISTERS THE DECISION.
11. Existing Polls, Preliminary Votes and Official Referendums
11.1 The Existing Petitions & Polls Facility
The Phoenix website already has a Petitions & Polls facility for ordinary public participation.
Its presence does not establish that it has been independently audited for secure constitutional voting, that it provides a secret ballot or that it can verify participation against the official UK electoral register.
Those capabilities would require examination of the actual implementation and its operating procedures.
11.2 The Proposed Referendum Pre-Vote
The preliminary referendum poll is intended to allow people to express their opinion before Parliament authorises the official constitutional referendum.
Its published arrangements must disclose the relevant participation rules and level of verification.
The totals may demonstrate public engagement, but must not be described as the official referendum result.
Before that poll opens, the existing plugin must be checked against the safeguards appropriate to the information and authority involved.
11.3 The Official Statutory Referendum
An official UK referendum requires parliamentary authorisation and is administered under the legal arrangements established for that referendum.
The Electoral Commission’s responsibilities depend upon the authorising legislation. Official voting, counting and certification are distinct from the operation of a private Phoenix opinion poll.
Read the Electoral Commission’s explanation of its referendum responsibilities.
11.4 Future Constitutional Voting
Binding decisions under the proposed Phoenix settlement would require the Constitution, implementing legislation, operational systems and independent safeguards necessary to exercise the approved Standing Powers.
The final legal framework must establish how votes are validated, counted, certified, reviewed and implemented.
Until those requirements have been satisfied, an experimental website poll must not be treated as exercising constitutional authority.
12. The Final Safeguard — Accountability to the People
The Phoenix Charter proposes constitutional authority that belongs permanently to the electorate.
That promise would be meaningless if the system used to exercise the authority could be captured by its administrators, manipulated by government or controlled through commercial dependency.
The people responsible for building, maintaining and protecting the system must therefore operate within enforceable limits.
Voting rules must be known in advance. Personal information must be protected. Individual ballots must remain secret where required. Results must be capable of independent verification. Disputes must have lawful remedies. No private organisation must acquire sovereignty through control of the voting machinery.
THE VOTING SYSTEM MUST OBEY THE CONSTITUTION. THE CONSTITUTION MUST PROTECT THE PEOPLE. THE PEOPLE MUST NEVER BECOME SUBJECT TO THE MACHINE THAT RECORDS THEIR VOICE.
FROM PARTY POLITICS TO PEOPLE POLITICS.