Page MenuHomePhabricator

Add a "release votes" feature for SecurePoll vote dumps
Closed, ResolvedPublic

Description

For many elections, there is a grace period between the end of voting period and the official tally of the results. In this period, election admins/executives will review votes and strike those there were cast in a disallowed way (for example, using a sock, or someone who lost their eligibility, or in the case of fawiki elections, when the vote is case through a proxy or VPN).

The problem is SecurePoll's dump feature is immediately available upon the completion of the voting period. This means people can download the votes (before striking of invalid votes happens) and run a tally on their own. This can be misused to publish unofficial results, challenge the real results and ... I guess today we especially understand how harmful it can be to have mixed messages about the outcome of an election.

There is a second issue with this too: if dumps are publicly available, and then a vote is struck, downloading the dump again and comparing it with the last dump will show the exact contents of that vote (currently, this issue only applies to elections that are not encrypted, but once we implement T145695 this will apply to every election).

Therefore, we should add a feature to SecurePoll that allows controlling when dumps are available. This could be date-based (a prespecified "release date") or a toggle that can be flipped by election admins (but for a toggle solution, T133369 needs to be fixed first).

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript
Peachey88 renamed this task from Add a "release votes" feature for SecurePoll to Add a "release votes" feature for SecurePoll vote dumps.Nov 8 2020, 6:57 AM
jrbs raised the priority of this task from Medium to High.Sep 23 2022, 10:34 PM
jrbs moved this task from Backlog to Evaluated on the MediaWiki-extensions-SecurePoll board.

Evaluation:

Medium dificulty. Could be solved by a dedicated DB field and an admin exclusive UI to "enable dumping". Or just be bound to the "tally state". So only if tally is completed dumps are available

Amdrel changed the task status from Open to In Progress.Feb 3 2025, 11:53 PM
Amdrel claimed this task.

Implementing a toggle for public access to the dump on the edit page would not work because elections cannot be edited once they are finished. I do think a release date field makes sense, and so does doing it based on the tally date. Either of those solutions would not require us to change the current edit page locking behavior.

Change #1117239 had a related patch set uploaded (by Amdrel; author: Amdrel):

[mediawiki/extensions/SecurePoll@master] Disallow access to vote dumps until after results are tallied

https://gerrit.wikimedia.org/r/1117239

Change #1117239 merged by jenkins-bot:

[mediawiki/extensions/SecurePoll@master] Disallow access to vote dumps until after results are tallied

https://gerrit.wikimedia.org/r/1117239