Seedlabs

BlindCheck: Unlinkable Verification Gateway for E2E Elections

A privacy front-end that election offices place in front of their public ballot-check website, so voters can confirm their vote was recorded without the election authority — or anyone watching — being able to link the check to a voter's IP address or identity.

Computer ScienceInternet Traffic Analysis and Secure E-voting
AI Governance and Cognitive ImpactElection administration and voting technology — privacy infrastructure for public ballot-verification portals.

Concept

E2E voting systems only deliver their security benefit if voters actually use the optional verification website to check their confirmation codes. The Takoma Park deployment recorded IP addresses on that website, and the case study flags the resulting "potential for identification attacks": a coercer or vote-buyer who can observe verification logs learns who checked and when, a malicious insider could correlate checks against voter rolls, and voters who know this may simply decline to verify.

BlindCheck is a drop-in, neutral third-party gateway that a jurisdiction places in front of its public verification site. Voters' code-check queries go to BlindCheck instead of the election server; the gateway strips IP addresses, session identifiers, and timing fingerprints, pads and batches queries so individual checks cannot be distinguished, forwards them to the jurisdiction's bulletin board, and returns only the yes/no "recorded as cast" result. It is offered both as ordinary HTTPS (rate-limited, with no per-voter logging beyond a short-lived nonce) and as a Tor onion service for the strongest unlinkability. The jurisdiction's own logs see only aggregate gateway traffic. The gateway publishes a short no-logs policy and attestation that the same kind of independent outside auditors engaged in Takoma Park (three were used there) can inspect after each election.

Why now

Paper [0] is the first evidence that a binding governmental E2E election with ballot privacy can be run and accepted by the general public (1,728 voters across six wards, with a 271-voter exit survey), which makes its residual risks the actionable ones — and its limitation list explicitly names IP-based identification attacks on the verification website as unresolved. Because verification is optional, every privacy concern suppresses the verification rate, the single metric that determines whether an E2E deployment actually delivers its promised integrity guarantee. An unlinkable front-end is therefore the cheapest way to raise verification participation in the next round of municipal and county pilots.

Written by GLM · 13 Oct 2026

AI assessment

Backed by 1 paper88

A highly focused privacy proxy that solves a specific, documented vulnerability in E2E voting systems to increase voter verification rates.

Evidence strength
5/5
The idea directly addresses a specific 'limitation' explicitly cited in the full text of the Takoma Park case study regarding IP-based identification attacks.
Market pull
3/5
While the need is critical for E2E integrity, the buyer pool is limited to a small number of government election offices and specialized voting vendors.
Novelty & moat
4/5
Unlike CodeSnap which focuses on the input (scanning codes), this focuses on the transmission (unlinkable verification), filling a distinct gap in the E2E pipeline.
Feasibility
5/5
Building a privacy-preserving proxy/gateway using existing technologies like Tor or simple IP-stripping batchers is technically straightforward.
Wedge clarity
5/5
The wedge is extremely sharp: a drop-in gateway for the specific 'ballot-check' page of an E2E election.
Simplicity / focus
5/5
The product is a single-purpose utility with a clear function, avoiding the trap of becoming a broad 'election platform'.

Scored by Gemma 4 · 13 Oct 2026. Rated against a fixed rubric (evidence, market, novelty, feasibility, wedge, simplicity), relative to the closest ideas already in the catalog. A prior estimate to compare ideas before real-world signal arrives.

Persona discussion

AI personas trained on real people's expertise debate this idea as it evolves.

View the discussion →

Act on this idea

Ideas only matter if someone runs with them. Your message goes straight to the founder's inbox — nothing is stored on our servers.

Who benefits

  • Hart InterCiviccompany

    U.S. election system vendor that could bundle an unlinkable verification front-end with its verifiable-systems offering, directly answering the documented IP-privacy objection when pitching to county customers.

  • Center for Democracy & Technologyorganization

    Works on election security and privacy policy; a deployable unlinkability tool gives it a concrete, standards-friendly answer to verification-surveillance concerns it raises in advocacy.

  • Smartmaticcompany

    Sells verifiable election technology internationally; a privacy gateway is a low-cost component that removes a named surveillance objection to public verification portals in its deployments.

  • The Tor Projectorganization

    An onion-service deployment for civic ballot verification is a high-integrity public-interest use case that directly advances its mission of mainstreaming privacy technology.

Research it builds on

  1. Scantegrity II Municipal Election at Takoma Park: The First E2E Binding Governmental Election with Ballot Privacy
    Richard Carback · 2026 · 107 citations
    All ideas from this paper →
Leave feedback
feasibility