Learning objectives
- Explain what an inclusion proof demonstrates to a voter
- State precisely what it does not demonstrate
- Assess the operational burden of offering voter-facing verification
Content
- The concept: a Merkle tree lets you prove one specific record is included in a published set, without revealing the rest of the set. The voter gets a short proof they can check independently.
- What it proves: this specific custody event, for this specific ballot envelope, is part of the record the office published at this time, and that record has not been altered since.
- What it does not prove — state this every time, without hedging:
- Not how the voter voted (custody is envelope-level; ballot secrecy is preserved by design)
- Not that the ballot was counted correctly (tabulation is a separate system and a separate audit)
- Not that the ballot was legitimately cast (eligibility and signature verification are separate processes)
- Overclaiming here is the fastest way to destroy the trust this is meant to build. A voter who is told verification means more than it does, and later learns otherwise, becomes a permanent adversary.
- Demo (25 min): a voter looks up a ballot, receives a proof, verifies it against a published root using an independent tool.
- Operational reality (20 min): support call volume, accessibility and plain-language requirements, what happens when a voter's proof fails to verify — the incident response path, which every jurisdiction must have before launch.
Run the exercise
Assessment
draft a plain-language explanation of ballot verification for a voter mailer, at an eighth-grade reading level, that neither overclaims nor confuses. ---