ProofPollPolls anyone can check.
ProofPoll is an open protocol for publishing a poll's record so that anyone can check it: that the design was fixed before fieldwork began, that each day's responses were committed that day, exclusions included, and that nothing was changed afterwards. It never rates a pollster, and it never says a poll is right.
What a reader can check
Every check runs on one folder the pollster publishes next to the poll, called the bundle. It works offline, against the pollster's signatures and the witnesses' clocks.
Nothing was changed after it was signed
Every step is signed and names the step before it, and independent witnesses countersigned each one. Change one number afterwards and its signature stops matching, and so do the witnesses' copies.
The pollster published what it promised
Before fieldwork, the pollster commits to how much it will publish: the signed steps, the documents behind them, or every response. The bundle is checked against that promise.
Each step happened when it says
The pollster's own clock is never trusted. The witnesses' clocks show whether the design was registered before the first response, and whether each day's responses were committed within 48 hours.
What it cannot check
A verified bundle does not show:
- that the sample represents anyone,
- that the respondents were real people,
- or that the pollster ran no polls it never registered.
This block is in every report, pass or fail.
How it works
Three parties, each with its own key: the pollster, at least two independent witnesses, and whoever wants to check.
- The pollster registers the poll before fieldwork. It signs the questionnaire, the population, the sampling plan, the weighting spec, what it will publish, and who paid for it.
- Each day's responses are committed as they come in. Accepted and excluded alike, with the reason for every exclusion. Responses carry an opaque id, never a name, and a random salt, so a pollster can commit to them without publishing them.
- Independent witnesses countersign every step. A poll archive, a university survey center, a newsroom -- any organization with a domain. The pollster chooses its witnesses, and the bundle names every one, so a reader can judge for themselves whether they are independent. A witness's timestamp on a step is the only time the report trusts.
- The pollster publishes the bundle next to the poll. Anyone can check it, on this site or offline with the tools.
Who it is for
Publishers and aggregators
You decide which polls you print and which go into your averages. You can ask for a bundle first.
Medical journals adopted the same rule for clinical trials in 2005: a trial that was not registered before it enrolled patients would not be published.
Pollsters
The tools are free and run on your own machine. Readers can check your methods statement against the record, because the design you registered and every exclusion you made were signed and dated by your witnesses.
Witnesses
Any organization with a domain can witness. A witness checks that each step links to the last, stamps its own time, and refuses to sign two versions of the same step. It never sees a respondent.
Where it stands
- The specification is version 0.1, a working draft.
- Reference tools for pollsters, witnesses and readers, with 17 published test cases to check a second implementation against.
- There is no hosted witness yet. Witnesses are independent organizations, and proofpoll.net will never be a required one.
- The verifier on this site runs on this site's server. To rely on nothing here, run
proofpoll-verifyon your own machine.
If you run polls, publish them, or would witness them, I'd like to hear from you. Richard Whitney, richard@whitneys.co