I am the author of this white paper, posting under the pseudonym Simurgh. Thank you for taking a look.
The Motivation: This project comes directly from my experience watching the "Women, Life, Freedom" movement in Iran and the subsequent efforts by the state to fragment and divide the opposition. I felt that if people could only talk to each other at scale and discover their common ground, they would be less susceptible to this strategy.
The Project: This white paper outlines a protocol for doing just that. It's a structured, multi-stage deliberation system designed to be built on a platform with an existing network, like Telegram. It uses three core principles:
Absolute Anonymity: To protect participants.
Structured Process: A tiered funnel to distill signal from noise.
Meritocratic Promotion: To ensure the most well-reasoned ideas rise to the top.
My Ask of the HN Community: I am not a cryptographer or a large-scale systems architect. I am posting this here because this community has an incredible depth of expertise. I am looking for your honest feedback, especially on:
Potential failure modes and security vulnerabilities in the protocol design.
Suggestions for strengthening the system against manipulation.
Any thoughts on the overall concept from those who have experience building social or secure messaging protocols.
Pol.is is a tool that uses ML to synthesize these shared views and provide inisght into both areas of consensus and discordance.
I am not sure of the specific relationships but it has been championed by Audrey Tang (Taiwan's minster of digital affairs) and other Pluralist people.
I think this is a worthy tool but slightly narrower than pol.is because it's just as important to understand where there is disagreement.
Thank you for sharing this; it's a fantastic reminder. I was actually introduced to the concept behind Pol.is a few years ago on a BBC Click Persian segment, and your comment prompted me to take a much deeper look into their work. The connection to Audrey Tang and Taiwan's digital democracy work is particularly inspiring.
You make a very sharp point about the importance of understanding disagreement. In my proposal, the primary mechanism for this is the public vote count. While it doesn't have the sophisticated ML clustering of Pol.is, the goal is to make the final vote tally on all candidate messages transparent. This way, you see not only the ideas that reached consensus but also the exact level of support for minority or dissenting opinions, creating a clear map of both agreement and discord.
Thanks again for the excellent and very helpful comment.
Democracy is not, about implementing whatever the majority says, nowhere in the world is democracy practiced like that. Democracy is about safeguarding minority rights and enforcing a government which functions by compromise. Protection against the tyranny of the majority, is what democracy is about.
To justify the "Orwellian". A society wide consensus justifies a total state, it removes legitimation from the opposition and creates an environment where divergence becomes suspicious. What OP does not understand is that totalitarian regimes in most case do have a popular mandate and exactly that popular mandate is used to justify the total state. Additionally, OP talks about Iran, but has he considered what would happen if 70% of the Iranian population would support the regime? What would the result look like, if not perfect evidence that the opposition should be oppressed.
This is an excellent critique, and it gets to the heart of the protocol's design. You are right to point out the risk of a "tyranny of the majority" in the promotion process.
The protocol's primary goal is indeed the deliberative "tournament." It's designed to shine in a situation where a fragmented majority exists, allowing them to build a unified voice through successive rounds of debate.
However, your comment highlights the need for a fail-safe in the scenario you described. In that case, the protocol is designed to produce a crucial byproduct: the transparent, aggregated data from all Level 1 groups. Even if a minority is outvoted in the tournament, the system would still capture and report the total percentage of votes their ideals received nationwide.
So, to your crucial question about a 70% pro-regime majority: the tournament would likely reflect that reality, but the protocol's data byproduct would simultaneously provide undeniable proof that "30% of the population supports opposition ideals." This proves their ideals are not a "tiny fringe," but a significant political reality that must be contended with.
The system is therefore designed with a dual function: its primary path is to forge a majority consensus, but its fail-safe path guarantees the ability to accurately map the strength of minority views.
Thank you for a sharp question that pushed me to articulate this core duality more clearly.
I don't see how it can be resistant to foreigners flooding the system with their text or to people creating multiple accounts to have an outsized influence.
I think if those problems could be solved it would be the best thing in the world, but the funnel procedure and the meritocratic promotion don't matter in the absence of those things. There are also many ways to do what this system proposes. A threaded discussion system is also good.
The problem is instead the lack of manipulation resistance from multiple accounts and people who shouldn't have accounts at all.
You have put your finger on the single most difficult technical challenge, and I appreciate you focusing on it. How does the system defend against manipulation from foreign actors or domestic users with multiple accounts?
A simple solution like filtering by in-country phone numbers is insufficient, as it would unfairly exclude the significant and important Iranian diaspora.
Instead, the primary defense against this kind of manipulation is built into the very structure of the protocol: massive randomization and scale.
The key is that an adversary with, for example, 1,000 coordinated accounts cannot concentrate them into one group to guarantee a win. The randomization protocol would scatter those 1,000 accounts across 1,000 different Level 1 groups. In each group, their single agent would be just one voice out of 100, rendering their coordinated voting power negligible.
To have a meaningful impact, an adversary wouldn't just need to create thousands of accounts; they would need to create hundreds of thousands or even millions to have a statistical chance of influencing a significant percentage of the concurrent discussions. This raises the cost and complexity of an attack by several orders of magnitude compared to traditional social media platforms.
While no system is perfectly immune, the protocol is designed so that its very architecture acts as the primary defense, making coordinated manipulation impractical.
Thank you again for this sharp and essential critique.
[1] https://www.weizmann.ac.il/math/shapiro/home
Hi discarded1023! Thank you for the kind words and for the excellent pointer to Professor Ehud Shapiro's work.
I've had a chance to look through his website. His work on designing protocols for large-scale collective decision-making is clearly very relevant and fascinating.
To your question, I think his protocols are very much aligned in spirit. The main difference in purpose seems to be that his models often focus on a group making a specific decision or recommendation. My project's immediate goal is slightly broader: to create a continuous, large-scale "map" of public opinion across many topics simultaneously. The underlying principles of fairness and structured debate, however, are very much the same.
Your note about his use of French political philosophy is also very insightful, and I'll keep that in mind as I explore his work further.
Thank you again for a very thoughtful and helpful pointer!
You have raised an absolutely critical point about trust in the platform vendor. The problem you mention, is indeed a major hurdle for any system where the results have binding power, and the potential for a powerful vendor to manipulate the process is a significant risk.
I think the key distinction for my proposal is that it's designed not as a binding e-voting system for electing officials or passing laws, but as a large-scale deliberative barometer or a highly sophisticated poll. Its power is not in its legal authority, but in its ability to create a transparent and undeniable public record of popular will and consensus. The goal is, of course, to influence the political landscape by revealing the truth, rather than to formally decide an election.
You are right that this still requires a great deal of trust in Telegram as the vendor. This is a deliberate trade-off. While a fully decentralized, open-source, and verifiable system would be ideal from a security perspective, it would lack the one thing necessary for this project to work: millions of active, engaged users. The strategy here is to leverage Telegram's massive, existing network as a foundation, accepting the platform risk as a necessary trade-off to achieve the scale required to be politically relevant.
Thank you for bringing up this crucial distinction. It's a conversation that needs to be had about any tool for digital democracy.
Deleted Comment