This demo follows one polling-station result from the paper sheet to your screen. It shows how every phone in the room can catch a figure changed on the way.
On election night, a result can change after the count. A figure is typed again, a database is edited, a file is replaced. Today, nobody can prove it. The party sees one number, the published page shows another, and it is one word against another.
Awa is a polling agent at Serekunda 12. The candidates A, B and C are fictional.
Awa and the observers count the ballots: A 312, B 241, C 19. She signs the paper result sheet.
She types the three figures in the agent app and takes a photo of the sheet. Her phone seals the figures and the photo with its own key. No network is needed. In a real deployment, that key is locked in the phone's secure chip; in this demo, the agent app is a web page.
When the network comes back, the phone sends the sealed sheet. If anyone changes a figure on the way, the seal no longer matches.
A second agent at the same station sends the same figures. Two sheets agree, so the station result is confirmed.
The results page shows Serekunda 12 with 312, 241 and 19, and the photo of the sheet. Every sealed sheet also goes into a public log, a record that can only grow.
Every phone in the room opens the verifier. It downloads the sealed sheets and adds them up again, on the phone itself. It does not ask the server for the total. When its figures match the sealed sheets, it turns green.
The demo plays two attacks live, the way an insider could.
We change B at Serekunda 12 from 241 to 290 in the database behind the results page. The page now shows 290. At its next check, every verifier turns red and names the station: Serekunda 12. The sealed sheet still says 241.
Next, we rewrite the public log itself so that it says 290. Each new state of the log needs the signature of an independent witness, a second server that keeps a copy of everything it signed. The witness sees that the history changed and refuses. Without its signature, every verifier turns red.
At the end, the evidence page puts the two side by side: the sheet Awa sealed, with 241, and the forged entry, with 290.
These are the addresses in use during the call.
| Address | Who opens it | What it shows |
|---|---|---|
tally.fellwin.sn | Everyone | The results page: the count as it comes in. |
verify.tally.fellwin.sn | Everyone, on their own phone | The verifier: it adds up the sealed sheets again and turns green, amber or red. |
tally.fellwin.sn/agent | The presenter only | Awa's agent app, simulated in a web page. |
tally.fellwin.sn/console/ | The presenter only, with a password | The consoles that run the demo and play the two attacks. |
witness.tally.fellwin.sn | Nobody | The independent witness. It has no page: it only signs or refuses. |
A demo is honest about its limits. These are the ones an expert can name.