How do you ensure a ballot is not rigged?

Every so often a client hands us a problem that has nothing to do with websites, branding, or AI, and those tend to be the ones we enjoy most.

This one came from a public sector client of ours. They run a sports facility that every club and community group in the area wants to use over winter. There's a fixed set of hourly slots on weekday evenings and far more organisations than slots. To make it harder, everybody wants roughly the same handful of good ones.

Allocating those slots had caused arguments for years. Whoever got the 6pm Tuesday slot was obviously somebody's mate, and whoever missed out had obviously been stitched up. Our client was tired of being accused of favouritism for a decision that somebody, somewhere, simply had to make.

So the brief we got was a belter: how do we run a ballot without anyone being able to say we fixed it?

The two obvious answers are both bad

The first obvious answer is first come, first served. You release a link at a set time and let people pile in. It sounds fair until you realise it rewards whoever happens to be sat refreshing their phone at the right moment, and punishes the volunteer coach who was at work, or putting the kids to bed, or stuck with one bar of signal.

The second obvious answer is to have a sensible person sit down and work it out. The trouble is that the moment a human makes the decision, that human owns the argument. It doesn't matter how fair they've been, because nobody can prove it either way.

We decided the only way to stop the arguments was to take people out of the decision altogether.

How it works

Organisations registered online and our client approved each one as genuine. Every approved organisation then got a login and ranked their preferred slots from one to five. They also told us what should happen if all five had gone: either give them whatever's left, or give them nothing.

Everyone had exactly the same window to do this. It made no difference whether you registered in the first five minutes or the last five, because speed counted for nothing.

Then we needed a running order, and this is the bit we're quite proud of.

Borrowing the National Lottery

A fair draw needs randomness that nobody involved can touch. If the client pulls names out of a hat, you have to trust the client. If our software picks random numbers, you have to trust us. We didn't want anyone to have to trust anyone.

So we borrowed the most heavily scrutinised random number generator in the country, which is the Saturday night Lotto draw.

Once the draw had happened, we took the six winning numbers and combined them with each organisation's unique reference. That combination went through a standard one-way calculation called SHA-256, which is a piece of maths that turns any input into a big, scrambled string of letters and numbers. It's the same sort of calculation that sits behind online banking and passwords, so it's well proven. It has two useful properties. The same input always gives the same output, so anyone can re-run it and check our working. And you can't work backwards from it, so there's no way to engineer the result you want.

Every organisation ended up with its own number. We sorted those numbers, and that gave us the running order.

From there it's simple. The system starts at the top of the list and asks whether your first choice is still free. If it is, it's yours. If it's gone, it tries your second, then your third, fourth, and fifth. If none of them are left, it does whatever you told it to do at the start.

The bit that makes it impossible to fiddle

Preferences locked at 7pm on the Saturday. Lotto ticket sales closed at 7.30pm, and the numbers were drawn after that.

Think about that for a second. At the moment everybody's choices were locked in, the numbers that would decide the order didn't exist yet. Our client couldn't have nudged the result and neither could we. An organisation couldn't have gamed its choices either, because there was nothing to game them against.

The only way to cheat would have been to know Saturday's lottery numbers in advance, and anyone who can do that has better things to do with their weekend than sort out booking slots.

Completely transparent

The rules were published before anyone registered. The method was made public, the lottery numbers are public, and the results were published for everyone to see. Anyone who fancied it could take the six numbers and an organisation's reference, run the same calculation, and get the same answer we did. Nobody had to take our word for any of it.

Did it work?

Nearly half of the organisations, 48%, got their first choice. Another 9% got their second, 13% got their third, 9% got their fourth, and 4% got their fifth. Add that up and 83% of the organisations that entered walked away with one of the slots they'd actually asked for, which is a pretty good outcome when everybody is chasing the same few evenings.

The result we care about most is that our client didn't spend the following week defending who got what. They didn't decide it, and neither did we. The rules were agreed in advance, everybody had the same chance, and a set of numbers that didn't exist when the entries closed put everyone in order.

Was it a bit over-engineered for allocating booking slots? Probably. But nobody can fiddle it and anyone can check it, which is exactly what the client asked us for.