Voting Service System Design

The prompt arrives in three instalments: "Design an online voting service for our college's student elections. Then we'll see how it changes if the whole university, with all its colleges, uses it. And at the end: what if it were a United States election?"

It sounds like a form with a counter behind it. Most candidates draw a votes table with a voter id, a candidate id and a count, and then the interviewer starts asking. If the table knows who voted for whom, what happened to the secret ballot? If a student opens two tabs and presses submit in both, how many votes count? When does anyone see results, and could seeing them early change the outcome? When the university arrives with twelve colleges and students enrolled in two of them, does each student get one ballot or two? And when the interviewer finally says "the United States", do you scale the same design up, or do you stop and say something braver?

The Trap Built Into a Familiar Question

Two failures show up again and again:

• The Counter: treats a vote like a like, a row tied to a user, updated in place, counted live. It is simple and fast, and it records exactly how every person voted. Signal: hasn't noticed that a vote has to be checked against a person and then made impossible to trace back to them.
• The Scaler: hears "United States" and reaches for sharding, queues and multi-region databases for 160 million ballots. The numbers were never the problem. Security experts advise against returning marked ballots over the internet, and real elections keep the official record on paper. Signal: scaled the solution without asking whether it should exist.

The passing performance right-sizes the college system to its real load of about one vote a second, and notices that the busiest moment is people reading results after the polls close. It records that Alex voted and, separately, what a ballot says, with nothing joining the two. It makes double voting impossible in one database transaction. It grows to the university by changing identity, eligibility and administration rather than throughput. And at the national step it changes the scope: the ballot stays on paper, and the system worth designing is the one that reports unofficial results to fifty million people on election night.