diff --git a/src/meerkat/bulletinboard/BulletinBoard.java b/src/meerkat/bulletinboard/BulletinBoard.java
index 4ea0bce..dfeb321 100644
--- a/src/meerkat/bulletinboard/BulletinBoard.java
+++ b/src/meerkat/bulletinboard/BulletinBoard.java
@@ -26,7 +26,7 @@ public interface BulletinBoard {
     float getRedundancy(MessageID id);
 
     /**
-     * Read all messages posted since a given ID
+     * Read all messages posted matching the given filter
      * Note that if messages haven't been "fully posted", this might return a different
      * set of messages in different calls. However, messages that are fully posted
      * are guaranteed to be included.
diff --git a/src/meerkat/voting/Ballot.java b/src/meerkat/voting/Ballot.java
deleted file mode 100644
index ca405ff..0000000
--- a/src/meerkat/voting/Ballot.java
+++ /dev/null
@@ -1,8 +0,0 @@
-package meerkat.voting;
-
-/**
- * Created by talm on 25/10/15.
- */
-public interface Ballot {
-
-}
diff --git a/src/meerkat/voting/BallotSecrets.java b/src/meerkat/voting/BallotSecrets.java
new file mode 100644
index 0000000..ef015aa
--- /dev/null
+++ b/src/meerkat/voting/BallotSecrets.java
@@ -0,0 +1,11 @@
+package meerkat.voting;
+
+/**
+ * Created by talm on 10/26/15.
+ */
+public class BallotSecrets {
+    PlaintextBallot plaintext;
+
+    EncryptionRandomness encryptionRandomness;
+    RandomnessGenerationProof proof;
+}
diff --git a/src/meerkat/voting/BoothParams.java b/src/meerkat/voting/BoothParams.java
new file mode 100644
index 0000000..28af6b5
--- /dev/null
+++ b/src/meerkat/voting/BoothParams.java
@@ -0,0 +1,11 @@
+package meerkat.voting;
+
+/**
+ * Parameters local to the voting booth:
+ *  Private and public signature keys
+ *  Logging keys,
+ *  Randomness generation params
+ *  etc.
+ */
+public class BoothParams {
+}
diff --git a/src/meerkat/voting/EncryptedBallot.java b/src/meerkat/voting/EncryptedBallot.java
index 3add851..aa7bd80 100644
--- a/src/meerkat/voting/EncryptedBallot.java
+++ b/src/meerkat/voting/EncryptedBallot.java
@@ -12,10 +12,5 @@ public interface EncryptedBallot {
      */
     Message getPublicPortion();
 
-    /**
-     * Return the secrets required to open and verify an encrypted ballot
-     * @return
-     */
-    Message getBallotOpening();
 
 }
diff --git a/src/meerkat/voting/EncryptedBallotWithSecrets.java b/src/meerkat/voting/EncryptedBallotWithSecrets.java
new file mode 100644
index 0000000..c38f52d
--- /dev/null
+++ b/src/meerkat/voting/EncryptedBallotWithSecrets.java
@@ -0,0 +1,12 @@
+package meerkat.voting;
+
+/**
+ * Created by talm on 10/26/15.
+ */
+public interface EncryptedBallotWithSecrets extends EncryptedBallot {
+    /**
+     * Return the secrets required to open and verify an encrypted ballot
+     * @return
+     */
+    BallotSecrets getBallotSecrets();
+}
diff --git a/src/meerkat/voting/PlaintextBallot.java b/src/meerkat/voting/PlaintextBallot.java
new file mode 100644
index 0000000..2833d54
--- /dev/null
+++ b/src/meerkat/voting/PlaintextBallot.java
@@ -0,0 +1,19 @@
+package meerkat.voting;
+
+import java.util.List;
+
+/**
+ * Created by talm on 25/10/15.
+ */
+public class PlaintextBallot {
+    /**
+     * Answers to the ballot questions.
+     * Each answer is a list of integers; its parsing depends on the question type.
+     * For example, a multiple choice question would have a length-1 list containing
+     * the single choice's index.
+     */
+    List<List<Integer>> answers;
+
+    long serialNumber;
+
+}
diff --git a/src/meerkat/voting/VotingBooth.java b/src/meerkat/voting/VotingBooth.java
index 8882702..1eebd78 100644
--- a/src/meerkat/voting/VotingBooth.java
+++ b/src/meerkat/voting/VotingBooth.java
@@ -4,9 +4,65 @@ package meerkat.voting;
  * Created by talm on 25/10/15.
  */
 public interface VotingBooth {
-    void init(ElectionParams params);
 
-    EncryptedBallot encryptBallot(Ballot ballot);
+    public interface UI {
+        /**
+         * Prepare UI for a new user.
+         */
+        void votingBegin();
+
+        /**
+         * UI must physically commit to an encrypted (or Wombat style) ballot.
+         * (probably by printing)
+         *
+         * When commitment is complete, should ask voter to choose between
+         * cast and audit.
+         *
+         * Called by votingbooth thread.
+         */
+        void commitToEncryptedBallot(EncryptedBallot ballot);
 
 
+        /**
+         * Finalize a vote for casting
+         * Called by votingbooth in case user decides to cast.
+         */
+        void castVote();
+
+        /**
+         * Submit audit information and spoil vote.
+         * Called by votingbooth in case user decides to audit
+         * @param ballotSecrets
+         */
+        void auditVote(BallotSecrets ballotSecrets);
+
+
+    }
+
+    /**
+     * Must be called before using any other method.
+     * @param globalParams global election parameters (e.g., global signing key, global encryption key)
+     * @param boothParams local parameters (e.g., private signature key for booth, randomness table?)
+     */
+    void init(ElectionParams globalParams, BoothParams boothParams);
+
+
+    /**
+     * Called from UI thread when voter has finished making selection.
+     *
+     * Should encrypt ballot and commit.
+     * @param ballot
+     */
+    void submitBallot(PlaintextBallot ballot);
+
+    /**
+     * UI calls this when the user cancels the voting process in the middle.
+     */
+    void cancelBallot();
+
+    /**
+     * Called by UI thread after voter made choice to cast or audit ballot.
+     * @param castVote
+     */
+    void voterCastOrAudit(boolean castVote);
 }