Xavier Bultel

Pascal Lafourcade

Secure Trick-Taking Game Protocols How to Play Online Spades with Cheaters

Trick-Taking Games (TTGs) are card games in which each player plays one of his cards in turn according to a given rule. The player with the highest card then wins the trick, i.e., he gets all the cards that have been played during the round. For instance, Spades is a famous TTG proposed by online casinos, where each player must play a card that follows the leading suit when it is possible. Otherwise, he can play any of his cards. In such a game, a dishonest user can play a wrong card even if he has cards of the leading suit. Since his other cards are hidden, there is no way to detect the cheat. Hence, the other players realize the problem later, i.e., when the cheater plays a card that he is not supposed to have. In this case, the game is biased and is canceled. Our goal is to design protocols that prevent such a cheat for TTGs. We give a security model for secure Spades protocols, and we design a scheme called SecureSpades. This scheme is secure under the Decisional Diffie-Hellman assumption in the random oracle model. Our model and our scheme can be extended to several other TTGs, such as Belotte, Whist, Bridge, etc.

Introduction

The first card games originate around the 9th century, during the Tang dynasty. Today, they are played all around the world, and a multitude of different games exist. For instance, Poker is probably the most famous gambling card game. Thanks to the Internet, many web sites implement online card game applications, where players meet other players. Cards games websites require some security guarantees, such as secure access for payment, robust software, trusted servers, and cheating detection protocols. These guarantees are crucial for the reputation of the web site in the card game community.

Spades is a famous online gambling card game. It is a trick-taking game: at each round, players take turns playing, then the player that plays the highest card wins the trick, i.e., all cards that have been played this round. Moreover, if it is possible, then players must play a card that follows the suit of the first card played in the round, otherwise they can play any other card. However, if a player cheats by playing a card of another suit while he has some cards of the leading suit, there is no way to detect it immediately. The other players will detect the cheat later, if the cheater plays a card of the leading suit. As a result, the game is biased, because players revealed some of their cards, hence players cannot replay the game, which must be canceled. Cheaters often get a penalty, but Spades is a team game, hence the cheater's partner is also punished, even if he is not an accomplice. It is even more unfair if the partners do not know each other and/or do not trust each other, which is the case in online games, where teams are chosen by the server.

To avoid this problem, online Spades web sites use a trusted server that manages the game. This server deals the cards, and prevents players from cheating, which means it knows all the cards of each player. However, having a trusted server is a strong security hypothesis, because if some players corrupt the server, then the security properties do not longer hold.

Our motivation is to design a cryptographic scheme, called SecureSpades, that allows the players to check that the other players do not cheat, whithout revealing any information about the cards of each player, and without any trusted server.

Contributions:

In this paper, we focus on Trick-Taking Games (TTGs), which are card games where each player plays one of his cards in turn, and where the player with the highest card wins the trick. For the sake of clarity, we focus our work on Spades, because it is the most played online TTG for real money, and its rules are simple. However, our protocol can be extended to other TTGs, such as Whist or Bridge.

We propose a scheme for Spades that has the following security properties: -The game server is not trusted.

-The players are convinced that nobody cheats. It means that:

1. Theft-resistance: a player cannot play a card that is not in his hand, nor can a player play cards from the hand of his partner . 2. Cheating-resistance: a player cannot play a card that does not follow the rules of the game (in Spades, if a player has a card of the leading suit, he must play it). -Unpredictability: the cards are dealt at random. -Hand-privacy: the players do not know the hidden cards of the other players.

-Game-privacy: at each round, the protocol does not leak any information except for the played cards. We propose a formal definition of a Spades scheme, then we give a formal definition of the security properties described above. We also design SecureSpades, a protocol based on the Decisional Diffie-Hellman (DDH) assumption, and zero-knowledge proofs. Finally, we prove the security of SecureSpades in the random oracle model.

Our protocol not only ensures all the security properties of the real card games, it also provides additional security features. In real card games, it is not possible to detect cheating exactly when the wrong card is played. In fact, our protocol also allows players to detect cheats that are undetectable with real cards, hence it can be used to create new TTGs, for instance a Spades variant where the game is stopped after 5 rounds. In this variant, if the players do not have to reveal the cards they did not play, then there is no way to prevent them from cheating. However, with our approach, such a game can be securely implemented.

Related Work:

In 1982, Goldwasser and Micali introduced the Mental Poker problem [START_REF] Goldwasser | Probabilistic encryption & how to play mental poker keeping secret all partial information[END_REF]: it asks whether it is possible to play a fair game of poker without physical cards and without a trusted dealer, i.e., by phone or over the Internet. Since then, several works have focused on this primitive, such as [START_REF] Barnett | Mental poker revisited[END_REF][START_REF] Wei | Secure and practical constant round mental poker[END_REF][START_REF] Zhao | A secure mental poker protocol over the internet[END_REF]. In [START_REF] Stamer | Bibliography on mental poker[END_REF], the author brings together references to scientific papers related to this problem.

Most of mental poker protocols are based on the following paradigm. The players encrypt the cards together and shuffle them, then ciphertexts are assigned to each player, and each player receives information from the other players in order to decrypt their own cards. At the end of the game, the players reveal their encryption keys, which reveals the hand of all the players. In trick-taking games, each time a player plays a card, he must prove that the card is in his hand and that he has no high-priority card that he should play instead of this card. To achieve this property, we model the deck in a different way: each card is associated to a commitment of the secret key of a player. The player plays a card by proving that the committed secret key matches one of its public keys. This allows the player to prove that he cannot play high-priority cards by proving that none of his public keys match possible high-priority cards.

David et al. [START_REF] David | Kaleidoscope: An efficient poker protocol with payment distribution and penalty enforcement[END_REF] introduced protocols for secure multi-party computation with penalties and secure cash distribution, which can be used for online poker. Bentov et al. [START_REF] Bentov | Instantaneous decentralized poker[END_REF] give a poker protocol in a stronger security model, which is more efficient than [START_REF] David | Kaleidoscope: An efficient poker protocol with payment distribution and penalty enforcement[END_REF]. More recently, David et al. [START_REF] David | ROYALE: A framework for universally composable card games with financial rewards and penalties enforcement[END_REF] proposed Royale, a universally composable protocol for securely playing any card games with financial rewards/penalties enforcement.

All of these works focus on mental card game protocols with secure payment distributions, but they cannot prevent players from cheating by playing illegal cards. Indeed, these protocols allow the users to play cards digitally with the same security level as if they play with real cards. Our goal is not only to implement a secure trick-taking game, but also to increase its security, in comparison with its physical version.

Finally, an other line of research is to detect collusion frauds in online card games, as done for instance in [START_REF] Yan | Collusion detection in online bridge[END_REF]. Players may exchange information about their cards using some side channels. The goal of [START_REF] Yan | Collusion detection in online bridge[END_REF] is to detect such a collusion attack via the users' behavior. This work is complementary to ours, because these collusion detection processes can also be used with our protocol.

Outline: In Section 2, we describe the rules of Spades. In Section 3, we give an informal overview of our scheme. In Section 4, we present the cryptographic tools used in the paper. In Section 5, we model Spades schemes. In Section 6, we define the security properties. In Section 7, we describe SecureSpades before concluding in the last section.

Spades Rules

Spades was created in the United States in the 1930s. Since the mid-1990s it has become very popular thanks to its accessibility in online card gaming rooms on the Internet. This game uses a standard deck of 52 cards and allows between two and five players. The most famous version requires four players, which are splitted in two teams of two. As indicated by the name of the game, spades are always trump. We give the rules of Spades for the four players version:

1. All 52 cards are distributed one by one to each player, meaning each player has 13 cards at the beginning of the game. 2. There are 13 successive rounds. In the first round, the first player is chosen at random, and subsequently the player that won the previous round begins.

Players then each play a card in turn. 3. At each round, the player who plays the highest card wins the trick (i.e., he takes the four cards played this round, but he cannot replay these cards). The rank of the cards is the following, form highest to lowest: Ace, King, Queen, Jack, 10, 9, 8, 7, 6, 5, 4, 3, 2. Trumps are higher than cards of the suit of the first card of the round, which are higher than all other cards. 4. Each player has to follow the suit of the first card of the round. If a player has no card that follows the suit, then he can play any other cards. 5. The game is finished once all players have played all of their cards.

Before playing the cards, each player bids the number of tricks he expects to perform. The sum of all the propositions for all players should be different from the number of cards per player. At the end of the game, each player calculates his score according to his bid and the number of tricks he has won.

An overview of our protocol

We now give an informal overview of our Spades protocol. The idea is that the players must prove that each card they play follows the rule of the game. More precisely, the player first proves that he has the played card. If this card does not follow the suit, then he proves that none of his other cards are of the leading suit.

1. Dealing cards: We need to model the cards in such a way that these proofs are feasible. Each player i generates 13 pairs of public/private keys (pk i,j , sk i,j ) (for 1 ≤ j ≤ 13). To deal the cards, the players run a protocol that privately assigns each key to each card with the following steps: (i) each player generates commitments on his 13 secret keys, (ii) the players group all the 13 • 4 = 52 commitments together, (iii) each player shuffles and randomizes the commitments in turn , (iv) the players jointly associate each commitment to each card of the deck at random. The hand of a player is the set of the 13 cards that match the commitments of his secret keys. Figure 1 illustrates our dealing cards protocol, where c(sk) denotes the commitment of a secret key sk, and c (sk) denotes the randomization of c(sk). In this example, the 1 st card of player is A♠. Note that the commitments and the public keys must be unlinkable for anyone who does not know the corresponding secret keys. 2. Play a card: To play a card, the player proves that this card matches the commitment of one of his secret keys. If the player does not follow the suit, then he proves that none of his other cards are of the leading suit. To do so, he proves that each commitment that matches a card of a non-leading suit commits one of his (not yet used) keys.

Cryptographic Tools

We present the cryptographic tools used throughout this paper.

Definition 1 (DDH [START_REF] Boneh | The decision Diffie-Hellman problem[END_REF]). Let G be a prime order group. The DDH assumption states that given (g, g a , g b , g z ) ∈ G 4 , it is hard to decide whether z = a • b or not.

A n-party random generator is a protocol that allows n users to generate a random number, even if n -1 users are dishonest.

Definition 2 (Multi-party random generator [START_REF] Blum | Coin flipping by telephone a protocol for solving impossible problems[END_REF]). A n-party S-random generator RG P1,...,Pn is a protocol where n parties (P 1 , . . . , P n ) interact, and return s ∈ S. Such a protocol is said to be secure when for any polynomial time distinguisher D, any polynomial time adversary A, there exists a negligible function such that:

|Pr[1 ← D(s) : s $ ← S] -Pr[1 ← D(s) : s ← RG C,A (k)]| ≤ (k) where s $ ← RG C,A
denotes the output of C at the end of the protocol RG where C plays the role of a honest user, and A plays the role of the n -1 other users.

Inspired by [START_REF] Blum | Coin flipping by telephone a protocol for solving impossible problems[END_REF], we propose the following multi-party random generator protocol based on the random oracle model (ROM). Definition 3. Let S be a set and n be an integer, and let

H : {0, 1} * → {0, 1}
k and H : {0, 1} * → S be two hash functions simulated by random oracles. The protocol RandGen S P1,...,Pn (k) is a n-party S-random generator defined as follows. Each player P i (where

1 ≤ i ≤ n) chooses r i $ ← {0, 1}
k at random, computes H(r i ), and broadcasts it, then each player reveals r i . Each player returns H (r 0 || . . . ||r n ).

Lemma 1. For any set S and any integer n, RandGen S P1,...,Pn (k) is secure in the random oracle model.

The proof of this lemma is given in the full version of this paper [START_REF] Bultel | Secure trick-taking game protocols[END_REF]. The idea is that dishonest parties cannot guess the r i of the honest parties before revealing their commitments, hence they cannot predict H(r 0 || . . . ||r n ).

A (non-interactive) Zero-Knowledge Proof of Knowledge (ZKP) [START_REF] Goldwasser | The knowledge complexity of interactive proof systems[END_REF] for a binary relation R allows a prover knowing a witness w to convince a verifier that a statement s verifies (s, w) ∈ R without leaking any information. Throughout this paper, we use the Camenisch and Stadler notation [START_REF] Camenisch | Efficient group signature schemes for large groups[END_REF], i.e., ZK{(w) : (w, s) ∈ R} denotes the proof of knowledge of w for the statement s and the relation R. Such a proof is said to be extractable when given an algorithm that generates valid proofs with some probability, there exists an algorithm that returns the corresponding witness in a similar running time with at least the same probability. Such a proof is said to be zero-knowledge when there exists a polynomial time simulator that follows the same probability distribution as an honest prover.

Formal Definitions

We formalize Spades schemes and the corresponding security requirements. We model a 52 cards deck by a tuple D = (id 1 , . . . , id 52 ) such that ∀ i ∈ 1, 52 ,

id i = (id i .suit, id i .val) ∈ {♥, ♠, ♦, ♣} × {1, . . . , 10, J, Q, K} is called a card, where ∀ (i, j) ∈ 1, 52 2 such that i = j, id i = id j .
The set of all possible decks is denoted by Decks.

We first define Spades schemes, which are tuples that contain all the algorithms that are used by the players. KeyGen allows each player to generate its public/secret key. GKeyGen allows the players to generate a public game key. DeckGen is a protocol that generates a random deck. GetHand determines the hand of a given player from his secret key and the game key. Play allows a player to play a card, and to prove that it is a legal play. Verif allows the other players to check this proof. Finally, GetSuit returns the leading suit of the current round (in Spades, the suit of the first card played during this round). Definition 4. A Spade scheme is a tuple of eight algorithms W = (Init, KeyGen, GKeyGen, DeckGen, GetHand, Play, Verif, GetSuit) defined as follows: Init(k): It returns a setup setup. KeyGen(setup): It returns a key pair (pk, sk). GKeyGen: It is a 4-party protocol, where for all j ∈ 1, 4 the j th party is denoted P j and takes as input (sk j , {pk i } 1≤i≤4 We then define the Spades protocol, which allows four players to play Spades using the algorithms of the Spades scheme. It is divided in four phases:

Initialisation phase: One player generates and broadcasts the public setup. Keys generation phase: After they have generated their public/private keys, the players run GKeyGen to generate the game key together. Shuffle phase: The players choose a deck using DeckGen, then they compute their own hand using GetHand. Game phase: Finally, they play in turn using the algorithms Play and Verif to prove the validity of the cards they play. If some verification fails, the player has to cancel only the last card he has played, and to simply play another card.

Definition 5. Let W = (Init, KeyGen, GKeyGen, DeckGen, GetHand, Play, Verif, GetSuit) be a Spades scheme and k ∈ N be a security parameter. Let Player

Security Properties

We first define Spades strategies. In a card game, each player chooses what card he wants to play depending on his hand and the previously played cards of the other players. In order to formalize the security of our protocol, we need to model honest players who choose the cards they play themselves. A Spades strategy is an algorithm that decides which card to play using all known information by a given player. We define security experiments where the choices of each honest player is simulated by a Spades strategy. The idea is that a Spades scheme is secure if for any polynomial time adversary, the probability of winning the experiment is negligible, whatever the Spades strategies used by the experiment. Definition 6. A Spades strategy is a polynomial time algorithm Strat that takes as input a tuple of cards played (which represents all cards played at some point in a Spades game) and a set of cards hand (which represents all cards of a player at the same point), a first player index p * , a player index p, and that returns a card id ∈ Hand which is valid according to the rules of Spades (i.e., that follows the suit of the first card of the current round).

We define an experiment where a challenger simulates the Spades protocol to an adversary. We use this experiment to define Spades' security properties. The adversary first chooses the index of the player he wants to corrupt. The challenger generates the public/secret keys of the three other users, then the adversary sends his public key together with the index of an accomplice. The accomplice allows the experiment to capture the attacks where a dishonest player and his game partner collude. The adversary has access to the private key of all players. The adversary and the challenger then run the game key and the deck generation protocol, such that the adversary plays the role of the corrupted player and the accomplice. The challenger generates the hand of each player. Note that the challenger cannot use the hand generation algorithm for the corrupted player, because he does not know his secret key; however, the challenger can deduce this hand because it contains the 13 cards that are not in the hand of the three other users. Finally, the challenger and the adversary run the game phase, such that the adversary plays the role of the corrupted user and his accomplice. Definition 7. Let W = (Init, KeyGen, GKeyGen, DeckGen, GetHand, Play, Verif, GetSuit) be a Spades scheme, S = (Strat 1 , Strat 2 , Strat 3 , Strat 4 ) be a tuple of strategies, and k ∈ N be a security parameter. Let A and C be two polynomial time algorithms. The Spades experiment Exp Spades W,S,A (k) instantiated by W and S between the adversary A and the challenger C is defined as follows: Keys generation phase: C runs setup ← Init(k), sets st =⊥, and sends the pair (setup, st) to A, who returns a corrupted user index i c ∈ 1, 4 . For all i ∈ 1, 4 \ {i c }, C runs (pk i , sk i ) ← KeyGen(setup) and sends (pk i , sk i ) to A, who returns the public key pk ic and an accomplice index i a .

Game key generation phase: C and A generate PK by running the algorithm

GKeyGen together, such that A plays the role of the players P ic and P ia , and C plays the role of the other players. If PK =⊥, then C aborts and returns 0.

Shuffle phase: C and A generate D by running the algorithm DeckGen together, such that A plays the role of the players P ic and P ia , and C plays the role of the two other players. C sets p = 1 and parses D as (id 1 , . . . , id 52 ). For all i ∈ 1, 4 \ {i c }, C runs H i ← GetHand(sk i , pk i , PK, D), and sets The first security property of a Spades scheme is the theft-resistance, which ensures that no adversary is able to play a card that is not in his hand, even if the card is in the hand of his accomplice. On the other words, two partners are not able to exchange their cards. Definition 8. A Spades scheme W is said to be theft-resistant if for any tuple of strategies S = (Strat 1 , Strat 2 , Strat 3 , Strat 4 ) and any polynomial time adversary A who plays the Spade experiment instantiated by W and S, the probability that there exists γ ∈ 1, 13 such that:

H ic = {id i } 1≤i≤52 \(∪ 4 i=1;i =ic H i ).
-Verif(i c , id ic,γ , Π ic,γ , pk ic , st γ , st γ , PK, D) = 1, i.e., the γ th play of the adversary is accepted for the card id ic,γ ; and -∀ id ∈ H ic , id ic,γ = id, i.e., the card id ic,γ is not in the adversary hand; is negligible.

We then define the cheating-resistance property, which ensures that no adversary is able to play a card if he should play another valid one. Definition 9. A Spades scheme W is said to be cheating-resistant if for any tuple of strategies S = (Strat 1 , Strat 2 , Strat 3 , Strat 4 ) and any polynomial time adversary A who plays the Spade experiment instantiated by W and S, the probability that there exists γ ∈ 1, 13 such that:

-Verif(i c id ic,γ , Π ic,γ , pk ic , st γ , st γ , PK, D) = 1, i.e., the γ th play of the adversary is accepted for the card id ic,γ ; and id ic,γ .suit = suit ic,γ and suit ic,γ =⊥ i.e., the suit of the card id ic,γ is not the leading suit; and -∃ īd ∈ H ic such that: ∀ l ≤ γ, id ic,l = īd and īd.suit = suit ic,γ . i.e., the adversary has a card of the leading suit in his hand that was not already played before the γ th play; is negligible. We define the unpredictability, which ensures that no adversary can influence the card dealing, i.e., A cannot predict which card will be in which hand. Definition 10. A Spades scheme W is said to be unpredictable if for any tuple of strategies S = (Strat 1 , Strat 2 , Strat 3 , Strat 4 ), any polynomial time adversary A who plays the Spades experiment instantiated by W and S, for all i ∈ 1, 52 the probability that id i ∈ H ic is negligibly close to 1/4.

We introduce a new experiment that is called the hand Spades experiment, where the challenger simulates the key generation phase of the Spades protocol (but not the game phase). In this experiment the adversary does not know the private keys of the other players and has no accomplice. This experiment will be used to model the attacks where an adversary tries to guess the cards of the other players, including his partner. For all i ∈ 1, 4 \ {i c }, C runs H i ← GetHand(sk i , pk i , PK, D), and sets We then define the hand-privacy. This property ensures that an adversary has no information about the hand of the other players before the game phase is run. Definition 12. A Spades scheme W is said to be hand-private if for any tuple of strategies S = (Strat 1 , Strat 2 , Strat 3 , Strat 4 ) and any polynomial time adversary A who plays the hand-Spades experiment instantiated by W and S, the probability that the experiment returns 1 is negligibly closed to 1/2. The last property is the game-privacy. The idea is that, at each step of the game phase, the players learn nothing else than the cards that have been previously played. We show that, after the game key is generated, each player is able to simulate all the protocol interactions knowing the players' strategies. More formally, there exists a simulator that takes as input values known by the player such that the player cannot distinguish whether he plays the real game experiment or he interacts with the simulator. Definition 13. For any k ∈ N, any Spades scheme W , any quadruplet of strategies S, any adversary D and any K = (setup, pk ic , {(pk i , sk i )} 1≤i≤4;i =ic , PK),

H ic = {id i } 1≤i≤52 \(∪ 4 i=1;i =ic H i ). Challenge phase: C picks (θ 0 , θ 1 ) in ( 1, 4 \ {i c }) 2 such that θ 0 = θ 1 . C picks b $ ← {0, 1}

Exp Spades

W,S,K,D (k) denotes the same experiment as Exp Spades W,S,D (k) except: 1. The challenger and the adversary use the setup and the keys in K instead of generating fresh setup and keys during the experiment. 2. The challenger does not send sk i for all 1 ≤ i ≤ 4 such that i = i c to A, and A has no accomplice. A Spades scheme W is said to be game-private if there exists a polynomial time simulator Sim such that for any tuple of strategies S and any polynomial time 5-

party algorithm D = (D 1 , D 2 , D 3 , D 4 , D 5 ), |P real (D, k) -P sim (D, k)| is negligible, where P real (k) = Pr             1 ← D5(vw) : setup ← Init(k); ic ← D1(setup); ∀i ∈ 1, 4 , If i = ic, (pk i , ski) ← KeyGen(setup); Else pk ic ← D2(setup, {pk i } 1≤j≤i , vw); PK ← GKeyGen P 1 ,P 2 ,P 3 ,P 4 where Pi c = D3; K := (setup, pk ic , {(pk i , ski)} 1≤i≤4;i =ic , PK); If PK =⊥, vwr :=⊥; Else b ← Exp Spades W,S,K,D 4 (vw) (k);             P sim (k) = Pr           1 ← D5(vw) : setup ← Init(k); ic ← D1(setup); ∀i ∈ 1, 4 , If i = ic, (pk i , ski) ← KeyGen(setup); Else pk ic ← D2(setup, {pk i } 1≤j≤i , vw); PK ← GKeyGen P 1 ,P 2 ,P 3 ,P 4 where Pi c = D3; If PK =⊥, vwr :=⊥; Else b ← Sim Spades W,S,D 4 (vw) (k, setup, ic, {pk i } 1≤i≤4 , PK, vw);          
and where vw denotes the view of D, i.e., all the values sent and received by each algorithm of D during his interaction with the experiment.

Note that if a scheme is both hand-private and private-game, then players have no information about the other players' hands except for all the cards they have already played. Keys generation. Each player i generates 13 key pairs (pk i,j , sk i,j ) for 1 ≤ j ≤ 13 such that pk i,j = g ski,j . The players then generate a game key PK together, which is made of 52 pairs (h l , PK l ) such that h l ski,j = PK l . The keys PK l are shuffled, meaning each player does not know which PK l corresponds to which pk i,j , except for his own public keys. To build PK, for all l ∈ 1, 52 the players set h 0,l = g and PK 0,l = pk i,j such that (i, j) is in 1, 4 × 1, 13 and is different for each l. Note that it holds that h 0,l ski,j = PK 0,l . The first player then randomizes and shuffles all pairs (h 0,l , PK 0,l ), i.e., he chooses a random vector r and a random permutation δ and computes h 1,l = (h 0,δ(i) ) ri and PK 1,l = (PK 0,δ(i) ) ri . The three other players randomize and shuffle the pairs (h n,l , PK n,l ) in order to obtain the pairs (h n+1,l , PK n+1,l ) for 1 ≤ n ≤ 3 in turn in the same way, then they set (h l , PK l ) = (h 4,l , PK 4,l ) for all l. If the shuffles are correctly built, then it holds that for each l there exists a different pair (i, j) such that h l ski,j = PK l . After each shuffle, the player proves that each (h i,l , PK i,l ) is a correct randomization of one (h i-1,l , PK i-1,l ) where 1 ≤ l ≤ 52. Each player then checks that each of his secret keys match one PK l , otherwise he aborts the protocol. Since each player shuffles the keys using a secret permutation, they do not know which PK l matches which pk i,j , except for their own public keys. Hand generation. Players generate a random deck D = (id 1 , . . . , id 52 ) using the RandGen Deck protocol, then for all 1 ≤ l ≤ 52, the key PK l corresponds to the card id l . The hand of the player i is the set of all cards id l such that there exists 1 ≤ j ≤ 13 such that h l ski,j = PK l . Since the player does not know the keys sk i ,j for i = i, he does not know the cards of the other players. Play a card. To play the card id l , the player i proves that the card id l matches one of his key pk i,j by showing that h l ski,j = PK l . Note that since the player does not reveal sk i,j , he can use the same set of public keys for different games. To prove that he cannot play any card of the leading suit, the player i sets L such that l ∈ L if and only if id l is not of the leading suit, then the player i proves in a zero-knowledge way that for all pk i,j that correspond to cards that are not already played, there exists an (unrevealed) l ∈ L such that log h l (PK l ) = log g (pk i,j ). This implies that the player has no card of the leading suit, hence he is not cheating. Definition 14. SecureSpades is a Spades scheme defined as follows: Init(k): It generates a group G of prime order q, a generator g ∈ G and returns (G, p, g). KeyGen(setup): For all i ∈ 1, 13 , it picks sk i $ ← Z * q and computes pk i = g ski . It returns pk = (pk 1 , . . . , pk 13 ) and sk = (sk 1 , . . . , sk 13 ). GKeyGen: It is a 4-party protocol, where for all i ∈ 1, 4 the i th party is denoted P i , and takes as input (sk i , {pk j } 1≤j≤4 ). This protocol returns a game public key PK, or the bottom symbol ⊥. If there exists (i 1 , j 1 ) and (i 2 , j 2 ) such that (i 1 , j 1 ) = (i 2 , j 2 ) and pk i1,j1 = pk i2,j2 , then the players abort and return ⊥.

-For all i ∈ 1, 4 , each player parses pk i as (pk i,1 , . . . , pk i,13 ). For all j ∈ 1, 13 , each player sets h 0,(i-1)•13+j = g and PK 0,(i-1)•13+j = pk i,j .

-Each player P i (for i ∈ 1, 4 ) does the following step in turn: P i picks r = (r 1 , . . . , r 52 ) $ ← (Z * q ) 52 , and a permutation δ on the set 1, 52 . P i computes h i,l = h r l i-1,δ(l) and PK i,l = (PK i-1,δ(l) ) r l for all l ∈ 1, 52 , then runs Π i = ZK (r, δ) :

52 l=1 h i,l = h r l i-1,δ(l) ∧ PK i,l = PK r l i-1,δ (l)
.

This proof ensures that each (h i,l , PK i,l ) is the randomization of one pair (h i-1,l , PK i-1,l ) for l ∈ 1, 52 . P i broadcasts {(h i,l , PK i,l )} 1≤l≤52 and Π i , then each player verifies the proof Π i . If the verification fails, then the player aborts and returns ⊥.

-If there exists j such that for all l, h ski,j 4,l = PK 4,l , then P i aborts the protocol and returns ⊥. For each i ∈ 1, 4 , P i sets PK i = ((h be the integer such that id = id v (i.e., v is the index of the played card id) and t ∈ 1, 13 be the integer such that log g (pk t ) = log hv (PK v ) (i.e., t is the index of the public key that corresponds to the played card id). It sets U n = U n ∪ {t}. Note that at each step of the game, the set U n contains the indexes of all the public keys of the user n that have already been used to play a card. For all i ∈ 1, 4 \ {n}, it sets U i = U i . If α = 4 or st =⊥ then it sets α = 1 and suit = id.suit. Else it sets α = α+1 and suit = suit. The index α states how many players have already played this round, so if α = 4, players start a new round. Moreover, suit states which suit is the leading suit of the round, given by the first card played in the round. This algorithm sets st = (α , suit , U 1 , U 2 , U 3 , U 4 ). It generates Π 0 = ZK{(sk t ) : pk t = g skt ∧ PK v = h skt v }, which proves that the played card id v matches one of the secret keys of the player. Let L ∈ 1, 52 be a set such that for all l ∈ L, suit = id l .suit, i.e., L is the set of the indexes of the cards that are not of the leading suit this round. For all j ∈ 1, 13

-If suit = id.suit, it sets Π j =⊥ (if the card id is of the leading suit, then the player can play it in any case, so no additional proof is required). -If j ∈ U n , it sets Π j =⊥ (We omit the keys that have already been used in the previous rounds).

-If j ∈ U n it generates Π j = ZK (sk j ) : l∈L (pk j = g skj ∧ PK l = h skj l ) .
This proof ensures that the card that corresponds to each public key pk j is not of the leading suit, which proves that the player n cannot play a card of the leading suit. Finally, it returns the proof Π = (t, Π 0 , . . . , Π 13 ), and the updated value st .

Verif(n, id, Π, pk, st, st , PK, D): It parses st as (α, suit, U 1 , U 2 , U 3 , U 4 ), st as (α , suit , U 1 , U 2 , U 3 , U 4 ), pk as (pk 1 , . . . , pk 13 ), the key PK as ((h 1 , PK 1 ), . . . , (h 52 , PK 52 )), D as (id 1 , . . . , id 52 ) and Π as (t, Π 0 , . . . , Π 13 ). If st =⊥, it sets four empty sets U 1 , U 2 , U 3 and U 4 . Let v be the integer such that id v = id (i.e., v is the index of the played card id). Let L ∈ 1, 52 be a set such that for all l ∈ L, suit = id l .suit, i.e., L is the set of the indexes of the cards that are not of the leading suit. This algorithm first verifies that the state st is correctly updated in st according to the Play algorithm:

-If there exists i ∈ 1, 4 \ {n} such that U i = U i , then it returns 0.

-If t ∈ U n or U n ∪ {t} = U n , then it returns 0.

-If α = 4 or st =⊥, and α = 1 or suit = id.suit, then it returns 0.

-If α = 4 and suit =⊥, and α = α + 1 or suit = suit, then it returns 0. This algorithm then verifies the zero-knowledge proofs in order to check that the player does not cheat by playing a card he has not, or by playing a card that is not of the leading suit even though he could play a card of the leading suit.

-If Π 0 is not valid then it returns 0.

-If suit = id.suit and there exists an integer j ∈ 1, n such that j ∈ U n and Π j is not valid then it returns 0. If none of the previous checks fails, then this algorithm returns 1. GetSuit(st): It parses st as (α, suit, U 1 , U 2 , U 3 , U 4 ) and returns suit.

Instantiation. We show how to instantiate the two zero-knowledge proofs of knowledge used in our protocol. The first one is a zero-knowledge OR-proof of the equality of two discrete logarithms denoted ZK {(w) :

n i=1 a i w = c i ∧ b i w = d i }.
An efficient instantiation of such ZKPs in the random oracle model is given in [START_REF] Bultel | Unlinkable and strongly accountable sanitizable signatures from verifiable ring signatures[END_REF]. Our protocol also uses a proof of correctness of a randomization of a set of shuffled commitments. This proof is denoted ZK{((r 1 , . . . , r n ), δ) :

n i=1 c i = a ri δ(i) ∧ d i = b ri δ(i)
}, and can be instantiated using the previous one, since it consists in proving the equality of two discrete logarithms for the statement {(a i , b i , c j , d j )} 1≤j≤n for each j in 1, 52 .

Security. We prove the security of our scheme in Theorem 1, then we give the intuition of the proof. The full proof is given in the full version of this paper [START_REF] Bultel | Secure trick-taking game protocols[END_REF].

Theorem 1. If the two proofs of knowledge are sound, extractable and zeroknowledge, then SecureSpades is theft-resistant, cheating-resistant, hand-private, unpredictable, and game-private under the DDH assumption in the ROM.

Theft-resistant. To play a card, the player i must prove that the discrete logarithm of one of his public keys pk i,j is equal to the discrete logarithm of the key PK l that corresponds to the card. If the card is not in his hand, then none of the the discrete logarithms of the public keys pk i,j is equal to the discrete logarithm of the key PK l . Hence, to play a card that is not in his hand, the player should forge a proof of a false statement, which is not possible, since the proof system is sound.

Cheating-resistant. To play a card that is not of the leading suit, the player i must prove that the discrete logarithm of each public key pk i,j is equal to the discrete logarithm of one key PK l that corresponds to a card that is not of the leading suit. Hence, assuming that the player has some cards of the leading suit, in order to play another card, he should forge a proof of a false statement. This is not possible, since the proof system is sound. Unpredictable. Since the deck D is chosen at random thanks to the protocol RandGen, players have no way of guessing which card matches which public key during the keys generation phase. Hand-private. Each player shuffles the keys PK l using a secret permutation when he runs the GKeyRound algorithm. Moreover, the zero-knowledge proofs ensure that for each PK l there exists a key pk i,j such that log h l (PK l ) = log g (pk i,j ). Guessing the hand of a player i is equivalent to guessing pairs (j, l) such that the key PK l has the same discrete logarithm in basis h l as the key pk i,j , which is equivalent to guessing whether PK l is the Diffie-Hellman of h l and pk i,j . Game-private. During the game, the players use nothing other than zeroknowledge proofs, which leak nothing about the secret values of the players.

Other TTGs. Our Spades security model and scheme can be generalized to several trick-taking games. It works for any number of cards, of players, and for any team configuration. Moreover, it can be generalized to any game where players must play some kinds of cards according to a priority order, as long as the players can establish the set of all the cards that should be played (when it is possible) instead of the played one. This includes (but is not restricted to) all variants of Spades, Whist, Bridge, Belotte, Napoleon or Boston. Moreover, physical cards limit trick-taking games to games where players reveal all their cards, because if they do not, cheating could not be detected, even later. Our protocol allows the creation of new fair TTGs where players do not play all the cards of their hand.

Conclusion

In this paper, we have designed a secure protocol for trick-taking games. We used Spades, a famous online gambling card game, to illustrate our approach.

Until now, such games required a trusted sever that ensures that players are not cheating. Our protocol allows the players to manage the game and detect cheating by themselves, without leaking any information about the hidden cards. Hence, a player cannot play a card that he does not have or that does not follow the rule of the game. Our construction is based on the discrete logarithm assumption and zero knowledge proofs. We proposed a security model and prove the security of our protocol.

In the future, we would like to implement a prototype, in order to evaluate the practical efficiency of our solution. Moreover, we would like to add secure payment distributions mechanism to our protocol. Another perspective is to try to generalize this approach to other games.

  Game phase: C initializes the current player index p = 1 and the corrupted play index γ = 0, and played =⊥. For i ∈ 1, 52 : If p = i c and p = i a : C runs id ← Strat p (played, H p , p * , p), then C runs (Π, st ) ← Play(p, id, sk p , pk p , st, PK, D). C sends (id, Π, st ) to A and updates st := st .If p = i a : C receives (id, Π, st ) from A. If Verif(i a , id, Π, pk ia , st, st , PK, D)= 0, then C aborts and the experiment returns 0. Else, C updates st := st . If p = i c : C increments γ := γ + 1, then receives (id, Π, st ) from A and sets (id ic,γ , Π ic,γ ) = (id, Π). C sets st γ = st and st γ = st . C sets suit ic,γ = GetSuit(st). If Verif(i c , id ic,γ , Π ic,γ , pk ic , st γ , st γ , PK, D) = 0, then C aborts and the experiment returns 0. Else, C updates st := st . C then updates the index p that points to the next player according to the rule of Spades, parses played as (pl 1 , . . . , pl n ) (where n = |played|) and updates played := (pl 1 , . . . , pl n , id). Final phase: The experiment returns 1.

Definition 11 .

 11 Let W = (Init, KeyGen, GKeyGen, DeckGen, GetHand, Play, Verif, GetSuit) be a Spades scheme and k ∈ N be a security parameter. Let A and C be two polynomial time algorithms. The hand Spades experiment Exp HSpades W,A (k) instantiated by W between the adversary A and the challenger C is defined by: Key generation phase: C runs setup ← Init(k). It sets st =⊥. It sends the pair (setup, st) to A, who returns i c ∈ 1, 4 . For all i ∈ 1, 4 \ {i c }, C runs (pk i , sk i ) ← KeyGen(setup) and sends pk i to A, who returns pk ic . Game key generation phase: C and A generate PK by running the algorithm GKeyGen together, such that A plays the role of P ic , and C plays the role of the three other players. If PK =⊥, then C aborts and returns 0. Shuffle phase: A sends a deck D ∈ Decks to C. C parses D as (id 1 , . . . , id 52 ).

  and īd $ ← H θ b , and sends ( īd, θ 0 , θ 1 ) to A, who returns b * . Final phase: If b = b * , then C returns 1, else it returns 0.

  1 is A♣, his 2 nd card is 2♥, and his 13 th card

	c(sk1,1) c(sk1,2)	. . .	c(sk1,13) c(sk2,1)	. . .	c(sk4,13)
	Shuffle commitments:
	c (sk4,13) c (sk1,13)	. . .	c (sk2,1) c (sk1,1)	. . .	c (sk1,2)
	Deal cards:
	2♠	3♠	. . .	A♠	2♥	. . .	A♣
		Fig. 1. Dealing cards in our Spades protocol.

  ). This protocol returns a game public key PK, or the bottom symbol ⊥. DeckGen: It is a 4-party Decks-random generator. GetHand(sk, pk, PK, D): It returns a set of 13 different cards H called a hand (where D ∈ Decks). Play(n, id, sk, pk, st, PK, D): It takes as input a player index n ∈ 1, 4 , a card id, a pair of secret/public key, a global state st that stores the relevent information about the previous plays, the game public key PK and the deck D, and returns a proof Π, and the updated global state st . Verif(n, id, Π, pk, st, st , PK, D): It takes as input a player index n ∈ 1, 4 , a card identity id, a proof Π generated by the algorithm Verif, the global state st and the updated global state st , the game public key PK and the deck D, and returns a bit b. If b = 1, we say that Π is valid. GetSuit(st): It returns a suit suit ∈ {♥, ♠, ♦, ♣} from the current global state of the game st, where suit is the leading suit for the current turn.

  At each turn, Player p designates the player who plays. Each step proceeds as follows:-Player p chooses id ∈ H p , then runs (Π, st ) ← Play(p, id, sk p , pk p , st, PK, D). -For all i ∈ 1, 4 \ {p}, Player p sends (id, Π, st ) to Player i .-Each Player i then checks that Verif(p, id, Π, pk p , st, st , PK, D) = 1, otherwise, Player i sends error to Player p , who repeats this step and plays a valid card. -If Verif(p, id, Π, pk p , st, st , PK, D) = 1, all players update the state st := st , and update the index p that points the next player according to the rule of the game.

1 , Player 2 , Player 3 , Player 4 be four polynomial time algorithms. The Spades protocol instantiated by W and the setup setup between Player 1 , Player 2 , Player 3 and Player 4 is the following protocol: Initialisation phase: Player 1 runs setup ← Init(k) and broadcasts setup. Keys generation phase: The players set st =⊥. Each player Player i runs (pk i , sk i ) ← KeyGen(setup) and broadcasts pk i , then the players generate PK by running the protocol GKeyGen together. Shuffle phase: The players generate a deck D ∈ Decks by running DeckGen

together. For all i ∈ 1, 4 , Player i runs H i ← GetHand(sk i , pk i , PK, D). Game phase: This phase is composed of 52 (sequential) steps (corresponding to the 52 cards played in a game). The players initialize the current player index p = 1.

  4,1 , PK 4,1 ), . . . , (h 4,52 , PK 4,52 )) and broadcasts it. If there exists i 1 and i 2 such that PK i1 = PK i2 , then P i aborts and returns ⊥, else P i returns PK = PK i . DeckGen: It is the 4-party Deck-random generator RandGen Deck protocol. GetHand(sk, pk, PK, D): It parses sk as (sk 1 , . . . , sk 13 ), PK as ((h 1 , PK 1 ), . . . , (h 52 , PK 52 )) and D as (id 1 , . . . , id 52 ). It returns the set H such that id i ∈ H iff there exists j ∈ 1, 13 such that PK i = h skj i . Play(n, id, sk, pk, st, PK, D): It parses D as (id 1 , . . . , id 52 ), sk as (sk 1 , . . . , sk 13 ), pk as (pk 1 , . . . , pk 13 )), PK as ((h 1 , PK 1 ), . . . , (h 52 , PK 52 )), and st as (α, suit, U 1 , U 2 , U 3 , U 4 ). If st =⊥ it sets four empty sets U 1 , U 2 , U 3 and U 4 . Let v ∈ 1, 52

We first informally show how our protocol, SecureSpades, works, then we give its formal definition.


Jeremy K Ward

Florian Cafiero

Raphael Fretigny

James Colgrove

Valérie Seror

France's citizen consultation on vaccination and the challenges of participatory democracy in health

Keywords: Vaccination, participation, controversies, legal mandates, ethics, policy

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

In the past decade, public health authorities from a great number of countries have been confronted to a multiplication of vaccine-related controversies and a rise in "vaccine hesitancy" [START_REF] Larson | The State of Vaccine Confidence 2016: Global Insights Through a 67-Country Survey[END_REF]. France has been particularly hit by this trend. Vaccine-related controversies have emerged at the end of the 1990s with a first vaccine scare surrounding an alleged link between the hepatitis B vaccine and multiple sclerosis. They have multiplied since 2009 and the pandemic flu vaccination campaign, with debates surrounding the use of aluminum-based adjuvants, the recommendation of the human papillomaviruses vaccines and the availability of vaccines only containing the three strains covered by French legal mandates (Diphteria, Tetanus and Polio) and not other strains such as Hepatitis B [START_REF] Anonymous | Rethinking the antivaccine movement concept: A case study of public criticism of the swine flu vaccine's safety in France[END_REF]. They have been accompanied by a sharp rise in vaccine hesitancy, to the point that France is today among the countries with the largest proportion of the population doubting the efficacy or safety of at least one vaccine [START_REF] Larson | The State of Vaccine Confidence 2016: Global Insights Through a 67-Country Survey[END_REF][START_REF] Peretti-Watel | Attitudes toward vaccination and the H1N1 vaccine: Poor people's unfounded fears or legitimate concerns of the elite?[END_REF].

In reaction to this alarming trend, French authorities have decided to extend mandatory vaccination to eight more childhood vaccines since January 1, 2018, bringing the total to 11. This decision has sparked a heated debate in the international public health community over whether legal mandates are the best way to raise vaccination coverages and whether they are likely to polarize attitudes towards vaccination rather than alleviate doubt (Nature, 2018;[START_REF] Ward | France's risky vaccine mandates[END_REF]Plotkin et al., 2018;[START_REF] Ward | France's risky vaccine mandates[END_REF]. The disagreement surrounding this decision may seem surprising given that the French government had organized a "citizen consultation" on vaccination between January and October 2016 to involve the wider public in policymaking and foster public acceptability. This citizen consultation was crucial in pushing forward the idea that mandates are a solution to France's contemporary crisis with vaccines [START_REF] Anonymous | Rethinking the antivaccine movement concept: A case study of public criticism of the swine flu vaccine's safety in France[END_REF]. Why has this effort to open up the decisionmaking process not prevented such a debate from arising? Drawing lessons from this precedent is crucial in a context where public health authorities across the world struggle to find the solution to contemporary vaccine hesitancy [START_REF] Larson | The State of Vaccine Confidence 2016: Global Insights Through a 67-Country Survey[END_REF].

Drawing lessons from this precedent is also necessary beyond the case of vaccination. In the past 30 years, the way national and international public health authorities have devised their policies has been accused of being technocratic and of prioritizing political and economic interests over those of the public [START_REF] Callon | Acting in an Uncertain World: An Essay on Technical Democracy[END_REF]. In response, decision-makers have sought to improve transparency and to increasingly turn to the tools of participatory democracy to foster public acceptability for a wide variety of their policies. This turn towards public participation has affected vaccination policies beyond the borders of France. For instance, the National Vaccine Advisory Committee of the U.S.

Centers for Disease Control has tried to involve the public in policy-making since 2009 and the European Commission launched in December 2017 a three-months long public consultation on vaccination (European Commission, 2017;National Vaccine Advisory Committee, 2016) However, shifting control away from experts and closer to public opinion carries the risk of giving prominence to unfounded beliefs and special interests. This is especially the case in a context where the Internet provides a relatively unregulated ground for motivated minorities to mobilize and, sometimes, spread refuted arguments [START_REF] Vosoughi | The spread of true and false news online[END_REF]. The tension between scientific and democratic principles has been the impetus behind the continuous search by authorities and political scientists for new ways to involve the public while maintaining a high standard of rational discussion [START_REF] Callon | Acting in an Uncertain World: An Essay on Technical Democracy[END_REF][START_REF] Fishkin | When the People Speak: Deliberative Democracy and Public Consultation, Har/ DVD[END_REF]. These methods include citizen consultations, general assemblies, citizen conferences, citizens' juries, and deliberative polls [START_REF] Bourg | Conférences de citoyens, mode d'emploi : Les enjeux de la démocratie participative[END_REF][START_REF] Callon | Acting in an Uncertain World: An Essay on Technical Democracy[END_REF][START_REF] Fishkin | When the People Speak: Deliberative Democracy and Public Consultation, Har/ DVD[END_REF]. Each of these experiments can help us move toward a more democratic public health system if we analyze closely whether and how they provided decision-makers with crucial information and a democratic mandate for their policies. The French citizen consultation on vaccination organized in 2016 highlights the temptations faced by decision-makers when they try to foster public debate while preserving an existing scientific consensus.

The purpose of this article is to present how this citizen consultation was organized and analyze the tensions at its core between the democratic and scientific principles. With this case study, we aim to further the understanding of how the concrete organization of a participatory device determines the contents of deliberations, the quality of the information gathered and how much democratic legitimacy authorities can gain in the process. We underline the importance of the formulation of the question to be debated -i.e. the framing of the debate -and how the organizational setup gave different weights to the various contributions to the debate. We show how this choice of setup affected discussions on crucial issues such as vaccine safety and legal mandates. These choices were effective to avoid legitimizing vaccine critical arguments and sparking even further debate on the safety of vaccines. But we also show that they ran counter to some essential principles of participatory devices. Because of this, it is unclear exactly what made this citizen consultation informative or efficient in comparison to more traditional forms of expertise, especially when it came to the discussion of mandatory vaccination. To facilitate readability and to highlight the implication of our case study, we will present our results and their discussion together (section 3).

Data and methods

We draw on data pertaining to the setup in itself. But to analyze any participatory setup, it is necessary to set it in its wider political context. We therefore also turn to data relative to how this consultation was received by major stakeholders (media coverage and documents produced by vaccine critics). The analysis is based on a mix of qualitative methods commonly used in political science and of quantitative methods developed in the field of computational linguistics. To interpret our results, we drew on our previous work on French vaccine-related controversies and policy-making [START_REF] Anonymous | Vaccine-criticism on the internet: new insights based on French-speaking websites[END_REF][START_REF] Anonymous | Rethinking the antivaccine movement concept: A case study of public criticism of the swine flu vaccine's safety in France[END_REF][START_REF] Anonymous | Rethinking the antivaccine movement concept: A case study of public criticism of the swine flu vaccine's safety in France[END_REF].

Our main focus will be on the two datasets that concern the setup in itself: the documents describing its organization and the public's comments posted on its website.

The organizers of the consultation were particularly transparent and gave the public access to documents detailing the workings of this consultation (see the annex to the final report available on the consultation's website: http://concertation-vaccination.fr/la-restitution). Two of the authors applied thematic content analysis to these documents with a coding scheme centered in particular on the presence of vaccine critics, the way the general public and civil society were integrated at the various stages of the consultation and how the recommendations coming from them were presented in the final report. This coding framework was formulated both deductively (through pre-established concepts guiding the research questions), and inductively (on the basis of salient and recurrent themes identified in the data) [START_REF] Braun | What can thematic analysis offer health and wellbeing researchers?[END_REF].

The database of all contributions published on the consultations' internet platform was provided by Santé Publique France, a public agency under the supervision of the French Minister for Health in charge of monitoring the French population's health and promoting health-inducing behaviors. This agency was in charge of the logistics of the citizen consultation including the construction and administration of the consultation's website. They were therefore responsible for guaranteeing that the contributions posted in the comments section of the website complied with French legal and ethical standards regarding internet publication (anonymization, filtering of violent and libelous discourse, etc.). This led them to delete 1404 contributions and to authorize the publication of a total number of 10 435 contributions. A deontologist was also responsible for insuring that all aspects of the consultation complied with ethical standards (see here: http://concertationvaccination.fr/page-d-exemple/le-comite-dorientation/la-deontologue-anne-fagot-largeault/). These contributions could not be analyzed using a qualitative coding scheme because of their great number. We therefore turned to quantitative tools developed in the field of computational linguistics. Two of the authors annotated manually a sample of a little more than 10% of the 10 435 contributions (1054) chosen at random, encoding two variables: does the text criticize at least one recommended vaccine? (yes/no); does the text praise mandatory vaccination, criticize it, or is it silent on the subject? These two themes were chosen because they are central to current vaccine-related controversies in France as they have been elsewhere [START_REF] Colgrove | State of Immunity: The Politics of Vaccination in Twentieth-Century America[END_REF][START_REF] Blume | Immunization: How Vaccines Became Controversial[END_REF] [START_REF] Anonymous | Rethinking the antivaccine movement concept: A case study of public criticism of the swine flu vaccine's safety in France[END_REF]. This choice of themes also reflects the fact that we were already aware before launching the study that this consultation led to the decision to extend mandatory vaccination and that it was criticized for not taking on the issue of the safety of adjuvants. Assessing the proportion of comments that took on these issues and the opinion they expressed was therefore crucial in the analysis of how the public's opinion was integrated in this participatory setup.

Using the software WEKA [START_REF] Eibe | The WEKA Workbench. Online Appendix for[END_REF], one of the authors trained an artificial intelligence to recognize texts according to those variables, with our sample as training corpus. To that end, he implemented two models based on multinomial logistic regression with Tikhonov regularization (Le Cessie and Van Houwelingen, 1992)based on n-grams (4-grams to 7-grams) of characters. Punctuation marks were retained as they proved to be meaningful for the categorization of the texts. For instance, in our corpus, the use of exclamation marks is significantly associated with vaccine-critical texts. The texts have not been lemmatized as this would have concealed important information. Speaking of one « vaccine » and not of « vaccines », of one's « doctor » and not of « doctors » in general etc. is significant in the context of our study. Outcomes of the model were generated with an acceptable precision for the first question (0.71, superior to the acceptability threshold of 0.68 defined by Bradley [START_REF] Bradley | The use of the area under the ROC curve in the evaluation of machine learning algorithms[END_REF], as well as for the second question (0.82).

Relevant lexical entities were isolated using CQL requests with the software TXM [START_REF] Heiden | TXM : Une plateforme logicielle open-source pour la textométrie -conception et développement[END_REF].

To set the results from the previous analyses in context, we will also occasionally draw on the qualitative content analysis of two datasets that concern the reception of the consultation in the media and by vaccine critics. This was meant to assess whether this consultation favored consensus-building and acceptability of its recommendations and whether it favored the wide dissemination of vaccinecritical arguments in the media.We gathered all articles pertaining to the consultation published in 7 of France's most prominent national newspapers (Libération, Le Parisien-Aujourd'hui en France, Le Monde, Le Figaro, La Croix, L'Humanité, Les Echos). These newspapers were accessed through the database Europresse which allows keywords searches (see www.europresse.com). We selected all articles containing the fragment "débat" or "Concertation" and the fragment "vacc" published between June 1 st , 2015 and February 1 st , 2017. The search generated 48 articles (after exclusion of duplicates and errors). Two of the authors applied a coding scheme focused on identifying critics and defenders of the consultation and their arguments.

To analyze the reception of the consultation among vaccine critics we turned to a database of the contents 299 French-speaking vaccine-critical websites. This sample comprises all prominent French vaccine-critical organizations and activists who had a website or a blog at the time. It was crawled using the software Hyphe, developed by the Medialab at Sciences Po Paris. We analyzed through close-reading all the pages of these websites that evoked this citizen consultation using the same keywords searches as for the media articles. Analysis was performed by two of the authors and the coding scheme focused on identifying the arguments for and against this consultation and the chronology of their appearance.

Since all the data used in this article are public, this research did not require the approval of an ethics committee in France.

Findings

Participatory democracy in France and the surge of vaccine hesitancy

Since the 1970s, social scientists have drawn attention to the growing distrust towards public officials and their institutions in most developed countries [START_REF] Inglehart | Modernization, Cultural Change, and Democracy: The Human Development Sequence[END_REF]. This phenomenon and the multiplication of scandals involving public administrations has prompted political theorists and activists to draw attention to the limits of "representative democracy" or "opinion democracy" [START_REF] Fung | Deepening Democracy: Institutional Innovations in Empowered Participatory Governance[END_REF][START_REF] Rosanvallon | La contre-démocratie: la politique à l'âge de la défiance[END_REF]. They underline the fact that the tools of representative democracy, such as elections, do not provide enough control over elected officials. In articulation with elections, opinion polls and public debates in the media are supposed to compel officials to take into consideration the will of the people. However, analysts have shown that media contents do not reflect public opinion's point of view on a number of subjects and that neither do opinion polls because of a wide range of biases in their methodology and misuses by politicians [START_REF] Bourdieu | Sociology in Question[END_REF][START_REF] Ginsberg | The Captive Public: How Mass Opinion Promotes State Power[END_REF]. The consequence of these shortcomings is that public interest is often trumped by political, economic or personal interests.

A number of institutional tools have been designed to overcome these limits by including the public at various stages of institutional decision-making processes [START_REF] Blatrix | La démocratie participative en représentation[END_REF][START_REF] Fishkin | When the People Speak: Deliberative Democracy and Public Consultation, Har/ DVD[END_REF].

Since the 1980s, officials in a great number of countries have increasingly turned to these tools of "participatory democracy" to deal with issues pertaining to science and technology, urban planning, health and medicine, the environment, etc. A first set of these tools are based on an understanding of democracy as participation of all the stakeholders on a given issue. In this approach to participatory democracy, the primary aim is avoiding cases where the interests of a minority are favored to the expense of the majority. This has led to a focus on integrating social movements and civil society more generally in decision-making processes. This is done either by including actors who represent civil society in these processes -for instance by putting the president of an NGO in an advisory board -or by setting up open spaces for anyone to give their opinion on a given subject -for instance by organizing neighborhood meetings or open internet websites [START_REF] Fung | Deepening Democracy: Institutional Innovations in Empowered Participatory Governance[END_REF][START_REF] Rose | Powers of Freedom: Reframing Political Thought[END_REF][START_REF] Shane | Democracy Online: The Prospects for Political Renewal Through the Internet[END_REF]. A second set of tools focuses on democracy as an overcoming of individual interests through rational collective deliberation [START_REF] Elster | Deliberative Democracy[END_REF][START_REF] Manin | On Legitimacy and Political Deliberation[END_REF]. In this approach, the primary aim is to build consensus and reach a decision that satisfies all the stakeholders' interests. This is done by choosing settings that favor the exchange of arguments rather than the successive expression of interests -for instance by favoring deliberative juries rather than polls and hearings -and by actively working to improve the participants' knowledge of the issues in order for them to express a better-informed opinion. This has led to the modification of some traditional tools of public opinion analysis, for instance deliberative polls and training courses for members of the public included in "citizen juries" (a variation on focus groups) before they deliberate [START_REF] Fishkin | When the People Speak: Deliberative Democracy and Public Consultation, Har/ DVD[END_REF].

In France, these new institutional devices were introduced at the turn of the 1990s mainly in the domain of urban policies [START_REF] Joly | À la recherche d'une « démocratie technique[END_REF][START_REF] Nez | Urbanisme : la parole citoyenne[END_REF]. Participation was progressively institutionalized within state administrations, in the opinion polling industry and in think tanks during the 1990s and 2000s [START_REF] Blatrix | Le débat public : une expérience française de démocratie participative[END_REF]. Such devices were later imported in the domain of health with the organization of general assemblies on bioethics and nanotechnology in 2009, of 150 local debates on the national health strategy in 2013-2014 and of a citizen consultation on mammary cancer in 2015-2016). In most cases, authorities opted for a set up that mixed several of types of participatory tools and articulated them with more traditional expert and politician-focused processes [START_REF] Bourg | Conférences de citoyens, mode d'emploi : Les enjeux de la démocratie participative[END_REF][START_REF] Callon | Acting in an Uncertain World: An Essay on Technical Democracy[END_REF].

These experiments with participatory democracy in health coincided with the turbulent period for vaccination in France we described in the introduction. The idea that a public debate could be the solution to vaccine hesitancy emerged in this context. Following the hepatitis B vaccine scare, the second half of the 2000s was a period of intense reflection on the ways to improve France's vaccination policies (Comité pour l'amélioration de la politique vaccinale, 2011). But recourse to participatory devices was not part of these debates. It only came to the fore after the traumatic experience of the 2009 pandemic flu vaccination campaign. The French government planned on spending around one billion euros in the fight against this disease and hoped to vaccinate around 70% of the population. Because it eventually appeared that this flu was not as lethal as expected, the government came under heavy criticism and the campaign was labelled a fiasco. As a consequence, two parliamentary enquiries were set up in the first half of 2010 to identify what went wrong and improve governmental preparedness to pandemic crises (Assemblée Nationale, 2010; [START_REF] Sénat | Rapport de la commission d'enquête sur le rôle des firmes pharmaceutiques dans la gestion par le Gouvernement de la grippe A (H1N1)[END_REF].

The enquiry led by deputies from the National Assembly (lower house, where legislation is debated and voted) endorsed the idea that a lack of openness to public debate and public opinion was part of the issue with this campaign. They came to the conclusion that a "public debate" on vaccination in pandemic situations and a "General Assembly" on vaccination should be organized (Assemblée Nationale, 2010). This suggestion that more public participation and debate were necessary became very influential in public health circles. In the following years, several prominent institutions and expert circles put in charge of finding a solution to French vaccine hesitancy endorsed this recommendation (Assemblée Nationale, 2012; Conférence Nationale de Santé, 2012; Haut Conseil de la Santé Publique, 2014). So, when in summer 2015 then Minister for Health Marisol Touraine decided to take on the subject of vaccination, a public debate had already been primed as a necessary step in the policy-making process.

Interestingly, these various expert advices also stress the risks that such a public debate could constitute a platform for vaccine-critical movements. This is not surprising or specific to the subject of vaccination. The possible conflict between democratic principles and the requirements of a rational debate based on facts and informed by science has been highlighted not only by public health experts, but also by some prominent thinkers of participatory democracy [START_REF] Bourg | Conférences de citoyens, mode d'emploi : Les enjeux de la démocratie participative[END_REF][START_REF] Callon | Acting in an Uncertain World: An Essay on Technical Democracy[END_REF].

The imperium of science: setting boundaries to public discussion of vaccines

The will to preserve vaccines while gathering as much information as possible on the societal aspects of vaccination is manifest in the setup eventually chosen by the French minister for Health in January of 2016. The goal set by the minister for the consultation was to restore trust in vaccination as part of the renewal of France's vaccination policy [START_REF] Hurel | Rapport sur la politique vaccinale[END_REF][START_REF] Ollivier-Yaniv | La vaccination, ça se discute ? » Le rapport sur la politique vaccinale[END_REF]. The organization of the consultation reflected this goal.

The consultation was conducted under the supervision of an ad hoc board of 16 people (the "orientation committee") composed of medical experts, representatives of state institutions, member of civil society, and social scientists. They translated this framing into a set of questions meant to guide the debates and organized the various settings which composed the consultation. The setup aimed to include the lay public in five ways: 1) a comment section on the consultation's website opened between September 14 th and October 14 th 2016 to gather the comments of the public (which ultimately numbered 10 435 comments), 2) a citizen jury composed of 22 laypeople randomly selected by a polling agency, 3) a jury of 16 medical professionals selected in the same way, 4) a qualitative study consisting of focus groups and interviews with laypeople and medical professionals, and 5) a quantitative study of vaccine-related perceptions (Comité d'orientation de la concertation citoyenne sur la vaccination, 2016a). It also integrated members of civil society at various stages and levels of the process. The organization committee comprised 5 members of civil society one of which co-chaired the committee with a pediatrician. Others were auditioned by the orientation committee and by the two juries, including some vaccine critics. Each jury auditioned a variety of experts and stakeholders, then deliberated and transmitted their recommendation to the orientation committee. The orientation committee wrote the final report using information gathered through all these various pathways (juries, auditions, website and qualitative study).

Several elements of this setup mark the will to preserve the imperium of scientific facts in this consultation. Firstly, the orientation committee was given the latitude to select among the proposals and arguments formulated during debates to compose the final report. Doctors and medical experts made up half of this committee (8 out of 16 members). The committee did not include vaccine critics and comprised several people known for their public defense of vaccination. Secondly, the juries were trained in the basics of vaccine science before deliberating on the subject. The third element is the most important one and consists in the framing of the debate. The orientation committee was intent on keeping the debates within the boundaries set by the minister's mission statement. The consultation was to answer the question of how to restore trust in vaccination and therefore raise vaccination coverage. This framing implies that the current vaccination strategy and the safety and efficacy of any of the recommended vaccines should be pushed to the margins of the debate if not outside. This is made clear in the set of six questions the orientation committee gave to both juries to help them focus their reflections and exchanges. Four of them focus on the public's behavior and how to have an effect

How vaccine criticism emerged in the consultation

This does not mean that this setup excluded other types of questioning.

It is important to note that vaccine critics were included in the list of people automatically auditioned by both juries. Those who reject vaccination in itself (antivaccinationists) were represented in this list by a spokesperson for France's oldest antivaccine group: La Ligue Nationale Pour la Liberté des Vaccinations (National League for Freedom in Vaccination). But this list also included a member of Entraide aux Malades de la Myofasciite à Macrophages (Support Group for People Suffering from Macrophagus Myofasciite, or E3M), a group of purported victims of aluminum-based adjuvants. In France, the use of these substances has become publicly contested since 2010. This patient group has three aims: recognition for the particular chronic fatigue syndrome they claim to suffer from, recognition by the medical community that aluminum-based adjuvants are the cause of this disease and financial compensation. The head of the research team they work with was also auditioned by the orientation committee and was requested by both juries for their second round of auditions. Also, among the six guiding questions, the ones pertaining to vaccine research and legal mandates were seized by the jury as opportunities to raise questions outside the box. The citizen jury, when responding to the former, raised the issues of conflicts of interest and transparency in the institutional processes that lead to a vaccine being put on the market, and recommended that research should be conducted to help replace aluminum-based adjuvants or produce non-adjuvanted vaccines; and, when responding to the latter, raised the issues of compensation for vaccine-related injuries and of multivalent vaccines. The jury of medical professionals advocated for more research on the long term adverse effects of vaccines and their genetic determinants.

The comment section of the consultation's website was unsurprisingly a space for the free expression of opinions regardless of the framing proposed by the organizers. Nurses and pharmacists took this opportunity to push forward the idea that they should be given a greater role in vaccination campaigns (with 936 contributions evoking the former and 584 the latter), following calls to flood the consultation's website by prominent professional organizations (Conseil de l'Ordre Infirmier de Paris, 2016; Infirmiers.com, 2016;[START_REF] Sniil | Concertation nationale sur la vaccination : Infirmières Libérales, exprimez-vous directement puisque le Ministère ne demande jamais votre avis ! www[END_REF][START_REF] Snpi | Concertation sur la vaccination : exprimez-vous ![END_REF]. More importantly, the theme of the safety of some or all vaccines barged in through this open window (60% of the contributions criticized at least one vaccination recommendation), with aluminum first among them (evoked in more than 20% of the contributions). This critique was often intertwined with issues of mandatory vaccination and transparency as is illustrated in the following contributions:

Vaccination has been a major leap forward for health. It has saved a number of lives. However, for many reasons, vaccination has a bad press in France: -the vaccination calendar, vaccination of newborns: why vaccinate babies so early when we know that their brain is still too vulnerable, notably to aluminium, and that they can be protected by their mother's antibodies? -Mandatory vaccines and combined vaccines: why force parents to vaccinate their children with combined vaccines that lump together compulsory valences and others who are optional, when some vaccines are out of stock? When will we have vaccines with only the compulsory strains? And without alumimium, since it is possible? -side effects: nobody wants the side effects of a preventative product. Why don't public authorities want to be transparent about the known side effects of some vaccines? Why is there no open discussion on the risk/benefit ratio of vaccines? -Adjuvants: it is now proven that some adjuvants are a risk for health. Why deny it? Why not undertake actions on the short, middle and long term with manufacturers to encourage them (force them?) to find other means to improve the immune response to a vaccine? The decrease in vaccine coverage for some diseases is a risk we should not take lightly. Which actions will the government undertake to restore trust among the French without infantilising them? It is a pity that the dialog is not more open on this societal and public health issue, that patients and doctors from all sides are not being heard. This citizen consultation is a first step. Vaccination is up for debate! Contribution 11716, October 13 th , 2016, posted as an answer to question 1: Express your opinion on vaccination in general Hello, My baby will have her first vaccines with aluminium next Monday and my spouse and myself are going there with fear in my belly, hands tied by the law and our desire to protect our daughter from serious diseases. Why leave this accursed aluminium in these injections? For pharmaceutical companies' money. Why put a baby's life in danger? Why will my daughter receive 5 vaccines on the same day? For pharmaceutical companies' money again. I wish and I even want safe and transparent vaccination! Contribution 5972, September 30 th , 2016, posted as an answer to question 3: What would be your recommendations to improve vaccination coverage?

The great number of contributions evoking aluminum reflects in some way the fact that it has become one of the crucial motives for vaccine hesitancy in France (Bulletin d'épidémiologie hebdomadaire, 2017). But it is also very likely that it is the effect of a great mobilization of vaccine critical activists.

For instance, within the month the platform was open, E3M prompted their supporters to comment on the platform on three separate occasions through their website and Facebook page.

With a relative consensus in the French vaccinology community on the lack of evidence to support the theory that aluminum-based adjuvants cause serious long-term effects (Académie Nationale de Médecine, 2012; Académie Nationale de Pharmacie, 2016), the emergence of this theme constitutes exactly what the public health milieu tends to fear about participatory devices.

The latitude given to the orientation committee in drafting the final recommendations allowed them to push aside these doubts and avoid legitimizing them. This can be seen in two different sections of the final report: in its introduction (Comité d'orientation de la concertation citoyenne sur la vaccination, 2016a) p9) …:

The analysis of all the available studies does not enable, in the current state of scientific knowledge, to establish a causal link:

-between the administration of vaccines containing aluminium-based adjuvants and autoimmune or inflammatory diseases such as macropagus myofasciitis, -between vaccination against hepatitis B and multiple lateral sclerosis, -between hpv vaccination and auto-immune diseases, only one study having observed a very low and still to be confirmed risk of Guillain-Barré syndrome, -between measles vaccination and autism … and in the section presenting recommendations for future research in vaccinology (Comité d'orientation de la concertation citoyenne sur la vaccination, 2016a) , p25):

Adjuvants are necessary to the efficacy of non-living vaccines. Live vaccines (measles, rubella, mumps, varicella, etc.) contain enough activating signals adjuvants of the immune system.

Adjuvants are therefore essential to many protein vaccines (such as diphtheria, tetanus, whooping cough, polio, hepatitis B, HPV, etc.) as substitutes to natural substances of infectious agents which stimulate the production of antibodies as well as cellular immunity. Recourse to non-adjuvanted protein vaccines, as suggested by the citizen jury cannot therefore be considered. Current research does not have the objective of replacing aluminium salts whose efficacy and safe use have been demonstrated in existing vaccines (…) Finally, it is important to note that the time necessary for operational development of a new adjuvant (which implies safety and efficacy tests) to replace aluminium salts is of around ten years. As for the safety, data should then be compared with that for aluminium salts for the use of which there is hindsight of almost 100 years.

The choice of framing also meant that it was very difficult for the issues of vaccine safety and of the list of recommended vaccines to become central in debates. More generally, this choice of setup seems to have been effective in preventing this consultation from sparking an even larger debate over the science of vaccines -the period of the consultation was marked by very little media coverage of vaccine-critical mobilizations. Even the announcement of the committee's recommendations at the end of November 2016 elicited little debate in the media. Among these recommendations were: making all these vaccines free of charge and more easily available; allowing pharmacists to vaccinate; increasing transparency, especially by facilitating access to the data of clinical trials; putting more effort in communication towards the public and training of medical professionals; and developing research on a variety of aspects of vaccination. But the most important and eye-catching recommendation was to extend mandatory vaccination to all childhood vaccines temporarily in order to abrogate all mandates once vaccination rates become satisfactory. The orientation committee also suggested that conscientious exemptions should be included in the law.

A missed opportunity to gather information on the acceptability of vaccine mandates

This combination of a narrow framing and a specific organization was successful in maintaining the imperium of scientific consensus, such as in the case of aluminium-based adjuvants.

But these constraints have run counter to some essential principles of participatory devices. Because of this, it is unclear exactly what made this citizen consultation informative or efficient in comparison to more traditional forms of expertise.

1.

Firstly, participatory devices can help deflate controversies by helping find common grounds with critical actors from social movements [START_REF] Callon | Acting in an Uncertain World: An Essay on Technical Democracy[END_REF][START_REF] Fishkin | When the People Speak: Deliberative Democracy and Public Consultation, Har/ DVD[END_REF][START_REF] Neveu | Démocratie participative et mouvements sociaux : entre domestication et ensauvagement ?[END_REF][START_REF] Topçu | La France nucléaire[END_REF]. This was not the case here. Many prominent vaccine critics applauded the initiative at first. Michèle Rivasi, a member of the European Parliament, posted as soon as November 2015 her 7 propositions to restore trust in vaccination in anticipation of the citizen consultation. The Institut pour la Protection de la Santé Naturelle (the Institute for the Protection of Natural Health, or IPSN) -the group that launched the petition against the use of aluminum that reached a million signatures and prompted the minister to call for this citizen consultation -promised at the beginning of January 2016 that they would "play the game" and placed great hope in this debate [START_REF] E3m | Vaccins : la Ministre répond aux "peurs irrationnelles[END_REF]IPSN, 2016;[START_REF] Rivasi | REMISE DU RAPPORT HUREL -VACCINS: pour un vrai débat public pluraliste, 7 propositions pour restaurer la confiance de la population[END_REF]. But the choices of framing and setup, announced in February 2016, antagonized them and also part of the participatory democracy milieu (Collectif, 2016;[START_REF] Formindep | L'obligation, c'est la décision éclairée[END_REF][START_REF] Joyeux | Concertation sur la vaccination : nouvelle arnaque[END_REF]Le Monde, 2016; Le quotidien du médecin, 2016). The deputy director of the Conference Nationale de Santé, one of the most prominent public institutions in charge of organizing public debates on health related issues, resigned resoundingly in reaction to the announcement of this setup. His protest was followed by Formindep, a prominent nonprofit which lobbies against the intervention of pharmaceutical companies' in the training of medical professionals.

Commenting on the orientation committee's recommendations in December of 2016, they described the consultation in the following terms [START_REF] Formindep | L'obligation, c'est la décision éclairée[END_REF] :

The consultation on vaccines, whose objective was to raise the level of trust in vaccines and vaccination coverage, is a total failure. The final report is an example of intellectual mediocrity, of loose deontology, of dubious transparency and its writing is the negation of a democratic exercise.

With defenders like that, vaccination does not need, alas, any enemies.

2.

Secondly, it is necessary to reflect on the democratic legitimacy the consultation's process has given to the orientation committee's recommendations with regards to involving the wider public. What makes this consultation a "citizen" consultation? The citizen jury and the web platform were supposed to be the two main pathways to this involvement. But the committee had to go beyond or against the information gathered through these means for two of their essential recommendations: the extension of vaccine mandates and maintaining aluminumbased adjuvants. The citizen jury could not reach a conclusion on the first issue and recommended that aluminum adjuvants should be abandoned since a great proportion of the population feared them (Comité d'orientation de la concertation citoyenne sur la vaccination, 2016b). Comments on the website contradicted these recommendations both on aluminium as mentioned previously, but also more clearly on mandatory vaccination. Indeed, only 20% of contributions evoked this issue, 87% of which opposed this measure. This does not mean that these opinions are representative of the wider public, but it does mean that both recommendations must find their legitimacy somewhere else, in the more expert-oriented aspects of this setup. Regarding mandates for instance, the committee relied more on the traditional tools associated with "opinion democracy". They focused on the result of an opinion poll suggesting that around 20% of the population would not get any vaccine if they weren't mandatory (Comité d'orientation de la concertation citoyenne sur la vaccination, 2016a).

3.

Our third concern relates to how the framing of a public debate affects the quality of the information it generates for decision-makers. In these devices meant to involve the wider public, individuals are first and foremost apprehended as citizens i.e. as capable of prioritizing competing social goals [START_REF] Callon | Acting in an Uncertain World: An Essay on Technical Democracy[END_REF]. It is implied that they can do so because there is some kind of civic education in society, because they have a local or practical expertise on these subjects but also because however informed their judgment, it is legitimate because they endure the consequences of public policies [START_REF] Callon | Des différentes formes de démocratie technique[END_REF][START_REF] Fishkin | When the People Speak: Deliberative Democracy and Public Consultation, Har/ DVD[END_REF][START_REF] Sintomer | The Power to the People[END_REF].

Reciprocally, members of the public take an interest in these debates for the same reasons. By focusing the reflection on ways to elicit a certain attitude in the public, this consultation asked citizens not to express their own point of view and values but to engage in the type of strategic thinking expected of political consultants or sociologists rather than of citizens. It is therefore not surprising that many commentators on the internet website shunted the two main questions put forward by the organizers: a majority of the were answers to the open question on vaccination (61%) rather than to the questions more in line with the framing of the consultation (how to restore trust and how to reach high vaccination rates, 19% and 20% respectively). Most members of the public wanted to debate of other aspects of vaccination and not just of the best ways to have everyone vaccinated. The issue of the framing of the debate was often explicitly addressed in comments such as these:

The debate is biased: this question shows that this is not an open debate on vaccination, but that the goal is to sell always more vaccines, whatever the cost… Contribution 4430, September 21, 2016, posted as an answer to question 3: What would be your recommendations to improve vaccination coverage?

How could we not see that this consultation is biased? It's a "mug's game"? What kind of deontology is behind it? How about the 2 nd and 3 rd questions! Don't they imply the premise that "vaccination is not up for debate! (Mme the Minister)?

Contribution 6989, September 30, 2016, posted as an answer to question 1: Express your opinion on vaccination in general

The emergence of a debate about what the debate should be about is not unusual in participatory setups [START_REF] Blatrix | Le débat public : une expérience française de démocratie participative[END_REF]. They reflect the fact that organizers are never completely open to questioning every aspect of the policy or issue under scrutiny and try to frame debates in a way that they deem "constructive", i.e. in a way that does not completely call into question their own intervention on the issue, past and future. For instance, public health officials want debates that generate ideas that they can use in their public health policies and not debates about the legitimacy of the institutions they represent or of the principle of public health. But in this case, this inevitable framing work is problematic even if we adopt the point of view of French public health officials.

Indeed, if we ask citizens to fill the shoes of experts of public opinion, the question necessarily arises of the quality of their judgments. The feeling that they were not experts of public opinion can explain why the citizen jury was unsure and divided on the subject of vaccine mandates. Their disagreement was not on matters of principle (individual autonomy vs state control for instance) but on whether the abrogation of mandates would effectively raise or lower vaccination coverages (Comité d'orientation de la concertation citoyenne sur la vaccination, 2016b). But even if they had agreed on their assessment of the social impact of vaccine mandates, why would the committee give any credence to this assessment compared to that of the various social scientists they auditioned and to the data gathered through the traditional tools of opinion politics such as methodologically-sound opinion polls? Not only did the orientation committee and the Minister for Health confuse participation with public opinion analysis, they also fell prey to some classical biases in public opinion research. They asked the public 1. a different type of question than the ones they were likely to be interested in or have an opinion about and 2. to analyze itself rather than produce the judgments necessary for the analysis [START_REF] Bourdieu | Public Opinion Does Not Exist[END_REF].

4. Finally and consequently, this consultation constitutes a missed opportunity to gather precise information on the acceptability of mandatory vaccination in a given national context. This precedent could have provided the international public health community with a framework and a model for ethical decision-making on this sensitive issue.

The question of when compulsory vaccination is acceptable has been discussed for more than a century and ethicists have not reached a definitive answer [START_REF] Omer | Vaccine Refusal, Mandatory Immunization, and the Risks of Vaccine-Preventable Diseases[END_REF][START_REF] Salmon | Making mandatory vaccination truly compulsory: well intentioned but ill conceived[END_REF]. This is not surprising; such discussions are inseparable from the inextricably political issue of balancing state power and individual autonomy which finds different answers depending on local cultures [START_REF] Colgrove | Manifold Restraints: Liberty, Public Health, and the Legacy of Jacobson v Massachusetts[END_REF][START_REF] Salmon | Compulsory vaccination and conscientious or philosophical exemptions: past, present, and future[END_REF]. This is why different countries have different policies on this issue [START_REF] Walkinshaw | Mandatory vaccinations: The international landscape[END_REF].

The citizen jury and the website could have given much information on when and how mandates can be acceptable in France. Unfortunately, the framing of the debate has largely overshadowed this issue. Only a small fraction of the citizen jury's statement document was dedicated to the question of coercion (2 pages out of ten) and it was far from providing a substantial material to decide on this subject. These two pages are not without interest. The jury states that it is divided on the subject and that those in favor of more mandates would like them to cover all childhood vaccines.

However, the value judgments explaining these recommendations are missing from this document.

Why vaccines for children and not adult? What about religious minorities such as Jehovah's witnesses? More importantly, one thing vaccination ethicists agree upon is that a mandate is all the more justifiable if the disease targeted is serious and transmissible, the precise point where the risk of the disease trumps personal autonomy being the crucial element to debate and identify [START_REF] Colgrove | Vaccine Refusal Revisited -The Limits of Public Health Persuasion and Coercion[END_REF]. Each vaccine should therefore be debated at least somewhat separately to determine whether their epidemiological situation warrants coercion. This was not done by the jury who only provides comments on vaccination in general, "vaccines for minors" (without explaining why the age of the vaccinated should be of importance) and a sentence to the effect that a "pandemic or a sanitary emergency" would justify coercion. Comment on the website did not provide the orientation committee with more information. Without this issue being put forward in the guiding questions, only the people who already had an issue with this aspect of vaccination -i.e. antivaccinationists [START_REF] Blume | Anti-vaccination movements and their interpretations[END_REF][START_REF] Kata | A postmodern Pandora's box: anti-vaccination misinformation on the Internet[END_REF] -were likely to spontaneously mention this subject.

Of course, the orientation committee provided more grounds for their recommendation to extend mandatory vaccination to all recommended childhood vaccines and added the introduction of philosophical exemptions. But this dearth in information bore on their own recommendations and their justifications remain weak from an ethical point of view. They justify restricting mandates to childhood vaccines only by saying that it is "easily understandable and in conformity with a prevention policy against a collective risk". They also provide many different arguments in favor of vaccination for each of these childhood vaccines and turn them into arguments in favor of mandatory vaccination (Comité d'orientation de la concertation citoyenne sur la vaccination, 2016a, 2016b). But it remains very unclear in this document why other vaccines such as against HPV or the flu should not be made mandatory. More importantly, it does not provide an answer to the most crucial question of all: when is it not justifiable to make a vaccine mandatory?

Conclusion

The 2016 citizen consultation on vaccination in France is a reminder of the difficulties of debating on issues for which there is a strong consensus in the public health community. By providing a platform to discuss issues pertaining to vaccine hesitancy and vaccine-related controversies it showed that the institutional tools of participatory democracy can provide a meaningful contribution to public health decision-making. But it should also be remembered as a warning that if some basic principles are not followed participatory devices cannot provide the quality of information and democratic legitimacy expected of them. In this particular case, it is arguable that by trying to obtain answers from the public on all aspects of vaccination policies and not only on mandatory vaccination, the organizers missed the opportunity to advance the reflection on one of the most crucial debates when it comes to vaccination. Beyond vaccination, public health deciders must realize that when trying to introduce more democracy in their decisions, how the inputs from the various actors involved in the debate are balanced and how the discussion is framed are always going to be the key issues.

  on it: 1. what are French people's perception of vaccines, 2. how can we facilitate vaccination, 3. in which conditions can mandatory vaccination be acceptable, 4. what do you expect of research on vaccines, 5. what are your recommendations to improve trust in vaccines, and 6. what are your recommendations to improve vaccine coverages? The comments section of the consultation's website was even more focused, with internet users posting their answers to one of three questions: questions 5 and 6 and an open question on vaccination.