  The LOCKSS project has developed and deployed in a world-wide test a
peer-to-peer system for preserving access to journals and other archival
information published on the Web. It consists of a large number of independent,
low-cost, persistent web caches that cooperate to detect and repair damage to
their content by voting in "opinion polls." Based on this experience, we
present a design for and simulations of a novel protocol for voting in systems
of this kind. It incorporates rate limitation and intrusion detection to ensure
that even some very powerful adversaries attacking over many years have only a
small probability of causing irrecoverable damage before being detected.
