@inproceedings{HMPS14,
	title="ANONIZE: A Large-Scale Anonymous Survey System",
	authors="Susan Hohenberger and Steven Myers and Rafael Pass and abhi shelat",
	conf="IEEE Security & Privacy (Oakland) 2014",
	year="2014"
}

PDF Full Version

A secure ad-hoc survey scheme enables a survey authority to independently (without any interaction) select an ad-hoc group of registered users based only on their identities (e.g., their email addresses), and create a survey where only selected users can anonymously submit exactly one response. We present a formalization of secure ad-hoc surveys and a provably-secure implementation in the random oracle model, called ANONIZE. Our performance analysis shows that ANONIZE enables securely implementing million-person anonymous surveys using a single modern workstation. As far as we know, ANONIZE constitutes the first implementation of a large-scale secure computation protocol (of non-trivial functionalities) that scales to millions of users.

See https://anonize.org for more information and the implementation.