Summary

  • AFRINIC’s meeting report says that on 21 May 2009 a valid election ballot was green and carried an AFRINIC stamp on the front and another on the back. Read literally, that was a conjunctive three-predicate authenticity rule, not merely a vague instruction to use official paper.
  • The visible rule was useful but narrow. The report says genuineness checks would be performed, yet it does not describe the method, identify the checker, disclose a ballot-level result, or reconcile authorised stock with ballots issued, unused, spoiled, cast, challenged and retained.
  • The report records 41 ballots cast and 40 valid, but the single void ballot lacked a vote mark for both regions; it was not reported as a colour or stamp failure. The known authentication-failure rate therefore cannot be calculated.
  • The proper lesson is to preserve simple visible controls while documenting issuance, stamp custody, checking, reconciliation and exceptions. A green double-stamped sheet could authenticate a private ballot form; it could not certify the election’s complete legitimacy or enlarge AFRINIC from a bookkeeper and coordinator into a sovereign or regulator.

Analysis

The ballot announced in three visible parts

The most revealing object in AFRINIC’s 2009 Board election was not an abstract governance principle. It was a sheet of paper. At AFRINIC-10, the election committee told the meeting how to recognise the ballot it would accept: the paper was green, and it bore an AFRINIC stamp at the front and at the back. Security checks, the committee said, would be done to ensure that ballots were genuine.

That description is unusually concrete. Much institutional language asks an audience to trust a process as a whole. This instruction instead presented three observable conditions. A person holding a sheet could ask three elementary questions. Is it green? Is there an AFRINIC stamp on the front? Is there an AFRINIC stamp on the back? The described ballot form satisfied the rule only when all three answers were yes.

The specificity is useful because it gives analysis an object. One need not speculate about hidden motives, imagined misconduct or the moral character of those present. The control can be decomposed, its handoffs can be traced and the surviving record can be tested against the assurance later attached to it. That is a better form of accountability than either institutional reverence or suspicion without evidence.

It is also a severe discipline. The visible features can support only the conclusion they were designed to support. They help distinguish the described official form from a sheet that lacks one or more stated features. They do not answer who was entitled to receive a ballot, whether the correct number was issued, whether the box remained continuously controlled, whether every sheet was inspected the same way, whether the count was accurate, or what authority an internal result could lawfully exercise.

The green double-stamped ballot is therefore important precisely because it is narrow enough to audit and too narrow to carry a constitutional myth.

The day before the green sheets entered the room

The chronology begins on 20 May 2009. AFRINIC’s meeting report says the chief executive reminded members to collect ballots from the secretariat for the Board election on the following day. On 21 May, the report says ballot papers should have been collected from the registration desk. That desk was more than a convenient distribution point. It was the physical chokepoint connecting the institution’s authorised stock to the people who carried sheets into the voting process.

A distribution point can be a strong control. It concentrates issuance in a place where staff can apply a rule, observe a handoff and prevent loose paper from circulating as if it were official. In a small in-person meeting, the desk also makes the procedure easy to explain: the accepted ballot comes from here, looks like this and carries these marks.

But a chokepoint becomes an auditable control only when its transactions can be reconstructed. The report does not disclose how many ballots were printed, how many reached the desk, how many were issued, how many returned unused, how many were spoiled, how many remained in stock or how many were retained after the count. It contains no recipient receipt, serial-number register or issue ledger. It does not say which staff member controlled the supply or whether a second person witnessed opening and closing counts.

Those absences do not establish that distribution was disorderly. They establish something more exact: the surviving evidence does not permit a reader to reproduce the flow of ballot stock through the registration desk. The reminder and the collection instruction prove that a desk-based issuance path was described. They do not prove the completeness of that path.

This distinction protects both fairness and accuracy. It avoids accusing election workers of a failure the record does not show. It also prevents the institution from borrowing more assurance from the words “registration desk” than those words can provide. A named location is a control point; it is not, by itself, a transaction log.

Four committee members, several unassigned control roles

The election section names Sunday Folayan, Ken Lohento, Mohamed Elghamry and Adiel Akplogan as the four members of the election committee. Sunday Folayan is the person the report records as presenting the collection instruction, the green-paper requirement, the two stamp locations and the promised genuineness checks.

Naming the committee is useful. It establishes the group attached to the election function and identifies the speaker of the authenticity rule. It does not, however, allocate every operational task within the control. The report does not say who designed the ballot, selected the paper, ordered the printing, controlled the stamp, applied the front mark, applied the back mark, carried stock to the desk, issued each sheet, inspected ballots before or after casting, recorded exceptions, reconciled the totals or retained the physical evidence.

That gap is easy to miss because committee membership can create a general impression of responsibility. Yet an audit needs verbs as well as names. “Election committee” describes an institutional group. It does not reveal which person performed which custody-sensitive act. If the same individual held the stamp, issued the sheet and judged an unclear impression, the control would have one risk profile. If those functions were separated and witnessed, it would have another. The record does not allow either design to be asserted.

The right conclusion is not that nobody was responsible. The right conclusion is that individual responsibility for the three-predicate check is not disclosed. A credible future record would name roles without disclosing vote choices: stock custodian, stamp custodian, issuing officer, box custodian, predicate checker, exception adjudicator and reconciliation witnesses. That would turn a committee label into a reviewable chain of actions.

A conjunctive rule, not three independent technologies

The described authenticity rule can be written simply: green paper plus a front stamp plus a back stamp. All three predicates were necessary to match the form AFRINIC announced as valid. This textual decomposition matters because casual summaries can quietly weaken the rule. “Stamped ballot” loses the front-and-back requirement. “Official green ballot” loses both stamps. “Two stamps” loses the colour predicate.

The three conditions should not, however, be confused with three independent security technologies. Green colour was one visible property. The front and rear impressions were two location-specific manifestations of what may have been the same institutional stamp process. The record does not identify separate devices, separate custodians, different inks or independent authorisations. It does not describe the stamp’s wording, design, size or anti-counterfeit properties. No probability can therefore be assigned to the chance that an unauthorised sheet would defeat one, two or all three conditions.

This is why “multi-factor” must be used with care. The rule required multiple visible factors in the ordinary sense that a checker had more than one feature to inspect. It does not follow that the factors supplied statistically independent protection. If one uncontrolled person could reproduce the entire form, the number of visible locations would add less protection than it would under divided custody. If stock and stamp were separately controlled, the same visual design could be stronger. The missing custody evidence determines the assurance ceiling.

Still, the conjunction had practical value. A non-green sheet could be rejected quickly. A green sheet marked only on one face would fail the announced form. Requiring inspection of both sides forced a deliberate handling action rather than a single glance at the top surface. These are real advantages in a counting room. They are also limited advantages. A control can be sensible without being cryptographic, forensic or complete.

Why the second stamp mattered—and why custody mattered more

The back stamp is the detail most likely to disappear in retelling. It should not. The official description did not merely require AFRINIC branding somewhere on the ballot. It identified marks on two faces. A checker following the rule had to turn the sheet over or otherwise establish that both locations were marked.

That extra action creates friction. A stray sheet that happens to resemble the authorised colour would not satisfy the rule. A sheet carrying only a visible front impression would also fail. Two placements can make casual substitution harder because the form has to be reproduced in more than one location.

But the second impression is valuable only within the custody system around it. If the instrument or authority to stamp was loosely available, two applications could be nearly as easy as one. If the front and back were applied at different stages without records, the second mark could even add ambiguity about when a ballot became complete. Conversely, if a restricted custodian applied both impressions to counted stock, recorded the quantity and returned the stamp under witness, the double placement could sit inside a strong and inexpensive chain.

The report does not say which of those possibilities describes the 2009 practice. It does not disclose whether ballots were pre-stamped or stamped when issued. It does not say whether the same instrument made both impressions, how many stamps existed, who held them, whether use was logged, or how faint, partial or misplaced marks were treated. It gives the predicate, not the production history.

That is the central difference between an authenticating feature and an authentication system. A feature is what the eye sees. A system explains how the feature was authorised, applied, protected, tested and accounted for. The green sheet had announced features. The surviving record does not disclose a complete system around them.

Green was a control because it was easy to see

Colour is an old and effective meeting-room tool. It compresses an instruction into a glance. People need not read serial numbers or compare signatures to notice that a sheet is green. For a small private election in 2009, that legibility was a reasonable design advantage. It lowered the cost of explaining the ballot form and could help counting-table participants notice a visibly different sheet.

Yet colour also demonstrates why precision matters. The report says green; it does not disclose the exact shade, paper specification, printer, supplier, watermark status or a retained specimen. A later reviewer cannot infer any of those details. Nor can a reviewer assume that lighting, fading, copying or ordinary variation was tested. The colour predicate is therefore an announced visual category, not a documented forensic specification.

This does not make it useless. Controls should be judged against their intended work. The green predicate could screen for obvious mismatch at very low cost. It could give voters and counters a shared reference. It could also combine with the two stamp locations so that colour alone was insufficient.

What it could not do was carry an unlimited claim. Seeing green cannot reveal how many sheets of that colour existed. It cannot reveal whether each one came through the desk. It cannot reveal whether every authorised recipient received exactly the proper ballot stock. It cannot preserve box custody or verify a tally. A visible colour is strongest when surrounded by counts and handoffs that do not depend on colour at all.

The useful question is thus not whether green was sophisticated. It is whether the evidence preserved around the green stock was proportionate to the assurance claimed for it. A simple election can justify a simple control. It cannot justify treating unrecorded steps as proved merely because the paper was conspicuous.

The promised genuineness check remains undescribed

The meeting report says security checks would be done to ensure genuineness. That sentence is important because it shows the election committee did not present the three features as decoration. A check was part of the announced procedure. But the record does not describe how that check operated.

Several questions remain unanswered. At what moment was the check performed: on issue, at the box, during sorting or at the count? Did one person inspect all three predicates, or did different people inspect different features? Was every ballot checked or only questioned sheets? Did a checker record pass and exception results? What happened to a faint front impression, a partial rear impression or a shade that looked ambiguous? Could a decision be challenged, and who resolved it? Was a specimen available for comparison? None of these details appears in the available record.

The missing method must not be converted into a claim that no check occurred. The report expressly announces checks. The evidentiary problem is different: a present reader cannot reproduce the test or verify its ballot-by-ballot application. “Checks would be done” records an intention and an institutional statement. It does not preserve a protocol or its results.

This boundary also prevents an opposite error. Because no stamp-related rejection is disclosed, one might be tempted to say every ballot passed authentication. That would be unjustified. The denominator of inspected ballots is not stated, the check results are absent and the report does not classify outcomes by the three predicates. Zero disclosed stamp-related rejections is not the same as a measured zero failure rate.

A sound report would distinguish the announcement, the performance evidence and the result. It would state the test, name the role responsible, give the inspection denominator, classify exceptions and retain a record. The 2009 report supplies the first of those layers. It does not supply enough of the others to make authentication reproducible.

Forty-one cast, forty valid, and the fraction that cannot answer the question

The report records 41 ballots cast and 40 found valid. At the aggregate level, that is a valid-ballot rate of 40 divided by 41, or approximately 97.560976 per cent. The void-ballot rate was one divided by 41, or approximately 2.439024 per cent.

Those figures are precise, but their meaning is easy to distort. The report attributes the single void ballot to the absence of a vote mark for both regions. It does not attribute that outcome to the paper’s colour, the front stamp, the back stamp or a failed genuineness check. The one invalid form was therefore described as a marking failure, not as an authenticity failure.

It follows that neither 40/41 nor 1/41 is an authentication rate. Forty valid ballots are not forty documented passes of the three-predicate test. One void ballot is not one documented failure of that test. The report combines the aggregate validity result with a reason for the sole void, but it does not provide the number of ballots inspected for authenticity or the number that failed a colour or stamp condition.

The known stamp-failure rate is therefore not zero. It is not one in 41. It is not 2.439024 per cent. It is not computable from the disclosed record.

That result may feel unsatisfying, but “not computable” is an important audit finding. It prevents a clean aggregate from being used to answer a different question. Election records often compress several control layers into the word “valid”: authenticity of the form, proper marking, voter entitlement, authorisation, count treatment and sometimes other procedural requirements. Here, the stated reason for the sole void lets us separate at least one layer. It tells us why that ballot was excluded, and by doing so it prevents us from pretending it tested the stamps.

The arithmetic thus teaches a larger discipline. Numbers do not become evidence merely by being exact. A fraction inherits the category of its numerator and denominator. The 40/41 figure describes the reported aggregate validity of cast ballots. Without an authentication denominator and classified stamp exceptions, it cannot describe the performance of the green double-stamp control.

Zero reported rejections is not a measured zero

There is a quiet but consequential difference between absence in a report and absence in the room. The report supplies no disclosed colour- or stamp-related rejection. That is a statement about the record. It is not proof that no ballot presented a defect, no sheet was challenged, or every check produced a clean result.

Perhaps all cast ballots did meet the visible form. Perhaps an unclear sheet was resolved before the final count. Perhaps inspection happened without a separate log. Perhaps the announced features were so obvious that no exception arose. The record does not decide among these possibilities, so the article should not either.

The same restraint applies in the other direction. Missing logs do not prove that an unauthorised ballot appeared, that duplicate sheets entered the box, that a stamp was copied or that anyone interfered with stock. There is no evidence here for such allegations. A gap in assurance is not evidence of misconduct.

This symmetry is the heart of responsible control analysis. Institutional prestige cannot fill the missing record, but institutional criticism cannot fill it either. The surviving report deserves full weight for what it actually records: the collection path, the three visible conditions, the planned genuineness checks, the aggregate cast and valid totals, and the stated marking reason for the void ballot. It deserves no extra weight as proof of unrecorded execution. Nor should it be treated as evidence of an unrecorded failure.

The honest conclusion sits between complacency and accusation. AFRINIC described a cheap, observable authenticity rule. The evidence available here does not establish the rule’s ballot-by-ballot performance. That is enough to justify better records. It is not enough to justify a scandal narrative.

The official report proves a statement and an act, not its own sufficiency

An official meeting report has special value because it records what the institution said and did in its own name. It is the controlling evidence for the 21 May 2009 announcement. Without it, the green paper and the two stamp locations would be hearsay or memory. With it, the rule can be stated precisely and attributed to the election committee.

Official authorship does not make the document self-validating beyond that scope. The report proves that AFRINIC recorded the rule, the planned check and the ballot totals. It does not prove merely by being official that the design was sufficient, the execution consistent, the electorate representative or the resulting authority unlimited. A record made by the operator of a process is evidence of the operator’s account; it is not a substitute for the independent evidence that account would need to support broader conclusions.

This matters especially for a registry. AFRINIC’s ordinary value lies in accurate bookkeeping and coordination. A trusted ledger can describe who is recorded, what action was taken and what institutional outcome was entered. The ledger does not create the world it records. An election report likewise describes an internal event. It cannot manufacture a principal, turn attendance into a continent or confer powers that the private corporate structure and actual authorisations do not contain.

The most dangerous inflation is subtle. It begins with a defensible claim—“we used a visible ballot control”—and ends with an unrelated one—“therefore the institution speaks with regional authority.” Nothing in green paper or two stamp impressions bridges that gap. The first proposition concerns form authenticity. The second concerns mandate. They occupy different layers and require different evidence.

Treating the report modestly is not hostility to AFRINIC. It is the discipline that keeps a bookkeeper trustworthy. The institution gains credibility when its records are read exactly, not ceremonially. A private coordinator should want its evidence to support precise operational statements, because an exaggerated claim converts an ordinary documentary gap into a crisis of belief.

Authenticity is one layer among several

The green-and-stamp rule asked whether a physical sheet matched the form AFRINIC described as genuine. That is a valuable question. It is not the only question in an election, and it should not be allowed to impersonate the others.

Form authenticity does not establish the identity of the person holding the sheet. It does not establish that the person was properly authorised by a member organisation. It does not establish that issuance prevented duplicates. It does not establish the ballot’s custody after it entered the box. It does not establish that the tally was accurate. It does not establish the legal reach of the result.

These distinctions are not loopholes designed to make every procedure look inadequate. They are the normal architecture of assurance. A passport can be authentic while its bearer lacks permission to perform a particular corporate act. A document can come from the correct printer and still contain an invalid instruction. A box can contain only genuine forms and still lack a disclosed custody record. One control succeeding cannot be used to certify another control that was never tested.

The proper model is layered. Ballot-stock control answers whether sheets originated from authorised stock. The three visible predicates answer whether a sheet matches the announced form. Issuance control answers whether distribution was authorised and counted. Custody control answers what happened after casting. Reconciliation answers whether stock, issues and returns cohere. Marking rules answer whether the voter expressed a countable choice. Corporate authority answers what the resulting act can lawfully do.

The 2009 report gives unusually useful evidence about one of those layers and limited evidence about parts of others. Its value increases, rather than decreases, when each fact is kept in its category. The green double-stamped ballot is worth studying because it lets a reader see the exact boundary between an inspectable object and the much larger system that people may assume surrounds it.

The strongest case for keeping the control simple

The best defence of AFRINIC’s approach begins with scale and time. This was a small in-person private-association election in 2009, not a national election. Green stock, two visible stamps, distribution through a registration desk and an announced genuineness check may have been proportionate to the risk. The form was easy to explain, cheap to produce and fast to inspect. A complicated forensic or cryptographic apparatus could have slowed the meeting, increased cost and created new failure points.

That defence has real force. Institutional analysis becomes unserious when it demands maximum technology for every modest process. Paper controls often work because humans can understand them. A visible colour and marks on both faces allow broad observation without specialist equipment. In a small room, social visibility and simple physical features may deter casual substitution effectively.

The answer is not to reject simplicity. It is to distinguish simple design from unrecorded design. Proportional control could have meant counted stock, restricted stamp custody, a basic issue tally, witnessed opening and closing counts, an aggregate reconciliation and a short exception note. None of those measures requires a national-election bureaucracy. None reveals how anyone voted. Most could fit on one page.

Nor do missing public fields prove those steps were absent in practice. They set the limit on what a later reader can verify. A proportionate process can remain proportionate while preserving enough information to show that its own rule was applied. The strongest defence of the green double-stamped ballot therefore supports the visible control but not an assurance claim larger than the evidence.

This is the constructive position. Keep the green paper if it helps. Keep the front and back stamps if they impose useful friction. Keep the registration desk if it concentrates issuance. Then count, assign custody, record the check and reconcile. Simplicity and auditability are allies when the institution refuses to confuse a visible symbol with a complete system.

The one-page ledger that would have transformed the record

The missing assurance could have been strengthened by a compact control inventory. Before issuance, the record could state the authorised quantity of ballot stock, the printer or controlled production role, the paper specification, the number prepared, the person holding the stamp and the number of sheets marked. It could record whether the front and rear impressions were applied before delivery to the registration desk or at issue.

During distribution, an issue ledger could count ballots released without linking a serial on the cast sheet to the voter’s identity. If member authorisation required a separate confirmation, that fact could be recorded on a detachable or independent receipt. The privacy-preserving principle is simple: prove that the right quantity was issued through the right path without making the anonymous vote traceable to a named person.

At closure, officials could count unused and spoiled stock, compare that total with issued stock and record any difference. At the box, a custodian could record closure or handoff status. At inspection, a checker could use three neutral columns—green, front stamp, back stamp—and an exception category for each failure or ambiguity. At count completion, the report could distinguish authenticity failures from marking invalidity and other classifications.

Finally, the totals could be reconciled: authorised stock equals issued plus unused plus spoiled, with every residual explained; issued stock connects to cast and appropriately returned or otherwise accounted sheets; retained evidence matches the final categories. Witnesses could sign the aggregate record. A specimen could be preserved without exposing any vote.

These are recommendations, not a reconstruction of 2009. The existing report does not establish that such a ledger existed. Their value lies in showing how little additional bureaucracy was needed to turn the visible rule into reproducible assurance. Green plus two stamp locations was already a useful control grammar. The ledger would have supplied memory.

Auditability without turning the ballot into surveillance

Election controls can become too ambitious. A serial number printed on a ballot and copied against a voter’s name might make issuance easier to trace, but it can also compromise secrecy, enable coercion or create fear that choices can be reconstructed. More audit is not automatically better if the audit record exposes the voter.

The right design separates entitlement from choice. An issuance record can show that an authorised recipient collected one ballot without reproducing the identifier on the cast sheet. A detachable counterfoil can be accounted for separately. Anonymous ballots can be counted by category while issuance receipts remain outside the box. Aggregate reconciliation can show that quantities balance without revealing which person selected which option.

The three visible predicates fit this privacy-preserving approach. Green paper and stamps on both faces describe the form, not the voter. They make the object observable to witnesses while leaving the vote choice inside the ballot. That is an advantage worth preserving.

But privacy does not require amnesia. The institution can publish the number of sheets authorised, issued, unused, spoiled, challenged, cast and retained. It can disclose how many failed the colour condition, how many lacked a front stamp, how many lacked a back stamp and how ambiguous cases were resolved. It can identify custody roles and witnesses. None of that requires a public voter-to-ballot map.

The choice is therefore not between a secret vote and an auditable election. It is between a careless combined record and a carefully separated one. The 2009 control’s physical simplicity offered a good base for separation. What is missing from the surviving account is the aggregate evidence that would let later readers see the control without seeing through the ballot.

Exception records are where a control becomes credible

A control that never records an exception may look perfect, but it is difficult to evaluate. Real paper varies. Stamps can be faint, edges can be partial, sheets can be folded and colours can appear different under light. A disclosed exception process shows how an institution handles the boundary between obvious compliance and ambiguity.

For the AFRINIC-10 rule, neutral categories could have tracked a wrong-colour sheet, missing front mark, missing rear mark, unclear impression, unrecognised stock or an otherwise questioned form. The record could then show who made the first assessment, who reviewed a challenge and what happened to the sheet. Crucially, these categories should remain separate from a ballot that was authentic in form but invalidly marked.

That last distinction is confirmed by the reported aggregate. The sole void ballot was attributed to missing vote marks for both regions, not to the authenticity features. A mature exception record would preserve that difference rather than collapse all rejected sheets into one undifferentiated total.

Exception handling also disciplines power. If an election official can reject a sheet under an unspecified genuineness check without recording the predicate or review path, the visible rule becomes less valuable. If the official must point to green, front stamp or back stamp and place the decision in a category, discretion narrows. Another person can examine the same object and understand the basis.

There is no evidence that arbitrary rejection occurred in 2009. The point is design. Observable criteria should be paired with observable reasons. A stamp is most useful when it limits judgment rather than decorating it.

What cannot now be recovered

Some weaknesses can be corrected at the next election. Future organisers can publish a specimen, count stock, assign stamp custody, record inspections and preserve aggregate exceptions. Training can be improved and a reconciliation template can be adopted. These are reversible design choices.

The missing contemporaneous facts from May 2009 are different. If the physical ballots, stamps, issue notes or working papers were not retained, their custody history cannot be recreated by later confidence. The exact number printed or issued cannot be recovered from the final 41 cast merely by subtraction, because unused, spoiled or uncast issued sheets are unknown. The identity of a checker cannot be inferred from the committee list. The presence of two impressions cannot reveal who applied them.

This is why contemporaneous records have disproportionate value. They are cheap at the moment of action and often impossible to recreate later. A one-page ledger prepared in the room can answer questions that years of institutional narrative cannot.

The hard-to-repair risk is not limited to missing paper. A later story may treat the visible green ballot as proof that the election was fully legitimate, representative and authoritative. Once repeated, that inference can influence governance expectations even though the control never tested those propositions. The loss then occurs in public reasoning: a narrow feature becomes a certificate for a much larger claim.

The remedy is to preserve uncertainty honestly. We know what the report says. We know what it does not disclose. No later party should be allowed to turn either absence into certainty.

A private ballot can authorise only a private act within scope

An election may produce a valid internal corporate decision when it is conducted within the organisation’s lawful instruments and by people holding the necessary authority. That is a meaningful function. Private institutions need ways to choose officeholders and record decisions.

But an internal ballot cannot enlarge the legal nature of the institution holding it. AFRINIC remains a private bookkeeper, coordinator and service provider. It is not a state, a legislature, a police force, a prosecutor, a court, a punisher, a confiscator, a taxing authority or an owner of Internet number resources. Green paper cannot confer those powers. Neither can a stamp, a meeting or an institutional report.

The distinction follows from the source of the act. A member organisation may authorise a representative within its own corporate capacity. A properly constituted voting body may authorise an internal outcome within the relevant private structure. Neither step turns the participants into a people or the service region into a polity. Participation supplies evidence and decision-making within scope; it does not manufacture a sovereign principal.

This limit is central because election ceremony is visually persuasive. Ballots resemble public democracy. Counting resembles popular choice. Official stamps resemble state authentication. Yet resemblance cannot carry authority across categories. A private stamp on a private ballot proves, at most, conformity with the institution’s announced form. It is not a constitutional warrant.

AFRINIC’s legitimate work does not need that inflation. Number uniqueness, registry accuracy, contactability, security metadata, transfer recording, dispute metadata, auditability, failover and continuity are valuable coordination functions. They can be justified by operational necessity and voluntary cooperation. They do not require a myth that a stamped sheet speaks for Africa.

The green sheet should make authority claims smaller, not larger

The lesson of the double-stamped ballot is institutional modesty. Because its features are concrete, one can say exactly what they do. The colour helps identify the announced stock. The front mark satisfies one location requirement. The rear mark satisfies another. Together they offer a low-cost screen against some unauthorised forms. Their value comes from staying close to the object.

Authority inflation moves in the opposite direction. It starts with an inspectable paper and ends with claims about representation, stewardship or regional mandate that no inspection of the paper could prove. It turns a useful control into ceremony and ceremony into title.

A trusted registry should resist that movement. Its records derive influence from accuracy and reliance, not coercive power. Networks cooperate with a registry because a common reference reduces conflict. The registry has no army and no independent public jurisdiction. It cannot prosecute, adjudicate or punish as a sovereign. Its strength is the belief that its ledger is neutral and useful.

That belief becomes fragile when the institution asks its internal procedure to bear more legitimacy than it contains. If a ballot authenticates only the form, say so. If the issue count is absent, say it is unknown. If stamp custody is undisclosed, do not imply it. If overall authority depends on corporate law and actual principal authorisation, do not replace that chain with green paper.

The narrow claim is not a concession. It is the foundation of trust. The more valuable the records surrounding scarce number resources become, the more important it is that the keeper of those records distinguish description from authorship. The ledger records a result; it does not create the rights, markets, networks and public authority around it.

The control’s proper legacy

The AFRINIC-10 rule deserves neither ridicule nor reverence. It was a practical visible control: green stock, an AFRINIC stamp on the front and an AFRINIC stamp on the back. The registration desk supplied a distribution chokepoint. The announced security check showed an intention to test genuineness. The final report disclosed 41 cast and 40 valid.

The same record imposes a strict limit. It does not specify the check, allocate checking responsibility, disclose stamp custody, preserve a ballot-level result or reconcile stock. The sole void ballot concerned an absent vote mark, so it cannot be recruited as evidence for or against the authenticity rule. No stamp-failure rate can be calculated.

The strongest answer is therefore constructive. Future organisers should retain the visible three-part form while publishing authorised stock counts, custody roles, issue and return totals, box handoffs, predicate checks, exception treatment and aggregate reconciliation. They should keep voter choice secret while making quantities and control actions inspectable.

Above all, they should keep the conclusion proportional to the object. A green double-stamped sheet was evidence of an announced private ballot form. It was not proof of the election’s whole legitimacy, a mandate from absent operators or a source of public authority. The bookkeeper may maintain the record and the coordinator may facilitate the act. Neither becomes sovereign because its paper carried two stamps.