Summary
- The public record supports a serious authorization problem in AFRINIC's 23 June 2025 election: ICANN later referred to at least one unauthorized power-of-attorney document, while the receiver described suspicions involving powers of attorney used by some voters and acknowledged that the extent of the irregularities was not yet known.
- Those statements do not establish either that only one vote was defective or that every voting channel and every seat was contaminated. A proportionate response must trace the defect from member authority to instrument, bearer, ballot token, count, candidate margin, and any shared validation weakness before selecting the scope of relief.
- Immediate suspension and evidence preservation can be justified on credible risk. Permanent annulment of the entire process carries a higher burden: it should explain the substantial injustice, the limits of reconstruction, the alternatives considered, and why rejecting, revalidating, recounting, or rerunning only the affected part would not protect both integrity and valid member votes.
The known defect and the unknown perimeter
The decisive governance problem in AFRINIC's June 2025 board election can be stated without accusation. A voting instrument was challenged as unauthorized. The election was suspended near its end. The receiver then annulled the process while the factual investigation remained incomplete. The narrow question is not whether an unauthorized instrument is serious. It is how an institution should move from a serious known defect to a remedy whose reach is broader than the defect proved at the time.
That distinction matters because a corporate election converts several kinds of authority into one count. AFRINIC's Resource Member is a legal entity. A human being may act as its registered contact, designated electronic voter, authorized in-person representative, or proxy. Each role has a different source and scope. A document can be genuine yet signed by someone without power to bind the member. A signatory can have corporate authority yet appoint a bearer outside the permitted form. A valid bearer can present more instruments than the rules allow. A valid authorization can still be associated with a duplicate vote.
None of these defects automatically proves the others.
The public material also contains two descriptions that must not be collapsed. ICANN's 16 July 2025 open letter listed the discovery of at least one unauthorized power-of-attorney document and police reporting. The receiver's 15 July notice used broader language: suspicions of irregularities, particularly concerning powers of attorney used by some voters, complaints to the authorities, a police investigation, and no final conclusion about extent. The first gives a public minimum. The second describes unresolved possible breadth. Neither supplies a completed census of invalid instruments or ballots.
The phrase “one disputed proxy” is therefore a discipline, not a factual conclusion that there could have been only one problem. It directs attention to the smallest publicly identifiable unit of controversy. Analysis should begin there and expand only as evidence establishes a shared bearer, repeated signatory, compromised member record, common validation error, duplicate-voting failure, mixed ballot batch, or another mechanism by which the defect could travel. The alternative is to let uncertainty do the work of proof.
Once that happens, any localized anomaly can be said to contaminate everything because the institution has not measured its own process.
What happened between authorization and annulment
The sequence can be reconstructed from AFRINIC's own election material. The 2025 election page scheduled electronic voting from 16 to 23 June and an in-person election day on 23 June. After an injunction was discharged, an 18 June communique said electronic voting would open that day and close at noon on 23 June, while in-person voting would run at a Mauritius venue. The communique set out physical-document requirements for appointed proxies and authorized in-person representatives.
The published design offered three ways for a member to exercise one vote: a designated electronic representative, an appointed proxy, or an authorized in-person representative. It also said that using more than one method was prohibited. A proxy was expected to bring a signed authority letter, a completed proxy form or certified copy, and identification. An authorized in-person representative needed a signed letter, a notarial certificate or another legally authorized document depending on the jurisdiction, and identification.
The guidance expressly allowed multiple members to select the same authorized in-person representative, provided the documentary set existed for each member.
At 17:41 on 23 June, the Nomination Committee issued its suspension communique. It said matters had come to its attention that required investigation, recorded that the chair suspended the election at 17:32, and froze online and in-person voting. The communique cited the committee's bylaw obligation and provisions of the election guidelines, but did not identify a member, document, bearer, ballot, seat, candidate, numerical margin, or validation step. A suspension at that moment was a containment act. It preserved the possibility of an inquiry before confirmation and announcement.
Two days later, ICANN's 25 June letter described reports, not adjudicated facts. It said some Resource Members alleged that powers of attorney presented on their behalf had not been authorized, and that some discovered the issue when they arrived to vote. It also highlighted a structural distinction: the formal proxy route limited a person to five proxies, while the election design appeared to permit a person carrying powers of attorney to act as authorized representative for an unlimited number of members. ICANN asked that no result be certified until the concerns had been addressed.
On 26 June, the receiver's annulment communique referred to feedback from several stakeholders and potential irregularities concerning voter documentation. It stated that those concerns had been reported to the appropriate authorities and announced the immediate annulment of the current election process. It also said the receiver would seek a limited extension from the Supreme Court to organize new, fully verified elections. A 30 June update reported that the court had granted a new deadline of 30 September.
The sequence establishes urgency and consequence. It does not disclose the evidentiary bridge between the two. The suspension was based on matters requiring investigation. The annulment occurred while public reporting still described potential irregularities. The later notice expressly said the investigation had not produced final conclusions about their extent. That gap does not prove that annulment was wrong. It identifies the issue that a reasoned remedy should answer.
A proxy, a representative, and a ballot are different entities
The dispute became harder to contain because the June rules created adjacent categories of delegated action. AFRINIC's 2020 Constitution allows voting in person, electronically, or by proxy. Article 12.12 requires written appointment, addresses the authority under which an instrument is signed, limits a person entitled to vote to five proxies, and prevents a board candidate from acting as a proxy. Those provisions define a familiar chain: member, appointment, proxy holder, and vote.
The June 2025 election guidelines added the authorized in-person representative route. A Resource Member that had not completed electronic or proxy arrangements could present a representative on election day with evidence of corporate authority. Multiple members could use the same person. The apparent purpose was enfranchisement: a member that missed an earlier registration step would not necessarily lose its vote. The consequence was a boundary problem. A person carrying authority for many entities could be treated as a series of corporate representatives rather than as one proxy holder subject to the five-proxy cap.
That distinction may be legally sustainable in a particular case. A director can ordinarily authorize an agent to act for a company, and a corporate representative is not always the same legal category as a proxy. But an election control cannot stop at labels. If the same human being arrives with a stack of instruments and casts a member's ballot, the integrity system needs to know why each authority is accepted, how the person's capacity differs from proxy status, whether the constitution permits the distinction for that poll, and how duplicate voting is blocked.
The minimum record is not simply a scanned document. It is a linked authorization chain. The member must exist in the eligible register. The signatory must have authority to bind that member at the relevant time. The instrument must authorize the particular representative and act. The representative's identity must match. The member must not already have voted electronically or through another channel. The ballot entitlement must be issued once. The cast token must enter the count once. Each link should be reviewable without revealing the voter's candidate choices.
This is why a database contact cannot silently substitute for corporate authority. Registry contacts are maintained for operational functions and can become stale, delegated, or narrow in purpose. A contact's access may be evidence, but it is not conclusive proof of a current power to appoint an election representative. Conversely, an officer with legal authority may not appear in the ordinary registry contact fields. The election administrator has to reconcile corporate authority and registry identity rather than assume either one answers both questions.
Contamination has a direction and a radius
“Contamination” is useful only if it describes a mechanism. A disputed document can affect an election through several progressively broader paths. The first is an individual-instrument defect. One member did not authorize one document, and one ballot entitlement was improperly released. If the ballot token can be identified without exposing its choices, the immediate perimeter is that ballot and every seat on which it recorded a preference.
The second path is a bearer cluster. The same person may have presented several instruments. One unauthorized document does not prove the rest are invalid, but it gives a reason to reauthenticate every instrument in that person's custody. The cluster is defined by shared control, not by suspicion toward unrelated voters. It can be expanded if repeated signatories, document templates, notaries, account origins, contact details, or submission routes connect further instruments.
The third path is a validation-method defect. Staff may have accepted the wrong type of evidence, omitted direct confirmation, misunderstood the distinction between proxy and representative, or applied different standards at different desks. If the defect is procedural and common, every instrument processed under that method becomes reviewable. Even then, reviewable does not mean invalid. It means the institution must establish authorization through an alternative reliable source.
The fourth path is a channel defect. If paper ballot entitlements were issued without a unique check against electronic voting, or if the association between authorization and anonymous ballot token was not preserved, it may be impossible to isolate invalid votes after the fact. This creates a stronger case for rerunning the affected channel or contests. The relevant evidence would be architecture, issuance logs, duplicate checks, ballot custody, count reconciliation, and independent testing. A general statement that confidence was lost is not a substitute for those facts.
The fifth path is an electorate or system defect. Compromised member records, unauthorized changes to designated voters, common credential abuse, failure to freeze the register, or widespread inability of legitimate members to vote can call the whole process into question. At that level, candidate margins may not capture the harm because the defect affects who could participate at all. Whole-process relief can become proportionate, but only after the systemic mechanism is identified and supported.
These paths show why the dispute cannot be resolved by counting allegations. Ten unrelated complaints may each be containable. One proven compromise of the entitlement-issuance system may not be. Scope follows common cause, propagation, and reparability. It does not follow the emotional size of the controversy.
Every ballot may contain several contests, but that still is not the whole election
AFRINIC was attempting to fill all eight elected board seats. The Bylaws provide six regional seats and two non-regional seats. A member's paper or electronic ballot could therefore affect several separate candidate contests. If one unauthorized ballot expressed a preference in each contest, its numerical reach could be one vote per seat. That is broader than one candidate race but narrower than every valid ballot.
The correct result analysis is seat-specific. For each seat, an investigator would identify the apparent leading candidate, runner-up, margin, number of challenged ballot tokens that included that contest, and number of eligible members whose votes were wrongly excluded. If the maximum plausible correction is smaller than the margin and the process was otherwise reliable, the result-risk argument for rerunning that seat is weak. If the challenged population equals or exceeds the margin, the outcome cannot be safely certified without resolving those votes.
If there was no announced count, the same calculation should still be possible from preserved election records under independent supervision.
Numbers are not the only consideration. A defect can be qualitatively fundamental even when it cannot be shown to reverse a margin. Systematic exclusion of a class of members, secret administrative addition of voters, or loss of ballot integrity may make the declared numbers untrustworthy. But that is a different proposition from an individual unauthorized instrument. It requires evidence about the rule, the affected population, and the failure's reach.
The public record reviewed for this article does not contain the candidate-by-candidate count, the margins, a reconciliation of electronic and paper ballots, the number of powers of attorney presented, the number challenged, the number verified after complaint, or the number of members prevented from voting. It therefore does not permit an external conclusion that one ballot could or could not have changed a seat. The absence of those figures is not evidence that all seats were contaminated. It is evidence that members could not evaluate proportionality from the published explanation.
Suspension is a protective measure; annulment is a final allocation of loss
An election administrator does not need final proof before stopping a process that may be actively compromised. If a member arrives and credibly says that another person is voting under an authority it never granted, the administrator should prevent further irreversible acts, secure documents, preserve recordings and logs, identify the disputed entitlement, and notify the relevant decision-makers. A short suspension can be proportionate to risk because it is reversible and evidence-preserving.
Annulment allocates the cost differently. It extinguishes the effect of every valid vote already cast, ends candidate reliance on the announced process, requires members to repeat authorization and participation, and extends temporary governance. For AFRINIC, delay also prolonged the period in which a receiver rather than an elected board controlled the route back to ordinary corporate authority. The measure may still be justified, but its consequence demands a fuller explanation than the emergency stop.
This difference is central to due process. A protective hold asks whether credible risk makes continued action unsafe. Final invalidation asks what the evidence establishes, which rights have been affected, and whether a narrower remedy can repair the harm. Treating the two stages as identical allows an emergency threshold to become a permanent merits decision. It also creates a perverse incentive: the less an institution knows about its own records, the easier it becomes to say that nothing can safely be preserved.
A disciplined response would therefore state two decisions. The suspension decision would identify the immediate trigger, records preserved, access frozen, responsible investigator, and review deadline. The remedial decision would identify proved findings, unresolved but material risks, affected ballot population, result implications, alternatives tested, and authority for the chosen relief. Public reporting can protect names, signatures, identification and ballot secrecy while still giving members that structure.
Mauritius company law points toward repair before indiscriminate invalidation
AFRINIC is incorporated in Mauritius, and the domestic statutory framework is more specific than general appeals to electoral legitimacy. Section 351 of the Mauritius Companies Act 2001 addresses irregularities in company proceedings. It says a proceeding is not invalidated by a defect, irregularity, or deficiency of notice or time unless the Court considers that substantial injustice has been or may be caused and cannot be remedied by an order.
The same section gives the Court a range of responses. Where an omission, defect, error, or irregularity has affected company administration or proceedings connected with a company meeting, the Court may rectify, nullify, modify, or validate the legal consequences. Before making an order, it must satisfy itself that the order would not do injustice to the company or a member or creditor. It may also give ancillary directions and deal with time limits.
Those provisions should not be presented as a judicial decision on the June election. The public material examined here does not show a reported judgment applying section 351 to the disputed powers of attorney or holding that the receiver's annulment was lawful or unlawful under that section. Nor does the statute answer every question about the receiver's powers under the separate court orders. It supplies a relevant legislative principle: company irregularities invite a remedial inquiry, and invalidation is not the automatic consequence of defect alone.
That principle is especially important where a remedy burdens members who complied with the rules. “Substantial injustice” cannot be assessed only from the perspective of the complainant or administrator. An unauthorized vote can injure the member whose authority was taken, candidates affected by the vote, and the institution's legitimacy. Annulment can injure all members whose valid votes are discarded, candidates who relied on the process, and the company whose return to ordinary governance is delayed.
Proportionality means comparing both sides and asking whether an order can remove the first injury without creating an unnecessary second one.
The pre-election court episode reinforces the need for targeted reasoning. AFRINIC's 19 June communique reproducing the court proceeding reported that the court did not consider an erroneous company-register classification, once corrected and explained, a sufficient reason to hold back the election and restart the whole process. That event concerned a different alleged irregularity and does not decide the later authorization dispute. Its relevance is methodological: correction, explanation, continuity, and the particular effect of a defect were considered before restart was ordered.
Comparative election cases offer tests, not governing law
Public-election decisions from other jurisdictions cannot be transplanted into AFRINIC's company election as if they were binding Mauritian authority. Their value is analytical. They expose recurring questions that any institution should answer before valid votes are discarded.
In Opitz v Wrzesnewskyj, the Supreme Court of Canada considered statutory irregularities in a federal election. The majority emphasized both enfranchisement and integrity, required the applicant to prove irregularities that affected the result, and warned against setting elections aside lightly. Its familiar quantitative approach compared invalid votes with the winning margin. The court also recognized that rerunning an election imposes its own democratic costs and may involve a different electorate acting on different information.
That approach illuminates an AFRINIC seat where challenged ballot tokens can be counted and compared with a margin. It does not answer a case in which the entitlement system itself cannot be audited. It also rests on Canadian statute and constitutional voting rights, not AFRINIC's constitution or Mauritius law. The useful lesson is narrower: technical noncompliance should not defeat valid voter intent unless the governing rule and evidence make the defect consequential.
In Kham v Electoral Commission, South Africa's Constitutional Court held that defects affecting voter registration and the fairness of particular municipal by-elections could justify setting aside those outcomes even without proof that the numerical result would have changed. The remedy was still tied to the affected wards and required fresh by-elections there. Process integrity mattered independently, but remedial geography followed the demonstrated breach.
Kenya's Supreme Court in the full reasons for the 2017 presidential election judgment distinguished quantitative outcome effects from substantial qualitative violations of constitutional election principles. It did not say that every breach invalidates an election; it required a substantial failure. Again, the constitutional context is far removed from a private company limited by guarantee. The transferable insight is that system-level opacity or unverifiability can matter even when a precise vote subtraction is impossible, but trivial or isolated error does not become systemic merely by being described as an integrity concern.
Taken together, these cases reject two absolutes. An election is not valid simply because the administrator cannot prove a changed winner. Nor is every serious-sounding defect a licence to erase the entire electorate. A decision-maker must classify the wrong: isolated invalid participation, affected result, substantial process failure, or unverifiable system. The remedy should follow that classification.
The burden cannot be shifted to every valid voter
When an unauthorized document appears, the institution holds much of the decisive evidence. It designed the channels, received the instruments, checked identities, issued ballot entitlements, operated or contracted the voting systems, and retained the reconciliation logs. Members possess evidence of their own authority, but they cannot reconstruct the whole election. The administrator should therefore carry the burden of mapping scope once it relies on a defect to discard valid votes.
The first burden is production. The receiver or election authority should identify how many instruments were submitted under each category, how many people carried more than one, how many were verified in advance, how many were accepted on the day, how many were challenged, and how many were linked to cast ballots. It should explain whether direct confirmation was attempted and whether any member records had been changed shortly before the election.
The second burden is causal. Which defect permitted the unauthorized act? Was the signature false, the signatory unauthorized, the bearer misidentified, the document outside its scope, the proxy cap avoided through classification, or the duplicate-vote control ineffective? Without a causal finding, a rerun may reproduce the same problem under a new date.
The third burden is remedial. Why could the specific ballot not be excluded? Why could the bearer cluster not be reauthenticated? Why could a recount not protect unaffected ballots? Why could one seat not be rerun if only its margin was uncertain? Why could the paper channel not be rerun while preserving independently verified electronic votes? Each answer might reveal a legitimate technical or legal obstacle. The point is to record it.
The fourth burden is distributive. How many valid members lose their votes under each option? How many candidates lose a completed contest? How much delay does the company bear? What new strategic opportunity does a rerun create for candidates, organized voting groups, or litigants who have already seen the first contest unfold? A remedy is not neutral merely because everyone is asked to vote again.
Valid voters should not have to prove that the entire election was clean. That would make each member responsible for systems it did not control. Nor should the complaining member have to prove the full hidden scope before a protective suspension. The institution must investigate the bridge between those positions.
Ballot secrecy should not make authorization unauditable
One practical argument for broad annulment is that secret ballots cannot be extracted after casting. If the administrator knows that an unauthorized person received a ballot but cannot identify which anonymous ballot entered the count, it may be unable to subtract the invalid vote. That is a real design problem. It does not justify linking identity to candidate choice, but it does show why privacy and auditability have to be engineered together.
A robust system separates authorization records from vote contents while preserving controlled revocation. The eligibility service can issue a unique anonymous credential after verifying the member. The ballot system can record that the credential was used without revealing the member's selections to the eligibility service. If authority is later disproved before certification, an independent trustee can invalidate the corresponding encrypted or sealed ballot token under a documented process, without disclosing how it voted.
Threshold cryptography, sealed token maps, or physical serial controls can serve this purpose depending on scale and budget.
For paper voting, a pollbook can record the member entitlement and a non-semantic ballot serial. The count should not expose a link to choices in ordinary operation. A protected mapping can permit an independent scrutineer, under tightly defined challenge conditions, to quarantine a ballot without publishing voter preference. If the paper ballots were entirely untraceable once mixed, the institution should say so and explain why that design was chosen for a contested, receiver-run election.
Secrecy also cannot conceal aggregate reconciliation. Members should know the eligible denominator, electronic credentials issued, electronic ballots cast, paper entitlements issued, paper ballots cast, duplicates blocked, challenged instruments, quarantined ballots, spoiled ballots, and final valid total for each contest. None of those figures identifies a voter's choice. Their absence makes a localized defect appear unknowable because the system has hidden its own control totals.
A remedial ladder for a disputed authorization
The first available remedy is correction before casting. If a member reports an unauthorized designation while voting remains open, revoke the unused entitlement, restore the member's ability to appoint a legitimate representative or vote directly, secure the disputed document, and record the incident. This protects both integrity and enfranchisement.
The second is ballot quarantine. If the disputed entitlement has been cast but certification has not occurred, isolate the corresponding ballot token. Verify the member's legal authority through an independent channel. If the authorization is confirmed, return the ballot to the count. If it is rejected, exclude it and allow the member a replacement vote if timing and secrecy controls permit. The decision should be reviewed by someone who did not accept the original instrument.
The third is cluster reauthentication. If one bearer carried authority for several members, contact each principal through a previously verified corporate channel, not contact details supplied only in the disputed papers. Confirm the signatory, scope, election, bearer, and absence of revocation. Treat each instrument separately while investigating common features. A false instrument raises the level of scrutiny; it does not erase genuine mandates by association.
The fourth is count correction. Where invalid ballots can be identified, remove them under independent supervision, reconcile every channel, and calculate each seat again. Publish the aggregate adjustment and margins without identifying member choices. If no outcome changes and no system-wide defect exists, certification may remain possible.
The fifth is a partial rerun. If one seat's margin is within the unresolved ballot population, rerun that seat. If only paper authorizations are unauditable, consider rerunning the paper component or the affected contests while preserving verified electronic ballots, provided the voting system and governing rules allow a fair combination. If a defined bearer cluster cannot be disentangled, a targeted re-vote for affected member entitlements may be possible.
The sixth is whole-process annulment. This is proportionate when evidence shows that the eligible electorate, authorization channel, ballot issuance, custody, secrecy, tally, or certification cannot be reconstructed across the process; when the number and distribution of unresolved ballots put all seat outcomes at risk; or when the rules were applied so inconsistently that valid and invalid participation cannot be separated. The explanation should identify which condition exists. “Confidence” describes the consequence of evidence, not a substitute for it.
The ladder is not rigid. Criminal investigation may require preservation that limits disclosure. A court order may constrain available action. A technical platform may make partial relief impossible. Time may matter where a company has lacked a functioning board for years. These factors can move the decision up the ladder, but each should be made visible.
The strongest argument for annulment is system failure, not scandal
There is a serious case for a complete rerun if the June design made authorization impossible to audit. The rules allowed multiple forms of representation, some registered before voting and others documented on election day. Electronic and paper channels overlapped. A bearer could reportedly present authority for many members under a category distinct from proxy. If the administrator lacked a single entitlement ledger, direct principal confirmation, immutable document history, and a way to isolate cast tokens, one unauthorized instrument might reveal a common control failure rather than an isolated forgery.
That is the strongest justification because it identifies propagation. The institution would not be annulling the election because one actor was accused or because the controversy was embarrassing. It would be annulling because the control that separated authorized from unauthorized ballots did not produce reliable evidence across a defined population. Under that finding, even genuine-looking instruments could not be certified without reauthentication, and secret ballot mixing might prevent repair.
The public explanation did not reach that level. The 26 June communique referred to potential voter-documentation irregularities. The 15 July notice said there were no final conclusions about extent. ICANN's 16 July letter called for release of a full investigation report and repeated concerns about the difference between the five-proxy limit and unlimited powers of attorney. These materials support investigation of a possible structural defect. They do not publish a finding that the entitlement ledger, count, or every authorization channel failed.
An incomplete public explanation can be understandable during a police inquiry. Names, signatures, investigative methods, and evidence of suspected offences may need protection. Yet confidentiality does not prevent publication of a control-level conclusion. The receiver could have said, for example, that ballot tokens could not be reliably associated with challenged authorizations; that duplicate checks could not reconcile the channels; that a defined number of instruments shared an unverifiable method; or that unresolved ballots exceeded every seat margin. Such statements would not accuse a person. They would explain the remedy.
The strongest argument against annulment is the value of valid votes
The counterweight is not procedural purity. It is the membership franchise. AFRINIC's constitution gives Resource Members and Registered Members powers in the company's governance, including election of directors. Members expended time to become eligible, designate representatives, examine candidates, authenticate, and vote. Candidates participated under published rules. Discarding those acts is a substantive governance decision.
A rerun is not a rewind. Entities know which candidates attracted support, which alliances mobilized, where verification was weak, and which legal interventions succeeded. Some voters will not return. Others will change choices because the controversy altered the campaign. New procedures can include or exclude a different population. Costs fall unevenly on smaller members, remote entities, and organizations whose internal authorizations take time. The temporary controller remains in office longer.
This is why valid votes cannot be treated as disposable in the name of protecting voting. The same integrity principle that condemns an unauthorized ballot protects an authorized one from unnecessary erasure. If the institution can identify and remove the first, it should preserve the second. If it cannot, it should explain why its own control design makes the broader loss unavoidable.
The receiver's continuity responsibility cuts in both directions. A quick annulment can protect the organization from certifying a disputed board. It can also defer the restoration of the board that the receivership was meant to facilitate. A proportionate decision must compare the danger of a tainted result with the danger of extending exceptional control and repeating the contest.
Trust cannot be ordered by demanding an unquestionable result
The annulment communique aimed to ensure “unquestionable legitimacy.” No election can meet that literal standard. Legitimate processes survive questions because they preserve evidence, answer challenges, correct errors, and give reasons. A standard of freedom from question creates a veto: any unresolved allegation can make a result unfit by definition.
The better threshold is justified confidence. Members should be able to verify that eligibility rules were announced, authority was authenticated consistently, each member received one entitlement, each entitlement was used at most once, ballots remained secret, counts reconciled, challenges were decided independently, and remedies matched proved defects. Some people may still disagree with the result. The institution can nevertheless demonstrate why it is reliable.
This distinction also protects investigators. A police inquiry asks whether an offence occurred and who may be responsible. An election administrator asks whether particular voting authority and ballots can be accepted. The standards, evidence, and timing differ. The election need not wait for criminal guilt if corporate authority can be disproved. Conversely, filing a complaint does not itself establish that every associated ballot is invalid. The receiver should not outsource the electoral scope decision to the mere existence of an investigation.
ICANN's 16 July letter was careful in one respect: it said its ideas for a fair election were not directives. It proposed a full review, member forum, clearer authority, and other measures based on its understanding. The same distinction should govern public debate. Institutional concern can justify scrutiny. It does not determine facts or remedy without the relevant decision-maker and record.
The replacement process should show what the first process lacked
A rerun is remedial only if it addresses the mechanism that defeated the first election. Changing the date, candidates, committee, or platform without identifying the authorization failure can create a new contest with the old vulnerability. The replacement should therefore publish a control map.
The member register should be frozen at a stated time, with every later correction recorded by reason and authority. Each eligible legal entity should receive a direct notice through independently maintained channels. A member should designate one voter through a defined route, with corporate authority verified before ballot credentials are issued. If proxy voting is retained, proxy and corporate-representative categories should be expressly distinguished, their numerical limits stated, and any route that permits one person to act for multiple members subjected to equivalent concentration and verification controls.
The election authority should confirm high-risk appointments directly with the principal. A reply to contact information supplied in the instrument is not independent verification. Confirmation should use existing member records, corporate registers where appropriate, and a second authorized officer for disputed or concentrated mandates. Any change of email, officer, voter, or representative close to the election should trigger enhanced review and notice to the previous contact.
Ballot issuance should draw from one entitlement service across electronic and in-person channels. The system should block duplicates in real time and produce a reconciliation signed by independent scrutineers. A challenge window should exist before certification, with urgent notice to the affected member, preservation of the disputed token, a written decision, and a review route. Candidates should receive aggregate assurance sufficient to challenge the count without obtaining member identities or choices.
The final report should publish denominators and exceptions: eligible members, designated voters, accepted proxies, accepted corporate representatives, credentials issued, ballots cast by channel, duplicates blocked, challenges opened, ballots quarantined, ballots rejected, spoiled ballots, and valid totals by seat. It should identify any deviations from the rules and their treatment. The report need not expose personal documents. It must show that each valid vote survived a controlled chain.
The unanswered questions are themselves bounded
Several important facts remain outside the public record reviewed here. The disputed powers of attorney are not available for independent examination. The identity and authority of signatories are not assessed. Police files and any confidential receiver report are not public. The complete voting-system logs, paper pollbook, ballot-token design, candidate tallies, margins, member complaints, staff decisions, and court submissions concerning annulment have not been reconstructed.
Accordingly, this analysis does not decide whether any named person committed fraud, whether a particular member authorized a representative, whether there was only one defective instrument, whether the receiver possessed additional confidential evidence, or whether the whole election was legally void. It also does not assume that every concern reported by ICANN was correct. Official statements establish what their authors said and did; they do not independently prove the underlying allegations.
The limits do not prevent governance analysis. The public minimum and the remedy are known. At least one unauthorized authorization was publicly reported; broader suspicions remained under investigation; the election was suspended and then annulled in full. The missing bridge is the measurable scope between those facts. That is exactly where proportionate-remedy discipline operates.
If confidential evidence showed systemic compromise, the institution could publish that control-level conclusion without exposing the evidence itself. If the evidence remained too incomplete to certify, it could state why preservation and targeted revalidation failed. If the receiver acted under a specific court direction, the operative terms and remedial reasoning could be released subject to lawful redaction. Members do not need a criminal case file to understand why their own votes were cancelled.
A doctrine for future registry elections
The doctrine of proportionate remedy can be reduced to seven questions. What exact rule or authority failed? Which member, instrument, bearer, credential, ballot, channel, or seat did the failure reach? What evidence establishes that perimeter? Could the affected act be corrected, quarantined, reauthenticated, or recounted? Could a partial rerun remove the remaining risk? What injustice would each option cause to the company and valid members? Who has lawful authority to choose and review the remedy?
The questions should be asked in that order. Starting with the desired institutional outcome encourages evidence to be assembled around it. Starting with the defect keeps the remedy connected to proof. It also allows the scope to expand when the facts warrant expansion. Proportionality is not leniency toward unauthorized voting. It is a method for making sure that the response is strong where the evidence is strong and no broader than necessary where the evidence ends.
For a regional registry, this discipline has value beyond elections. The institution controls records and services on which network operators rely. A compliance error, disputed authorization, compromised account, or false document can require urgent intervention. The same ladder applies: contain risk, preserve evidence, identify the affected entity, test propagation, use reversible measures first, protect unaffected rights, and reserve system-wide action for system-wide proof.
AFRINIC's June 2025 election is therefore not instructive because one disputed authorization was trivial. It was not. It is instructive because the event exposed how quickly a narrow proof problem can become an institution-wide remedy problem. The administrator had to protect the member whose authority may have been taken, the candidates whose contests may have been affected, the valid electorate whose votes had been cast, and the company waiting for a board.
The public case for suspension was direct: credible authorization concerns required investigation before certification. The public case for full annulment was less complete because the extent remained unresolved and the reasons did not identify why narrower repair was impossible. That gap should not be filled with an accusation against the receiver or a presumption in favor of the challenged vote. It should be filled with evidence architecture, reasoned decisions, and remedies that reveal their own perimeter.
One disputed proxy can be the first visible sign of a broken election. It can also be one containable wrong inside an otherwise recoverable vote. The difference lies in records, common cause, margins, and reparability. An accountable institution proves which condition exists before it asks every valid voter to bear the cost.