The Ballot That Left the Room

Summary

• The public material establishes concerns about voter documentation in AFRINIC’s June 2025 election, subsequent annulment and later attention to powers of attorney. It does not establish, on its face, that marked ballots were removed, altered or returned by an unauthorised person.
• A ballot artefact has a life history: production, inventory, issue, marking, deposit, sealing, movement, opening, reconciliation, counting, preservation and eventual disposition. Trust depends on records connecting those states, not on the room’s walls alone.
• An unexplained transfer is a procedural breach and may weaken confidence. It does not independently prove substitution, identify a beneficiary or establish that an outcome changed. Those conclusions require additional evidence.
• Copies, photographs, witness attestations, access records and video can corroborate a custody ledger, but none is a universal substitute for contemporaneous dual-control handoffs and arithmetic reconciliation.
• Once a link breaks, the institution must preserve the artefact, identify the interval of uncertainty, test who had access, reconcile quantities, hear affected parties and select a remedy proportionate to the contests that could have been affected.
• Transparency matters only when disclosure can lead to correction, exclusion, recount, a limited rerun, annulment or independent review. Publishing an account without enforceable consequence leaves control with the original custodian.

Before the paper existed: authority creates the artefact

The ballot’s biography starts before ink reaches paper. A physical sheet becomes an election artefact only because an authorised process defines its form, quantity and permissible use. Without an approved design, controlled production and an inventory, a paper resembles a ballot but carries no reliable entitlement. This starting point matters because later custody can preserve only what was correctly constituted at the beginning.

AFRINIC’s June 2025 process sat within an exceptional institutional setting. A receiver was organising a board election while the organisation lacked ordinary elected leadership. The April communiqué on the board election described a court-linked mandate and referred to the statutory and constitutional basis of the receiver’s role. That material helps identify the administrative source of the event. It does not provide a public forensic inventory of every physical paper used in June.

A trustworthy production record would connect the approved template to a numbered print run, record spoiled sheets from printing and place unused stock under paired custody. The numbering need not reveal voter choice. It may identify batches, detachable stubs or containers instead. The aim is to make additions and losses detectable while preserving secrecy. Spare papers should be treated as controlled objects, not stationery available to anyone working in the venue.

Authority also governs who may release stock. The person ordering production should not be the only person confirming receipt. The custodian should acknowledge a precise quantity and seal condition. Observers may attest to the reconciliation without handling ballots. If papers are later moved into the election room, the transfer should show origin, destination, time, purpose, batch and the two people accepting responsibility.

Publicly available evidence does not include such an inventory, so none should be assumed. The absence of a published production ledger does not prove that no ledger existed. It limits what readers can verify. This distinction recurs throughout the ballot’s life: missing public evidence is a transparency problem, while missing underlying evidence would be a custody problem. Only inspection can determine which condition applies.

Authority at the point of creation is not a ceremonial concern. A paper becomes capable of carrying institutional power because a prior decision has defined what counts as an official instrument and who may put it into circulation. If that decision is vague, later custody records can prove only that a controlled object was moved; they cannot prove that the object was validly born. The beginning of the chain therefore has to answer a modest but essential question: what exactly entered custody?

This is also where participation and custody first diverge. Members may have a right to vote, but they do not personally manufacture the instrument that records the vote. Officials may handle stock, but handling is not the same as deciding entitlement. Observers may confirm quantities, but they do not become custodians. A mature design keeps these roles separate from the start, because later disputes often arise when one role is used to imply another. The more precisely the first state is defined, the less the institution must rely on trust after controversy appears.

Arrival: the room receives a quantity, not a presumption

When controlled papers enter the voting room, the receiving act should create a new state. The room does not magically confer integrity. Two custodians should inspect the container, compare seal identifiers, record the quantity and sign acceptance. If observers are present, their role should be documented. A camera may corroborate the transfer, provided it cannot capture voter choices or sensitive identification.

Time is part of the evidence. A ledger entry made immediately can be compared with venue access logs, witness notes and recorded images. An account reconstructed weeks later may still be useful, but it carries more uncertainty. Human memory tends to compress routine movements and absorb later controversy. The institution therefore needs a record created before anyone knows which transfer will become disputed.

Access should be purposeful. A room may contain officials, candidates, members, observers, venue staff and security personnel, yet their presence does not confer equal authority over the ballot stock. The access record should distinguish admission to the room from permission to handle a sealed container, issue a paper or approach the box. Participation and custody are different powers.

If materials cross an internal boundary, the description must be precise. Movement from a secure table to a nearby counting area is not equivalent to disappearance into an uncontrolled location. A sealed box carried through a corridor by two authorised people differs from an open packet taken by one person without a log. Saying only that a ballot left the room erases the facts needed to evaluate risk.

Publicly available official material does not establish that physical ballots travelled off site or were changed. It identifies concerns regarding voter documentation and later powers of attorney. The title therefore frames an analytical test, not a finding about a proven journey. Any claim about actual movement must be tied to evidence naming the object, interval, custodians and destination.

Receipt should be understood as a measurement exercise, not a ritual. The room receives a defined set of controlled objects under defined conditions. That status can be strengthened, weakened or lost depending on how the next handoff is recorded. A sealed container placed in a visible area is not automatically secure if too many people can approach it without purpose. Conversely, a container outside immediate public view is not automatically compromised if access, sealing and paired responsibility are documented. The institutional question is always what later reviewers can reconstruct.

The access boundary should therefore be intelligible. Some people are present to participate, some to observe, some to administer and some to secure the setting. Those categories should not blur into a general permission to touch evidence. When a dispute arises, the relevant fact may be less dramatic than removal from a room: it may be an unrecorded approach, an unclear instruction or a moment when responsibility shifted without acknowledgement. Calm scrutiny depends on describing the movement, not loading it with conclusions before the records are examined.

Issue: a credential becomes an entitlement

The most consequential transfer may occur without the ballot leaving anyone’s sight. At the issue desk, an authority document is converted into a voting entitlement. Publicly available evidence supports only a suitably cautious conclusion about credential controls: the directly linked 2026 guidelines make powers of attorney a visible issue. The question is not merely whether a document appeared regular. It is whether the accepted authority linked to a legitimate member and to exactly the ballots the bearer was allowed to receive.

A sound issue ledger records the member account, the class of authority, the verification decision, the issuing official and the ballot entitlement released. It should prevent repeat issue while avoiding any link between a voter’s identity and marked choices. Unique credential references can support this separation: one record proves that an entitlement was consumed, while another anonymous control shows that a valid paper entered the box.

The process must distinguish document categories. An ordinary proxy form may be subject to requirements different from a broader authority instrument or an in-person corporate representation. Applying one cap or validation route to every document without a legal basis would create unequal participation. Conversely, allowing one route to escape equivalent controls could concentrate voting access. The relevant question is not whether the documents share a convenient label but whether the announced rules assigned comparable checks.

When an objection arises, the entitlement should be frozen before the allegation becomes a conclusion. The original document, any copy, verification communication, issue entry and unused ballot should be placed in a numbered incident record. If a ballot has already been cast, secrecy may prevent removal. Officials then need to calculate the maximum contests it could affect rather than pretending that the marked choice is knowable.

The cited public record did not disclose a complete comparison of accepted credentials, papers issued and votes counted. That limits measurement of representation. Useful figures would include eligible member organisations, authorised representatives, ordinary proxy appointments, other authority instruments, rejected submissions, ballots released, spoiled papers and final counted ballots. Without those numbers, scale and materiality remain uncertain.

Marking and deposit: secrecy deliberately breaks one link

A secret ballot contains a designed discontinuity. The system must prove that an eligible entitlement produced one vote without retaining a path from the voter to the selection. This is not a custody failure. It is a rights protection. The difficulty arises when a credential is challenged after deposit, because the institution may know that a questionable entitlement was used while being unable to identify which candidate received it.

The design should anticipate that tension. A ballot can carry an anonymous contest or batch marker sufficient to identify the relevant election without revealing the voter. The issued-entitlement ledger can show whether a credential was consumed. The box can contain only papers valid for the designated contest. These controls allow officials to bound the possible effect of a disputed entitlement while keeping choices secret.

Observers should verify procedure rather than voter behaviour. They may watch that one paper is released for each approved entitlement, that the box remains controlled and that spoiled papers are cancelled. They should not see how a member votes. An observer’s attestation is strongest when it addresses a precise step: seal intact at opening, issue totals matched or no unrecorded access observed during a defined interval.

A paper may be spoiled, abandoned or quarantined before deposit. Each state needs a record because arithmetic later depends on it. The opening stock should equal unused stock, issued ballots and authorised losses such as demonstrably spoiled print items. Issued papers should reconcile with cast, spoiled and formally cancelled papers. These equations do not prove every credential was legally valid, but they can detect unexplained physical differences.

If a ballot leaves the voter’s hand and enters the box under observation, custody changes from individual control to institutional control. From that point, the institution bears responsibility for showing continuity. A member cannot inspect the marked paper without sacrificing secrecy. That dependence gives the custodian public-like power even though AFRINIC remains a private, member-based body rather than a government.

The issue desk is where representation is converted into physical capacity to affect the count. That conversion should be neither hostile nor credulous. A system that rejects doubtful documents without a chance to answer risks disenfranchising lawful representation. A system that accepts every plausible document because the queue must move risks allowing effective participation to outrun the rules. The proper middle course is a record that can distinguish approval, rejection, cure, quarantine and later review.

The evidential threshold should rise with consequence. A visible inconsistency may justify holding a document aside. It should not automatically justify treating the member as culpable or assuming that every ballot linked to a class of documents is tainted. Where the ballot has not yet been issued, the remedy can remain narrow. Where the paper has already entered a secret process, the remedy must respect both the challenged entitlement and the secrecy of other choices. The hard work is to measure possible effect without pretending to know what the system deliberately conceals.

Suspension: freezing the artefact’s state

A live objection changes the ballot’s biography. The first goal is not to decide the accusation. It is to prevent the evidence from acquiring new ambiguity. Officials should record the time, halt only the affected operation where possible, inventory the current state and seal relevant materials. Digital access connected to accreditation may also need preservation, but it should not be altered in the name of securing it.

A suspension record should capture which papers were unused, issued, spoiled, deposited and quarantined at the freeze point. If several contests used separate papers, the inventories should remain separate. If the same credential enabled voting across multiple contests, that fact should be recorded because it affects the possible scope of remedy. The number of affected votes should not be assumed from the number of disputed documents.

Dual control is particularly important during interruption. Routine roles may become unclear, senior officials may issue hurried directions and normal observers may leave. Every new custodian should sign acceptance, and no one should handle evidence alone merely because the vote is no longer active. An emergency creates greater need for a ledger, not less.

Publicly available evidence does not establish the ultimate truth of any allegation. It instead supports caution under uncertainty, not a finding that disputed conduct occurred. A police inquiry may examine possible offences, whereas the election process must determine whether a tally remains reliable and what member rights are affected.

The suspension should also have a decision path. Who can authorise reopening? Who determines whether a disputed entitlement is accepted or rejected? When does a temporary seal become evidence for an independent reviewer? If those questions are unanswered, physical preservation may succeed while procedural custody fails. The artefact remains intact, but no legitimate process exists to decide its consequence.

The doorway: what an external movement could prove

Suppose a sealed container crossed the voting-room threshold. The movement itself proves only a change of location, and even that proposition requires observation or a record. Its significance depends on permission, destination, duration, seal condition, companion custody and access. A documented transfer to secure storage may strengthen preservation. An unexplained removal into a private space may create a serious interval of uncertainty.

The primary record should identify the container, departure time, origin, intended destination, reason, both custodians and witnesses. Receipt at the destination should confirm the same seal and record arrival time. Return should repeat the process. If the seal changed, both identifiers, the reason and the people authorising replacement should be preserved. Spare seals require their own inventory because a number has little value if replacements are uncontrolled.

Supporting evidence can test the ledger. Venue-access data may show who entered a storage area. Time-synchronised video may show a container moving. Photographs may record a seal’s apparent condition. Messages may explain why the transfer occurred. These sources can corroborate, contradict or narrow the primary account. None proves what happened inside an opaque container before sealing.

An unlogged journey shifts the practical burden. The institution chose the custody design and controlled the evidence, so it should explain an interval that its own rules required it to document. That burden does not reverse ordinary reasoning so completely that tampering must be presumed. It requires the custodian to produce reconciliation, access information and inspection results sufficient to restore confidence.

If no adequate explanation exists, the established finding may be limited: continuity cannot be demonstrated for a defined period. It would still be improper to state, without more, that papers were substituted, votes were changed or a named party benefited. A break enlarges the set of possible events. It does not select one possibility as fact.

Copies and attestations: secondary traces of the original

When custody is contested, institutions often reach for copies. A scan of an authority document can preserve appearance and content. A photograph can show a container and visible seal. A copy of a ledger can protect against later alteration. These are useful traces, but their evidential value depends on who made them, when, from which original and how the resulting file was stored.

A copy cannot repair every defect in the original. A scan may omit the reverse side, physical indentation or attached pages. A photograph may not show whether a seal was correctly applied. A spreadsheet export may not reveal later changes to the underlying system. The copy’s creator should therefore attest to the source and method, and a verifiable record should show subsequent access.

Witness statements have parallel limits. A contemporaneous note by a person who directly observed a handoff is stronger than a later account assembled from discussion. Two witnesses may provide independent corroboration, or they may repeat a common assumption. Their attestations should identify exactly what they saw: a sealed box departed, a named custodian accepted it, or a quantity was counted. Broad claims that the election was secure or compromised are conclusions, not observations.

Digital metadata can assist without becoming infallible. File creation times, access histories and cryptographic checks can help establish whether a stored copy changed after capture. They cannot prove that the photographed object was complete or that the first capture occurred before interference. Access logs also show recorded account activity, not necessarily the human behind every action.

The correct evidence model is cumulative. The custody ledger supplies the intended chain. Reconciliation tests quantities. Seals indicate whether a container appears to have remained closed between inspections. Access records identify opportunities. Copies preserve content. Witnesses describe observed conduct. Public verification exposes the logic to challenge. Confidence comes from convergence among imperfect sources, not from declaring one artefact conclusive.

Opening and count: reconciliation before interpretation

When the container is opened, the first task is inspection. Custodians should compare seal identifiers, document condition and record any anomaly before breaking the seal. Observers should be able to attest to that sequence. If the seal is inconsistent, officials should preserve it and invoke the incident process rather than debating intent beside the box.

The next task is arithmetic. Opening stock, issued stock, unused stock, spoiled stock, quarantined stock, deposited ballots and counted ballots should reconcile. Voter check-in records should correspond to entitlements consumed. Contest totals should be internally consistent. Reconciliation can establish whether the quantity of papers remained stable. It cannot determine the legal validity of every authority document.

Counting officials should work from accepted inputs defined by another authorised decision where eligibility is contested. Otherwise, counters become ad hoc judges. They can identify a duplicate paper, an unreadable mark or a mismatch in totals. They should not decide whether a corporate representative had legal capacity unless the rules explicitly assign that question and provide a fair process.

A recount is appropriate for uncertainty about tallying or paper classification. It is less useful when the dispute concerns who was entitled to receive a ballot. If questioned entitlements could have affected a contest and secrecy prevents identification of their choices, repeated counting will reproduce the same uncertainty. The remedy may then require exclusion before deposit, a bounded rerun or another authorised response.

Public verification should release totals and logic without exposing votes. Readers need to see how many papers existed in each state, which discrepancies were found and whether they could affect a seat. They do not need names or marked ballots. The old cited record did not publish a full ballot-level reconciliation for June, so the analysis cannot state whether the arithmetic balanced or failed.

Counting gives arithmetic a privileged role, but arithmetic is not the whole inquiry. A balanced tally can coexist with an entitlement error, and an unbalanced paper record can coexist with honest voting. The count should therefore be preceded by classification: what kind of uncertainty is being tested, and what evidence can answer it? If the uncertainty concerns marks, a recount may help. If it concerns access to unused stock, the issue records matter more. If it concerns the legal authority behind a credential, the answer lies outside the counting table.

This division protects counters from being turned into emergency judges. Their responsibility is to interpret accepted papers under the rules assigned to them, preserve anomalies and record totals. They should not be asked to resolve contested representation merely because the ballots are in front of them. Once a questioned entitlement has merged into a secret ballot, the institution must switch from identification to materiality. It can no longer ask which choice was made. It must ask whether the uncertain entitlement could have affected the contest and what remedy would be proportionate.

The broken link: consequence must follow materiality

A custody breach becomes legally significant through consequence, not metaphor. The decision-maker should first define the broken interval. Was the paper stock uncontrolled before issue, the ballot box unobserved after deposit, the seal undocumented during storage or the count record exposed after tallying? Each interval creates different risks and affects different remedies.

Next comes opportunity. Who could access the artefact during the interval, and what could that access accomplish? An open packet of unused ballots creates a risk of unauthorised additions if issue controls are weak. A sealed box with an unexplained journey creates a different risk. A copy of a tally sheet leaving the room may expose information without changing physical votes. The existence of access does not prove its abuse, but it helps bound the plausible harm.

Materiality then connects risk to contests. If an identified number of uncertain papers is smaller than every relevant margin and there is no systemic inequality, certification may remain possible with a recorded breach. If the uncertainty can alter one seat, a rerun of that contest may be sufficient. If papers and entitlements are so entangled that no reliable subset can be isolated, a broader remedy may be justified. The reasoning should be published in redacted form.

Procedural equality can matter even when arithmetic does not. If custody rules were applied differently to competing groups, the injury includes unequal opportunity. That conclusion still needs evidence and a scope analysis. A defect in one channel should not automatically destroy votes cast through another controlled channel. A defect connected to one contest should not automatically erase unrelated contests.

The burden of explaining indivisibility belongs to the actor seeking the broadest remedy. Whole-election annulment should not be the reward for poor institutional records. Otherwise, officials could obtain greater discretion by maintaining weaker chains. The incentive should run in the opposite direction: accurate records preserve valid votes and allow narrow corrections.

Rights, sanctions and review after custody failure

The first right after a breach is preservation. Affected candidates and members should be able to rely on the continued existence of original papers, authority documents, issue records, seals, video, access histories and count worksheets. A replacement election should not authorise destruction of the earlier evidence. Practical recovery and historical accountability can proceed together.

The second right is notice. A member whose credential may be rejected should learn the specific defect and receive a realistic chance to answer. A candidate whose contest may be rerun should be able to address materiality and propose a narrower remedy. Public summaries may protect private information, but the people losing rights require more detail through a secure process.

The third right is independent review. The same office should not control the ballot, investigate its own custody, select the consequence and decide the appeal. Review must be capable of changing the result: restoring an entitlement, ordering reconciliation, directing a recount, narrowing a rerun, confirming annulment or requiring publication of reasons. An observer report without remedial force supplies information, not accountability.

Sanctions should distinguish error, neglect and proven misconduct. A missing signature may call for corrected procedure. Failure to keep a required ledger may justify independent supervision and removal from later adjudication. Intentional interference, if established by competent authority under applicable law or rules, may warrant stronger consequences. The existence of a police referral does not establish that final category.

Transparency without consequence is particularly weak in Internet governance. AFRINIC is not a state, yet its internal governance affects stewardship of regionally important Internet-number resources. Members and users cannot simply treat the organisation’s electoral controls as a private inconvenience. At the same time, public importance does not transform every committee into a government agency. Accountability must be built through enforceable corporate rules, judicial supervision where applicable and review that can repair rights.

Annulment and the replacement ballot’s separate life

Annulment ends one legal trajectory and begins another. It does not physically erase the first artefacts, nor should it. The cancelled election’s papers and records remain evidence of whether the decision was justified. A new vote has its own inventory, voter register, rules, custody and certification. Mixing the histories prevents reviewers from determining which safeguard addressed which risk.

A replacement election may be necessary to restore a functioning board. Participation in it does not necessarily concede that the first cancellation was lawful. Members may vote again because abstention would surrender influence, because they value institutional continuity or because no other practical route exists. Their action should not be converted into waiver without a clear rule.

The 2026 guidelines provide a public point of comparison on proxy voting in virtual elections and powers-of-attorney concerns. A revised risk model can be constructive. It cannot retroactively prove the facts of June, and it should not permanently narrow representation without explaining proportionality, alternatives and review.

The new ballot’s biography should therefore begin with a change statement. Which earlier controls were retained? Which rights or channels were altered? Who authorised each difference? What evidence justified the measure? When will it be reconsidered? These questions make reform testable rather than symbolic.

Certification of the replacement result should also state that earlier records remain preserved and that any outstanding review retains its defined effect. A later successful election can reduce the practical value of reinstating an earlier result, but declaratory review still matters. It can clarify jurisdiction, protect future members and prevent emergency discretion from becoming ordinary precedent.

When a rerun or reconstruction becomes necessary because an institution failed to preserve a reliable record, the institution responsible for that failure should bear the resulting operational and financial cost. That allocation places the burden on the body best positioned to prevent the loss and avoids shifting it to members whose participation must be repeated. It is a remedial design choice, not evidence that any person acted intentionally or that misconduct occurred.

Separate from cost allocation, the institution should preserve an incident record that identifies the broken control, the reconstruction attempted, the corrective measure adopted and the office responsible for carrying it forward. That record should remain available over time to future decision-makers so the same weakness is not rediscovered only after another failure. Institutional memory can support training, supervision and better custody design without converting an administrative allocation of expense into a finding of fault or proof of misconduct.

Public verification without exposure of the vote

AFRINIC can make custody testable without publishing sensitive documents. A redacted movement register can show times, container identifiers, purposes and paired handoffs. An inventory can show quantities by state. An incident schedule can state the class of defect, the step affected and the disposition. A decision can explain materiality and authority without naming individuals under investigation.

Observers require meaningful access rather than ceremonial presence. They should see seals before opening, witness reconciliation, receive incident numbers and be allowed to record objections. Their reports should be published or summarised, subject to secrecy and privacy. They should not control the evidence or decide legal validity.

Affected members require a secure evidential channel. Public discussion is not a substitute for a hearing. The institution should disclose the precise reason an authority document was doubted, permit an answer and record the decision. Where local corporate authority is complex, appropriate expertise may be needed. The person at the issue desk should not be forced to make an irreversible legal judgment under pressure.

The public needs enough information to understand consequence. If papers moved, who authorised the class of movement? Did totals reconcile afterward? Was the seal unchanged? Could the interval affect one contest or several? Which remedy was selected, and who could review it? Refusing to answer these institutional questions because private information exists would use confidentiality as a shield broader than necessary.

Disclosure also needs timing. An immediate notice can state that an incident occurred and evidence was secured. A later preliminary account can describe verified categories. A final redacted decision should follow once the applicable process permits. Silence until a replacement election is completed allows institutional facts to be replaced by partisan narratives.

A concrete monitoring agenda for every handoff

Monitoring should begin with the production order. Observers should record the authorised design, batch quantity, receipt reconciliation and custody of unused stock. They should confirm that damaged print items and spare seals are separately inventoried. No names or ballot choices need enter the public account.

At accreditation, monitors should compare the announced documentary routes with actual issue practice. They should record aggregate acceptance and rejection totals by category, any cure opportunities and the number of entitlements released. If different forms of representation receive different treatment, the legal basis should be identified before voting proceeds.

During voting, attention should remain on access boundaries, one-entitlement controls, spoiled papers and box custody. Every interruption should produce a timestamped incident entry. Any movement should show origin, destination, purpose, paired custodians, witnesses, seal identifiers and receipt. Copies should carry an attestation connecting them to originals.

Before counting, monitors should witness seal inspection and inventory reconciliation. Count totals should be tested against issued entitlements and paper states. Discrepancies should be classified before results are interpreted. A recount should preserve the first worksheet and produce a comparison rather than overwriting the initial record.

After an incident, monitors should follow consequence as closely as custody. They should identify the investigator, remedial authority, evidential standard, affected rights, response opportunity, decision deadline and reviewer. If total annulment is proposed, the decision should show why no smaller remedy can protect reliable votes. If a replacement poll occurs, earlier evidence should remain sealed and reviewable.

Public disclosure can test custody without turning the vote itself into public information. The useful disclosure is about control of objects and responsibility for transitions, not about the content of any marked paper. It can describe categories of material, custody states, seal checks, timing bands, transfer purposes, and the offices or roles accountable for acceptance and release, while withholding names, document contents, and anything that would connect a person to a choice.

That account lets members ask whether the same object was tracked through each custody state, whether unexplained access was possible, whether physical totals still make sense, and whether the proposed consequence fits the uncertainty.

Enforceable consequence is separate. Where the record cannot support a material handoff, the institution should lose the benefit of treating the affected material as continuously controlled. It should isolate the affected contest or material class, disregard any certification premise that depends on the missing link, and submit the proposed remedy to a reviewer with power to change it. That consequence does not presume fraud or identify a winner. It enforces the duty to make later reconstruction possible.

The institutional implication of a travelling ballot

The ballot that left the room is a useful image because it concentrates a broad governance problem in one object. The paper is produced under authority, released through an eligibility decision, protected by secrecy, held by custodians, interpreted by counters and converted into institutional power through certification. Every handoff changes who can affect the outcome and what evidence others must trust.

A proved unauthorised journey would be serious. It would require the controlling institution to account for the interval and demonstrate why the artefact remained reliable. An alleged journey without supporting evidence must remain an allegation. Missing records justify criticism of provability, but they do not identify tampering, motive or beneficiary.

The appropriate response after a broken link is to keep evidence, adjudication and remedy institutionally distinct. Custody records should support factual reconstruction; affected parties should be heard on rights and materiality; and a decision-maker with corrective authority should determine consequence. That division prevents uncertainty in one function from becoming unchecked power in another.

That sequence also clarifies power. Voters participate, but they do not control custody. Custodians possess the object, but they do not acquire unlimited authority to judge their own breach. Investigators establish facts, but they do not automatically select the remedy. Reviewers require power to correct, not merely observe. Certification must identify the legal actor who converts a protected tally into governance.

AFRINIC’s private and member-based form does not make these disciplines optional. Its decisions have public-like regional consequences without turning it into a conventional government. The institutional lesson is therefore concrete: no ballot should depend on trust in a room, a seal or an office alone. Confidence comes from a life history that another person can reconstruct, challenge and, when a link fails, remedy.