Summary

  • AFRINIC's published architecture scheduled electronic voting from 16 through 23 June 2025 and a separate in-person vote on 23 June. The Tanzanian Internet Service Providers Association (TISPA) applied for an injunction, and on 13 June, only three days before the remote window was due to open, the Supreme Court of Mauritius intervened in TISPA v AFRINIC & Anor, SC/COM/WRT/000435/2025.
  • Limb (i) of the interim order separately restrained the electronic voting scheduled for Monday 16 June 2025. A different operative limb addressed the physical election, a boundary fact that shows the court did not treat the two channels as one indivisible event.
  • The restraint was preservative, not a final judgment that electronic voting was invalid or insecure. The established fact is the legal restraint; the available record does not establish a cast vote, a tally, credential misuse, a platform failure or culpability by any actor.
  • A secret remote ballot presents its own preservation problem. Once credentials are exercised and choices are sealed, a later remedy can collide with voter equality, secrecy and reasonable reliance even when the underlying dispute has not yet been decided.
  • The durable governance response is a channel-specific ballot-launch receipt: a privacy-protecting record of authority, rules, court status, electorate freeze, credential lifecycle, opening and closing state, secrecy, duplicate controls, cross-channel reconciliation, incidents, challenges, suspension and terminal certification or cancellation.

Three days before a digital threshold

The calendar made limb (i) unusually revealing. AFRINIC's published election architecture placed electronic voting in a window running from 16 June through 23 June 2025. It also scheduled an in-person vote for 23 June. Then, on Friday 13 June, the Supreme Court of Mauritius issued an interim order in TISPA v AFRINIC & Anor, cause SC/COM/WRT/000435/2025. The applicant was the Tanzanian Internet Service Providers Association, or TISPA. The official case index describes an injunction application that sought, among other things, to restrain the Board-reconstitution election process and to direct compliance with an order dated 12 September 2023. The index records the order as granted and the matter as completed.

For this episode, the decisive feature is narrower than the whole case. Limb (i) separately restrained the electronic voting scheduled for Monday 16 June 2025. The physical election scheduled for 23 June appeared in a different operative limb. That second limb matters here only as a comparator: the wording confirms that the court separated the remote and physical channels. The legal effect or merits of the physical-vote restraint are not this article's subject.

Between the order and the planned electronic opening stood one weekend and three calendar days. That gap was short, but it sat on a genuine threshold. Before a remote ballot opens, its legal and operational state can still be preserved without confronting completed secret choices. After opening, authorised representatives may rely on credentials, voters may commit selections, and a system may begin generating records whose usefulness depends on confidentiality and controlled access. None of those events is proven to have happened here. They describe the general reason the opening event matters.

A court trying to preserve a meaningful remedy need not wait until an irreversible consequence has fully matured.

That is why the restraint should not be reduced to the casual idea that an online convenience was switched off. An electronic ballot is not merely a distant doorway into a physical room. It has a launch moment, a defined electorate, a credential path, authentication rules, secrecy protections, duplicate controls, incident procedures and a closing state. Those elements form a distinct mechanism. When limb (i) named the scheduled electronic voting on its own, it made that mechanism separately legible in law.

Legibility is not condemnation. The order does not establish that the remote platform was defective, that credentials were mishandled, that a participant acted improperly or that electronic voting was generally unsuitable. It does not establish that the ballot opened, remained closed for technical reasons, accepted a vote, produced a tally or was incapable of proceeding. Nor does an interim restraint settle the underlying merits. Its immediate force was to hold a scheduled channel at a legal boundary while a dispute existed around the election process.

The distinction is easy to lose because people often describe a hybrid election as one event. In ordinary speech, that is understandable: there is one Board contest, one corporate electorate and one eventual institutional consequence. Operationally, however, each voting channel can pass through different states at different times. Legally, the order's separate limbs recognised that difference. A remote window beginning on 16 June had an earlier threshold than a physical poll scheduled for 23 June. Restraining the first required language directed to the first.

What an interim restraint actually preserves

The strongest benign account of the court's intervention begins with remedy rather than suspicion. Three days before a secret electronic ballot was scheduled to open, a dispute concerning a Board-election process was before a court with jurisdiction over the Mauritian company. If the channel opened and choices were committed, later relief might have to answer difficult questions. Could the process be unwound without exposing how individuals voted? Would some participants have relied on the official opening while others held back? Could credentials already exercised be restored to an equivalent state?

Would a new process reproduce the same electorate and information conditions?

Those are preservation questions, not allegations about this particular platform. Their force comes from the character of secret voting. A remedy that simply deletes a visible transaction may be technically imaginable, yet still fail to restore the conditions that existed before the transaction. A voter may have revealed participation even if not a choice. Campaign knowledge can change over time. Representatives can change. Eligibility can change. Confidence in secrecy can change. Once a legitimate-looking launch invites action, participants can form reliance on the process even before any final result.

A pre-launch restraint offers a cleaner preservation point. It can keep the channel from acquiring new reliance and evidentiary complications while leaving the court free to consider the dispute. That does not mean restraint is costless. Members expecting to participate face uncertainty; administrators must hold their preparations; institutional continuity remains unsettled. But interim relief often exists because the court must choose which state is least damaging to the possibility of effective later adjudication. Here, the remote channel's scheduled launch created a visible point at which holding the status quo could be meaningful.

The order should therefore be read with two forms of discipline. The first is temporal. On 13 June, the court addressed a vote scheduled to begin on 16 June. It did not write from the vantage point of a completed remote count established by the closed evidence. The second is doctrinal. An interim order is not a final merits judgment. It can constrain action without resolving every factual or legal controversy that led to the application.

That discipline protects every party from overstatement. It avoids turning TISPA's application into a set of pleadings not found in the available record. It avoids attributing technical failure or improper purpose to AFRINIC, its staff, a vendor or any election participant. It also avoids treating the lack of a final merits finding as though the restraint had no significance. The restraint was real and executable. Its significance lies in the state it preserved and the governance mechanism it isolated, not in conclusions the evidence does not support.

The official case index provides a bounded description of the application: restraint of the election process and compliance with the 12 September 2023 order were among the things sought. It does not supply TISPA's affidavit, a detailed theory of breach, a defined membership class or a full account of final relief. The signed order establishes the operative restraint. Responsible analysis stops where those instruments stop, then explains the institutional implications as analysis rather than invented fact.

One implication is particularly durable. If a remote poll can be separately restrained before launch, then governance arrangements should be able to identify its pre-launch legal state with equal precision. A date on a public timetable is not enough. Participants need to know what authoritative act converts preparation into an open ballot, what legal checks precede that act, and what record proves that the authorised threshold was crossed—or deliberately not crossed.

The channel is more than its interface

Public discussion of electronic voting often gravitates toward software: screens, login pages, encryption, hosting and the possibility of intrusion. Those matters can be important, but limb (i)'s lesson begins one level earlier. The court did not need to find a software defect to treat the electronic channel as a distinct object. What made the channel distinct was the bundle of legal and operational states through which corporate suffrage would be exercised remotely.

Start with authority. Someone or some defined body must have lawful power under the governing corporate instruments and applicable law to initiate the channel. The relevant election rules must have a particular version. Any prerequisite must be satisfied. A launch actor must know whether an operative court order changes what may occur. Without those facts, a technically functional system can still be in the wrong legal state.

Then comes the electorate. A remote ballot cannot authenticate an abstraction called “the membership.” It needs a denominator frozen at a defined time, a method for designating the human representative authorised to exercise each eligible corporate vote, and rules for changes, revocations and replacements. The evidence here does not disclose the denominator or any credential totals. That absence is not evidence of failure. It identifies the kind of fact that a well-designed launch record should make available in aggregate.

Credentials create their own lifecycle. They may be issued, replaced, revoked, left unused or exercised. Each transition has to be controlled without converting a secret ballot into a public register of personal behaviour. The governance question is not whether every sensitive detail should be exposed. It is whether an authorised reviewer can establish that credentials followed defined rules and whether the public can see non-sensitive totals sufficient to understand the channel's state.

Opening and closing are events, not moods. A ballot should not be considered open merely because a web page exists, nor closed merely because a deadline has passed on a poster. An authorised opening event should be recorded against the governing rule, legal status, time standard and system state. The same is true at closing. If a restraint arrives before opening, the record should distinguish a lawful non-launch or suspension from a technical outage. In this case, the proven proposition is the court's restraint; no claim about the platform's actual operational state follows from that fact alone.

Secrecy and authentication pull in different directions. The system must establish that a person is entitled to vote and prevent duplicate exercise, while protecting the connection between identity and choice. A credible process describes how those goals are separated institutionally and technically without disclosing security-sensitive details. It also defines what information can be retained for a challenge without reconstructing individual choices. These are control surfaces of the remote channel even when nothing goes wrong.

A hybrid architecture adds cross-channel risk. An eligible representative must not obtain an unintended second opportunity simply because there are two mechanisms. Equally, a control designed to prevent duplication must not expose a remote voter's choice or create an unexplained denial at another channel. The separate 23 June physical vote is relevant here only to establish that a second channel was planned and separately treated in the order. The internal design or later history of that physical channel remains outside this inquiry.

Finally, the remote mechanism needs routes for observation, incidents, suspension, challenge and terminal disposition. Who can report a problem? Who decides whether it meets a suspension threshold? What happens to unused or partly exercised credentials? Which body can certify, cancel or lawfully vary the channel? A system lacking a clear answer can produce confusion even if its code performs exactly as designed. Conversely, a system with careful answers can still be restrained by a court if the surrounding legal dispute requires preservation. Technical competence and legal permission are different questions.

This fuller account explains why “online voting” is too thin a label. The interface is the visible edge of a state machine governed by corporate rules and law. Limb (i) reached the mechanism at its planned opening threshold. By doing so, it provided a concrete reason to describe remote voting in terms that courts, members, administrators and operators can all understand without pretending they occupy the same role.