Section 1: Application and Voting Platforms
This Article shall apply to elections, referendums, recalls, and other public votes held by ballot of registered electors under Totemian law, including national, subnational, and local contests. It shall govern preparation, registration, procurement, testing, voting, processing, counting, audit, certification, and preservation of records, including services supplied by external providers.
A dedicated digital voting platform developed by or specifically for the Government is a government-developed platform for this Article. An existing external service authorised by the National Electoral Administration is an external platform. The Administration may select a lawful voting arrangement according to its suitability and the requirements of this Article.
Section 2: Totemian Electoral Security and Verifiability Standard
The Administration shall prescribe and publish the Totemian Electoral Security and Verifiability Standard. It shall specify verifiable technical requirements, responsible functions, assessment procedures, and the dated editions applicable to each voting method and component. Its minimum requirements shall incorporate and require compliance with the following applicable standards:
(a) the Council of Europe Recommendation CM/Rec(2017)5 for electoral secrecy, equality, verification, observation, and independent examination;
(b) the applicable software-independence, auditability, integrity, access-control, and usability requirements of VVSG 2.0;
(c) NIST VTS 200-1 for election-infrastructure risk management, NIST SP 800-218 version 1.1 for secure development, and the applicable Level 3 requirements of OWASP ASVS version 5.0.0 for critical election web applications, subject to any statutory transition expressly applicable to client authenticator hardware;
(d) NIST SP 1500-20, SP 1500-101, SP 1500-103, and SP 1500-100 revision 2 for interoperable ballot definitions, event records, cast-vote records, and results;
(e) RFC 3339 for exchanged timestamps, NIST SP 800-53 revision 5 controls AU-8 and AU-9 for time records and their protection, and the time-assurance requirements in Section 13.
The Standard shall identify the scope and applicability of each adopted requirement and the evidence needed to demonstrate compliance. An equivalent measure or later edition shall require a published technical assessment and independent examination. A version fixed by law shall be changed only by the authority and procedure required under that law. Requirements governing a poll shall be settled before it opens; emergency corrections shall be recorded, independently reviewed, and applied consistently without retrospectively changing voter entitlements or the counting rule.
Section 3: Responsible Officers and Separation of Duties
The Chief Electoral Registrar shall designate the responsible Returning Officer, qualified independent reviewers, and record custodians. Their functions and material conflicts of interest shall be recorded. An independent reviewer shall not examine work for which that person was responsible or have a material candidate or campaign conflict. A qualified person outside the Administration may be appointed for that function.
Critical operations involving ballot definitions, election software, opening keys, primary evidence, or certification shall require recorded authorisation by at least 2 distinct persons. Custody and access shall be limited to the functions assigned. Reviewers shall submit their findings without alteration by the persons whose work is reviewed.
Section 4: Examination and Preparation
Before first use, after material changes, and before each poll, the system and its operation shall undergo examination appropriate to the change and risk. Examination shall cover approved software and dependencies, authentication, ballot presentation, all permitted preferences, accessibility, secrecy, administrator privileges, verification, counting, recovery, and protection against interference. Where Title 1, Chapter 7, Article 9 of the Civil Code is in force, every covered digital electoral system, including an external platform, shall comply with its WCAG 2.1 Level AA requirements. The Administration shall verify that compliance before authorizing use. This requirement applies to the complete electoral process presented through the system, including authentication, ballot instructions, access to the submitted text, selection, correction, review, submission, and confirmation, while preserving secrecy and independent choice.
The Returning Officer shall record the approved build and ballot configuration, verify the authoritative candidate and elector information, conduct tests with known results and defective or interrupted inputs, and confirm the opening, closing, and recovery arrangements. Material changes and their tests shall be identifiable in the election record.
Section 5: Ballot Evidence and Secret Choices
Electronic voting shall provide evidence permitting the lawful recording, inclusion, and counting of ballots to be verified independently of the recording and counting software. The method shall use voter-verifiable primary records or an independently examined end-to-end verification protocol appropriate to the contest.
The protocol shall separate identity and participation information from secret selections and prevent the recovery of identified choices through administrative access, account recovery, or custody of counting keys. Counting shall use anonymous ballot evidence or verified aggregate computation. Any anonymisation, mixing, or decryption necessary for counting shall be independently verifiable. Anonymisation shall remove recoverable identity correlations before individual selections are decrypted for counting or tally review.
Authenticated evidence sufficient for verification shall be preserved in separate custody outside the exclusive control of the operating host and its administrator. Custodians may use protected offline media or physical records. Where paper is primary evidence, the elector shall be able to inspect the human-readable choices before casting the record into secure custody.
Section 6: Processing, Reconciliation, and Exports
The Administration shall account for submissions received, accepted, rejected, superseded, anonymised, counted, or awaiting determination. Each material exclusion or correction shall have a recorded lawful basis and independently verifiable supporting evidence. Receipt, acceptance, effective-ballot status, and final inclusion shall be recorded as distinct events.
The record shall include approved configurations, examinations, ballot evidence, reconciliations, complete counting stages, custody and access records, incidents, corrections, audit findings, and certification. It shall support documented machine-readable exports and readable tables or spreadsheets. Identity records and secret preferences shall be separated in storage, exports, and access permissions. Public release and record interfaces shall comply with Sections 14 and 15.
Section 7: Verification Before Certification
Before administrative certification, an independent reviewer shall reconcile the preserved evidence and independently recompute the result for every seat, ticket, or question. Verification shall cover lawful replacements and exclusions, each material transfer, exhausted value, quota or majority calculation, precision rule, and tie decision. Reusing production totals alone shall not constitute independent recomputation.
A complete independent recount against the preserved primary evidence shall be the default. A sampling audit may be authorised only under a published method independently validated for the precise counting rule, capable of verifying every reported winner or outcome, with a stated risk limit and escalation to the necessary further examination or full recount. Material discrepancies shall be resolved before the affected result is certified. The method, findings, and resolution shall be published subject to ballot secrecy.
Eligibility, participation, and replacement checks shall use protected administrative records or privacy-preserving proofs. Tally verification shall use anonymised ballot evidence or verified aggregate computation. The verification method shall demonstrate the correspondence of eligible effective submissions and counted evidence without disclosing a link between an identified elector and unencrypted selections.
Audit identifiers shall be independent of National ID numbers, account identifiers, private receipt references, and publicly observable submission order. Identifying timestamps, network addresses, device data, and other correlating metadata shall be removed or protected before selection evidence is made available for tally review. Reviewers shall receive only the evidence necessary for their assigned functions. Review assignments and released datasets shall not combine identity-linking material with unencrypted choice evidence. Access to verification records shall not authorise reconstruction or disclosure of identified choices.
Before evidence or exports are released, the Administration shall independently assess whether individual records, distinctive rankings, small groups, or combinations of datasets would reveal choices. The public package shall use privacy-preserving proofs, safe aggregation, delayed release, or necessary redaction while preserving meaningful verification. An audit requiring protected ballot evidence shall use controlled access and publish its method, checks, findings, and nonidentifying verification evidence.
Section 8: Incidents and Judicial Directions
The Administration shall preserve incident evidence and assess the effect on eligibility, secrecy, availability, timing, and the result. Protective action shall be reasoned, recorded, proportionate to the affected process, and preserve unaffected votes so far as practicable.
Where a material incident prevents required verification within a statutory certification period, the Administration shall promptly apply to a court of competent jurisdiction for directions. The court may order protective measures and the shortest necessary extension, giving written reasons and providing expedited consideration. Recounting, restoration, suspension, or a replacement poll shall follow the applicable law and any lawful judicial direction.
Section 9: Preservation and Production
Before polling, the Administration shall publish a retention schedule covering the official evidence and protected personal records. Evidence necessary for verification shall be preserved through the applicable challenge periods and final resolution of pending recounts, investigations, or proceedings requiring it. Access, transfer, and lawful destruction shall be recorded. Published result summaries and audit reports shall be retained as permanent public records.
The Emperor and courts of competent jurisdiction may require production of lawful election records, subject to the constitutional secrecy of identified choices. Production shall use verification evidence that preserves that secrecy.
Section 10: Individual Participation Lookup
A government-developed platform shall provide an individual participation lookup during and after active voting, separate from secret ballot records. An authenticated registered elector may inspect their own status and may request the participation status of another elector for a specified ballot, contest, or question by supplying that person's complete National ID number, recorded first name, and designated surname. The service shall return only the single matching participation record. It shall provide no voter directory, name-only search, partial-number search, suggested identities, or bulk participation listing.
For this Section, the National ID number is the stable person identifier assigned by the Office of Civil Registration, distinct from a credential-issuance reference, seal reference, PIN, or account identifier. The name fields shall correspond to the authoritative registry meanings under the applicable National ID legislation. Renewal, replacement, or expiry of a credential shall not erase the person's earlier participation records or create another person record.
The requesting elector shall satisfy the authentication required for their own lawful access. The target number and matching particulars shall identify only the limited participation record; they shall confer no access to the person's credential record, private voting history, authenticators, or secret choices. The requester shall not be required to obtain or enter another person's PIN, passkey, or recovery material.
The response shall show only the ballot and contest or question, and whether a submission is recorded or awaits verification. A confirmed blank submission shall establish participation. It shall omit selections, rankings, blank or nonblank status, replacement counts, submission times, confidential identifiers, and links to secret ballot evidence. A failed or incomplete match shall not return suggested corrections or disclose the unmatched identity particulars.
Identifying participation detail shall be withheld to the extent necessary where its combination with released results or other records would identify choices. The owner shall retain private access to their own status. The service shall apply proportionate query limits and anti-enumeration controls, protect query particulars from public logs and shared caches, and record authorised use without linking the lookup to secret selections. Identifying lookup fields shall be transmitted in a protected request body and excluded from URLs, public telemetry, and publicly accessible request logs.
Section 11: Private Voting Records
A government-developed platform shall provide each elector with a private record of that elector's digital submissions. It shall show the ballot and question, submitted selections or rankings, receipt and acceptance information, replacement history, the effective submission, and the outcome of inclusion verification. A submission shall not be described as finally counted merely because it was received.
Selection history shall be encrypted under material controlled by the elector and accessible through authenticated voter-side processing. Administrators shall hold no key, recovery mechanism, or impersonation function enabling them to read that history. Counting keys and personal-history keys shall be separate. Account recovery may restore participation access and prospective voting without revealing earlier choices; recovery of encrypted choice history shall depend on material controlled by the elector.
The elector shall have private access while the records are retained and an opportunity to retain an encrypted personal copy before lawful deletion. Official receipts shall establish submission and processing status without certifying an identified elector's choices to third parties. Personal choice history shall remain a private reference record. Independent examination shall assess the verification protocol, software delivery, administrator compromise, recovery, and risks of coercion arising from continuing access.
Section 12: Replacement of Digital Votes
On a government-developed platform, an elector may submit replacements for an identified contest or question as often as desired before its replacement cutoff. The cutoff shall be 30 minutes before the published closing instant. No replacement first received at or after that cutoff shall be accepted. If the voting period is 30 minutes or less, replacement voting shall be unavailable. An initial submission shall remain permitted until closing.
A replacement shall require affirmative confirmation and operate only upon the identified contest or question. Other effective submissions shall be preserved. The platform shall display the replacement cutoff and closing time and prominently advise an elector making an initial submission during the final 30 minutes that further changes will be unavailable.
Only the latest accepted lawful submission received within its applicable deadline shall be effective for each elector and contest or question. The protected receipt sequence shall determine the order and whether a submission is initial or a replacement, regardless of the order in which processing finishes. Concurrent or pending requests shall not bypass the cutoff by being described as initial submissions.
A confirmed blank replacement shall supersede the earlier submission and be treated as blank under the applicable counting rule. A failed, rejected, or incomplete attempt shall leave the preceding accepted submission effective. Earlier submissions shall be excluded from the count but preserved to the extent necessary for reconciliation, verification, and the private record.
A valid initial submission received before closing, or a valid replacement received before the replacement cutoff, may complete validation and durable recording afterward. The system shall distinguish a receipt awaiting validation from confirmed acceptance. A late replacement shall not cancel the existing effective submission.
An external platform may offer replacement voting under these rules where authorised before voting opens. Where voting channels are combined, the Administration shall publish and test a lawful procedure for channel changes and priority that ensures only 1 effective ballot per elector and contest. Channel changes shall preserve secrecy and shall not permit an existing vote to be replaced during the final 30 minutes.
Section 13: Trusted Electoral Time
The Administration shall designate a UTC-traceable time reference and publish each poll's opening, replacement-cutoff, and closing instants in UTC and the official local time with its applicable offset. Exchanged time records shall conform to RFC 3339. The technical Standard shall prescribe timestamp resolution, the maximum permitted uncertainty, reference checks, drift monitoring, and bounded operation during loss of a reference.
Where network time is used, it shall use authenticated synchronisation through NTP with Network Time Security under RFC 8915 or an independently examined equivalent. A locally managed system may use a validated local time reference with documented calibration, drift bounds, and witnessed checks. The approved method shall demonstrate that its claimed accuracy is maintained throughout polling.
Each complete authenticated submission shall receive a protected receipt sequence and a timestamp at the designated intake. Receipt, acceptance, durable recording, and later evidence timestamping shall retain their actual distinct times. A monotonically increasing sequence shall determine the order of submissions, including those with equal displayed times. Sequence continuity shall be protected across restarts. An elector's device clock shall not determine timeliness or replacement order.
Clock corrections, source changes, loss of synchronisation, restarts, and their effects shall be recorded and independently examined. A correction shall preserve the original records and shall not retrospectively alter their sequence or the published deadline. Where uncertainty could affect whether a submission preceded the replacement cutoff or closing, the submission and timing evidence shall be preserved for expedited determination under rules published before polling, subject to judicial review. It shall remain provisional until resolved.
Where cryptographic timestamp tokens are used, they shall comply with RFC 3161 and the applicable policy and security requirements of ETSI EN 319 421 version 1.3.1, or an independently examined equivalent. The election record shall identify the issuer, source, accuracy, validation material, and limitations of the attestation. A later token shall attest the existence of the protected data at that later time and shall not replace the actual intake record or constitute proof that the submission was timely received.
Section 14: Ballot Records and Live Public Verification
A government-developed platform shall provide a public page designated a Ballot Record for each official ballot and an index designated Ballot Records. Each record shall have a stable public Ballot ID, shared by submissions made using that official ballot. Each contest or question within it shall have a stable identifier. A Ballot ID shall be distinct from an elector's identity, private receipt, or individual submission reference.
The page shall be accessible without authentication and available before voting opens, throughout active voting, and afterward under the retention rules. It shall publish the approved ballot and rules, candidates or options, voting method, opening time, replacement cutoff, closing time, software and configuration identification, test and approval records, public operating events, recorded corrections, audit reports, certification, and the verification methods and evidence suitable for public release.
Public events shall be published as they occur, with their actual event and publication times, a protected public-event sequence, and any delay or service interruption identified. The record shall retain authenticated versions and corrections without silently overwriting earlier published material. Signed manifests and preserved copies shall permit independent comparison and detection of inconsistent versions. The public-event sequence shall be separate from private submission sequences.
During active voting, live publication shall be confined to nonidentifying operational information and verification material safe for that stage. Candidate or option totals, partial tallies, and records capable of linking a person to secret selections shall remain sealed until the relevant contest or question closes. Counting stages and permitted results shall then be published as they become available. Raw per-voter logs shall not be made public merely because they form part of the protected election record.
The page shall provide a downloadable, documented verification package containing the public records, their authenticated versions, relevant verification software or independently reproducible checking instructions, and privacy-preserving evidence sufficient to check the recorded outcome under the approved method. A record digest or signature alone shall not constitute proof of correct eligibility, inclusion, or counting. Any published commitment to secret ballot information shall use an independently examined hiding construction appropriate to the protocol.
The same Ballot Record page shall provide a public view, an authenticated individual participation lookup, and an owner-only private-record view, each subject to its required permissions. The public response shall contain only public material; protected information shall be retrieved separately under the required authorisation and voter-side protection. Role-specific visibility shall be enforced by the service rather than by hiding fields already delivered to an unauthorised viewer.
Section 15: Verification and Record APIs
A government-developed platform shall provide documented, versioned application programming interfaces for the public Ballot Records, individual participation lookup, and authorised private record functions. Documentation shall identify the data schema, stable identifiers, release stages, authentication and authorisation requirements, query limits, pagination, error responses, and verification procedures applicable to each interface.
Public verification interfaces shall provide read-only access to the same approved public data and downloadable evidence available on the Ballot Record. Protected interfaces shall enforce server-side authorisation for each requested record, property, and action. Knowing a Ballot ID, National ID number, or receipt reference shall not confer authority to retrieve a private record or alter a vote. The participation interface shall accept only the limited individual query permitted by Section 10.
The interfaces shall use protected transport, validated inputs, fresh and appropriately restricted credentials for protected operations, replay and request-forgery protections where applicable, bounded requests, and proportionate resource and query limits. The service shall separate public, participation, personal-history, and restricted-audit permissions. Shared caches, public error responses, telemetry, and public logs shall exclude protected particulars and secret selections.
Audit and service accounts shall have separately authenticated credentials restricted to their lawful functions. Public access shall not expose administrative controls or bypass the elector's required authentication, private decryption material, replacement cutoff, or voting deadline. Verification traffic shall be managed to preserve capacity for lawful voting and record access.
Before use and after material changes, independent examination shall test cross-account access, object and property authorisation, enumeration, secret leakage, cache behaviour, replay, rate limits, clock-boundary handling, and consistency between the page, API, exports, and authenticated record versions. Assessment shall apply the relevant ASVS requirements and address the risks described in the OWASP API Security Top 10, 2023 edition.