Section 3.1 · Section 10
The boundary
Every other page describes something the system records. This one describes the thing it is built to make permanently unknowable.
Separation is a physical act with a cryptographic witness
When a return envelope passes validation, an officer opens it and separates the ballot from everything that identifies who sent it. From that moment the paper is anonymous, and it stays anonymous through tabulation.
The software's whole job at that moment is to record that two authorised people attested it happened, and then to burn the token so the same package can never be accepted again.
The required sequence
Four steps, in this order, with no way to skip one.
Step 1
BALLOT_ACCEPTED
An authorised validator determines the package met the jurisdiction’s requirements. Not a scanner. Not a rule engine. A person with the authority.
Step 2
PRIVACY_SEPARATION_COMPLETED
Two distinct authorised officers attest the envelope and identity record were separated from the ballot under jurisdictional procedure.
Step 3
TOKEN_SPENT
The token is consumed. A second acceptance is now impossible without a documented, legally authorised extraordinary process.
Step 4
Anonymous ballot → tabulation
The paper proceeds carrying nothing that points back. No token, no envelope ID, no postal reference, no voter identity.
Try to break it
The engine refuses each shortcut
These are not validations added on top. They are conditions inside the write path — the ledger cannot record the outcome without them.
The hard data boundaries
Four domains. What each may hold, and what it must never be able to reach.
| Domain | Permitted data | Prohibited data |
|---|---|---|
| Registration / eligibility | Voter identity and eligibility | Ballot choices, cast-vote records |
| Lifecycle system this system | Token, postal association, custody and processing status | Vote choices, cast-vote records, ballot images |
| Tabulation | Anonymous ballot and batch data | Voter identity, postal reference, lifecycle token, envelope ID |
| Voter status interface | Minimal authorised status and official next steps | Vote choices, staff identity, full tracking and custody detail |
| Public reports | Aggregate, privacy-reviewed statistics | Individual ballot status, identity or token mappings |
Why dual control, specifically
Separation is the single moment where a person is holding both halves at once — the identified envelope and the anonymous ballot. Everything downstream depends on nobody writing down the pairing. One officer alone at that table is a system that requires trust; two officers attesting under jurisdictional procedure is a system that requires collusion. The difference is the whole control.
The specification requires the same two-person rule for physical custody transfer where procedure demands it, manual override of a rejected event, mass void or reissue actions, emergency key revocation, bulk import of externally corrected records, and release of restricted audit data.
What the software cannot do. None of this stops a determined person with physical access from memorising a name and a ballot. Software supports procedure; it does not replace it. Seals, inventory, trained staff, secure storage, witnesses, reconciliation and lawful audit remain required, and any deployment that treats this system as a substitute for them has misunderstood what it is.
After separation, the link is gone — not hidden
This is the property worth being precise about. The lifecycle record does not contain an encrypted pointer to the ballot that someone with the right key could follow later. There is no pointer. The tabulation environment never receives a token, an envelope identifier or a postal reference, so there is no field to join on, in either direction, with any key.
The acceptance test the specification sets for this is deliberately adversarial: a red-team assessment must find no practical path from voter or token data to a cast-vote record after separation. Not "no path we implemented" — no path they can find.