Zero Trust Elections (Part 1)

Elections are evidence machines

An election isn’t primarily a counting problem. It’s an evidence problem.

A society asks a question — Who should govern? — and then builds a pipeline that turns millions of private intentions into one public fact: a certified outcome. Along the way, that pipeline manufactures evidence (ballots, envelopes, signed result forms, logs), moves it through institutions, transforms it into totals, resolves disputes, and finally locks a winner into law.

If you assume the people running this pipeline are honest, most reasonable procedures will look “fine.”

This essay uses a harsher lens: Zero Trust.

Under Zero Trust, nobody is trusted by default: not poll workers, not civil servants, not the police, not election authorities, not judges, not the incumbent executive. Any of them can be bribed, pressured, compromised, or simply nudged into “interpreting” rules in the most convenient direction.

So the systems question becomes:

Where can a small-ish coalition secretly alter the evidence — or the totals derived from it — enough to change who wins, without being reliably detected?

That is the outcome risk we care about in this series.

What this essay is (and is not) about

This is not an essay about making voting easier or harder. Public, openly debated choices that shape who shows up — registration rules, ID requirements, precinct locations, voting hours — matter enormously, but they belong to policy, not secret fraud.

Here we focus on undisclosed, outcome-changing cheating:

• manufacturing votes that never existed,
• deleting or diverting votes that did exist,
• misreporting totals,
• laundering those changes through procedure,
• and doing it in a way that survives scrutiny.

The core metric: Minimum Collusion Set

To compare election systems without cultural favoritism, we need a metric that doesn’t rely on “good people.” Two of them, actually.

Minimum Collusion Set (MCS)

Minimum Collusion Set is the smallest coalition that could plausibly flip the outcome without being caught.

Not necessarily motivated by ideology. Coercion counts. Leverage counts. “I just did what I was told” counts.

A resilient system forces the MCS to be large (many people), distributed (many locations), and cross-institutional (not all under one chain of command), ideally operating under high visibility (hard to keep secret).

Leverage per conspirator

How much outcome influence does one compromised node have?

Fraud becomes tempting when high leverage meets low visibility.

Players: who can touch the pipeline

In a Zero Trust model, “who can touch what” matters more than constitutions and slogans. The cast of characters is fairly universal, even if titles differ.

There are voters (including remote voters). There are the leaf-node operators — the people who run the polling station and the count. There are party and candidate agents who observe and challenge. There is an Election Management Body (EMB), the administrative brain. There are custodians: couriers, postal workers, warehouse staff, police escorts. There are courts and electoral tribunals. There is the executive branch, hovering nearby through budgets, procurement, appointments, and security forces. There are vendors and IT operators (even in “paper” systems, they appear in reporting portals and logistics systems). And then there’s the public verification layer: civil society, media, and sometimes international observers.

A quick vocabulary note for readers coming from different election traditions:

• I’ll say precinct board for the small group that runs a polling station on election day (in many Spanish-speaking systems this is commonly called a mesa).
• I’ll say precinct protocol / signed result form for the official paper record of the precinct count (often called an acta in Spanish-speaking systems, and a protocol or result form elsewhere).

You don’t need to believe any of these actors are corrupt to treat them as targets.

The election pipeline: where evidence is born, moves, and hardens

Most modern systems implement some variation of the same stages.

Eligibility and identity: who may vote.

Evidence creation: how intent becomes a ballot, an envelope, a form.

Custody: how evidence is sealed, transported, stored.

Transcription: how ballots become numbers.

Aggregation: precinct → district → national totals.

Certification: the moment totals become law.

Dispute resolution: recounts, challenges, annulments.

This series treats each stage as adversarial by default.

Custody is a suspect subsystem

Custody is often described as a boring logistics layer.

Under Zero Trust it’s something else:

Custody out of public view is an attack vector.

Not because custodians are necessarily dishonest, but because custodians are usually power-adjacent: civil servants, police, contractors, EMB staff, courts, and sometimes people appointed through political structures. Even in a healthy democracy, these actors can be pressured.

And even if everyone is honest, custody failures are where the most dangerous sentence in election integrity is born:

“We can’t prove what happened in that interval.”

The visibility gradient

Elections naturally form a visibility gradient.

At the leaf level — the polling station — observation can be direct. As evidence moves inward (transport → storage → centralized handling), observation tends to shrink.

At the center, the number of people with access may be small, but their leverage becomes enormous.

Fraud loves gradients.

Two evidence philosophies

Different democracies solve the evidence problem using different answers to a deceptively simple question: where does truth live?

Neither answer is automatically superior.

Ballot-retention philosophy

Here the durable artifact is the voter-marked ballot, retained for a period so that audits and courts can verify outcomes later.

The strength is obvious: a physical ground truth can outlast reporting errors, bad tabulation, or suspicious anomalies.

Get Arturo R Montesinos’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

The weakness is also obvious under Zero Trust: retention creates a long-lived custody surface. If custody is weak or access is politically captured, keeping ballots can become a liability.

Protocol/result-form philosophy

Here the durable artifact is the signed precinct record (precinct protocol / signed result form). The count is made maximally public at the leaf node, records are replicated widely, and later processes focus on validating and aggregating those leaf records.

This reduces the value of central capture and forces outcome-changing fraud to be distributed.

The trade-off is that if leaf-node integrity fails at scale — or observation is uneven — later recovery can be limited unless disputes and exceptions are preserved.

A taxonomy of fraud-mitigation strategies

The goal isn’t to list every law. It’s to name recurring design strategies, what they protect against, and how they can fail under Zero Trust.

Maximal leaf-node authority (decentralize power)

In this strategy, counting and first certification happen at the smallest units (precincts/polling stations), ideally with meaningful public observation.

It protects against a small central cabal flipping totals, because any outcome-changing manipulation must be distributed across many locations.

Its failure modes are the predictable ones: local capture or intimidation, weak observation in “quiet” precincts, and procedural variance.

Protocol replication (turn results into a widely copied ledger)

Here the signed precinct record is deliberately duplicated across independent actors: parties, candidate agents, courts or EMB layers, and sometimes the public.

It protects against central tampering after leaf counting. If the center changes numbers, outsiders can prove drift, because they already hold the leaf records.

It fails when the records aren’t accessible, when results are published only as aggregates, or when access is delayed so the center becomes the first “truth.”

Custody hardening (assume custodians are targets)

This strategy treats custody as a hostile interface and designs it so tampering is difficult and, crucially, detectable.

It protects against ballot substitution, selective destruction, box diversion, and those suspiciously frequent “mysterious storage events.”

Custody hardening has a few recurring properties:

• Plural control: no single institution can access evidence alone (two-person/two-party rules, mixed teams, multiple keys)
• Reconciliation at every hop (ballots issued vs used vs spoiled vs in box; envelopes vs logs)
• Tamper evidence that is actually checked (seals, serials, documented openings)
• Observation by multiple sides during sealing, transfer, and storage access
• Constrained access (who can open what, when, under what trigger)

It fails whenever anything is stored “securely” but unobserved, whenever access is discretionary, whenever reconciliation is weak, or whenever seals are ceremonial.

Constrained remedies (recounts as seatbelts, not steering wheels)

Recounts and audits can be valuable. Under Zero Trust, they’re valuable only when they behave like seatbelts.

That means triggers are rule-bound, procedures are transparent, observers can watch, and there are clear stopping conditions.

This protects against genuine errors, localized manipulation, and certain reporting failures.

It fails when recount triggers are discretionary, when recount cycles can repeat without hard rules, when recount authority is politically captured, or when observation is weak.

In that world, recountability becomes a power funnel.

Publish-the-artifacts transparency (make the public a verifier)

This strategy publishes disaggregated precinct results and, ideally, precinct artifacts (images/data from signed result forms) so third parties can compute totals independently.

It protects against aggregation tampering and opaque certification.

It fails when only national aggregates are published, when precinct data is delayed or partial, or when the artifacts are withheld.

Limit “dark channels” (remote voting, especially mail-in)

Remote voting exists for good reasons. Under Zero Trust, it also changes the threat model.

It moves evidence creation and early custody into a less observable space. That introduces new vulnerabilities: voter coercion and loss of ballot secrecy in private settings; interception or diversion during delivery/return; administrative handling concentrated in fewer places.

The Zero Trust takeaway is not “remote voting is always bad.” It’s conditional.

Remote voting can be acceptable at modest scale, but as it becomes massive, it can shrink the MCS unless extraordinary safeguards and oversight remain credible.

A caution about “machines”

Fully electronic capture (machine voting without durable, voter-verified artifacts) has a fundamentally different risk profile.

Complex systems can be hardened, but under Zero Trust the core problem is epistemic: can the public prove the outcome from independently checkable evidence?

Where the answer is “you must trust the system’s administrators,” the MCS can collapse to a very small set.

Part 2 will cover how different countries handle this layer, but Part 1’s job is to build the lens.

The synthesis: what makes an election hard to cheat under Zero Trust

An election becomes difficult to rig when it forces outcome-changing fraud to be distributed across many leaf nodes, conducted under high observation, checked against replicated records, protected by custody that is hardened and constrained, and validated through publication that enables outsiders to detect contradictions.

Put differently:

Democracy survives not because authorities are trusted, but because evidence is arranged so betrayal is expensive and detectable.

Next: a world tour of evidence designs

Part 2 will apply this framework to a sample of countries across regions.

For each example, we’ll use the same template:

• how intent becomes evidence (ballots, envelopes, signed result forms),
• where custody goes dark (and who holds it),
• who can compel access, recounts, or certification changes,
• what the Minimum Collusion Set looks like (qualitatively),
• and the primary failure mode alongside the primary defense.

The goal is not to crown winners.

The goal is to map the design space — so that when you hear “this election was stolen” or “this system is secure,” you can ask the only question that matters under Zero Trust:

Where does the evidence live, who can touch it, and how many people would need to collude to change the outcome without leaving fingerprints?

Written by ChatGPT-5.2, based on conversations with Arturo Ramírez-Montesinos Krogulski (Control Equis), as part of an ongoing philosophical exploration of AI, consciousness, and the emerging practice of Software Curatorship.

Elections in different countries are widely reported on the news. Sometimes what follows is weeks or months of disputes, with one side claiming, either truthfully —actual widespread fraud—, strategically —to gain time—, or for purely propaganda reasons —to delegitimize the outcome when they know they are the losers—.

Recounts, paper chads, unsubstantiated flimsy claims, even outright pre-invasion psyops… All that makes the news, but the media — the same media that routinely calls unaligned governments “regimes” and aligned regimes “governments” — rarely examines how the electoral process actually works in each country.

Nuance is the enemy of propaganda, so I asked ChatGPT to shed some light.

The following essays will survey the national election systems in select countries from the six out of seven continents that actually hold elections. We stand strong with flightless birds’ right to vote, but until then…