← All posts

When the only working audit is a courtroom, the system already failed

Three countries held presidential elections. Three supreme courts had to throw them out. The question isn't why courts intervened — it's why the elections needed saving in the first place.

It is the morning of September 1, 2017, and six judges in Nairobi are about to make history no one wanted to make.

The presidential election was held 22 days ago. Uhuru Kenyatta has been declared the winner. The ballots have been counted — or something resembling counting has occurred. Millions of Kenyans have stood in line, marked their choices, and waited. And now the Supreme Court, by a majority of four to two, is doing what no court in African history had done before: invalidating the result entirely.

Not because it found mass fraud. Not because votes were clearly stolen.

Because no one could prove they weren't.

What the Kenyan court actually said

Read the judgment carefully — Presidential Election Petition No. 1 of 2017 — and you find something more troubling than a corruption story. The court's concern was structural. Kenya's constitution requires that elections be simple, accurate, verifiable, secure, accountable, and transparent. The Independent Electoral and Boundaries Commission had set up a system to make that happen: result forms from every polling station (called Forms 34A) were to be electronically and simultaneously transmitted to the national tallying centre, creating a real-time, traceable link from each ballot box to the final number.

That system did not work as designed. Not all Forms 34A were transmitted. The final national tally form had no watermark or serial number. The IEBC chair declared a winner before all the underlying forms had even arrived. When the court looked for the chain of evidence that would let it — or anyone — independently verify the announced total, the chain had gaps.

Two justices dissented: they felt the evidentiary burden for annulment had not been met. That honest disagreement is itself part of the story. The majority and the dissent were not arguing about fraud. They were arguing about proof. Whether what existed was enough to trust. Whether the absence of a verifiable chain justified throwing out an election tens of millions of people had participated in.

The court ordered a fresh election within 60 days. Kenya ran it. The verifiability gap that caused the annulment — the design problem, not just the execution failure — remained a subject of political argument afterward.

The court caught something real. But it caught it the hardest possible way, after the fact, under political pressure, with a country waiting.

The correction-fluid problem in Malawi

Eight thousand kilometers south, in February 2020, Malawi's Constitutional Court did the same thing.

The May 2019 presidential election had returned Peter Mutharika as the narrow winner. But when litigants challenged the result and the courts examined the official tally sheets — the physical documents that should be the foundation of any verifiable count — they found something that should not exist in any serious electoral system.

Correction fluid. Tipp-Ex, applied to official government result sheets, overwriting the original figures.

Not just in one district. Not just in one region. Pervasively. Alongside duplicate result sheets, unsigned forms, and improperly handled tallies. The Supreme Court of Appeal upheld the annulment on May 8, 2020, finding the irregularities meant the announced result could not be treated as a verifiable, lawful reflection of the vote.

Think about what correction fluid means in this context. It is not a sophisticated attack. It is not a cyberattack. It is a bottle of white paint that costs a dollar. And it was enough to make an entire presidential election legally unverifiable.

The tally sheet is supposed to be the one tamper-evident artifact that cannot lie. It is the piece of paper signed at the polling station, in front of witnesses, recording what the count showed. Once you introduce Tipp-Ex, you have removed the tamper-evidence. You have turned a verifiable record into an alterable record, and an alterable record is no record at all.

Malawi held a fresh election in June 2020.

Austria's chain-of-custody breakdown

In July 2016, the Austrian Constitutional Court voided a presidential runoff that had been decided by roughly 30,000 votes. The court found procedural violations affecting around 77,000 postal ballots: envelopes opened early, counts begun by unauthorized people, required witnesses missing. The winning margin was smaller than the number of votes handled in violation of the rules.

Critically — and this is the point most reporting missed — the court found no evidence of fraud. No one was accused of changing a vote. The court annulled the election not because it found manipulation, but because it could not verify that manipulation had not occurred. The procedures that exist to make an election independently checkable had been violated at a scale that could have affected the result.

A repeat runoff was held in December 2016.

Here is the thing about Austria: the procedures that were violated are not obscure technicalities. They are the mechanisms of verifiability. Who may handle ballots, in whose presence, at what time — these rules exist so that anyone with standing can look at the record and confirm that no unauthorized person had the opportunity to alter what was inside those envelopes. When you open envelopes before the permitted time, without witnesses, you do not just break a rule. You destroy the evidence base that makes the result checkable. You make verification retroactively impossible.

That is why the court had no choice. It was not about punishing an error. It was about the basic question of whether a legitimate, verifiable result existed at all.

Three elections, one underlying problem

Kenya. Malawi. Austria. Three very different countries. Three very different failure modes — a digital transmission gap, a bottle of Tipp-Ex, a premature envelope opening. Three supreme courts forced to act as the last line of defence.

But notice what connects them: in every case, the verification failure was upstream of the court. The problem was not that the court system failed. The problem was that the election system produced no independently checkable record. The court was called in to examine something that had already become unexaminable.

A court that cannot verify a result and voids the election is doing exactly what courts are for. But it is also a sign that everything that should have prevented the need for that intervention had already failed.

Courts are slow. They are expensive. They are inherently political environments — as those two Kenyan dissenting justices remind us, reasonable people examining the same record can reach different conclusions about whether the evidence clears the bar. A hung court doesn't force a recount; it just leaves a disputed result standing.

A court is a last resort, not a verification mechanism. And the difference matters enormously, because by the time a court is involved, the legitimacy damage is already done.

What built-in verification would actually look like

The German Constitutional Court put the principle cleanly in its 2009 ruling on electronic voting machines: the essential steps of the voting and of the determination of the result can be examined by the citizen reliably and without any specialist knowledge. Not by a judge. Not by a computer scientist. By a citizen.

That is a higher bar than it sounds. And it is exactly the bar that Kenya, Malawi, and Austria all failed to clear — before any court got involved.

What would clearing that bar look like in practice?

In Kenya, it would mean that every Form 34A is photographed, transmitted with a tamper-evident signature, and published in real time at a public URL anyone can check. A voter in Mombasa could look up their polling station's result, compare it to the national tally, and detect any discrepancy without needing a lawyer or a court order.

In Malawi, it means tally sheets that are signed in pen, witnessed, photographed, and hashed — so that if anyone applies correction fluid to the original, the digital record shows what the form said before the paint went on.

In Austria, it means chain-of-custody logs with timestamps and witnesses that are themselves part of the public record, not private administrative notes that only a court can subpoena.

These are not hypothetical ideas. Colorado has run statewide risk-limiting audits since 2017 — statistical checks that provide defined confidence levels rather than reassuring noises. Georgia hand-counted roughly five million ballots in 2020, producing a result anyone could compare against the machine totals. The gap was about a tenth of one percent. That is not perfection, but it is a checkable, public, independently reproducible number. The Dutch government's election commission concluded in 2007 that an election is only trustworthy if the public can verify it — and the country went back to paper ballots and manual counting.

The common thread is this: verifiability is not a feature you add on afterward. It is a property you either build in from the start, or you don't have at all.

Why 'the audit confirmed it' is not the lesson

When election officials point to an audit that confirmed a result, the response should always be: confirmed it how, and can I check?

A Tipp-Ex tally sheet that passes a cursory review is not confirmed. An electronic transmission log that only the commission can access is not confirmed. A court that splits four to two is not a confirmation — it is a contested finding that came dangerously close to going the other way.

Even a manual hand recount — the supposed gold standard — carries irreducible human error. Antrim County, Michigan's December 2020 hand audit of presidential ballots differed from the machine tabulation by about a dozen votes out of roughly 15,700 cast. Twelve votes. In a small county with a comfortable margin, that is noise. In a race decided by fewer votes than that, it is the ballgame. And as the Windham, New Hampshire forensic audit showed in 2021, a fold in a ballot from a leased folding machine — no malware, no fraud, no conspiracy — was enough to cause the scanner to read a crease as a marked oval, hundreds of times over.

"A hand count confirmed it" is a reassurance. "An audit confirmed it" is a reassurance. A Secretary of State saying "everything matched" is a reassurance.

Reassurances are not verifiable. Records are.

The Kenya Supreme Court was not given the records it needed. The Malawi courts looked at the records and found they had been altered. The Austrian court found that the record of who had handled the ballots, and when, simply did not exist.

Three courts. Three annulments. No built-in verification.

The question that remains open

None of the three fresh elections that followed — in Kenya, Malawi, and Austria — fixed the systemic problem that caused the original annulment. Each country ran a new vote under the same structural architecture that had failed. Kenya's repeat election in October 2017 was boycotted by the main opposition, and the underlying question of how to make digital result transmission independently verifiable was never fully resolved. Malawi's June 2020 rerun produced a different winner, but the tally-sheet design — paper, signed in pen, susceptible to correction fluid — was not replaced.

What would actually close the gap? Not a new court. Not a more aggressive audit after the fact. Not a louder statement from an election authority.

A system where the chain from ballot to announced total is cryptographically hashed, time-stamped, published, and independently downloadable by anyone — before the first legal challenge is filed.

Not a system where a court has to order production of records. A system where the records are already public, already machine-readable, already archived in a form no single official can quietly alter.

That is what courts keep finding the absence of. It is what Germany's Constitutional Court demanded in principle. It is what Kenya's constitution required and the IEBC failed to deliver. It is what Malawi's correction-fluid tally sheets destroyed. It is what Austria's unauthorized envelope-openers undermined.

The court is always the last resort. The question worth asking — before any election, not after — is whether your system was built so the court never has to be called.

"A court that cannot verify a result and voids the election is doing its job. A system that forces a court into that position has already failed."

See how common this verification gap is across the world →

Read the two-minute version of why built-in verifiability matters →

Explore where your election system's gaps are →

Sources

See all postsExplore the gaps