Part VIII, The Digital & Technological Layer

Derived from Axiom 7 (end-to-end verifiability), 9 (resilience), 11 (anti-capture), and the privacy/data rights of §I.3. This is the substrate beneath the whole model. The premise of BIG, "given all technological advances", lives here, governed by one rule: technology serves the model; it never governs.

VIII.1 Principles for governing technology

Every system in this layer obeys, without exception:

1. Open and verifiable, all governing-critical software is open-source, independently auditable, and reproducibly built (§VIII.8). No black box decides anything about a citizen.
2. Privacy by design, data minimisation and unlinkability are defaults, not options (§I.3).
3. Resilient and offline-capable, graceful degradation and paper fallback are requirements, not extras (Axiom 9).
4. No single point of failure, of code, key, vendor, or datacentre.
5. Security as a first-class property, assume a nation-state adversary (§VIII.6).
6. Human-accountable, technology advises and verifies; humans decide and answer (§V.6).

VIII.2 Secure identity and authentication (the §II.1 architecture, technically)

• Separated architecture: the identity issuer is cryptographically and institutionally separate from every relying system (voting, services), so no party can link a citizen across activities.
• Sybil-resistance, honestly reconciled with "no master record". Uniqueness ("one real person → one identity") requires a canonical enrolment root, which is in genuine tension with "no single linkable national ID" (§II.1) — a tension the model names and resolves rather than asserting both away. The uniqueness check runs on one-way commitments that are never queried after issuance (split custody, sunsetted biometric templates), establishing uniqueness without leaving a surveillance graph behind.
• Issuance is governed by separation of powers, because whoever controls it controls the electorate. The issuer sets both the numerator and the denominator of every §XIX.5 threshold, so: no single body can mint or deny an identity — issuance requires a threshold agreement of independent parties; the live count of issued credentials is published in aggregate and independently reconciled against population estimates, with published discrepancy bounds, so ghost-issuance (padding the roll) or mass denial (silent disenfranchisement) is publicly detectable; and denial or revocation is subject to statutory limits and a fast, independent, appealable adjudication separate from the government of the day (§II.2). Privacy protects against surveillance; this protects against issuance fraud — the two are distinct and both are needed.
• Public randomness for the lot. The sortition draws (§VI.3a) use the same published, tamper-evident public-randomness beacon; each draw is reproducible from the beacon output and the reconciled roll, so "random" selection is verifiable rather than administered on trust.
• Zero-knowledge eligibility proofs: a citizen proves a predicate ("eligible and not yet voted") without revealing identity; the relying system verifies the proof, stores no link.
• Unlinkable, per-domain credentials prevent cross-domain profiling.
• Citizen-held keys with threshold recovery — the trilemma named. At population scale key loss is routine, so recovery becomes the main path and its security becomes the system's real security; recovery is both an attack surface (collude to seize an identity and mint a vote) and a coercion surface (an abuser or the state compels a recovery, re-importing the coercion problem at the identity layer). So recovery is threshold-based across parties from disjoint trust domains, rate-limited and publicly logged in aggregate (mass or anomalous recovery is detectable), with cooling-off and out-of-band confirmation to blunt coerced recovery, and a purely institutional path that needs no "social guardians" (which the isolated and the homeless lack). No master backdoor; the recovery-fraud residual is stated, not hidden.
• Offline credential, a physical token + in-person process granting identical rights (Criterion 12).

VIII.3 End-to-end verifiable voting (E2E-V)

The hardest problem in the model, and the one where honesty matters most. The required properties:

• Cast-as-intended, recorded-as-cast, counted-as-recorded, each independently verifiable.
• Voter-verifiable (the voter can confirm their own vote was included) and universally verifiable (anyone can verify the tally), while remaining a secret ballot.
• Receipt-free / coercion-resistant, a voter cannot prove to a third party how they voted, defeating vote-buying and coercion.
• Software-independent, a result error or fraud is detectable even if the software is buggy or malicious, via the paper record and risk-limiting audits.
• Mandatory paper record retained for every vote; risk-limiting audits mandatory every election (§III.6).

Honest engineering boundary (required by §0.6's "no design that only works in ideal conditions"): remote internet voting at national scale remains an unsolved problem for coercion-resistance and client-side malware. Therefore:

• Primary channel: in-person, verifiable digital + paper. In-person supervised voting is the coercion-safe default.
• Postal and assisted voting are offered for access, but the honest boundary extends to them too: they are the classic settings where receipt-freeness fails (a coercer at the kitchen table; a controlling carer marking an "assisted" ballot), so they carry compensating controls (assistance witnessed by two independent officials; offences with an audit trail) and are never presented as carrying the same coercion-resistance as the supervised booth. Cryptographic receipt-freeness protects nothing when the coercer watches the postal ballot being filled.
• Remote/online voting: offered only where coercion and malware risks are managed, bounded, and audited; never as the sole channel; never at the cost of the properties above.
• We do not pretend a hard problem is solved. The system is designed to be trustworthy and verifiable, not maximally convenient.

VIII.4 The transparency ledger (technically)

A public record with these properties (specified as properties, not products, no dependence on any single technology or vendor):

• Append-only and tamper-evident, cryptographic integrity (e.g. Merkle-chained entries) so any alteration or deletion is detectable.
• Byzantine-fault-tolerant agreement, with a published fork-resolution rule. Tamper-evidence detects alteration after the fact, but the canonical record must be agreed among custodians: a defined BFT quorum agrees each entry, and a published rule resolves custodian disagreement, so the ledger cannot silently diverge or fork. (Rejecting blockchain-for-its-own-sake does not license leaving Byzantine agreement unsolved by fiat — it is specified.)
• Omission detection. A Merkle chain proves what was written; it cannot by itself reveal a legitimate entry that was simply never admitted (censorship-at-write). So every expected entry carries a public "expected-entry" attestation, making omission detectable rather than invisible.
• Independently replicated across the m-of-n multi-custody function of §VI.1 (the three integrity bodies plus external civil-society notaries), citizen-jury custodians, and public mirrors, so no single party controls history.
• Publicly auditable, open read access; verification tools any citizen can run.
• Privacy-preserving, personal data is never exposed; votes are recorded in aggregate/anonymised, money and decisions in the clear, persons only as the Charter permits.
• Delay, not secrecy, for operationally-sensitive spend. A real-time public record of money and decisions is also an operational-intelligence feed for a nation-state adversary (§VIII.6). Genuinely operationally-sensitive spend may be time-delayed (not hidden) under narrow, independently-reviewed justification, and is published in full once the sensitivity lapses (mirroring §VII.3's redaction discipline).
• Not blockchain-for-its-own-sake, the requirement is integrity + agreement + replication + public verifiability; the implementation is chosen on merit and kept open.

VIII.5 AI and computational decision-support (technically)

Implementing §V.6:

• Public algorithm register, every AI/algorithm used in a governing function is listed, with purpose, owner, and audit status.
• Auditable, explainable, bias-tested, reproducible before deployment and continuously after; tested by the Integrity Assembly and citizen juries (§VI.4).
• No autonomous coercive authority, no system may, of itself, deprive a citizen of liberty, money, or rights; a named human decides (§V.6).
• Model/version governance, defined policy for evaluating, testing, and upgrading models; no silent changes to systems that affect citizens.
• Learned models are barred from the classification and rights-adjacent roles. "Open-source, reproducibly built, formally verified" makes a vote-tallier trustworthy; it does not make a large learned model's judgement inspectable — its behaviour lives in billions of weights and its training data, and it can pass every sampled audit while drifting on the unsampled tail (behave under test, defect in production). So the Router's value/technical classification (§XIX.3) and any function bearing on a citizen's liberty, rights, or eligibility must run on a rule-based, human-readable decision procedure a citizen could in principle apply by hand; a learned model may only flag candidates for that procedure, never make the call. A reproducible build reproduces the same opaque weights — it is not a substitute for an inspectable decision rule.
• Separation of the four AI-governance roles. The corpus curator, the rule/prompt author, the deployer, and the evaluator of any governing model are institutionally separate; no person or body holds two, so no single "man in the middle" can steer outcomes invisibly.
• *Open by default; no unaccountable models. The default is full openness; a narrowly-defined, security-justified exception still receives closed audit by cleared independent reviewers plus jury-cleared members, never zero* audit — the identical rule to §VI.4. "Open where possible" never degrades to "trust us" for the decisions that most need verification (the graded-assurance regime for non-public data is in §V.2).
• Risk-tiered and impact-assessed before deployment, every governing AI is classified by impact and must clear a published algorithmic impact assessment and independent review before use, on the model of the EU AI Act's high-risk regime and Canada's directive on automated decision-making. The highest-impact uses face the strictest tier.
• Sovereign control of governing-critical models, no opaque dependency on a foreign frontier model for any function the state cannot itself inspect, reproduce, and guarantee (links §VIII.8). This is a real trade-off, stated honestly: frontier capability is presently concentrated in a few foreign labs, so where a sovereign, inspectable model cannot yet match a foreign one, the design accepts a capability gap rather than an inspectability gap — foreign models may be used only in non-decisional, non-rights-critical advisory roles whose output is independently reproducible by sovereign means, and never in the classification (§XIX.3) or any rights-adjacent function.

VIII.6 Cybersecurity and the threat surface

The digital layer is the highest-value target in the country; it is defended accordingly:

• Assume-breach, defence-in-depth architecture; assume a nation-state adversary.
• Formal verification, scoped to a defined critical kernel — the vote tally, the ledger-integrity core, and the identity uniqueness check — with a published, funded roadmap. Formal verification at the scale of a whole national system is not achievable, so the design scopes it honestly rather than implying "all critical software" is proven.
• Against the honest supply-chain residual. Reproducible builds prove the binary matches the source; they say nothing about whether the source is honest (the XZ-Utils / trusting-trust attack — a subtle backdoor patiently merged into vast, under-reviewed code). So critical components require multi-party signed review (no single maintainer can land code), diverse double-compilation to counter trusting-trust, hardware supply-chain attestation, and continuous funded auditing weighted to critical paths — "audited" is treated as a resourced, rate-limited process, not a one-off property.
• Independent, continuous red-teaming and public bug-bounty; findings logged and fixed.
• Incident response & continuity integrated with Part VII (isolation, fallback to paper/manual, attribution).

VIII.7 Data sovereignty and privacy

• UK sovereign control of critical systems and data; defined residency for sensitive data.
• Data minimisation, collect the least necessary, keep it the shortest time, justify every field.
• No mass surveillance, guaranteed by law and warrant (§XII.4), not by architecture alone: the unlinkable identity design removes one major linkage vector, but bulk data lives outside it (communications, financial, CCTV/ANPR, brokered, foreign-partner), so the binding guarantee is the statutory bulk-acquisition warrant regime, independently audited (§XII.4, §I.3, §VI.4). "Structurally impossible" would be an overclaim; the honest claim is "structurally harder, and forbidden by law".
• Citizen data rights, access, correction, and control, per the Charter.

VIII.8 Open-source and verifiability mandate

• All governing-critical software is open-source and independently auditable. Democracy may not run on code the public cannot inspect (Axiom 7, 11).
• Open-source is paired with a funded defensive programme. Publishing every governing-critical component also hands the code to a resourced attacker who needs only one zero-day first, so openness is matched by a permanent, funded security programme — nation-state-competitive bug bounties, a red-team retainer, and a rapid-patch pipeline — so defenders keep the discovery race. Kerckhoffs's principle helps defenders only if the defender is resourced to exploit the openness before the attacker does.
• Reproducible builds, the running system provably matches the audited source.
• No vendor lock-in / black-box dependency for any critical function, a private vendor must never be able to hold governance hostage or hide its workings.

VIII.9 Resilience and offline operation (technically)

• Graceful degradation designed and drilled (not assumed) for every critical system.
• Paper and manual fallback for voting, identity, and essential services (§VII.6).
• Distributed, federated architecture, local systems survive a central outage.
• Disaster recovery with geographically dispersed, independent replicas; tested failover.

VIII.10 Failure modes and safeguards

Part VIII ends. Next: Part IX, Separation of Powers & Checks, which arranges all these institutions so that no branch, including the new ones, can dominate.