IT experts list sins of Comelec, partner

MANILA, Philippines—The holding of automated elections on May 10 was “mismanaged” because the Commission on Elections (Comelec) and its technology partner, Smartmatic-TIM, did not follow technical requirements, including security features, mandated by the automation law and the terms of reference of the bidding for the automated system.

The Philippine Computer Society (PCS) issued this assessment on the eve of the expected proclamation of the new president and vice president.

“These are grounds to doubt the accuracy and integrity of results. We don’t know whether (the vote count) accurately reflected correct ERs (election returns),” PCS director Edmundo Casiño said in an interview with the Inquirer over the weekend.

Asked point-blank if, from the point of view of information and communication technology (ICT) experts like PCS members, rigging of votes could have occurred on May 10, PCS president Nelson Celis said: “Computers are programmable.”

He cited as example a normal cellular phone whose ring tone could be changed anytime by the user. “It may happen,” Celis said.

All doubts about the integrity of the results of the polls should have been assuaged if only the Comelec and Smartmatic complied with the provisions of the automation law and the terms of reference of the bidding of the automated election system (AES).

Sins

Celis and Casiño ticked off what could be the sins of the Comelec and Smartmatic:

• Too many delays in the preparations. (The Washington-based International Foundation for Election System says it takes 18 months to prepare; the Comelec had only less than a year, prompting the PCS to warn it that it’s already a “suicide mission,” but the recommendation of the PCS was overruled by the Comelec due to time constraints).

• Lack of certification attesting to the 99.995-percent accuracy of the system, an explicit requirement under the terms of reference of the bidding. (Dennis Villorente, chair of the Comelec technical evaluation committee, said last week that there was such a certification from SysTest Lab Inc., but it called for compliance with so many “compensating controls,” which were not apparently met by Comelec, the PCS said).

• Removal of security safeguards such as digital signatures (replaced with iButton key and PIN features) and UV security mark censors (replaced with UV lamps).

• Failure to have an independent review of the hash/source code—and whether the source code used by all 76,000 precinct count optical scan (PCOS) machines was the same one stored at the Bangko Sentral ng Pilipinas.

Celis and Casiño pointed to the documentary film “Hacking Democracy,” produced in the United States to check the accuracy of the PCOS machines. It has been posted on YouTube under the same title. Based on the film, “switching of votes can happen,” Celis said.

• Late final testing and sealing.

• Lack of quality assurance in any changes in the AES.

• No full manual audit, but only five elective positions were audited (president, vice president, congressman, governor and mayor).

• No certification of the system integration test dubbed consolidated canvassing system, which starts from the PCOS transmission of results to the national canvassing.

As early as last year, the PCS had been asking Comelec to implement changes in the system, but nobody listened.

In a letter to the Comelec on May 13, the PCS sought an immediate meeting with the poll body, wary about the implications of the recently concluded polls.

“It is our intention neither to discredit the Commission nor favor any political parties but rather to assist the Commission to enhance the transparency and acceptability of the election results,” Celis said.

The meeting did not materialize, but Celis appeared as ICT resource person in the national canvassing of votes for president and vice president by Congress at the Batasan Pambansa complex in Quezon City two weeks ago.

Audit of CF cards

Casiño called on the Comelec and possibly Congress, sitting as the national board of canvassers, to order an audit of all CF cards, which contained software codes and configuration files that were used in the scanning, counting and transmission of the election results.

The CF card is one of the most critical components of the AES because it “controls access to the sensitive PCOS functions, governs how the PCOS software will read, validates and tabulates the ballots and directs the transmission of results,” Celis said.

As shown by the film, CF cards can be tampered with individually, contrary to Smartmatic’s pronouncement, said the two PCS officials.

Without an audit log to check all data stored by all CF cards, the country would have new government officials although “we don’t know who voted (for them),” Casiño said.

Too much intervention

Celis explained that what was evident in the conduct of the AES was that the electoral environment allowed too much human intervention—the very evil which the automation law had sought to destroy to end decades of shameless fraud under the antiquated electoral system.

He pointed to “errors or inaccuracies” as a result of the failure to comply with the safeguards.

Casiño said that the PCS—in coming out with this negative assessment of the conduct of automated polls—was only “qualifying the statements (already) said … in the context of a technical scenario.”

The PCS said it was willing to be a resource person in any legal proceeding in the aftermath of the elections. –Michael Lim Ubac, Philippine Daily Inquirer