Last credibility check:random manual audit

Was there fraud in the presidential and VP election? At least 1,800 vote counting machines (VCMs) broke down on E-Day, affecting 1.44 million voters. Comelec count was unusually fast. An hour after the close of balloting, 8:02 p.m., its transparency server tallied 20.05 million votes, representing 37.96 percent of votes cast (80.38 percent turnout, or 52.81 million of 65.7 million registered voters).

At once the votes of the two leading presidential candidates flattened at a ratio of 68:32 and continued till end of count. Possible in a landslide. But also at 8:02 p.m. a flat curve emerged till the end in the close fight between the third and fourth candidates. Same with the top two VP candidates. Highly improbable, mathematicians cite the Law of Large Numbers.

Given bailiwicks and varying voter patterns per region, candidates’ curves should first fluctuate then flatten in the end. Foolish to claim that pre-election surveys showed such results. Elections validate surveys, not the other way around.

Yet those are not evidence of fraud. At best, they’re only clues.

But set aside partisan passions. Forget who won or lost. Listen to what info-technologists and election experts say. Voters will see that May 9 was a flawed automated election – again. As in 2010, 2013, 2016 and 2019, provisions of the Automated Election Systems (AES) Law were unmet.

That law provides for an unbroken chain of safeguards and processes. “But there were too many gaps,” says Nelson Celis, PhD, of AES Watch. Among these were in:

(1) Digital signatures – Last March 23 Celis and National Press Club president Paul Gutierrez petitioned the Supreme Court. “Command the Comelec to assign digital signatures (passcodes) to the three election inspectors per precinct.” This was after Comelec said only those in Metro Manila, Cebu City and Davao City would be assigned passcodes from the roster of the Dept. of Information and Communications Technology. In the rest of Luzon, Visayas and Mindanao only the chairmen were to be given passcodes, not the two others. For authentication, three digital signatures must be keyed in to boot each of the 106,000 VCMs and transmit election returns (ERs). With only one signatory, any fraud can happen at precincts. The SC issued no mandamus.

(2) Monitoring of ballot printing and SD (secure digital) card formatting – Citing pandemic restrictions, Comelec disallowed monitoring by party reps and election watchdogs until after 70 percent of ballots already were printed. Pray that the ballots were untampered. One Filipino info-technologist reported to Comelec on March 22 when refused entry to witness the SD card formatting at the VCM warehouse. No action taken, Celis says.

(3) Documented results – Section 11 of the AES Law requires Comelec to release six findings 90 days before E-Day or Feb. 9. Those are: field test and mock election; audit of accuracy, functionality and security controls of AES software; source code review of VCMs, transmission router, consolidation/canvassing system; certification that the source codes are kept in escrow at the Bangko Sentral; certification that the reviewed source codes are those used by the equipment; and a continuity plan to avoid failure of elections at voting, counting or consolidation. Comelec resolved to release these only on May 6, three days before E-Day, stating that some findings were received only the previous day. It posted the resolution on May 11, two days after E-Day; the links to the findings cannot be opened or accessed. No Filipino IT expert was able to review it.

(4) Source code review of central, backup and transparency servers – A reputable international body must certify the source codes, in this case Pro V&V of America, 90 days before E-Day. Comelec must release details for scrutiny by Filipino experts as it did in 2010 with then-certifier SysTest Labs. Only then can Comelec issue a trusted-build, or executable file to run the VCMs and servers. Comelec issued a trusted-build in January and revised it in February. Source code reviews went on till April. “Reviewers say there were third and fourth revisions,” Celis remarks.

(5) Check of ERs versus transparency server – The tally of precinct ERs must jibe 100 percent with the transparency server because all came from the same 106,000 VCMs. But because of gaps in the four above processes, there could be variants. Watchdog Parish Pastoral Council for Responsible Voting did report 1.6 percent difference between its tally and the Comelec server. That represents 1,696 precinct VCMs or 1,356,800 votes. Could there be more, asks former DICT secretary Eliseo Rio.

(6) Random manual audit (RMA) – Ballots in 759 precincts, one per district or 607,200 votes, are to be manually checked against the ERs. Those must be chosen publicly by tambiolo at the close of balloting. Precinct inspectors must then commence audits, observed by party reps, watchdogs and voters. Since 2013 the selection has been behind closed doors. This 2022 Comelec did it via an Automated Random Selection Program in a laptop. Celis and Rio doubt if the ARSP source code was reviewed at all. The RMA is being held in a Manila venue. Comelec gave field offices two to five days to send over the ballot boxes. Who will transport the boxes? Are those properly sealed and padlocked? The RMA supervisor, watchdog National Citizens Movement for Free Elections, does not know the logistics firm; nor does it hold the padlock keys. “The teacher-auditors are in a bubble; they’re incommunicado,” says Namfrel chairman Gus Lagman, also former Comelec commissioner.

All these dent the credibility of Election 2022.

But there’s a remedy. Publicly re-select the 759 precincts. To shorten the time, prepare one tambiolo for each region. Open the audit to the public.