AAutomated utomated EElection lection SSystemystemModernizing Democracy or Modernizing Cheating?Modernizing Democracy or Modernizing Cheating?

Technical and Election Management Technical and Election Management BriefingBriefing

Center for People Empowerment in Governance (CenPEG)

WHY AUTOMATE?WHY AUTOMATE?

To eliminate clerical, human intervention-related errors

Process is too long and exhausting. It

takes almost two months before national positions are proclaimed.

To remove conditions for DAGDAG BAWAS or wholesale cheating

What is the AES?What is the AES?

““A system using appropriate A system using appropriate technologytechnology which has been demonstrated in the which has been demonstrated in the voting, counting, consolidating, voting, counting, consolidating, canvassing, canvassing, andand transmissiontransmission of of election result, and other electoral election result, and other electoral process” (RA 9369)process” (RA 9369)

CenPEG, 2009

Public perception of the AESPublic perception of the AES

Less human interventionLess human interventionCheating would be impossible in an Cheating would be impossible in an

automated electionautomated election

AES = CLEAN ELECTIONS

CenPEG, 2009

But automated elections also But automated elections also commit mistakes because of…commit mistakes because of…

1. Software errors1. Software errors2. Hardware errors2. Hardware errors3. Human errors3. Human errors4. Poor or Flawed design4. Poor or Flawed design5. Deliberate tampering5. Deliberate tampering6. Problematic transmission & power supply6. Problematic transmission & power supply

Introducing theIntroducing the……The Philippine AES SystemThe Philippine AES System

Election Management System (EMS)Election Management System (EMS)Precinct Count Optical Scan (PCOS)—Precinct Count Optical Scan (PCOS)—

Optical Mark Reader (OMR) SystemOptical Mark Reader (OMR) System

Precinct Machine – Precinct Machine – SAESSAES-1800-1800Consolidation / Canvassing System (CCS)Consolidation / Canvassing System (CCS)

CCS Computer -- CCS Computer -- REISREIS

CenPEG, 2009

•AES F e a t u r e s–MANUAL VOTING using PAPER

BALLOTS: voter shades oval next to names of chosen candidates

–COMPUTERIZED COUNTING at precinct level

–COMPUTERIZED CANVASSING consolidation and canvassing at municipal, provincial, national COMELEC, and national Congressional levels

CenPEG 2009

SMARTMATIC AUDITABLE SMARTMATIC AUDITABLE ELECTION SYSTEM ELECTION SYSTEM (SAES 1800)(SAES 1800)

PCOS – OMR Machine for CountingPCOS – OMR Machine for Counting

CenPEG, 2009

Introducing…Introducing…

SAESSAES andand REISREIS For COUNTINGFor COUNTING For CANVASSINGFor CANVASSING

SAES SAES 18001800PPrecinct recinct CCount ount

OOptical ptical SScan / can /

OOptical ptical MMark ark

RReader (OMR) eader (OMR) ----(PCOS-OMR)(PCOS-OMR)

• Detects the Detects the absence or absence or presence of a mark presence of a mark in predefined in predefined positions on a formpositions on a form

CenPEG, 2009

CANVASSING LEVELSCANVASSING LEVELSData FlowsData Flows

CenPEG, 2009

Operating System: GNU/LinuxOperating System: GNU/LinuxSoftware possibly written in web server Software possibly written in web server

side programming language (e.g. JAVA)side programming language (e.g. JAVA)

Consolidation & Canvassing SystemConsolidation & Canvassing System (CCS) (CCS)

Real-Time Electoral Information SystemReal-Time Electoral Information System (REIS)(REIS)

CenPEG, 2009

Canvassing Canvassing FeaturesFeatures Cities/Municipal Cities/Municipal

Input: ERs from precinctsInput: ERs from precincts Provincial/CongressionalProvincial/Congressional

Input: Statement of Votes and Certificate of Input: Statement of Votes and Certificate of Canvass from Cities/MunicipalitiesCanvass from Cities/Municipalities

NationalNational Congress: President and Vice President Congress: President and Vice President

contestscontests Comelec: Senators and Party List contestsComelec: Senators and Party List contests Input: Statement of VotesInput: Statement of Votes

Comelec back-up serverComelec back-up server Dominant majority/minority parties, citizens Dominant majority/minority parties, citizens

arm, KBP serverarm, KBP serverCenPEG, 2009

PCOS MachinePCOS Machine

(for counting)(for counting)

SAES -1800SAES -1800

CCS Server CCS Server (for canvassing) (for canvassing)

REISREIS

CenPEG, 2009

3030 VULNERABILITIESVULNERABILITIES

Pre-election * Election * Canvassing * ProclamationPre-election * Election * Canvassing * Proclamation

CenPEG, 2009

6 6 Vulnerable spots in the AES2010: Vulnerable spots in the AES2010:

Pre ElectionPre Election Voters’ list, project of precincts, candidates’ list Voters’ list, project of precincts, candidates’ list

Possible manipulation of listsPossible manipulation of lists

Printing of ballots Printing of ballots Excess ballots, preciseness of printing, security marksExcess ballots, preciseness of printing, security marks

Storing of ballots Storing of ballots Security of storage, pre-shading of ballotsSecurity of storage, pre-shading of ballots

Shipping of packed ballotsShipping of packed ballots Security of ballots during delivery, ensuring that ballots Security of ballots during delivery, ensuring that ballots

get to their proper destinationget to their proper destination

CenPEG, 2009

Deployment of machinesDeployment of machinesSecurity of machines, suitability to local Security of machines, suitability to local

conditionsconditionsFinal testing and sealing of machinesFinal testing and sealing of machines

Long lapse between testing and actual Long lapse between testing and actual election day, security of storageelection day, security of storage

8 8 Vulnerable spots: Vulnerable spots: Pre ElectionPre Election

CenPEG 2009

66 Vulnerabilities On Election DayVulnerabilities On Election Day

• Hardware Failure: Start up or boot failure

• Pre-marked legitimate ballots might be fed

• Legitimate ballots rejected

• Long ballot twists and jams

• Machine fails to recognize dot, check, and x marks

• Voter cannot verify if ballot is read/scanned correctly

• Failure to accept password

• Wrong CF card inserted

• Failure of initialization function

• Machine has stored ballot images already

• Wrong program installed• Paper jam

• Failure of function to close polls (premarked ballots can still be inserted)

• Misreading of ballots• Mis-crediting of marks• Erroneous counting• Printer fails

• Signing/encryption/transmission failure

• Failure to accept password• Connectivity failure

BEI inserts physical key into PCOS machine to power it

BEI inserts CF card into PCOS machine to configure

it

BEIs type passwords to initialize the machine – zero

votes

Voter fills up and feeds ballot into the machine BEIs close poll, presses

function key to count

and print ER

BEI attaches external modem to access internet

connection

BEIs digitally signs electronic ER for

transmission

Canvassing

• No cellular signal in area• One modem shared by all

PCOS machine in voting place

CenPEG,2009

Counting

T r

a n

s m

i s

s i

o n

InitializationInitialization

InitializationInitialization Initialization ReportInitialization Report

BCenPEG, 2009

VotingVoting

Sample BallotSample BallotFeeding the Ballot Feeding the Ballot

into the Machineinto the Machine

BCenPEG, 2009

VotingVoting

BCenPEG, 2009

Election ReturnElection Returnand Transmission of Votesand Transmission of Votes

ER CertificationER Certification External ModemExternal Modem

BCenPEG, 2009

5 5 MAJOR TECH ISSUESMAJOR TECH ISSUES

Software and Data IntegritySoftware and Data Integrity

CenPEG, 2009

HighlightsHighlights of Technical Concerns of Technical Concerns

Verifiability of Voter’s ChoiceVerifiability of Voter’s Choice Machine Interpretation of BallotMachine Interpretation of Ballot

Program Correctness and Integrity VerificationProgram Correctness and Integrity Verification Review of Source CodeReview of Source Code

Protection of Transmitted DataProtection of Transmitted Data Digital SignaturesDigital Signatures

System AdministrationSystem Administration Root Users / System AdministratorsRoot Users / System Administrators

Transmission / ConnectivityTransmission / Connectivity

CenPEG, 2009

Voter’s Choice VerifiabilityVoter’s Choice Verifiability

““Provide the voter a system of verification to Provide the voter a system of verification to find out whether or not the machine has find out whether or not the machine has

registered his choice.” registered his choice.”

[Article 7 (n) of RA 9369][Article 7 (n) of RA 9369]CenPEG, 2009

Disabled functionDisabled function

Voter’s Choice VerifiabilityVoter’s Choice Verifiability

No sufficient mechanism for voter to verify No sufficient mechanism for voter to verify that the computer has interpreted his ballot that the computer has interpreted his ballot correctlycorrectly. .

SafeguardSafeguard Comelec has to enable the feature of the SAES-1800 Comelec has to enable the feature of the SAES-1800

that will show how the PCOS machine interpreted the that will show how the PCOS machine interpreted the ballot. ballot.

CenPEG 2009

Program CorrectnessProgram Correctness

RA 9369 Section 14 requires Comelec to make RA 9369 Section 14 requires Comelec to make the source code available and open to review by the source code available and open to review by

all interested political parties and groups.all interested political parties and groups.

CenPEG, 2009

Source CodeSource CodeHuman readable version of the computer Human readable version of the computer

programs running on the PCOS and CCS programs running on the PCOS and CCS computers.computers.

Will reveal whether the counting and Will reveal whether the counting and canvassing are done properlycanvassing are done properly

To prove that the PCOS and CCS To prove that the PCOS and CCS programs follow RA 9369 and COMELEC programs follow RA 9369 and COMELEC ToRToR

CenPEG, 2009

An illustration of Java source code with prologue comments indicated in red, inline comments indicated in green, and program code indicated in blue.

CenPEG, 2009

Reviewed and approved

Source CodeMachine

executable format

Burned into each PCOS machine /

Install in CSS

SafeguardSafeguard

CenPEG, 2009

Program Integrity VerifierProgram Integrity Verifier

How can we know that the How can we know that the approved source codeapproved source code is installed? is installed?

CenPEG, 2009

SafeguardSafeguard Comelec should subject the approved program Comelec should subject the approved program

to an integrity verifier (hash) functionto an integrity verifier (hash) function The hash value must be provided to the BEIs The hash value must be provided to the BEIs

and pollwatchers on election day as basis for and pollwatchers on election day as basis for comparison of the hash value of the PCOS comparison of the hash value of the PCOS machine in the precinctmachine in the precinct

CenPEG, 2009

CenPEG, 2009

Protection of Transmitted DataProtection of Transmitted Data

Immutability of Precinct DataImmutability of Precinct Data

CenPEG, 2009

RA 9369RA 9369Section 19 Electronic ReturnsSection 19 Electronic Returns: : "The "The

(precinct) election returns (ER) (precinct) election returns (ER) transmitted electronically and transmitted electronically and digitally signeddigitally signed shall be considered shall be considered as official election results and shall be as official election results and shall be used as the basis for the canvassing used as the basis for the canvassing of votes and the proclamation of a of votes and the proclamation of a candidate."candidate."

CenPEG, 2009

Comelec ImplementationComelec ImplementationGuide: ToR/RfP AES2010Guide: ToR/RfP AES2010

44. . Counting, Consolidation and Generation of Counting, Consolidation and Generation of ERER

4.34.3 The BEI shall physically sign and affix The BEI shall physically sign and affix their thumbprints on all copies and on all their thumbprints on all copies and on all pages of the ERpages of the ER

4.54.5 The The BEI shall digitally signBEI shall digitally sign and encrypt and encrypt the internal copy of the ER the internal copy of the ER (RA8792; RA9369)(RA8792; RA9369)

CenPEG, 2009

Digital Signature / Secret KeyDigital Signature / Secret Key

A summary (hash value) of the ER encrypted A summary (hash value) of the ER encrypted using the BEI’s secret key. using the BEI’s secret key.

The digital signature serves two purposes: The digital signature serves two purposes: Identifies the BEI personnel who signed the precinct Identifies the BEI personnel who signed the precinct

ER ER It ensures that the precinct ER is not modified in any It ensures that the precinct ER is not modified in any

way by way by dagdag-bawasdagdag-bawas

CenPEG, 2009

CenPEG, 2009

What Happens If AnotherWhat Happens If AnotherPerson Knows the Teacher'sPerson Knows the Teacher's

Secret Key?Secret Key?

The other person, with malicious intent, can remove theThe other person, with malicious intent, can remove theBEI's signature, change the contents of the ER, and signBEI's signature, change the contents of the ER, and signthe modified ER (again) with the BEI's secret key.the modified ER (again) with the BEI's secret key.

Only the person who has possession of the BEI's secret Only the person who has possession of the BEI's secret key can resign the ER.key can resign the ER.

Any person who has possession of a majority of the BEI’sAny person who has possession of a majority of the BEI’ssecret keys can control the results of Election 2010secret keys can control the results of Election 2010

CenPEG, 2009

Comelec's ErrorComelec's Error

Bid Bulletin No. 10 (2009/04/15):Bid Bulletin No. 10 (2009/04/15):

The digital signature shall be The digital signature shall be assigned by the winning assigned by the winning bidder to all members of the BEI and the BOCbidder to all members of the BEI and the BOC (whether (whether city, municipal, provincial, district). For the NBOCs, thecity, municipal, provincial, district). For the NBOCs, thedigital signatures shall be assigned to all members ofdigital signatures shall be assigned to all members ofthe Commission and to the Senate President and thethe Commission and to the Senate President and theHouse Speaker. The digital signature shall be issuedHouse Speaker. The digital signature shall be issuedby a certificate authority nominated by the winningby a certificate authority nominated by the winningbidder and approved by the Comelec.bidder and approved by the Comelec.

CenPEG, 2009

SMARTMATIC WILL CREATE THESMARTMATIC WILL CREATE THEPRIVATE-PUBLIC KEY PAIRSPRIVATE-PUBLIC KEY PAIRS

In Smartmatic's financial proposal, Item 1.2.1.4 consists In Smartmatic's financial proposal, Item 1.2.1.4 consists of 246,600 sets of 2048-bitof 246,600 sets of 2048-bitprivate public key pairs for BEIs (3 per PCOS)private public key pairs for BEIs (3 per PCOS)at the cost of PHP0.00. The BEIs will beat the cost of PHP0.00. The BEIs will beanonymous (will not be known by name) soanonymous (will not be known by name) sothat any teacher can sign in any BEI position.that any teacher can sign in any BEI position.

CenPEG, 2009

SafeguardsSafeguards

Comelec should ensure that the secret key Comelec should ensure that the secret key of the teacher is of the teacher is known only by the teacherknown only by the teacher

The The ER and digital signatureER and digital signature (encrypted (encrypted hash value) hash value) should nevershould never be separated be separated during transmission and storage in the during transmission and storage in the Comelec databasesComelec databases..

CenPEG, 2009

System AdministrationSystem Administration

He Who Controls the Technology, He Who Controls the Technology,

Controls the VotesControls the VotesCenPEG, 2009

System AdministrationSystem Administration

The root user/system administrator or The root user/system administrator or “super user”“super user”A HUMAN who can issue any command A HUMAN who can issue any command

available on the computer, normally to do available on the computer, normally to do system maintenance or to recover from failuresystem maintenance or to recover from failure . .

The root user can edit the precinct The root user can edit the precinct ERs if he has access to secret keys ERs if he has access to secret keys and change the election results.and change the election results.

CenPEG, 2009

SafeguardsSafeguardsComelec should have enough precautions so Comelec should have enough precautions so

that a that a root user is not needed to manually root user is not needed to manually interfere with the election programsinterfere with the election programs

In case of a breakdown, the root user’s In case of a breakdown, the root user’s activities are all activities are all properly logged in publicly properly logged in publicly displayed audit and log files in real time displayed audit and log files in real time to be to be scrutinized by poll watchers.scrutinized by poll watchers.

The root user The root user must not be allowed to log-in must not be allowed to log-in from remote / different locationfrom remote / different location

CenPEG, 2009

TransmissionTransmissionConnectivityConnectivity

CenP

EG

AE

S R

esearch

Transmission by cellphone : 72%

Transmission by Internet : 10%

Public elementary schools have either no internet Public elementary schools have either no internet connection or limited internet connectionconnection or limited internet connection. .

Reality in 45,255 public Reality in 45,255 public elementary schoolselementary schools

PowerPower Stable – 84%Stable – 84% Scheduled – 3%Scheduled – 3% No report – 2%No report – 2% None – 11%None – 11%

InternetInternet Cellular – 72%Cellular – 72% Wired – 10%Wired – 10% No report – 2%No report – 2% None – 16%None – 16%

CenPEG 2009

July 5, 2009, Smartmatic: Dream polls for May 2010: “ERs would be

transmitted by cellular phone, landline or satellite at the end of voting hours…. There’ll be no more human intervention.”.

September 16, 2009, Chairman Jose Melo

…admits that Comelec is preparing for the conduct of manual polls in “30% to 50 % of areas in the country,” specifically places that are prone to power failures and network transmission issues

Doomsayer?

CenPEG 2009

What happens if vulnerabilities are not What happens if vulnerabilities are not addressed, and safeguards prescribed addressed, and safeguards prescribed in the law not properly implemented?in the law not properly implemented?

Unless these valid issues are addressed Unless these valid issues are addressed satisfactorily by Comelec, Smartmatic, the satisfactorily by Comelec, Smartmatic, the Comelec Advisory Council (CAC), the Comelec Comelec Advisory Council (CAC), the Comelec Technical Evaluation Committee (TEC), and the Technical Evaluation Committee (TEC), and the Joint Congressional Oversight Committee, the Joint Congressional Oversight Committee, the computerized elections in 2010 can lead to:computerized elections in 2010 can lead to:

Wholesale computerized cheating Wholesale computerized cheating oror

Failure of elections.Failure of elections.CenPEG 2009

Doom saying or just PLAIN TRUTH?Doom saying or just PLAIN TRUTH?Transparency is the call of the times Transparency is the call of the times

CenPEG 2009

HOW YOU CAN HELPHOW YOU CAN HELP

CenPEG 2009

- Advocate for the proper implementation of Advocate for the proper implementation of SAFEGUARDSSAFEGUARDS in the AES in the AES

- Help publicizeHelp publicize the issues, educate the public about the the issues, educate the public about the AES, vote and guard AES, vote and guard vsvs its vulnerabilities its vulnerabilities

- Help compelHelp compel the Comelec-CAC-Smartmatic-TIM to plug in the Comelec-CAC-Smartmatic-TIM to plug in the proper safeguards like the SOURCE CODE REVIEWthe proper safeguards like the SOURCE CODE REVIEW

- No short cutsNo short cuts to transparent, credible and fair elections in to transparent, credible and fair elections in May 2010May 2010

- Register, Go out & Vote, Watch & GuardRegister, Go out & Vote, Watch & Guard against cheating & against cheating &- AffirmAffirm the sovereign will of the Filipino people in the May the sovereign will of the Filipino people in the May

2010 elections2010 elections

Call 4 VIGILANCE & ACTION

CenPEG 2009

Contact InformationContact Information CenPEGCenPEG: : http://www.cenpeg.orghttp://www.cenpeg.org Cenpeg.info@gmail.comCenpeg.info@gmail.com +632-9299526+632-9299526

For briefings, hand-outs, pollwatch trainings For briefings, hand-outs, pollwatch trainings and voters’ education on the AES 2010and voters’ education on the AES 2010

CenPEG 2009