Hacking the Elections

By ROM FERIA
April 27, 2009, 3:28pm

I wrote about the importance of having the software for the election released as open source not too long ago and the Comelec has agreed to show the code to a select few. Why only to a few people remains a mystery. I mean, what are they trying to hide? Show us the code! :)

Next event was the "hack the machine and win money" stunt. I am not saying that the machines that the Comelec will be procuring are hack-proof -- there is no such a thing -- but hacking the machines is quite difficult to stage. The question is - will Comelec allow everyone to hack the machine or wait until the actual elections for the hacking to commence.

Having the ballots counted by a machine means trusting the machines and those who have configured it. There should not be a problem if the public trusts the Comelec but with the incidents of the previous national election, I think that the Comelec has to regain that trust again. Unfortunately, having a machine count the ballots - which may be tampered PRIOR to deployment - is such a high risk for the poll body.

The source of possible cheating, at this scale, points to whoever supplies the machine. If a candidate, somehow, gets linked to the supplier, then that changes the playing field.

If the candidate is corrupt, s/he can get the supplier to program the machine to do the automated dagdag-bawas and burn the code to the NVRAM. The machine can be reset before the start of the counting but since this malicious code is embedded already, it cannot be replaced easily. Unless the Comelec knows about this, there is no way to find out until it is too late.

In addition, the Comelec MAY be accused of tampering with the machine IF the current administration's candidates win. Whether this is true or not, the Comelec cannot do anything BUT revert back to manual tallying to validate the machine's tally. This is what happened in the US not too long ago.

The manual tallying on the precinct level is still the best way to ensure that votes are counted properly -- under the supervision of human beings and in the presence of the watchers. Whilst it may take a few hours longer than the machine, the infrastructure is in place should someone from the precinct contests the results.

The tallying of the numbers from the precincts can easily be automated and can easily be verified since these are already validated by the election officers (election inspectors) and watchers. This tallying exercise is what delays the entire election process -- I don't know why it takes that long for people to do additions!

So, no matter how I look at it, the Comelec has still a long way to go to properly implement an automated election. I honestly think that it should first do everything to regain the public's trust!

Comments