Namfrel pushes one more step to make ACMs more secure
The National Citizens’ Movement for Free Elections (Namfrel) has called on the Commission on Elections (Comelec) to undertake measures to dispel any doubt about the security of the automated counting machines (ACMs) to be used in the May polls.
The watchdog made a recommendation on Thursday to address concerns that the ACMs may be vulnerable to hacking while connected to the internet on Election Day.
It asked the Comelec to specifically instruct local electoral boards not to connect the ACMs until after the printing of the first batch of the nine election returns following the end of voting in the May 12 midterm polls.
Election returns refer to the reports submitted to the board of canvassers after the counting of votes at the precincts. It is a summary of the number of votes cast for each candidate.
Sued for videos
Lawyer Jeryll Harold Respicio, a vice mayoral candidate in Isabela province, earlier claimed that the ACMs would be connected during the voting period on Election Day, rendering them vulnerable to attacks altering the ACM software and manipulating the election results.
Respicio also stated that there was nothing in the general instructions to the electoral boards telling them not to connect the ACM to the internet until such time that the election returns have been printed and the ACM is ready to transmit the election results.
The lawyer posted videos about his claims on Facebook in January and, as a result, was sued by the Comelec for violation of Article 154 (Unlawful Use of Means of Publication and Unlawful Utterances) of the Revised Penal Code, in relation to Section 6 of Republic Act No. 10175, or the Cybercrime Prevention Act of 2012.
The videos were later taken down by Facebook, but Respicio, claiming freedom of speech, has continued to criticize the Comelec and challenge the poll body to disprove his claims.
Volunteers see lawyer’s point
The lawyer has also obtained support from various cause-oriented groups, such as the Clergy for Good Governance and Alyansa ng Nagkakaisang Mamamayan.
Namfrel said its volunteers from cybersecurity circles agree with Respicio’s point that connecting the ACM to the internet during the voting period renders the ACM vulnerable to possible attacks.
The watchdog added that it also “confirms” Respicio’s assertion that there is no provision that explicitly instructs the electoral board not to connect the ACM to the internet until after the election returns had been printed and the ACM is ready to transmit these returns.
It said the instructions given in Comelec Resolution No. 11098, issued on Jan. 21, show that the ACM will be connected to the internet only after the first batch of election returns has been printed.
Its Annex B contains ACM operation procedures to be followed during the final testing and sealing, on Election Day, and for the transmission of election results.
However, “to dispel any doubt,” Namfrel recommended the inclusion of a provision telling the electoral boards “not to connect the ACM to the internet until after the first batch of nine copies of the election returns shall have been printed and the ACM is ready to transmit the election returns to designated servers.”
Overall observation
Of the nine returns, seven will go to the city or municipal board of canvassers, Comelec, Congress, Parish Pastoral Council for Responsible Voting, Namfrel and the dominant majority and minority parties.
The eighth copy will be left inside the ballot box, while the ninth will be posted on a wall within the premises of the polling place or counting center.
Citing its overall observation, Namfrel said the Comelec had ensured that the minimum capabilities of the automated election systems (AES) as set by law were present and that security measures against hacking had been put in place.
Among these measures, it noted, are the controlled access to the ACM through the use of smart cards as keys with corresponding passwords for each member of the electoral board; encryption of the election returns prior to transmission; generation of unique hash codes of the machine executable code of the ACM software and software for the other AES components; and the use of secure transmission channels as required by the poll automation law.
