Source code hack-resistant, expert tells Congress

MANILA, Philippines - The source code of the software to be used in the May elections remains “very difficult” to hack, experts and officials of the Commission on Elections (Comelec) told the joint congressional oversight committee on automated elections yesterday.

Pablo Manalastas, a source code reviewer, said  it would be hard for cheaters to tamper with the source code of the consolidation and canvassing system, and vote counting machines (VCMs) supplied by Smartmatic Inc.

“It’s very difficult to prove these programs are written to be malicious, to cheat in favor of one candidate over another. Smartmatic has put in enough security to make it hard for outsiders to use the system to cheat,” Manalastas told the panel chaired by Sen. Aquilino Pimentel III.

“All the challenges to hack into the system fail, because the system is so secure. In order to be successful in hacking the system, you have to have the cooperation of people who are in charge of the databases and who have physical control of the machines,” he said.

He pointed out the only way to manipulate the codes is from the inside, meaning, it could be done if one has all the passwords and “sign-in keys.”

Manalastas also cited the strict security measures – including “frisking” implemented by Smartmatic during the review of the source.

The committee held the hearing following the detection of glitches in the mock elections last week.

The Comelec attributed the glitches to the reported incompatibility of the source code with the election management system (EMS), which contains important information like the name of candidates, ballot serial numbers and details about some polling precincts.

The Comelec also brought VCMs during the hearing to demonstrate how voters should use them, and how fool-proof they are.

Commissioner Christian Robert Lim told the panel the Comelec is set to conduct more field tests in the coming weeks along with Denver-based internal certifier of source codes SLI Global Solutions.

He said glitches detected in the first tests had been addressed.

Lim also cited several instances of delays in Comelec’s preparations for the May elections but assured the committee the poll body would be able to catch up.

He cited at least 12 instances of delays since last year in Comelec’s preparations, including deferments or postponements in contract signing with Smartmatic, preparation and finalization of the list of candidates, and in the delivery and field testing of the VCMs.

There was also a brief debate on the decision of the Comelec not to configure the VCMs to print receipts. The receipt is meant to show the voter that his or her ballot has been received and read.

Comelec Chairman Andres Bautista said the decision not to print receipt was reached in a unanimous vote.

He said a receipt could be used for vote buying and would only lengthen the voting process by several hours.

“The long time and long lines could disincentivize voter,” Bautista said, even as he cited a Supreme Court ruling stating the ballot itself is the document that can be used for auditing.

He said the receipts could also cause confusion as the VCM can churn out a different result from what the voter may be expecting if the ballot is marked erroneously.

 Shorter ballots

 Lim also said the ballots to be used in the coming elections would be just slightly longer than an office bond paper.

He said the cleansing of the list of candidates has allowed a redesigning of the ballots to make them shorter.

A ballot for the May 9 polls would only be 15 inches in length as against the 27 inches long ballot used in 2010 and 2013 elections.

The Comelec earlier trimmed the list of presidential candidates from 170 to six, and from 170 to 50 for senatorial candidates.

The number of party-list groups vying for seats in Congress has also been reduced from 203 to 115.

“The impact of the cleansing (of the lists) was on the size of the ballots,” he said.

He said the ballots for the Autonomous Region in Muslim Mindanao would be slightly longer – at around 22 inches – as they would include Arabic translations. The region has a longer list of candidates.

During the demonstration of the VCMs, Comelec spokesman James Jimenez asked voters to properly mark their ballots with official markers.

“Please don’t put smileys, or ‘Xs’ or lines in the ballot, or your votes will not be read,” Jimenez said.

But he said the VCMs have been configured to allow for certain degree of excesses in the shading of the ovals.

“And please, don’t take home the markers as souvenirs – they’re not souvenirs,” he said.

Meanwhile, the Comelec has also directed its field officials to conduct public hearings on mall voting in compliance with the “notice requirement of the law” as well as “to ascertain the sentiments of the affected voters, candidates, political parties, accredited citizen’s arms and other stakeholders.”

In Resolution No. 10059, the Comelec has directed concerned city or municipal elections officers to hold one public hearing in each barangay with clustered precincts to be transferred to malls. The hearing should be held in the barangays concerned or in the malls where the precincts would be transferred, the Comelec said in the resolution.

The resolution stated the Comelec chairman himself supports the “concept of mall voting.”

“The commission believes that the conduct of voting at the pre-selected malls will enhance the voting experience of the voters in the forthcoming May 9, local and national elections and Autonomous Region in Muslim Mindanao elections,” it noted.

The poll body added that as part of preparations for  mall voting, “there is a need to finalize” the number of voters, and clustered precincts to be transferred as well as the total number of VCMs, official ballots and other election materials, supplies and paraphernalia to be transferred to the malls.

Comelec, in its resolution, also stressed that public hearing “shall be summary in nature” and should be done to give parties the “opportunity to be heard.” – With Sheila Crisostomo