LITO AVERIA Ppt_Vulnerable Spots of PCOS May 2009

8/8/2019 LITO AVERIA Ppt_Vulnerable Spots of PCOS May 2009

1/65

Automated Election SystemAutomated Election SystemThe Challenge: Meaningful Poll WatchingThe Challenge: Meaningful Poll Watching

ByBy

Angel Lito S. Averia, Jr.Angel Lito S. Averia, Jr.

Prepared for the Center for PeoplePrepared for the Center for PeopleEmpowerment in Governance (CenPEG)Empowerment in Governance (CenPEG)


2/65

Automated Election SystemAutomated Election System

ConcernsConcerns

OperationsOperations

CheatingCheating FraudFraud

SabotageSabotage


3/65

Operational Problems with OMROperational Problems with OMR

Valid ballots that were crumpled, folded (to fit in

the size of the ballot box) and those that contained

unnecessary markings or smudges as well asthose lightly shaded ballots were rejected, which

slowed down the counting.

CAC Report on the 2008 ARMM Elections


4/65


The number of ballots to be counted per ACM

was not as it was projected. There are

discrepancies in the counting of ballots between

those who actually voted with results counted. An

example of this was experienced in one of the

precincts of Shariff Kabunsuan where the actual

number of voters is 371 but the machine countedonly 276, there was a discrepancy of 95 ballots

papers. But, after the BEIs conducted a recount

the machine counted 365.



5/65


Incidents of over voting in some precincts that

used OMR, such as Bumbaran, Lanao del Sur,

were also encountered because of BEIs voting

in their assigned precincts. In these cases the

result was invalidated (treated as zero) and

COMELEC had to override it.



6/65


The Counting and Canvassing System (CCS)

was not programmed to accommodate failure of

elections in some municipalities, such as

Balindong, Lanao del Sur and Basilan, thus the

machine had to be shut down to force the system

to close the counting. There were incidents

wherein the system would not close the counting

and canvassing since it showed that it didnt

count 100% of the total votes from all the

precincts though all precincts were able to count

the votes. CAC Report on the 2008 ARMM Elections


7/65


Some ACMs to include laptops and printers

overheated, stopped functioning and had to bere-started.



8/65


Constant paper jamming (of the OMR Ballots).



9/65


The attached full 196-key Keyboard in the

ACM is open to programming intrusion.



10/65


During the results transmission phase after the

closing of the election, it was observed that

problems were encountered by the supplier

involving the data communication infrastructure.Specifically, it was reported that in the areas of

Buluan, Pagagawan, Talayan and Shariff

Aguak, the BEIs had to personally bring the

USB flash drive to their respective canvassing

centers due to total transmission failure. This

incident holds true for several areas in

Maguindanao.CAC Report on the 2008 ARMM Elections


11/65


The supplier admitted that they used an

untried and untested private network that was

only installed too close to the Election Day.Not only did this delay the transmission but

also compromised the integrity and security of

the AES.



12/65


Another cause of delay in the consolidation and

transmission process was the physical

transportation of the OMR ballots to the countingcenters. The printing of 30 copies of the election

returns of each precinct and counting center also

slowed down the canvassing and transmission

process, which in turn inconvenienced the BEIs ofqueuing to wait for their turn before their ballots

could be counted and canvassed.



13/65

2008 ARMM Elections2008 ARMM Elections

The previously listed problems wereThe previously listed problems wereexperienced in the 2008 ARMM Electionsexperienced in the 2008 ARMM Elections

2008 ARMM Elections involved and2008 ARMM Elections involved andestimated 1.2mn voters in approximatelyestimated 1.2mn voters in approximately5,600 precinct clusters5,600 precinct clusters


14/65

Replication at Nationwide ScaleReplication at Nationwide Scale

The foregoing listed problems could recurThe foregoing listed problems could recurduring the 2010 national elections if theduring the 2010 national elections if the

COMELEC fails to put in place theCOMELEC fails to put in place thenecessary safeguardsnecessary safeguards


15/65

The Election ProcessThe Election Process

A Comparison of the TraditionalA Comparison of the Traditional

Process and the AutomatedProcess and the AutomatedProcessProcess


16/65

Machines & InfrastructureMachines & Infrastructure

TraditionalTraditional

NoneNone

AutomatedAutomated

Precinct Count OpticalPrecinct Count Optical

Scan (PCOS)Scan (PCOS) Canvassing ComputersCanvassing Computers

Central ServerCentral Server

TelecommunicationsTelecommunications

devices and networkdevices and network SoftwareSoftware


17/65


Machines could be riggedMachines could be rigged PCOS and Canvassing Computers: A programPCOS and Canvassing Computers: A program

or software could be embedded into firmwareor software could be embedded into firmware(burned into eprom) which can be installed on(burned into eprom) which can be installed onthe motherboard of the PCOS and/orthe motherboard of the PCOS and/orCanvassing Computers. The embeddedCanvassing Computers. The embeddedprogram or software could include hard dataprogram or software could include hard data

or randomly generate votes to favor a certainor randomly generate votes to favor a certaincandidate. The firmware could be installedcandidate. The firmware could be installedbefore the machines are shipped out of thebefore the machines are shipped out of themanufacturing facility or before the machinesmanufacturing facility or before the machinesare sealed days before the elections.are sealed days before the elections.


18/65


Machines could be rigged:Machines could be rigged: The PCOS and Canvassing Computers areThe PCOS and Canvassing Computers are

basically computersbasically computers Computers have central processing unitsComputers have central processing units

(CPU)(CPU) In the CPU is a program called the BIOS orIn the CPU is a program called the BIOS or

Basic Input/Output SystemBasic Input/Output SystemA malicious code designed to manipulate theA malicious code designed to manipulate the

results of the count or canvassing to favor aresults of the count or canvassing to favor acertain candidate could be embedded in thecertain candidate could be embedded in theBIOS.BIOS.


19/65


Machines could be riggedMachines could be rigged

Mitigation: Review/audit of the hardwareMitigation: Review/audit of the hardware

before sealing. This would, however, requirebefore sealing. This would, however, requirehighly skilled hardware engineers to reviewhighly skilled hardware engineers to reviewthe equipment circuitry.the equipment circuitry.


20/65


Software Program ComponentsSoftware Program Components

ImagingImaging

Optical mark readerOptical mark reader CountingCounting

PrintingPrinting

SigningSigning

EncryptionEncryption

TransmissionTransmission

CanvassingCanvassing


21/65



Different, rigged versions of the software thatDifferent, rigged versions of the software that

will create the image of the ballot, count thewill create the image of the ballot, count thevotes, and prepare the ER could be loaded invotes, and prepare the ER could be loaded in80,000 PCOS units.80,000 PCOS units.

General software failureGeneral software failure Software component failureSoftware component failure


22/65



Mitigation: inspection and testing of eachMitigation: inspection and testing of each

PCOS unit. However, it will be a HerculeanPCOS unit. However, it will be a Herculeantask to check all 80,000 PCOS units totask to check all 80,000 PCOS units todetermine if the same software is deployed.determine if the same software is deployed.


23/65

BallotBallot


elective positions andelective positions and

blank line(s) for eachblank line(s) for eachelective position.elective position.

AutomatedAutomated

Names of candidatesNames of candidates

for each electivefor each electiveposition are printed onposition are printed onthe ballot. Across thethe ballot. Across thename of eachname of eachcandidate name is acandidate name is a

figure (oval or square)figure (oval or square)which will be shadedwhich will be shadedby the voter.by the voter.


24/65

BallotBallot

Potential Problem:Potential Problem:

If the preIf the pre--printed ballots are preprinted ballots are pre--filled, there is nofilled, there is no

way to detect if one and the same person preway to detect if one and the same person pre--filledfilledthe ballots.the ballots.

The preThe pre--filled ballots may be read or scanned by thefilled ballots may be read or scanned by thePCOS before the PCOS is sealed with the connivancePCOS before the PCOS is sealed with the connivanceof the technical personnelof the technical personnel

Or, before opening of polls with the connivance of theOr, before opening of polls with the connivance of theBEIBEI


25/65

BallotBallot

Mitigation: At initialization of the PCOS, itMitigation: At initialization of the PCOS, itshould be demonstrated that no imagesshould be demonstrated that no images

are stored in the PCOS.are stored in the PCOS. Note: The RFP requires a function to showNote: The RFP requires a function to show

that all vote counters are zeroed. But nothingthat all vote counters are zeroed. But nothing

in the RFP requires the execution of ain the RFP requires the execution of afunction to show that there are no ballotfunction to show that there are no ballotimages stored in the PCOS.images stored in the PCOS.


26/65

PrePre--PollPoll--Opening ActivitiesOpening Activities


Preparation of electionPreparation of election

paraphernaliaparaphernalia

AutomatedAutomated

Preparation of electionPreparation of election

paraphernaliaparaphernalia Breaking of seal of theBreaking of seal of the

PCOSPCOS

Powering up the PCOSPowering up the PCOS

Execution of theExecution of theinitialization functioninitialization function


27/65

PrePre--PollPoll--Opening ActivitiesOpening Activities

ProblemsProblems

No sealNo seal

Seal brokenSeal broken

Failure to power upFailure to power up

No powerNo power

Defective UPS or power supplyDefective UPS or power supply Failure of the initialization functionFailure of the initialization function


28/65

Poll OpenPoll Open 7am to 6pm7am to 6pm

PCOS Unit FailurePCOS Unit Failure

Malfunction due to:Malfunction due to:

OverheatingOverheating Component shutdown (no power)Component shutdown (no power)

Machine or any component hangsMachine or any component hangs

Mitigation:Mitigation:

Rugged testing prior to election dayRugged testing prior to election day

Backup planBackup plan

Procedures to employProcedures to employ

EscalationEscalation


29/65

PrePre--PollPoll--Opening Activities orOpening Activities or

Poll OpenPoll Open 7am to 6pm7am to 6pm Machine or component failure:Machine or component failure:

Backup unit delayedBackup unit delayed

What is COMELEC action?What is COMELEC action?


30/65

VotingVoting


Voter writes theVoter writes the

names of candidatesnames of candidatesper elective positionper elective position

AutomatedAutomated

Voters marks theVoters marks the

figure across the namefigure across the nameof his selectedof his selectedcandidatecandidate


31/65


32/65

CastingCasting


Voter folds the ballot andVoter folds the ballot anddrops it into the ballot boxdrops it into the ballot box

AutomatedAutomated

Voter feeds the ballotVoter feeds the ballotinto the PCOSinto the PCOS

If PCOS is integrated withIf PCOS is integrated withballot box, ballot isballot box, ballot isautomatically dropped intoautomatically dropped intoballot boxballot box

If PCOS and ballot box areIf PCOS and ballot box are

independent units, voterindependent units, voterdrops the ballot into thedrops the ballot into theballot boxballot box


33/65

CastingCasting

ProblemProblem PCOS rejects or does not read the ballotPCOS rejects or does not read the ballot Cause for rejectionCause for rejection

Crumpled or foldedCrumpled or folded Overly smudgedOverly smudged FakeFake Machine failureMachine failure

MitigationMitigation voter educationvoter education Not to crumple or fold ballot; avoid smudgingNot to crumple or fold ballot; avoid smudgingAccept ballots only from BEIAccept ballots only from BEI Machine Failure: COMELEC should institute actions to beMachine Failure: COMELEC should institute actions to be

taken by BEI and Tech Supporttaken by BEI and Tech Support


34/65

CountingCounting

TraditionalTraditional Manual count, stick counting.Manual count, stick counting.

Guided by the Rules on BallotGuided by the Rules on BallotAppreciation, a member of theAppreciation, a member of the

BEI shall read the name of theBEI shall read the name of thechosen candidate for achosen candidate for aparticular position. Anotherparticular position. Anothermember shall record by stickmember shall record by stickmark (taras) the vote for amark (taras) the vote for aparticular candidate on theparticular candidate on thetabulation form posted on thetabulation form posted on thewall of the precinct while thewall of the precinct while the

third member of the BEIthird member of the BEIrecords the vote for arecords the vote for aparticular candidate on theparticular candidate on theElection Return (ER).Election Return (ER).

AutomatedAutomated PCOS count. A function in thePCOS count. A function in the

Precinct Count Optical ScanPrecinct Count Optical Scan(PCOS) will be executed by(PCOS) will be executed by

the BEI after closing of polls.the BEI after closing of polls.The count shall be doneThe count shall be doneinternally and without publicinternally and without publicview/review of the ballots.view/review of the ballots.

PCOS program component willPCOS program component willread the marks on the ballotread the marks on the ballotin order to count the votes.in order to count the votes.


35/65

CountingCounting

Counting is away from public view. If theCounting is away from public view. If thehardware/software is rigged, the result ofhardware/software is rigged, the result of

the machine count may not be faithful to athe machine count may not be faithful to ahand/manual count.hand/manual count.

The program to read the marks couldThe program to read the marks could

misread the marks. Or it could bemisread the marks. Or it could bedesigned to actually misread the marks.designed to actually misread the marks.


36/65

CountingCounting

Mitigation: hardware/software audit priorMitigation: hardware/software audit priorto deployment to 80,000 PCOS units andto deployment to 80,000 PCOS units and

another 2,000 PCOS units that will serveanother 2,000 PCOS units that will serveas backup. Ensure same software copy isas backup. Ensure same software copy isdeployed.deployed.


37/65

Election ReturnElection Return


The ER is preparedThe ER is preparedmanually in seven copies.manually in seven copies.

The ER is signed andThe ER is signed andthumbprints affixed.thumbprints affixed.

A copy of the ER is postedA copy of the ER is postedon the wall of the precinct.on the wall of the precinct.

The rest of the copies ofThe rest of the copies of

the ERs are distributedthe ERs are distributedaccordingly.accordingly.

AutomatedAutomated

The ER is prepared usingThe ER is prepared usingthe PCOS.the PCOS.

First eight (8) copies of theFirst eight (8) copies of theER is printed and signedER is printed and signedand thumbprints affixed.and thumbprints affixed.

The electronic copy of theThe electronic copy of theER is digitally signed andER is digitally signed and

encrypted.encrypted. A copy of the printed andA copy of the printed and

signed ER is posted on thesigned ER is posted on thewall of the precinct.wall of the precinct.


38/65

Election ReturnElection Return

ProblemsProblems ER is prepared/generated by PCOSER is prepared/generated by PCOS

Printout could be different from ER copyPrintout could be different from ER copystored in PCOSstored in PCOS

RFP does not specify a way to verifyRFP does not specify a way to verify

Printing failurePrinting failure

MitigationMitigation Testing and preTesting and pre--audit of PCOSaudit of PCOS


39/65



The ballots and ER areThe ballots and ER areplaced in the ballot box.placed in the ballot box.

The ballot is thenThe ballot is thentransported to the City ortransported to the City orMunicipal Board ofMunicipal Board ofCanvassers.Canvassers.

AutomatedAutomated

The ER, precinct statisticalThe ER, precinct statisticalreport, and PCOS auditreport, and PCOS audit

logs shall be transmittedlogs shall be transmittedelectronically to variouselectronically to variousdestinations, including butdestinations, including butnot limited to thenot limited to thecity/municipalcity/municipal

Computerized CanvassingComputerized CanvassingSystem (CCS), centralSystem (CCS), centralserver, and various parties.server, and various parties.


40/65


Assurance that the transmitted copy is the sameAssurance that the transmitted copy is the sameas those earlier printed and manually signedas those earlier printed and manually signed

then posted on the precinct door?then posted on the precinct door? Mitigation: immediate posting on a publiclyMitigation: immediate posting on a publicly

accessible website. Poll watchers can thenaccessible website. Poll watchers can thenimmediately download the web copy andimmediately download the web copy and

compare with the one posted on the precinctcompare with the one posted on the precinctdoor.door.


41/65


ProblemProblem

Inability to establish connectionInability to establish connection

Failure to transmitFailure to transmit

Poor or no telecommunications infrastructurePoor or no telecommunications infrastructurepresent in the localitypresent in the locality


42/65


ProblemProblem

Signal interception or data hijacking. ThisSignal interception or data hijacking. This

would require sophisticated actions. Thewould require sophisticated actions. Thewindow is tight. Data shall be transmitted towindow is tight. Data shall be transmitted tomultiple destinations at (almost) the samemultiple destinations at (almost) the sametime. If signal interception or data hijackingtime. If signal interception or data hijacking

is successful, spurious data could be injected.is successful, spurious data could be injected.


43/65



Manual tallying andManual tallying and

preparation of SOVpreparation of SOVand COC at each leveland COC at each level

AutomatedAutomated

Canvassing computersCanvassing computers

at each level shall tallyat each level shall tallythe votes and shall bethe votes and shall beused to generate theused to generate theSOV and COC.SOV and COC.


44/65


Problem:Problem:

Canvassing software could be rigged suchCanvassing software could be rigged such

that votes for a particular candidate could bethat votes for a particular candidate could bepadded or shaved.padded or shaved.


45/65

Certification of ResultsCertification of Results


46/65

CertificationCertification

BEI and BOC cannot certify to theBEI and BOC cannot certify to thecorrectness/accuracy (ER, SOV, COC) ofcorrectness/accuracy (ER, SOV, COC) of

the results/reports generated by thethe results/reports generated by thePCOS and Canvassing ComputersPCOS and Canvassing Computers

BEI and BOC can only certify that theBEI and BOC can only certify that the

printouts are generated by/from theprintouts are generated by/from themachinesmachines


47/65

Security ThreatSecurity Threat


48/65

Remember Estonia!Remember Estonia!


49/65


50/65

Denial of Service AttackDenial of Service Attack

An attack similar to the Estonia attackAn attack similar to the Estonia attackcould be launched on May 10, 2010 andcould be launched on May 10, 2010 and

paralyze the telecommunicationsparalyze the telecommunicationsinfrastructure thus preventing theinfrastructure thus preventing thetransmission of the Election Returns, PCOStransmission of the Election Returns, PCOS

audit logs, and precinct statistical data.audit logs, and precinct statistical data.


51/65


52/65

Protection of the PCOS UnitsProtection of the PCOS Units

Problem: somebody could/might/attemptProblem: somebody could/might/attemptto physically hack or pour liquid on theto physically hack or pour liquid on the

PCOS units (prior to or on election day).PCOS units (prior to or on election day). Mitigation:Mitigation:

Store PCOS in secure room.Store PCOS in secure room.

On election day, limit number of people whoOn election day, limit number of people whohave direct access to PCOShave direct access to PCOS BEI and watchers should be watchful ofBEI and watchers should be watchful of

movements of votersmovements of voters


53/65

EnvironmentEnvironment

Power outage (or blackout) on electionPower outage (or blackout) on electionday.day.

Natural disasterNatural disaster flash flood, heavy downflash flood, heavy downpourpour


54/65

The Poll WatcherThe Poll Watcher


55/65

Role of the Poll WatcherRole of the Poll Watcher

Role of poll watcher in guarding the voteRole of poll watcher in guarding the votecount is mootedcount is mooted

Poll watcher is limited to observing andPoll watcher is limited to observing andcontesting actions of BEI and/or BOCscontesting actions of BEI and/or BOCs


56/65

ChallengeChallenge

No way to protest / challenge a ballotNo way to protest / challenge a ballot

Undefined protest procedure in theUndefined protest procedure in the

automated environmentautomated environment


57/65

Electoral ProtestElectoral Protest


58/65

BIG QUESTIONBIG QUESTION

HOW?HOW?


59/65

EvidenceEvidence


60/65

The Ballot as EvidenceThe Ballot as Evidence

The ballot is a traditional documentThe ballot is a traditional document

The ballot image may not be treated as anThe ballot image may not be treated as an

electronic document. The ballot image iselectronic document. The ballot image isproduced from a traditional document.produced from a traditional document.

The ballot box cannot be opened unlessThe ballot box cannot be opened unless

there is a protest and the electoral tribunalthere is a protest and the electoral tribunalauthorizes its opening.authorizes its opening.


61/65

The PCOS and CanvassingThe PCOS and Canvassing

Computers as EvidenceComputers as Evidence Contents of the machines need to beContents of the machines need to be

analyzedanalyzed

Need for digital forensic analysisNeed for digital forensic analysis

Electronic DiscoveryElectronic Discovery

No rules on electronic discoveryNo rules on electronic discovery


62/65

Center for People EmpowermentCenter for People Empowerment

in Governancein Governance NASSANASSA--CBCP ForumCBCP Forum

May 11, 2009May 11, 2009

CenPEG Policy Critique of the AutomatedCenPEG Policy Critique of the AutomatedElection Systems Project of the COMELECElection Systems Project of the COMELEC


63/65

Salamat Po!Salamat Po!

Lito S. AveriaLito S. Averia

[email protected]@[email protected]@gmail.com


64/65

ConcernsConcerns

What if COMELEC fails to test all 82,000What if COMELEC fails to test all 82,000PCOS units, 1,632 municipal canvassPCOS units, 1,632 municipal canvass

machines, 70+ provincial canvassmachines, 70+ provincial canvassmachines, 70 central servers, 70 backupmachines, 70 central servers, 70 backupcentral servers?central servers?

What if COMELEC fails to review sourceWhat if COMELEC fails to review sourcecode or allow any third party to review thecode or allow any third party to review thesource code?source code?


65/65

ConcernsConcerns

What happens if transmission is notWhat happens if transmission is nottested?tested?

Documents

LITO AVERIA Ppt_Vulnerable Spots of PCOS May 2009