Smartmatic defends integrity of VCMs' source code

Technology provider Smartmatic-Total Information Management (TIM) Corp. on Sunday defended the integrity of the source code used in the vote counting machines (VCMs) to be operated on election day after a poll watchdog claimed that glitches caused the equipment to credit votes for Davao City Mayor Rodrigo Duterte to administration standard bearer Manuel “Mar” Roxas II during the final testing and sealing (FTS) process last week.

Lawyer Karen Jimeno, Smartmatic's Head for Voter Education, said Sunday that the VCMs run through a source code designed and configured to only scan and read votes that each voter marks on the ballot.

She said the code has been reviewed by information technology experts from political parties and election watchdogs seven months before the May 9 elections.

“In addition, the source code was reviewed and certified by United States-based SLI Global Solutions (an independent certification agency hired by the Commission on Elections) to run properly for the elections, free from errors or any malicious code,” Jimeno said in a statement.

Duterte votes

Citing anecdotes from a lawmaker and some netizens, the Automated Election System (AES) Watch raised the alarm over the alleged anomalies in the VCMs.

It recalled an incident shared by Davao City Rep. Karlo Nograles on Facebook, where he claimed that a vote for Duterte was credited to Roxas during the FTS of the VCM.

Based on reports it has received, AES Watch said the supposed discrepancy between the ballots and voter receipt in Davao City was not an isolated incident.

“This happened in Bohol and in Tarlac and even overseas,” it said.

Jimeno said Smartmatic has looked into reports of the alleged anomalies found in the VCMs, but found no discrepancies between the contents of the ballots fed into the machines and the voters' receipts and election returns.

She noted that no formal complaints were filed with the Commission on Elections (Comelec) and the Board of Election Inspectors (BEIs) in areas where the supposed mismatch between the ballots and voters' receipts occurred.

Jimeno, however, said some confusion was created because some posts on the alleged discrepancies presented voters' receipts different from the VCMs.

Vote switch likely

But in an article posted online, Ateneo de Manila University IT expert Dr. Pablo Manalastas explained that the supposed discrepancies resulted from the alleged mismatch between the ballot and VCM configuration file delivered to the concerned precinct.

He said the error is likely to happen since Comelec has to prepare over 92,500 VCM computers and twice the number of SD cards for each machine containing the correct version of the election.xml file for the precincts concerned.

“Because of the vast number of SD cards that Comelec has to prepare it is very likely that it will make mistakes in the preparation of these SD cards. For example, the following erroneous election.xml file might be delivered to your precinct, together with the correctly printed ballots,” Manalastas said.

While voters will be made aware of the discrepancies between the ballots and voters' receipts, the IT expert lamented that the most an individual could do is file a complaint with the BEI, who is required to enter the complaint in the Minutes of the Precinct.

“Since voters do not file election protests (although candidates do), there is no way of acting on voters’ complaints, and the injustice to the voter is never resolved,” he said.

Manalastas said he has written the Comelec's Local Source Code Review Committee three times to ask that all 2,000-plus distinct ballot faces and all election.xml files be posted on the poll body's website for the perusal and review of political parties and the public

“After corrections have been made, the 92,500-plus corrected election.xml files should be posted, together with their hash values, at the Comelec website, he added.

With the Comelec yet to act on the request, Manalastas said the VCMs “cannot be trusted to properly count our votes” since there is no way of checking the hash values of the VCM program and the election.xml file with the published known values.

Jimeno, however, said any person can verify that each VCM uses the certified source code because the machines reflect the “hash code” or fingerprint of the source code deposited by the Comelec with the Bangko Sentral ng Pilipinas.

The hash code is also reflected in all Election Returns that will be produced after the voting.

“Additionally, a random manual audit by election watchdogs will compare the ballots against the election results of VCMs,” Jimeno said.

She encouraged voters to be vigilant and make the necessary complaints should problems arise on election day since the Comelec has issued guidelines on what voters should do in case they have issues with the voters' receipt. —ALG, GMA News