Namfrel Discovers Potential Tampering in Comelec Vote Counting Machine
NAMFREL’s Lito Averia couldn’t believe his eyes. Working into the early morning hours and fueled by massive amounts of coffee, Lito found a mismatch in the hashcodes of Comelec’s Vote Counting Machines (VCM).
This 64 character hashcode is the proof that the system code inside the VCMs were never altered. This hashcode acts much like a security seal. If the seal is broken, there is prima facie case for tampering. In other words, if the system code of Comelec’s Vote Counting machine were in any way changed, the hash code would be DIFFERENT. This is the original hashcode as published by Comelec:
However, NAMFREL saw a different hashcode:
So this “b” and “8” character difference raises the presumption that the system code WAS tampered with. Comelec’s reaction was to issue a certification here saying that there was a typo. It even had an attachment from their vendor Pro V&V supporting this position as well.
Reactions from netizens:
Most agree it looks more like a typo, rather than a malicious act:
“Hi, looking at all the info you have and what’s being discussed here. IDK why the hash was manually typed ¯\_(ツ)_/¯ beats me. But it looks like it was typed manually lol. Any changes to the file or a string much as a character will create a completely unique hash. it will not change a 4 bits (half-a-byte). sha256 is 64chars.” — Jenny Mullhenny
“It’s probably a typo. An altered document, even by just 1 character, would result in an entirely different hash code and not differ only by 1 character as this case, that is assuming they were using a strong hash function”- Andres marianitojr
And at the same time, most also wonder why the hashcode was typed in manually. We usually just “copy and paste” long strings of characters:
“My programmer self is crying of “typo error” reasoning of Comelec on hash discrepancy. Hash is system generated and not manually typed. Next time kung magrereport kayo, highlight+copy then paste na lang ah. Wag i-type!” -@ayekxanderr
MB Tech and Business Editor, Art Samaniego looked into this in detail. He posits a plausible explanation of why the Hashcode was manually typed in:
“I checked and found out that the hashcode is generated by the VCM and printed on a paper that looks like a cashier’s receipt. There is no other way to document the hashcode but to type it manually, di pwede ma copy and paste dahil naka print sa papel and the VCM is not connected to other machines for security.” — Art Samaniego Jr
Still others underscore the weight of such a ‘typo’:
Now this is a valid concern. It can also be exploited illegally in “controlled” precincts — William Emmanuel Yu, PPRCV’s Co-IT Director
The election is a “sacred rite” and as such “lahat ng pagduda dapat masagot ng Comelect at Smartmatic” — Luna
“Hahahashcode” — Niz Shinoda-Jørgensen
Call to Action:
Hanlon’s Razor comes to mind to explain this typo:
“Never attribute to malice that which is adequately explained by stupidity.”
Still COMELEC could do more to allay the fears. NAMFREL calls on Comelec to re-run the compilation. The public needs to witness the output hashcode. This step was never done in the previous ‘audits’.
Background and full disclosure:
I stumbled upon this while interviewing Fernando Contreras Jr (Namfrel) to get their reactions to UP Vanguards’ 4 point recommendations to Comelec. Namfrel and BNSHosting.net (which this author manages) have commercial transactions.