NAMFREL’s Lito Averia couldn’t believe his eyes. Working into the early hours of the morning and fueled by massive amounts of coffee, Lito found a mismatch in the hashcodes of Comelec’s Vote Counting Machines (VCM).

This 64-character hashcode proves that the system code inside the VCMs was never altered. This hashcode acts much like a security seal, and if the seal is broken, there is a prima facie case for tampering. In other words, if the system code of Comelec’s Vote Counting machine were in any way changed, the hash code would be DIFFERENT. This is the original hashcode as published by Comelec:

So this “b” and “8” character difference raises the presumption that the system code WAS tampered with. Comelec’s reaction was to issue a certification here, saying there was a typo, and it even had an attachment from their vendor Pro V&V supporting this position.

Reactions from netizens:
“Hi, looking at all the info you have and what’s being discussed here. IDK why the hash was manually typed ¯_(ツ)_/¯ beats me. But it looks like it was typed manually lol. Any changes to the file or a string much as a character will create a completely unique hash. it will not change a 4 bits (half-a-byte). sha256 is 64chars.” — Jenny Mullhenny

“It’s probably a typo. An altered document, even by just 1 character, would result in an entirely different hash code and not differ only by 1 character as this case, that is assuming they were using a strong hash function”- Andres marianitojr

“My programmer self is crying of “typo error” reasoning of Comelec on hash discrepancy. Hash is system generated and not manually typed. Next time kung magrereport kayo, highlight+copy then paste na lang ah. Wag i-type!” -@ayekxanderr

“Could be a typo. I checked and found out that the hashcode is generated by the VCM and printed on a paper that looks like a cashier’s receipt. There is no other way to document the hashcode but to type it manually, di pwede ma copy and paste dahil naka print sa papel and the VCM is not connected to other machines for security.” — Art Samaniego Jr, MB Tech and Business Editor

Now this is a valid concern. It can also be exploited illegally in “controlled” precincts — William Emmanuel Yu, PPRCV’s Co-IT Director

The election is a “sacred rite” and as such “lahat ng pagduda dapat masagot ng Comelect at Smartmatic” — Luna

“Hahahashcode” — Niz Shinoda-Jørgensen

Call to Action:
Hanlon’s Razor comes to mind to explain this typo: “Never attribute to malice that which is adequately explained by stupidity.”

Still COMELEC could do more to allay the fears. NAMFREL calls on Comelec to re-run the compilation. The public needs to witness the output hashcode. This step was never done in the previous audits.

Background and full disclosure:
I stumbled upon this while interviewing Fernando Contreras Jr (Namfrel) to get their reactions to UP Vanguards’ 4-point recommendations to Comelec. Namfrel and BNSHosting.net (which this author manages) have commercial transactions.