“I think it was a Melo-Smartmatic show.”

Former Commission on Elections (Comelec) commissioner Augusto “Gus” Lagman is highly suspicious of what was inside the source code deposited with the Bangko Sentral ng Pilipinas (BSP) in February 2010.

He had always been skeptical of the Smartmatic system even when he was still a Comelec official because the Venezuelan company would not let the source code of its AES and PCOS machine system be tested by independent experts.

His doubts appear to have been boosted by Smartmatic International’s own clear statement in its legal suit against its licensor, Dominion Voting Systems, that it did not get to possess Dominion’s master software.

Despite the claims of retired Supreme Court (SC) Justice and former Comelec Chair Jose Melo that the Comelec’s Information Technology (IT) Department double checked the two compact discs put in escrow two years ago, Lagman believes that the source code in BSP’s vault is either fake or stolen.

“Either that’s fake or Smartmatic stole the source code from Dominion. It is they who said Dominion did not put the source code in escrow with Iron Mountain,” Lagman said. Iron Mountain is third party escrow service provider.

The source code, being the master software of the precinct count optical scan (PCOS) machines supplied to the Comelec by Smartmatic, determines how the equipment should work and behave.

In a text message to The Manila Times, retired Justice Melo said that the Comelec’s IT department, technical committee, and other government officials checked the source code before placing it inside the box sealed with Comelec stickers at all the sides.

It was first validated by SysTest Labs (an American company now called SLI Global Solutions) for use in the 2010 elections.

The source code was also reviewed by the Nacionalista Party, the only political party that was able to check the software, according to Melo.

“The source [code] was made available to interested parties. Thereafter, Representative [Teodoro “Teddy Boy”] Locsin, Senator [Francis “Chiz”] Escudero, and I together with media reps deposited the source code in the vaults of the Central Bank,” he said.

However, Lagman said that if ever Comelec checked the content of the CD’s, it was just a hasty inspection based on Smartmatic’s clear admission in its suit.

“Anong tsinek nila? Malamang superficial check lang yon. Malinaw naman sa case ng Smartmatic na hindi sila binigyan ng copy [What was it that they checked? Most probably they just did a superficial check. It’s clear in the case filed by Smartmatic that they weren’t given copy (of the master software)]. So which is the lie?” Lagman said.

According to the 52-page suit filed by Smartmatic against Dominion in the Delaware Court of Chancery last September, Dominion allegedly failed “to place in escrow the required source code, hardware design, and manufacturing information” for the 2010 Philippine elections, making it impossible for Smartmatic to correct the bugs in the PCOS machines’ software.

The bugs caused a mess that up to now has made protests of fraud unverifiable.

The complaint stated that in March 2010, Iron Mountain, the third party escrow service provider, received the “pre-customized” version of the source code from Dominion, but did not escrow any further modifications.

Comelec Chair Sixto Brillantes Jr., on the other hand, has constantly refuted these allegations and told The Times that the poll body is ready to open the source code in the vaults of BSP at any time.

“Willing kaming buksan [We’re willing to open the safe] all the time not because of Commissioner Lagman because I don’t think he knows what he’s talking about,” he said.

“Yan ang problema eh. Ako naman matagal na akong nagtitimpi dyan pero [That’s the problem. I’ve been controlling myself but] I think he should stop talking cause he was inside the Comelec when we were discussing that.”

Not made available to interested parties
But Dr. Pablo Manalastas, convenor of multisectoral group Automated Election System (AES) Watch and Center for People’s Empowerment in Governance (CenPEG) fellow for IT, refuted Melo’s claims that the source code was made available to interested parties and experts in accordance to Republic Act 9369 or the poll automation law.

His group asked for the source code as early as May 2009—a year before the 2010 elections—but to no avail.

Manalastas said that the source code review referred to by Melo was just a mere walk-through. Comelec and Smartmatic imposed restrictive conditions and did not allow local IT professionals to conduct their own source code review as required by law.

“Mr. Melo’s statement [...] is false. The correct statement should be, ‘Because of the restrictive conditions under which Comelec and Smartmatic wanted the source code review to be done, any source code review will not be the political party’s or interested group’s own review,’” he said.

“So nobody did the source code review (or code walk-through) that Smartmatic was suggesting.”

In fact, according to Section 11 of R.A. 9369, the Comelec “shall promptly make the source code of that technology available and open to any interested political party or groups which may conduct their own review thereof.”

A source code review for the AES is very important because programmers can sometimes commit errors while creating the software.

“Programming is a very human activity, and programmers oftentimes make mistakes (called “bugs”) when they write the EMS [election management system], PCOS, CCS programs.”

Though testing is optional, Comelec commissioned SysTest Labs to review the source code. Yet Filipino IT poll experts, like those of CenPEG—who are willing to do it for free—were not allowed to review it.

“Today, we now understand why Smartmatic is restricting, to the max, [the] access to the source code—because they did not have the source code, at least not the correct one that would be used in Philippine election 2010,” Professor Manalkastas said.

2010 source code review results
In 2009, the Denver, Colorado-based SysTest Labs was awarded by Comelec a P70 million-contract to review, test and certify the source code as requireded by R.A. 9369. It conducted the review from October to February 2010 after it received the pre-customized source code directly from Dominion.

According to the company’s report, the review found 9,888 minor and major or critical problems. Out of these problems, 4,422 major problems were fixed by Smartmatic; yet there were a total of 5,466 problems—327 major ones, 4,897 minor deviations from standards, and 242 minor non-standard-related problems—that were not corrected.

Based on the summary of the report submitted to Comelec in March of the same year, SysTest Labs’ review consisted of a manual source code review and the use of various automated source code static analysis tool applications. It concluded that the software “revealed no evidence of any intentionally written instructions to yield any but the correct results.”

But the report gave no indication whether the system was—as RA 9369 requires— “operating properly, securely, and accurately.”

The results of the review were a big issue at that time, especially because SysTest Labs’ credibility was already tainted in the U.S. The company’s accreditation was suspended by the U.S. National Institute of Standards and Technology (NIST) in 2008 because it allegedly engaged in fraudulent behavior, like allowing the manufacturer to influence the testing process, and other unethical business practices.

It was also sued by Premier Election Solutions, an AES company, because of fraud, breach of contract, among others.

SysTest Labs has a longstanding business relationship with Smartmatic.