'Irregularities' in 2016 election server logs? Not necessarily, says I.T. expert

MANILA, Philippines – An information technology (IT) professional said the server logs presented by Senator Vicente Sotto III in a recent privilege speech on alleged poll fraud in the 2016 automated elections may not necessarily show that something irregular took place.

There are "possible valid explanations" to the activities that appeared on the logs presented by Sotto on Tuesday, March 6, said William Yu, IT director of election watchdog Parish Pastoral Council for Responsible Voting (PPCRV) and part-time computer science professor at the Ateneo de Manila University.

Sotto's privilege speech cited a "concerned and impeccably reliable source" who alleged that early transmission of votes and foreign access to election servers were supposedly reflected in certain election server logs.

Yu explained that the allegations concerning DNS servers may just be a "lookup" query, similar to searching for a phone number on an address book "but it doesn't mean I called you."

DNS stands for domain name system, which maps a readable domain name to an IP address of a server or device.

"There are many other activities before the elections. This does not necessarily, automatically mean that data has been transmitted," said Yu.

As for alleged "foreign access" through username "e360sync," he said it may likely be a "synchronization script" between two machines to get data from a monitoring portal or dashboard offered by Smartmatic, which provided the vote-counting machines in the last 3 automated elections.

But Yu added that it should be checked whether this was authorized by the Commission on Elections (Comelec) or not.

"Anybody who knows how networks work knows that these activities can occur. There are many possible activities," said Yu. (READ: How does the PH automated election system work?)

He also said that the logs in Sotto's speech are only snippets and "not the whole picture."

There was also not enough information to solidly connect a supposed "e360sync" service to an Amazon web server, as alleged by the source cited in Sotto's speech, said Yu.

Comelec, Smartmatic should explain

Yu also told Rappler that these allegations have already appeared in a video on a Facebook page that tackled alleged anomalies in the 2016 polls.

Nonetheless, he said that the Comelec and Smartmatic should explain these activities on the server logs.

"I agree, if we find something, we ask for an explanation," Yu said. "Let the parties involved, Comelec and Smartmatic, answer it."

He also raised the possibility that the Comelec could have been "lax" in securing its data, as he wondered how these server logs have been obtained.

In a statement on Wednesday, March 7, Comelec Spokesperson James Jimenez said the poll body will look into these claims.

"The Comelec shares Senator Sotto's call to determine the accuracy of these allegations. The Commission understands the grave importance of this matter and will, itself, strive to determine the veracity of these claims," Jimenez said.

"To this end, the Comelec will reach out to Senator Sotto and ask for copies of any documents which may be available for close examination and careful evaluation. This is consistent with the Comelec's commitment to the integrity of Philippine elections." – Rappler.com

Michael Bueza

Michael Bueza is a researcher and data curator under Rappler's Research Team. He works on data about elections, governance, and the budget. He also follows the Philippine pro wrestling scene and the WWE. Michael is also part of the Laffler Talk podcast trio.