Blog

The 2025 midterm elections may have been marred by an overlooked systemic software error, one that inflated overvote figures by 1,200% and potentially misrepresented the voice of millions of Filipino voters. This is not a baseless claim, nor is it hypothetical. It’s based on publicly available data, analyzed by NAMFREL, an independent and accredited watchdog. Their analysis shows 16.8 million senatorial overvotes across roughly 56 million voters, implying that nearly 30% of all senatorial ballots were voided due to overvoting.<figure id="figure-hvodc3wnoqmaprb9da"><img id="hvodc3wnoqmaprb9da" src="https://cdn.durable.co/blocks/5WUj3hg4w2sXL7afT13zedNovVbaeccChdUZcRdGtHWKumZoOV8hNnjY5C9AVuYx.jpg" alt="" title="" class="object-cover bg-gray-100" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/blocks/5WUj3hg4w2sXL7afT13zedNovVbaeccChdUZcRdGtHWKumZoOV8hNnjY5C9AVuYx.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure>At face value, this number is alarming. But what’s more troubling is this: Every overvote figure across precincts is perfectly divisible by 12.And 12 just happens to be the exact number of seats in the senatorial race.This statistical pattern is unnatural. In a real-world voting scenario involving millions of individuals, random voter error would not produce such mathematically consistent results. So why is every precinct’s overvote total a multiple of 12?A Misinterpretation of the Overvote MechanismIn any election, an overvote occurs when a voter selects more candidates than allowed. In the senatorial race, that means shading 13 or more candidates instead of 12. A well-designed vote-counting system should register 1 overvote per ballot, and disregard that specific race on that ballot.But based on the numbers, it appears the MIRU Automated Counting Machine (ACM) applied incorrect logic. Instead of recording 1 overvote per overvoted ballot, it recorded 12 overvotes, one for each candidate slot.This kind of error could only occur at the software level. And this is where accountability must be demanded of:Pro V&amp;V, the independent software reviewer, The Technical Evaluation Committee, which approved the source code, And COMELEC’s own technical team. Were these patterns not visible during testing? Was the overvote logic not reviewed line by line? Or worse, was it misunderstood entirely? The Problem with the Formula Used by MIRULet’s look at how this inflated overvote number may have been derived:Likely Faulty Formula:X = (V × C) – Z – U Where: X = Overvotes V = Valid Ballots C = Number of Senators (12) Z = Total Votes for All Candidates U = Total UndervotesThis formula treats overvotes as the difference between the maximum theoretical votes and the sum of recorded votes and undervotes. This is incorrect. It creates the illusion of more overvotes than actually occurred.Case Example:Region V, Camarines Norte, Labo, Mabilo I (Cluster ID: 16060060)V = 418 C = 12 Z = 3,038 U = 1,810MIRU Calculation: X = (418 × 12) – 3,038 – 1,810 = 168 overvotesBut let’s apply the correct definition, where an overvote is a discarded race per ballot, not a calculated leftover:Correct Formula:X = V – ((Z + U) / C)Applying the data: X = 418 – ((3,038 + 1,810) / 12) = 14 actual overvotes The inflated figure (168) is 12x higher than the real one (14). The math doesn’t lie. What This Means NationallyIf this pattern holds across precincts, then the 16.8 million overvotes reported could actually represent just 1.4 million ballots, not 16.8 million. That brings the real overvote rate down from 30% to just 2.5%—a normal and expected figure. Accountability and Action NeededWe must now ask:Did Pro V&amp;V fail to detect this during source code review? Did the Technical Evaluation Committee and COMELEC overlook or misunderstand the overvote logic? Why were watchdog groups not granted access to deeper technical validation of how overvotes were recorded? &nbsp;This is not a political accusation, it is a call for technical accountability. Systems fail. Bugs happen. But transparency and correction must follow.We Call On COMELEC and Its Partners to:<ol><li>&nbsp;Publicly disclose the overvote counting logic and whether it follows per-ballot or per-candidate methodology. 2. Explain why all overvote numbers are divisible by 12. Allow independent audits of MIRU’s source code and overvote logic, including a line-by-line review. 3. Reassess the 2025 senatorial vote tallies if this bug is confirmed to have affected legitimate votes. &nbsp;</li></ol>This issue is not about party or preference. It is about math, fairness, and the sanctity of every Filipino vote. The&nbsp;nation deserves a clear, public explanation and a commitment that it will never happen again. Jay Jimenez, CISSP Founder, OpenVCM.org

The Case of a Potentially Critical Software Bug That Inflated Senatorial Overvotes in the 2025 Midterm Elections And Why the Total Overvotes Per Precinct Are Suspiciously Divisible by 12

<h3>Introduction</h3>The foundation of a healthy democracy is a free, fair, and honest election system. It is a state in which the electorate trusts the government that it has the policies and mechanisms in place to ensure that votes are protected, free from fraud, and genuinely reflect the will of the people. Automation is pivotal in guaranteeing integrity as it minimizes human intervention that could tamper with the election result. Since the Philippines started its automated election system in 2010, numerous legal cases questioning its conduct or its outcome in part or its entirety have reached the land's highest court (Judiciary.gov.ph, 2017). While the government is doing its mandate to ensure that security controls are in place to combat both external and internal threats, it should always continue to address reasonable doubts in its approach to protect the integrity of votes as technologies and threat landscape continuously evolve (Cisa.gov, 2025). This means that the entire security chain could demonstrate its capability to preserve integrity from all threats, especially insider threats. An insider threat to an election system that utilizes optical-scan-based technology is when a malicious insider flips the vote in favor of a chosen candidate (Bernhard et al., 2019). In a country like the Philippines, with almost 100,000 counting machines deployed in every election period, this is hard to detect and poses a significant risk to vote integrity. Previous election systems since 2010 have outlined several policies that intend to resist this kind of attack. One of these is the source code review, in which experts were invited to review the source code designed to be compiled and built for all machines. However, it is challenging to demonstrate to the electorate that every counting machine uses a trusted build. There is a lack of openness, if not a total absence of a mechanism to verify that the trusted build derived from reviewed code is deployed. The second known security control to deter this threat is the random manual audit, which allows auditing of 1&nbsp; randomly chosen precinct per congressional district. However, how this RMA is conducted from selection to actual execution of audits is still not transparent to the electorate and not convincingly demonstrable. In 2022, only 757 out of 94,000 clustered precincts were chosen. With the security controls previously mentioned, it is insufficient to convince the voters that the election outcome is 100% foolproof. <h3>Verifiable Scheme &nbsp;</h3>A verifiable scheme is a paradigm in which the election outcome is verified from casting votes to its final tally. This is a mental model shift from a hard-to-grasp and highly technical source code review mentioned earlier. It only offers how the counting machine works and how technically inclined people understand it. A verifiable scheme is independent of the machine's internal workings as it only concerns that the output is reasonably derived from the set of inputs (i.e., VVPAT). &nbsp;Since a verifiable scheme offers higher confidence through widespread precinct-level verification on&nbsp;election day, it is far superior to the random manual audit in detecting fraud and increasing voters' trust.A verifiable scheme must demonstrate that the votes are recorded as cast and counted as recorded. While the scheme is undoubtedly promising, its effectiveness relies on policies allowing a third-party implemented mechanism for end-to-end verification to fortify the security chain. Figure 1 shows a practical verification of votes by manually counting the receipts by an accredited Citizen Arm.While manual receipt counting provides end-to-end verifiability, it may require an additional 700 minutes, assuming 700 receipts per clustered precinct. The most favorable approach is a solution that combines verifiability and automation. <figure id="figure-18aw2ygcrom60vj7uj"><img id="18aw2ygcrom60vj7uj" src="https://cdn.durable.co/blocks/aknZwK9P1fYsdjd6elSGBoDZfXFICzE9WSmvKFZL1BhMAzPtjb9n1hnfN6rnnZg1.png" alt="" title="" class="object-cover bg-gray-100 " style="aspect-ratio: 1/1; object-position: undefined undefined;" data-corners="default" data-aspect="1:1" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/blocks/aknZwK9P1fYsdjd6elSGBoDZfXFICzE9WSmvKFZL1BhMAzPtjb9n1hnfN6rnnZg1.png" data-mce-style="aspect-ratio: 1/1; object-position: undefined undefined;"></figure><h3>The COMELEC’s Implementation of Verifiable Scheme for the 2025 Election</h3>In the middle of 2024, COMELEC demonstrated a new counting machine that features a new Voter Verifiable Paper Audit Trail (VVPAT) receipt with a QR code. &nbsp;The content of the QR code claims to correspond with the printed text of the VVPAT. After the polling precinct is closed, every receipt shall be scanned by a scanner attached to the same machine where the receipts were printed. QR codes will be transmitted to the election watchdogs, such as NAMFREL and PPCRV, for verification and counting.&nbsp;<h3>Strengthening COMELEC’s Implementation by 3rd-Party Verification</h3>The COMELEC and its service contractors that provide a critical function for the election are always viewed by the electorate as one. Hence, for the entire verification chain to achieve complete integrity and be trusted by the voters, the printed receipts should be verified by tools and parties independent of COMELEC and the service provider’s people, process, and technology. &nbsp;In a YouTube (2024) video published by ANC, it was evident that the tool used to scan the QR code for 3rd-party counting will be provided by the same provider that printed the receipt. &nbsp;Moreover, it was also not demonstrated in the same video who and what will verify the accuracy of the QR codes against the printed text. A proper end-to-end verification scheme should indicate that the process, people, and technology that will conduct the verification are neither COMELEC itself nor its paid 3rd-party contractors. This is the golden rule to ensure the verification process is free from conflict of interest and insider collusion. Fortunately, in the same video, Comelec Chairman George Garcia guaranteed and mentioned, “… We will going to allow NAMFREL, PPCRV, the majority party, and minority party even to capture the QR codes so they can immediately send to their headquarters the results on per precinct basis”.&nbsp; As shown in Figure 2, a grassroots-driven, mobile app-enabled complete end-to-end verification requires a four-phase approach involving every member of the electorate and the poll watchers (i.e., a verifiable chain). <figure id="figure-bfydrr2mmem60vpqwj"><img id="bfydrr2mmem60vpqwj" src="https://cdn.durable.co/blocks/21J5DJxdA6IGhsWDWB7Dew49dvrPegsAbgsO8NTHG36aodOX5UbmfSnYmmMdh2VX.png" alt="" title="" class="object-cover bg-gray-100 " style="aspect-ratio: 1/1; object-position: undefined% 55%;" data-corners="default" data-aspect="1:1" data-caption="" data-positionx="undefined%" data-positiony="55%" data-fullwidth="false" data-mce-src="https://cdn.durable.co/blocks/21J5DJxdA6IGhsWDWB7Dew49dvrPegsAbgsO8NTHG36aodOX5UbmfSnYmmMdh2VX.png" data-mce-style="aspect-ratio: 1/1; object-position: undefined% 55%;"></figure>Phase 1. The verification of printed receipt as the vote has been castThis is the first chain verification where a voter must ensure that it has wholly verified the receipt if it accurately printed the voter’s chosen candidates. Voters have been aware of this practice since the previous election. After voter verification, the receipt will be deposited into the assigned secure box. Phase 2. The verification of the QR code and the printed textAfter the polling is closed, a verifier with a mobile app scanner scans the QR code printed on the receipt and compares the app's output against the candidates' names printed on the receipt. This phase ensures that the machine accurately prints the correct QR code. Phase 3. Counting of the QR codesParallel to phase 2, a mobile app will count the receipts, produce a tally of all the receipts, and compare the results against the election return. The app will also transmit the tabulated result to a server so that the public can verify the official election return against the mobile app’s tallied result. &nbsp;This process will take 35 minutes to complete. Phase 4. Comparison of printed election return against the published online resultEvery counting machine transmits its results to servers managed by election watchdogs to ensure no manipulation between the precinct’s counting machine and the official count. This transparency server previously allowed the election watchdogs to compare the counting machine's results against the official count. <h3>Conclusion &nbsp;</h3>Every electorate member should participate to achieve complete integrity in the upcoming 2025 election. After casting votes and feeding the ballot to the counting machine, it is his/her duty to verify the receipt's output to see if it accurately prints his/her chosen candidates and ensure that such a receipt has been deposited in the designated box. &nbsp;Poll watchers and various Citizen Arm must ensure that after the polling is closed, the verification process begins by comparing the QR code against the printed names on the receipt and ensuring that all receipts have been counted and tallied by the OpenVCM app. The final tally of the OpenVCM app can be compared to the counting machine’s printed Election Return and the officially published result online. The process will only take an hour to complete, with no additional government expenditure, but it will result in 100% confidence in the integrity of the election. &nbsp; <h2>References Cited</h2>Bernhard, M., Kandula, K., Wink, J. and Halderman, J. (2019). UnclearBallot: Automated Ballot Image Manipulation. Lecture notes in computer science. 11759:14-31 Cisa.gov (2025) &nbsp;Election Threat Updates [Online] Available at &nbsp;https://www.cisa.gov/topics/election-security/election-threat-updates (Accessed 14 January 2025) Judiciary.gov.ph (2017) BAGUMBAYAN-VNP MOVEMENT, INC., AND RICHARD J. GORDON, AS CHAIRMAN OF BAGUMBAYAN-VNP MOVEMENT, INC., PETITIONERS, VS. COMMISSION ON ELECTIONS, RESPONDENT. [Online] Available at https://elibrary.judiciary.gov.ph/thebookshelf/showdocs/1/61738 (Accessed 24 December 2024) Youtube.com (2024) Comelec demonstrates features of new Miru voting machines | ANC [Online] Available at https://www.youtube.com/watch?v=lfiy_V6UkMU9 (Accessed 14 December 2024)

Blog

The Case of a Potentially Critical Software Bug That Infl...

Grass-Roots Driven End-to-End Verifiable Voting