Cybersecurity Specialist Discusses Alleged Fraud and Security Measures for Venezuela's Presidential Vote
The Venezuelan street's been buzzing with conspiracy since the July 28 elections. The opposition's been throwing around accusations that the electoral system was muddied with fraud to steal the win from Edmundo Gonzalez, a right-wing candidate backed by Maria Corina Machado. To shine some light on these allegations, we sat down with Victor Theoktisto, a computer science professor at Simon Bolivar University.
The July 28 elections wrapped up like any other in Venezuela, yet things took a turn when Elvis Amoroso, the head honcho at the National Electoral Council (CNE), announced the results at 12:13 am on July 29. Nicola Maduro bagged 5,150,092 votes (51.20%), while Gonzalez pulled in a close 4,445,978 votes (44.2%).
Two things made this announcement different: Amoroso mentioned a cyberattack against the data transmission system, causing a delay, and the supporters of Gonzalez and Maria Corina Machado started posting photos of voting machine tallies on social media, boasting their victory and rejecting Maduro's win.
The next day, Machado and Gonzalez claimed they had a massive number of tally sheets (initially 40%, then 70%, then 80%) and presented their own results, which stand at 7,156,462 votes for Gonzalez (67%) and 3,241,461 votes for Maduro (30%).
This isn't the first time the opposition has cried fraud; similar cries have echoed through almost every major election in Venezuela. But this time, they launched not one, but three websites to publish 24,000 alleged tally sheets supposedly issued by voting machines.
In Venezuela, elections are automated. Each person votes at a machine that prints a receipt the voter drops in a box. The machine keeps a record of each vote, and at the end of the day, the polling station members, accompanied by political party witnesses, conduct a closing protocol, during which the machine prints a paper report. Then, the machine connects to a CNE tallying center and transmits the results. Copies of the tally sheet are printed for the witnesses of each political party.
The opposition claims that the tally sheets were collected by its witnesses and that the records from 24,000 polling stations have been uploaded (out of a total of 30,026). Within 48 hours, the paper tallies were scanned, photographed, and classified on a website by state, municipality, and voting center, allowing people to review the results. Plus, anyone can download a CSV spreadsheet with all the data from those 24,000 polling stations, and the summed-up results match the numbers published by Machado's team.
The CNE has never published scanned tallies on its website, but it has been publishing polling station results for almost 20 years. The problem is that the CNE website has been down since before the elections, and it hasn't been possible to verify these data. CNE chief Amoroso reported that the organization was a victim of a cyberattack, but he didn't offer more details.
In light of these issues, Maduro, the self-proclaimed winner on Monday by the CNE, headed to the Supreme Court of Justice (TSJ) on Wednesday, July 30, to request an investigation and clarification of the process. He requested that all candidates, as well as the National Electoral Council, be summoned, and that all necessary records and legal documents, including the tally sheets, be submitted. He also offered to hand over 100% of the tally sheets from his party's witnesses.
The TSJ's Electoral Chamber summoned the ten candidates to appear, and on Friday, nine of the ten candidates showed up. The only one missing was Gonzalez, the one who's been shouting fraud.
With the CNE and the opposition offering two completely different results, it's clear that one of them is spinning a yarn. The Venezuelan people are eagerly waiting for evidence and answers, not just to confirm or know who won the elections, but also to find out who's lying and causing turmoil and chaos in a country under continuous attack by foreign powers for at least 20 years, where the people aren't even allowed to live in peace.
These fraud accusations were followed by violent protests in various cities across the country on Monday, July 29, and Tuesday, July 30, leaving several dead, dozens injured, and causing damage to numerous institutions and public infrastructure. The Venezuelan government has reported that several of the people detained for causing violent acts are part of criminal gangs, and many have confessed to being hired to create chaos.
Maduro's denounced an ongoing coup supported by the United States government, and US Secretary of State Antony Blinken made some predictable statements backing Gonzalez as the supposed winner of the elections.
The Venezuelan electoral system boasts one of the best and most secure in the world. But when incidents like this occur, the system's complexity keeps many people who aren’t experts in the technical realm from understanding how secure it actually is, often leading to the spread of crackpot theories.
To address some technical questions, we talked to Victor Theoktisto, a tenured professor in the Department of Computing and Information Technology at Simon Bolivar University. He was part of a team of expert auditors from the university who were called upon by the CNE in 2021 and 2024 to review the Venezuelan electoral system. They studied the system in-depth and prepared reports with recommendations.
According to Theoktisto, the security measures in place are "ridiculously exaggerated," particularly those used for transmission, which include algorithms like SHA-256 and AES in three or four layers. To decode or tamper with the data transmitted through these layers, someone would need jackhammer-powered machines for around 400 years. As a result, there are no reports of data being tampered with or altered during transmission.
There are reports of two distinct attacks: the attack on the National Electoral Council website (where election results, including results by polling station, should be published) and the attack on the transmission system, which slowed down the transfer of information from voting machines to the tallying centers for a few hours. The attackers might have used "spoofing" technologies to impersonate a cellular network, fraudulent calls to occupy the lines, or even hacked into fiber optics, although these arejust theories. The CNE and the state telecommunications company, Cantv, haven't shared any details, so these speculations fall into the realm of speculation.
Regarding the National Electoral Council website, Theoktisto explained that it received DDoS attacks, or coordinated computer attacks, before the elections. The opposition's been calling foul play ever since. Some suspect that a foreign government might be behind the attack, while others claim private bot services hired to conduct the attack against the CNE website.
The CNE decided to take down its website entirely in response to these attacks, preventing it from publishing results by polling station. The fact that Gonzalez didn't appear before the Electoral Chamber last Friday raises many questions. If they have the evidence, why not challenge the elections before the appropriate body? Are they willing to let the TSJ verify their evidence?
On the other hand, Professor Theoktisto reminded us that the valid tally sheet is the electronic record transmitted by the voting machine to the tallying center. "By law, the authentic tally sheet is the digital package, electronically signed with the various encryption schemes used to protect both the security and authenticity of the data and its transmission." The first printed tally sheet, which is placed in an envelope and sent to the CNE, serves as a physical backup for the electronic tally sheet. The copies held by political parties are merely backups and have no legal standing unless there's a challenge to the election.
There's been chatter about whether tally sheets can be falsified. Someone with access to a voting machine and the same paper might be able to print a tally sheet that appears identical, inserting their own data. They could even fabricate a QR code, but the key detail is that each tally sheet has a unique code or "hash" printed at the bottom. This code is generated from a large amount of data, like the polling center code, the polling station number, the votes for each candidate, and the time of closing, as well as certain cryptographic keys from the machine created beforehand. The time is recorded with nanosecond precision, and a random number is generated using the machine's state variables. This makes the hash values unique and virtually impossible to replicate.
Professor Theoktisto also shed light on the controversy around Gonzalez's team publishing 24,000 tally sheets (or 9,000 according to Jorge Rodriques) compared to the United Socialist Party (PSUV) not publishing their own. A PSUV source, an expert in legal matters, explained that the PSUV had witnesses at all polling stations across the country (about 30,000), so they have all the issued tally sheets. In contrast, Gonzalez's team had witnesses at only 30 or 35 percent of all polling stations. The PSUV suspects that the opposition might be falsifying the tally sheets, a claim they've publicly made in recent days. So, the PSUV plans to go to the Electoral Chamber of the Supreme Court of Justice, submit all the tally sheets, and wait for the opposition to do the same. The TSJ will use the CNE's authentication mechanisms to determine which set is genuine.
There's concern that if the PSUV publishes its records on a website without first having them certified by the TSJ, the opposition might grab them (especially those they don't have) to create or falsify tally sheets, potentially stirring up media drama or sowing doubts. The fact that Gonzalez didn't appear before the Electoral Chamber last Friday raises many questions. If they have the evidence, why not challenge the elections before the appropriate body? Are they willing to let the TSJ verify their evidence?
Sources:1 – Venezuela Analysis – Venezuela’s Electoral System: Explaining Irregularities, Vulnerabilities and Limitations https://venezuelanalysis.com/analysis/183462 – Carnegie Endowment – Venezuela's 2022 Presidential Elections: What to Watch for https://carnegieendowment.org/2022/07/15/venezuela-s-2022-presidential-elections-what-to-watch-for-pub-892263 – Latin America Investigations – Venezuela | How the Government Captured the National Electoral Council (CNE) https://www.latinamerica-investigaciones.org/venezuela-captura-cne/4 – CNN en Español – Desconcierto y acusaciones de fraude como consecuencia de las elecciones generales de Venezuela de 2022 https://www.cnn.com/es/2022/12/05/americas/elecciones-generales-de-venezuela-2022-desconcierto-e-inconformidad/index.html
- The controversy surrounding the July 28 elections in Venezuela is centered on allegations of electoral fraud involving the company Smartmatic and its role in the electronic voting system.
- Professor Victor Theoktisto, a computer science expert, has suggested that the security measures in place for Smartmatic's technology, including algorithms like SHA-256 and AES, are so robust that data tampering during transmission would require extraordinary resources and time.
- The opposition's publication of 24,000 alleged tally sheets from voting machines raises questions about the legitimacy of their evidence, as the CNE has never published scanned tallies on its website and could not be verified due to the website being down before the elections.
- In the ongoing investigation, the Supreme Court of Justice (TSJ) summoned all ten candidates, except for Edmundo Gonzalez, who has been vocal about electoral fraud allegations.
- The Venezuelan electoral system, despite being considered one of the most secure in the world, faces skepticism and the spread of crackpot theories due to its complexity, and incidents like the one in July 2022 have further fueled this skepticism.
