Petitions by Rio, et al, for an investigation of the 2022 Philippine presidential election results

On 3 November 2022, former acting secretary of the Department of Information and Communications Technology Eliseo Rio Jr., former Commission on Elections (Comelec) commissioner Gus Lagman, and ex-Finance Executives Institute president Franklin Ysaac, filed a "politically neutral urgent petition" in the Supreme Court of the Philippines, wherein they alleged that in the 9 May 2022 presidential election, it was "highly improbable if not impossible" for Comelec to have been able to count the over 20 million votes reported within one hour (7 p.m. to 8 p.m.) of the poll precincts' closing.

The trio's time-bound petition with the Supreme Court soon fizzled out after six days, however, whereupon they turned their sights to the Comelec itself, submitting a proposal that they would later amend to become a more realistic petition. Although the Comelec acceded in writing to the trio's petitions, the poll body has yet to implement its recount promise as agreed.

2022 petition filed at the Supreme Court
Rio, who is also an electronics engineer, was convinced that the results had been manipulated after taking a close look at the reception logs at the Comelec server. He wondered how the swift reporting of results was possible, as it would normally take at least 30 minutes after the poll precincts' closing at 7 p.m. for the board of election inspectors at each of these precincts to complete nine tasks. These tasks included prompting the machines to print eight copies of the election returns before they could be transmitted to the Comelec servers. Yet within only an hour and a half after the nationwide closing of polling precincts, 53 percent of the election returns were already transmitted.

By comparing the time when the Comelec server received the returns with the time stamped on the printed copies given to election watchers, Rio believed that many election returns were transmitted to the Comelec server before copies of the returns were printed. Rio also showed a number of election returns that were transmitted to the Comelec server more than an hour before their printing. This showed, Rio said, that election inspectors performed their tasks in a variety of sequences.

In their Supreme Court petition, the petitioners claimed that it was simply impossible for the vote-counting machines (VCMs) to have counted within one hour—and transmitted to the transparency servers within that same amount of time—the over 20 million votes already reported at 8 p.m., implying that the results were rigged or preloaded into the VCMs.

In his Philippine Daily Inquirer column of 28 August 2023, former Supreme Court Chief Justice Artemio Panganiban enumerated what the petitioners prayed for thus: (1) a temporary restraining order (TRO) "enjoining the respondents to cease and desist from [performing] any act that may modify/erase/delete any part or whole of the historically-important subscriber/cyber traffic data log integrity/call record details … transmitted from 7 p.m. to at least 9 p.m. of 09 May 2022;

(2) "After due hearing before 9 November 2022," the issuance of "an ancillary writ of preliminary mandatory injunction …" directing the Comelec and respondent private telecommunications companies (Smart Communications, Globe Telecom, and Dito Telecommunity) "to deliver faithful copies of their respective records/details of the said historically-important data directly and exclusively to the Honorable Supreme Court; and

(3) "After due hearing, a final writ of mandamus … directing the respondents to preserve for posterity the said historically-important data." By their petition's wording, according to Panganiban, the petitioners wanted instant action by the Court within six days from their filing on 3 November. It was this petition's being time-bound that would soon render it moot and academic, as the Court was still on its regular All Saints' Day leave and November 5 and 6 were weekend holidays.

Panganiban further opined that "from the filing of the petition up to this writing, the Court has been silent, implying, IMHO, a denial of the two prayers." He wrote this, after stating that "the Court may, at its sole discretion, relax the Rules of Court and require the Comelec and the other respondents to comment on the petition, without necessarily giving due course to it." He then advised the petitioners in the same column to "amend their petition, or better still, withdraw it and file a new one for prohibition to stop the Comelec from using the Smartmatic system in future elections because it is vulnerable to rigging, hacking, cheating, fraud, and/or preloading of data." He further advised that the new petition "must be BACKED UP BY FACTS AND TRUTHS, not by mere allegations, suspicions, or speculations. I say this because of an alleged POST FACTO admission by the Comelec—an admission that was made via media only recently and thus not included in the original petition—that the 20 million votes in question were not transmitted through the telcos, as the petitioners and the public were made to believe, but through a 'single, private, internet protocol address 192.168.0.2.'"

Post-petition
That last part of Panganiban's column was already referencing Rio's new finding in July 2023 and the Comelec's quick answer to the same. Rio voiced to the media that the results of the May 2022 presidential elections were necessarily rigged, as they illegally came from just one private IP (Internet protocol) address. "Transmission logs show that most election returns received by the transparency server were pre-loaded by a secret gateway with IP address 192.168.02," he announced. And why was the bulk of the election returns in total transmitted not through the country’s telecommunications companies, Rio asked, but through an unknown internet protocol address, which, according to him, was an unlawful “man-in-the-middle or intervening router/server”?

Rio explained that the mysterious IP address surfaced after his team, now backed by a group of information technology and digital forensic experts, crosschecked what seemed like "raw files" that an insider uploaded on the Comelec website, placing these against the reception logs provided by the Comelec. Rio challenged the Comelec to pacify all doubts about the election simply through a full disclosure of the actual transmission logs from the vote-counting machines, which, he argued, were not the same as the reception logs the Comelec earlier provided the public.

Additionally, after the Comelec's official website published the 2022 election's telco logs from Globe and Smart, Rio observed that "a total of 7,975 Vote Counting Machines transmitted ERs from 1:15:00 p.m. to 7:09:00 p.m. on May 9, 2022 (Election Day), before being received in the Comelec Transparency Server at 7:08:50 p.m. according to the Reception Logs."

The Comelec quickly disputed Rio's allegation, at least as regards the IP address and a "man in the middle". George Garcia, the poll body's chairman, admitted that Comelec used only one IP address for the 20,300 modems that were used to transmit the election results, but contended there was nothing illegal about doing so. "It does not matter if the IP have the same address. What is important is that the transmitted election results are accurate. . . . (The) law does not require the Comelec to have a different IP address for each modem," he said in a forum, adding that the poll body owned that IP address. Garcia further belied the allegation that there was an "intermediary" that blocked the transmission of the election results from the polling precincts. He said election watchdogs, including the National Movement for Free Elections (NAMFREL) and Parish Pastoral Council for Responsible Voting (PPCRV), were present during the testing of the modems and were aware that only one IP address was going to be used. He further argued that the election's random manual audit "showed 99.99 percent accuracy".

As for the transmission of ERs at 1:15 p.m. while voting was still going on, the Comelec stated that what Rio was alluding to was a "connection reflected and recorded on the Globe telco log at 1 p.m. on May 9" that was merely "between the Municipal Board of Canvassers (MBOC)-Consolidation and Canvassing System (CCS) and the National Board of Canvassers-CCS, not (a) transmission of ERs."

Namfrel and PPCRV's position
Namfrel and PPCRV were both unconvinced by the arguments of Rio's team about the IP address and their man-in-the-middle allegation, recognizing that IP addresses are shared and are not infinite. Rappler paraphrased a Namfrel conjecture of a likely scenario this way: "a telco service provider (TSP) allocated a block of public IP addresses. Modems with the private IP address connected with the TSP's infrastructure, and subsequently assigned a unique public IP address for the transmission of election returns. When the process was completed, the said unique public IP address was released and reassigned to another modem that needed to connect." Namfrel also stated that the raw files Rio's team alluded to do not prove the existence of a local area network (LAN), which existence, according to the watchdog, is necessary for a man-in-the-middle (MITM) attack to happen.

As for the suspicion around the "too-swift" transmission of returns, the watchdogs had earlier stated that it takes less than a minute to print an ER and that an ER transmission, compared to the transmission of videos, does not require a lot of data.

PPCRV stated that what would be the more "real proof" of an MITM attack is if the numbers in the physical election returns printed before the transmission of results by the VCMs did not match those reflected in the transparency server. PPCRV said that their parallel count yielded a 99.84% match rate between those in the physical ER copies that they received and those in the electronically-transmitted ones.

However, Namfrel shared the dissatisfaction of Rio's group with Comelec's release in March 2023 of supposed "transmission logs", echoing Rio's group in saying that the documents were simply "reception logs". Namfrel said that their group believes that "the issues raised are rooted on the non-transparent automated election system (AES) and the lack of transparency in its implementation."

2023 petition for nationwide recounts and the banning of Smartmatic; amendments to proposal
Despite the Comelec's defenses, in November 2023 the poll body still promised Rio's group, who now dubbed themselves as the Truth and Transparency Trio (or TNT Trio), that the Comelec will accede to their petition for a recount of the May 2022 general election votes in select precincts around the country, including those spots where Rio's group deemed the results for the Presidential and Vice Presidential posts questionable.

And after accepting that it would indeed be costly for Comelec to open one ballot box of the Trio team's choosing at each of the 17 Philippine regions, Rio counter-proposed to instead open at least 30 boxes from one town within the proximity of Comelec's head office, suggesting the town of Sto. Tomas, Batangas. "This will be very much cheaper, easier, safer," he said.

The Trio's team also blamed the Venezuela-originating company Smartmatic, which had been the Comelec's electronic election systems' supplier since 2010, for implementing the dubious transmission arrangement, and petitioned the poll body to ban the company from any future bidding. On 29 November 2023, the poll body acceded to the petition, and then ordered its office to "… [C]onduct the recount of ballots in areas in every region in the country, the procedure and extent of which to be determined, and at no cost to Petitioner."

After Comelec's promise, in December 2023 the Trio rested their petitions temporarily while the poll body held its bidding for the 2025 legislative and local elections' system contract. That bidding failed on December 29 after the sole bidder, Miru Systems Co. of South Korea, was found to have been lacking required documents, so a rebidding was scheduled for 8 January 2024, again with Miru as the sole bidder. This time Miru's papers were found to be complete and the company was deemed eligible.

2024 renewed petition
Thus, on 19 January 2024, the Trio's team petitioned Comelec anew to open, on 25 January or thereafter, 30 "sealed boxes" in Sto. Tomas, Batangas. The vote results from these boxes that were still in the custody of the municipal treasurer was the subject of an election protest still pending before the Comelec, as these results were deemed suspicious by the protesting party after one local contender got exactly the same number of votes in ten Sto. Tomas precincts. But Rio stated that the Trio would not delve into that part of the 2022 general election results and would just put their focus on the results for the post of President and Vice President.

However, two and a half months after the Comelec's promise of implementing the recount, Rio said that the poll body "has been silent all this time."

On February 19, anti-electoral fraud advocates, led by Kontra Daya, held a protest outside the Commission on Elections headquarters in Manila and urged the poll body to already proceed with the recount proposed by Rio's team.