BVR computer system tamper-proof: Zec

Source: BVR computer system tamper-proof: Zec – DailyNews Live

Farayi Machamire 27 September 2017

HARARE – The Zimbabwe Electoral Commission (Zec) has said data collected
during electronic voter registration will be stored in tamper-proof flash
drives before the information is fed into a central data base which is
hack-proof.

This comes after the opposition has raised fears that there are inadequate
security measures to guard against unauthorised access to the voter
register database.

Zec is compiling a new voter register ahead of presidential, parliamentary
and municipal elections next year, a mammoth task which is key to ensuring
the vote is more credible than past polls.

The electoral commission is looking to register seven million voters
through electronic voter registration kits, including laptop computers,
fingerprint scanners, cameras and printers.

Zec commissioner Qhubani Moyo told the Daily News on the sidelines of Zec
media workshop yesterday that the process is very secure from the time of
registration to the storage.

“(First) the information is collected from the field and it saved into
tamper-proof flash drives. The machines themselves are embedded with USB
storage as backup storage,” he said.

A USB is a plug-and-play portable storage device that uses flash memory
and is lightweight enough to attach to a keychain.

“The USBs are manually transported to a consolidated server where
information will be fed with all the data from all the registration
centres.

“All the information will be consolidated into one server which is located
at Zec offices (in Harare).

“At this server, we will use the Central Automated Finger Identification
System (AFIS) which will weed out people who have registered more than
once, to leave us with a clean voters’ roll. The clean data will be stored
in the final server at our head office,” Moyo said.

He said the server is protected with numerous passwords and other security
measures which “I cannot make public.”

This comes as Chinese firm, Laxton Group Limited – which won the $4m
tender to supply biometric voter registration (BVR) kits for registering
voters ahead of the crucial 2018 general elections – highlighted in leaked
documents that there was glaring lack of tangible protection mechanisms,
leaving the BVR storage systems vulnerable to fraud.

The State Procurement Board settled for Laxton Group after it proposed a
$3,9 million budget to supply the BVR kits.

A leaked risk report by Laxton Group Limited’s chief legal officer Paul
Bellin raised grave concerns over the security of the voter registration
Data Centre, and said any breach could dent its image.

“This is a highly alarming risk. Zec does not appear to have this
infrastructure in place and when Laxton raised this issue, it fell on deaf
ears.

“It was also made clear that Zec intends using an alternative company to
provide the central system, which was even more alarming,” reads the
leaked report to Laxton’s board of directors and security chiefs in
Zimbabwe.

There are fears Israeli company, Nikuv Projects International, could be
called in to handle the voter database, and was likely to use the central
registry database at the Registrar General’s Office, which will contain
all person-identifying biometrics information in the country.

Laxton said there must be elaborate security measures in place to prevent
or detect tampering that risks soiling its credibility.

“If issues arise, it is virtually impossible to know who is accountable.
With multiple parties handling the system, then who is responsible if an
issue arises? It will make it too easy to point fingers at each other,”
the Laxton Group report said.

Morgan Tsvangirai’s MDC claims the Registrar General’s Office paid the
controversial Israeli-based company, Nikuv Projects International, over
$10 million to assist Zanu PF rig the July 31, 2013 polls, an allegation
strenuously denied by the shadowy firm, the ruling party and Zec.

Asked how the system will prevent multiple registrations, Moyo told the
Daily News: “It is not possible to flush them out instantly because the
kits we are using are not linked.

“It can only flush you if you try to register at the same machine. But
when you go to two stations, it can only be flashed out when we are doing
the de-duplication exercise to say this person is registering for a second
time.” Zec has purchased 3 000 BVR kits and have since taken delivery of
400 BVR kits with the remaining 2 600 BVR kits expected to arrive in the
country in mid-October.

So far the commission has established 63 registration centres but says a
total of 10 000 voter registration centres will be established across the
country when the rest of the kits arrive in October.