25″ July 2024
Messrs Chukwuka Ikwuazom SAN; Tobenna Erojikwe
Gentlemen,
RE: REOUEST FOR ACCESS TO CRITICAL INFORMATION REGARDING THE 2024 NBA NATIONAL ELECTIONS
We refer to your letters, namely that of Mr. Chukwuka Ikwuazom, SAN dated 21st July 2024 and received by email at 10:24pm of same day, and the letter from Mr. Tobenna Erojikwe dated 22nd July 2024 and served by email at 5:27pm of same date, both in the main, worded in similar language and containing similar requests from the Electoral Committee of the Nigerian Bar Association (ECNBA) in respect of the just concluded NBA 2024 Elections. By reason of the similarity in content and requests, permit us to respond jointly to you both to avoid becoming repetitive in our response,
We have also taken into consideration various earlier publications by yourselves on social media addressed generally to Members of our noble association by which medium you both raised similar matters of complaints concerning the just concluded NBA election, and other pre-election issues which we consider only appropriate for us to respond to herein for the purpose of completeness. In the circumstance, kindly permit we start with those pre-election issues Mr. Erojikwe particularly had raised in his social media letters to Members of the Bar.
INTRODUCTION
By the provisions of Section I0 (6) of the NBA Constitution, the election of National Officers and NBA representatives to the General Council of the Bar shall be by universal suffrage and electronic voting as set out in the second schedule to the Constitution. It was in furtherance of this the 2024 NBA Elections were held on 20th July 2024 on the “ElectionBuddy” electronic voter platform and final results announced on Sunday 21st July 2024 within 11 hours of completion of voting, in accordance with our Constitution. Election Buddy Inc, Owners and Operators of the voting platform had formally issued ECNBA a certification of the results of the election on 21st July 2024 at about 12:57 am WAT, duly signed off by its President and Chief Executive, Dave Bodnarchuk (See annexure). In addition to the validation of the election outcomes by the certification of Election Buddy Inc at completion, and upon receipt of your respective complaints referred to above, we have in consultation with the Election Service Provider (Election Buddy Inc/Inits Consortium) and the Technical Service Consultant (DigiterHub Ltd) sought to provide answers to your respective requests where possible, in the hope that the answers we now exhaustively provide below will clear any misconceptions, ambiguities or misinformation you may have or have circulated concerning the NBA 2024 elections.
It should be noted that the Election Voting Platform (Election Buddy) is an international company based in Edmonton, Canada and has conducted over 300,000 elections globally for organizations like the NBA, Multinational Corporations holding General Meetings across continents, party primaries and national elections of Nations around the world. Election Buddy consortium therefore has no affiliation of any sort with the Nigerian Bar Association nor any candidate other than as a service provider to ECNBA for this election.
BACKGROUND
Over the several months of preparation for the elections of 20th July 2024, ECNBA issued about 17 Notices on various aspects of the electoral process, besides our published Request For Proposals, list of shortlisted bidders for services, announcements, were, all issued in compliance with the provisions of the NBA Constitution and extant Laws of the land as provided in Part II, Article 7, 2nd Schedule of the Constitution, which requires that the ECNBA shall demonstrate respect for the rule of law and comply with the laws of the Federal Republic of Nigeria.
Summary of Compliance Steps
i. Notice of election was issued in Notice No 2 on 1st March 2024 and further directions in Notice 2A of 5th March 2024 in compliance with Part VII, Article 1, 2nd Schedule of the Constitution.
ii. Nominations opened on 11th March 2024 and ECNBA’s first set of Guidelines on the conduct of the elections were issued and published in our Notice 3 (Guideline A) of 11th March 2024 on the elections, made pursuant to Part ,1, Article 2 of the NBA Constitution (ahead of the 60 days deadline to election day), with additional Guidelines (B & C) following in ECNBA Notices 9 and 11, as the electoral process progressed into its various stages.
iii. Selection of service providers including the Technical Service Consultant and Electronic Voting Platform Providers was transparentlv conducted by ECNBA issuing Requests for Proposals, receiving bids, transparent opening of bids, publication of shortlisted bidders, conduct of technical and financial reviews before the final selection of the Service Providers, and their names announced in the Notices.
iv. Final list of Candidates was published and circulated ahead of deadline in line with our Constitution, upon conclusion of screening and the appeal process.
v. The Voters’ List was published on the 28″ of May 2024 ahead of the Constitutional deadline of 45 days to election day, and announced in our Notice No.8 issued on the same date. Whereas Mr. Tobenna Erojikwe had continued to erroneously claim in publications on social media that the Voters’ list was not published, the electronic trail of our notices on the www.ecnba.org website shows clearly this claim is misconceived. Perhaps the misconception was from a lack of appreciation of the need to publish the Voters’ list in the secured format we did, which allowed only eligible voters to check and view their names, details and personal data on the Voters list, but without the pleasure of viewing other voters’ personal data. The critical security information for the elections were the voter’s SCN number, phone number, and email address, which constitute personal data protected under the Nigeria Data Protection Act 2023, and which a custodian of such data (as ECNBA is) should not unlawfully publish, particularly without the consent of the data subject. See generally sections 24 to 40, and 65 of the Act. It was however important for the credibility of the elections that the Voters’ list to be published, should of necessity show these critical details to enable each voter to verify the correctness of their personal data through which means they would ultimately receive their voting credentials to participate in the elections and cast their vote for the candidates of their choice. These personal data are the core information with which each voter would vote on election day, and thus critical to be published on the Voters’ list, yet without our breaching statutory provisions that may render the ECNBA/NBA liable for regulatory infringement, besides liability exposure to individual members whose personal data would have been unlawfully published. It should be noted that we now live in an age where many members who bank electronically with digital banks, have their phone numbers serving as their bank account numbers, and in an age of bank hacking, exposing members’ personal data (email, phone number, SCN) may render them vulnerable in many unintended ways. It was in deference to the provisions of the Data Privacy Act, that ECNBA felt mandatorily obliged by statute to protect these critical members’ data in our custody lest it became unduly exposed or render our members vulnerable to identity theft by that exposure. Indeed, Part 2, Article 7 of the NBA Constitution requires our compliance with National laws,
In view of this, and in line with the Data Privacy Act, we employed the use of appropriate technical and organizational measures to ensure confidentialitv, integrity and availability of the personal data, in publishing the Voters’ list for the purpose of meeting our constitutional obligations under the NBA Constitution. This informed the unique manner in which the Voters’ list was published on our website which met the requirements of both the Data Privacy Act and the NBA Constitution. It allows members to check their eligibility, and confirm their personal details to receive their voting codes by personally inserting their unique SCN to search for their names on the list, yet prevents unauthorized persons from accessing their personal details without their consent. We owe that statutory duty to you as candidates, to all our members and the NBA. We were therefore never in breach of our Constitution on publication of Voters’ list as you alleged sirs.
vi. The outcome of our initial verification exercise of the Voters’ list by members and further filtration conducted by the ECNBA and our service providers were discussed and presented to yourselves and other candidates at the stakeholders’ meeting of 10th June 2024, with resolutions taken presented to NEC and ratified, and further at a second stakeholders’ meeting with candidates on 12th July 2024. It should be emphasized that every step, decision, and procedure adopted by ECNBA in the electoral process were either announced and published in our Notices to all members, circulated on various channels, and/or presented at the stakeholders’ meetings with candidates. As far back as our stakeholders’ meeting and press conference of 10th June 2024, yourselves and other candidates were given all the facts and figures behind the Voters’ list including the total number of eligible voters (72,071), data correction requests submitted at verification, our adopted policies for processing the submissions transparently, our filtration outcomes, observations on the voters’ list, etc, thereby demonstrating utmost transparency to you and co-candidates at every stage of the process.
vii. Prior to, and at the stakeholders’ meeting of 12″ July 2024, Mr Tobenna Erojikwe had again requested that the already published voters’ list be re-published with full details to which we restated our above position, further to which you requested we re-publish in a different format showing members’ names and branches, and although you left that meeting early, it was the consensus of all other candidates present at the stakeholders’ meeting that your request was an unnecessary exercise. That resolution was expressly communicated to you by other candidates and by the ECNBA Chairman after the meeting. Nevertheless, the ECNBA in our consistent responsiveness and transparency decided to still publish a Branch Voters’ Directory on our website showing in alphabetical order, the names and branches of all eligible voters (but without their critical personal data). This format was not, and could not have been a valid Voters’ list (if that was all we published) as its content falls short of the essential features a valid Members’ Voters’ list for an electronic voting election should contain (i.e. SCN, Phone number, email), which details we had earlier published in the Voters’ list and database released on 28th May 2024 and visible to every eligible voter. Please note that both the Voters’ list and the Branch Voters’ directory are still on the ECNBA website till date and will remain until the post-election reviews and audit processes are finalized and submitted to the National Executive Council {NEC).
It is therefore misinformation by any candidate to continue to suggest on social media that the voters’ list was not published until hours to the commencement of the election when yourselves and all candidates are aware of the Voters’ list publication since 28th May 2024 when members were invited to verify their personal details in preparation for election as intended by our constitution.
ALLEGED ELECTION DAY ANOMALIES STATED BY YOURSELVES
May we quickly state that ECNBA is by its mandate conducting a full post-election audit of its election processes, operations and execution with a view to providing a final post-election report in the coming weeks to be submitted to the NBA NEC.
This, we are doing along with our Service Providers and may take a few weeks to complete.However, your complaints and requests necessitated an urgent response to same even though our post-election audit is still ongoing, hence this preliminary report to you and the production of some of the relevant documents you requested, on which further drill down procedures are still ongoing, all in a bid to assist you to better appreciate the processes and systems adopted for the election, answer your· questions and clarify your assumptions.
- Alleged IdentityTheft/Double voting:
We implemented a robust system to prevent double-voting in the election process using Election Buddy. Each voter receives a unique voting link, which is securely generated and distributed individually.
This unique link is dispatched by email and SMS to eligible voters via the email and phone number attached to their profile on the list of eligible voters. They are also required to provide their SCN to unlock their own ballot on that link. Once a vote is cast using this unique link, it becomes inactive and cannot be used again, thereby preventing duplicate votes. This method guarantees the integrity of the election by ensuring that each voter can only vote once, maintaining a fair and transparent voting process.
While we are confident in the process and system design deployed, which inherently prevents double-voting or identity theft, we take your claims very seriously. In our pre-election engagements, we provided ample information of discoveries of various kind in the clean up of the Voters’ list. One of such which we discussed with you and other candidates was that many members at the time they paid their Bar Practice Fees in January-March, had this done for them by proxy (by their staff, juniors, Assistants, etc). Those proxies in most cases while registering the payment in the name of their lawyer seniors/friends being assisted, inserted their own phone number and/or email by default (not necessarily maliciously). Those data entries if not amended remains their contact details to receive voting credentials and such recipients of it may then have access to your ballot. ECNBA gave such members the opportunity to correct such default derails during the verification period between 28th March and 7th June 2024. Therefore, members who failed to avail themselves of the opportunity cannot hold ECNBA liable if their voter links became compromised by their default. That was not an ECNBA issue but that of the voter who had compromised his personal data to a proxy at the point of entry of payment of your BPF, and failed to correct same during voter verification exercise when we published the Voters’ register.
Other than these, should you have any valid claims of such identity theft,we require and request detailed information about the specific cases to interrogate each case as it may be a professional misconduct for any lawyer to use another’s voting credentials to cast a vote on behalf of the authentic voter. Please provide us the SCN numbers of your said supporters you claim suffered such or experienced this issue so we can investigate the associated voter links sent to their profile on the Voters’ list, identify the exact ballot cast via that link and any related activity, and we shall publish our findings accordingly. Rather than make a sweeping statement of identity theft without particulars, you can assist us to show you the truth about each case if you provide us the details of your complaining supporters
Additionally,the voting platform secures from voting manipulation by providing a unique confirmation code to a voter after the ballot is cast, and also emailed to each voter. This confirmation code represents their entire ballot, protecting their choices and ensuring it is impossible to alter their voting records bv double voting. If you oblige us the details requested, we have an electronic footprint to use to show who voted using the sent voter link, and if we additionally have written consent from those supporters of yours so complaining, we can also unveil their said privately cast votes for transparency in our investigation.
- Discrepancies in Vote Display and Updates
To achieve a better viewing experience and at the same time discourage multiple and aggressive refreshing of the results page, the results display page had an automatic refresh feature so the voter only needed to have the page open in their browser,on their phone, or computer.The refresh is confirmed to happen within one and two minutes after the page is loaded. This is also done to match the results tallying process which happens as votes are being cast. The compilation of results after a vote is cast takes a few seconds or up to a few minutes, depending on how many votes have already been cast and how many have just been cast. The results page would therefore not change until the compilation is completed.
Additionally, it is important to note that the snapshotview at every refreshed minute displays votes already sorted into each candidate’s tally. Votes still being sorted upon being cast may not have reflected immediatelv until the system completes sorting and adds them to each candidate’s pile. Some people, however, were refreshing the page every few seconds, hoping to see updated results before the results page had the updated information, ignoring this recommended refresh period. There was therefore no malicious intent of any sort either in the periodic display nor in the final tally. (See the Annexure D -final results certified by Election Buddy, also posted on www.ecnba.org)
- Suspicious Vote Increase Pattern:
The number of votes attributed to all candidates is an exact reflection of the ballots cast by participants over the course of the election period.
Your claim of a steady increase pattern without specifying your assumed or calculated ratio of the so-called “steady increase” makes such a claim empty and without foundation. However, to provide you some clarity, we have attached the hourly table of votes cast (See Annexure A). This table aptly demonstrates that the votes cast each hour by all voters do not follow any steadv pattern nor even increase, thus disproving your claim of a pre-programmed voting pattern or vote allocation. Any vote increase pattern observed is a natural result of member participation throughout the election period. You had both further alleged in your letters and comments on social media that you observed a “steady increase” of the votes of the winning candidate was in an “almost exact geometric progression at the top of the hour” concluding howbeit erroneously, that same was pre-programmed. The attached table of hourly capture of votes cast shows there are hourly bands with votes in excess of 3000/2000 votes, just as there several hourly bands with total votes cast far less than 1000 votes, The question is which of these hourly bands reflect the alleged “exact geometric progression”? It is important to note that at commencement of the election, Mr Ikuwazom, SAN was in 2nd place in the votes cast at least in the early hours until later when the vote tally of Mr. Erojikwe increased and pushed him to 2nd place with Mr Ikuwazorn SAN dropping to 3rd . It is therefore incorrect to allege as Ikuwazorn and his supporters suggested in social media posts that he was placed third all through the election, nor was there an exactitude attributable to votes progression of any candidate.
ECNBA and our Service Providers were and remain committed to maintaining the integrity of the election process and ensuring that every vote cast is accurately reflected in the final results. To put out an allegation of pre-programming of voting results without any fact of such is to maliciously deprecate the reputation of the international companies and Service Providers employed by ECNBA, and indeed of members of the ECNBA as being co-conspirators in pre-programming vote patterns, yet offering no shred of fact in justification. We continue to urge restraint in our use of words to express our dissatisfaction, so as to avoid a misinformation of members and the public, or denigrating reputations of men and/or institutions built over several decades.
- Discrepancies in Vote Patterns
It was alleged by Mr. lkwuazom SAN that “reported voting figures show inconsistencies with the actual votes cast” by his supporters, therefore suggesting manipulation of the system. It is important to clarify that the choices made by voters in their ballots are private and confidential. It is not possible for any contestant to know with certainty how individual voters or indeed his said supporters have cast their votes. Did the 40,656 voters who participated (of which 9,018 voters cast their ballots for Mr Ikuwazom) show you their e-ballots to know who they really voted for? Actual votes cast by any candidate’s supporters are. only known to each voter. Extrapolating from assurances given you by supporters, to match against actual reported voting figures tallied, offers no scientific basis of arriving at your conclusions sirs. While we cannot imagine the possibility of this claim in any scenario, 1, we are open to understanding how you gained access to the actual votes cast by the said supporters as that remains the onlv way to conclusively assert vour expected voting pattern against the actual votes cast, especially in an electronic voting system. We find no basis for this assertion sirs.
- That the number of votes ascribed to the winning candidate steadily increased in an almost exact geometric progression at the top of each hour for nearly the entirety of the election in a manner is demonstrative of a pre programming of votes:
In addition to answers in paragraph 3 above, note that the number of votes attributed to all candidates is an exact reflection of the ballots cast by the participants over the course of the election period. A claim of a steady increase pattern without specifying the ratio of such a “steady increase’ is baseless. To provide clarity, we have attached an hourly table of votes cast. This table demonstrates that the votes cast each hour by all voters do not follow a steady or even increase, thus disproving the claim of a pre-programmed vote allocation. The vote increase pattern observed is a natural result of member participation throughout the election period.
- That the number of votes cast for candidates at different positions during the course of the election did not tally.
For interim results (while the election is ongoing), the platform processed votes in a sequential manner, reviewing each position and question independently before moving on to the next one. Each set of results is stored separately as it compiles the subsequent ones. Given there were 13 positions being vied for (10 National offices and 3 General Council of the Bar Bloc Regional slots), a vote can be included in the results for a subsequent compilation, depending on when it was cast during the ongoing compilation process.
This sequential processing can lead to temporary disparities in the. totals displayed at intervals for different positions, while minute by minute snapshots were being viewed as the system tallied votes. For example, results presented at 8AM may show wider disparities compared to those at 4 AM due to a higher volume of votes being cast and processed at that time. Additionally, as the number of ballots cast increases, the time required for compilation also increases. Consequently, results at 4 PM may take a bit longer to compile than those at 4 AM, providing more opportunity for votes to be cast during the compilation process of each position.
This is why the ECNBA labelled these interim views of results using the phrase “Vote Count” and also included a time stamp in the results so it is dear this is an interim result view. At the end of the voting period, the final official results were compiled for the last time and consistency was confirmed across all categories leading to the final results.
- That while the actual voting took place on the platform provided by Election Buddy i.e. electionbuddy.com, the live election results were exhibited on a completely different and unrelated platform, go.ecnba.org. Technical experts engaged by me find this rather curious and strange, and it questions the integrity of the results. As a technical matter, it leads to irresistible inference that the results purportedly projected on the ecnba.org platform as live results of the election were simulated results that may,likely,be different from those at the backend servers of Election Buddy:
The full certification of results by Election Buddy and delivered to the ECNBA immediately after the election negates this allegation. This certification is based on all the information available on the backend servers of Election Buddy and the information displayed on go.ecnba.org is consistent with the certification of results. The complete voting information has been securely provided to the ECNBA. Below is additional technical information on the process and thinking for the viewing portal go.ecnba.org.
From the original 72,071 eligible voters on the Voters list, 72,059 voters were uploaded on the voter platform as eligible (less 12 blanked out voters with strange SCN numbers starting with EXM …… which were invalidated by the Supreme Court enrolment office, and which fact had been earlier presented to stakeholders on 12th July 2024) to participate in the 2024 NBA elections. The platform where. the votes were cast must therefore have had more than enough capacity for this number of voters. Based on past NBA election experience, we found the viewership of election results extends beyond the eligible voters. Concerned citizens, observers, Non-Eligible/Non-Voting lawyers, Non-lawyers and curious individuals within and outside Nigeria, and many others follow the results. This means that while the system for elections is designed to sufficiently handle the expected number of voters {72,059), the results display page must be able to handle much more traffic than the voter traffic without freezing nor downtime. This was one of the key lessons learnt from the previous online NBA elections held by past ECNBA. As a matter of fact, in one of such past NBA elections, there were over 3.7 million hits on the election results page alone from all over the world!
It was therefore imperative to ensure:
- That the voting process, result compilation, and experience by voters were not affected by the traffic to the result viewing site.
- Detailed snapshots of the results are periodically taken and presented on go.ecnba.org on a public URL that anyone can visit easily and see conveniently.
- That we had a system architecture design that would support this separation of processes. A good solution architect knows how critical this is.
- That the infrastructure is optimized based on its primary function.
- That we had the right rules in place to repel all cyber threats we could be subjected to.
- Well-architected designs follow a similar pattern.
At a point in time, the results viewing page started receiving a massive flood of hits, matching the characteristics of a Denial of Service. (DoS) attack. Details of these will be in the final post-election report.
In the digital world, a DoS attack happens when a hacker attempts to overwhelm a website or online service with an excessive amount of traffic or requests, with the intention of making it unable to function properly and preventing legitimate users from accessing it. If successful, such a disruption can cause inconvenience and damage to the reputation of the affected service. This means a successful Denial of Service would have blocked access to the results viewing page and raised concerns with everyone. However, we had already prepared for the possibility that someone or a group of persons may attempt to do this and we were able to handle and ensure the results viewing page remained available by reason of the system architecture. solution employed.
Regarding the specific concern about voting on Election Buddy and vewing results on go.ecnba.org:
- Single Election Platform: There was only one election platform for voting, which was Election Buddy. All votes were cast on this secure platform.
- Results Display and Information Hub:The go.ecnba.org platform was used exclusively to display the results of the elections and provide valuable pre election information and instructional guides for public consumption. There was no separate platform for voting for the elections. The voting platform for the NBA 2024 Election was provided and run by ElectionBuddy. Only ElectionBuddy.com was used for voting. The go.ecnba.org portal was merely a viewing portal (It is like a viewing screen in an overflow canopy outside an event center, to provide a view of the event happening in the event hall. Offering that view outside the hall controls viewing traffic from flooding the main event hall where the main event is happening yet watching same event in the hall. It can also be likened to our watching on a television set at home a live soccer match in a stadium. Whereas you may not be inside the stadium, you are watching the same match being played in the stadium on your TV set at home, and not a different match. The go.ecnba.org page was not a voting platform and any ICT expert worth his claim can go on the said portal and verify to see it was never a voting site but a viewing portal only.
- Familiar Platform:The go.ecnba.org website had been widely circulated by the ECNBA through various channels, including videos, broadcasts, sensitization meetings across regions, and notices, ensuring that voters were already familiar with it. It is contained in the animated videos widely circulated pre-election and announced as the result viewingplatform ahead of elections.
- Post-Vote Confirmation: After a voter casts their vote, the confirmation message includes a link to see the results on go.ecnba.org, providing seamless navigation from voting to result viewing,
- Secure Connection: The go.ecnba.org was securely connected to the results page and was projecting that information throughout the election period, ensuring accuracy and integrity.
- Traffic Management: By directing the significant traffic to the result viewing page, we were able to protect the voting pages from potential overload, ensuring a smooth voting experiencefor all eligible voters. We thus avoided the negative experiences of past elections.
- Some Voters reported receiving emails acknowledging that their votes had been submitted even before they had the opportunity to cast their votes. Others reported subsequently receiving another link to cast their votes. In other words, these were demonstrable instances of double-voting or at least data manipulation.
We implemented a robust system to prevent double-voting in the election process using Ele.ctionBuddy. Each voter receives a unique voting link, which is securely generated and distributed individuallv. This unique link is dispatched by Email and SMS to Eligible Voters via the Email and Phone Number attached to their profile on the list of eligible voters.
The voter would also need to provide their unique SCN to unlock their own ballot on that link. Once a vote is cast using this unique link, it becomes inactive and cannot be used again, thereby preventing duplicate votes. This method guarantees the integrity of the election by ensuring that each voter can only vote once, maintaining a fair and transparent voting process. While we do not see the svstern design allowing the possibility of this complaint raised, we would like to explore the validity of this claim by requesting for a pool of the SCN numbers of persons you claim experienced this challenge. Without this it would be mere speculation for anyone to make such a claim without proof. Note if a person claims his vote had been submitted without him participating, he must have received an acknowledgment of such submission. If he claims he later upon complaining, received a second link, did he vote with the said second link. If he claims he did, then he must have received a second acknowledgment of vote code, which we would find incredibly impracticable given our system security. The platform also secures from voting manipulation by providing a unique confirmation code to a voter after the ballot is cast, and emailed to them. It is a representation of their entire ballot for the purpose of protecting their choices. It would be impossible to change their voting records on any basis, hence making double voting in this election almost impossible and unbelievable.
Nevertheless, if you can send us the SCNs of such complainants, we will definitely offer you more detailed facts related to such a case beyond what you may have been told.
- Despite the fact that the election was widely advertised to commence by 12:00am and end by 11 :59 pm on Saturday 20 July2024, voting continued into the early hours of Sunday 21 July 2024 and the number of votes continued to increase.
The compilation of results were completed at past midnight when the voting closed. The final compilation of results is an intensive process because it includes a ballot by ballot check,vote by vote verification and integrity check. It also includes a check for any tampering. All the voting data is tamper evident, making it very difficult to manipulate the results of the election. This is one of the most powerful features of the voting platform provided by ElectionBuddy.
However,due to a surge towards the final minutes of the voting period, it meant it was critical to wait and fully complete this check when voting closed. This as expected resulted in the number of votes changing as the final compilation was taking place. A total of 23 votes dropped after midnight and processed. At close of polls, It was transparently made clear on the result display screen that the final compilation was taking place and it was also made clear when the final compilation was completed. As seen in the ElectionBuddy certified results annexed, the final results issued out at 12.57am West African Time.
REQUESTS BY COMPLAINANTS
We have escalated your respective requests for access and information to the electronic voting service provider (E-Buddy), and while the post-election audit process is still on, we are only able to make the following responses, and documents annexed available to you, in addition to the given explanations above and below. Where requested documents are unavailable, the reason for such are also clearly stated. We therefore have copied below the responses from the Service Provider:
a. Request for full access to server and application log files used during the election period.
The log information would contain information that is not specific to ECNBA votes. Access to these logs would expose other user’s sensitive information and would constitute a breach of data. This is contrary to the GDPR, and NDPA\NDPR compliance regulations. As you are aware, Election Buddy Inc provides its services to tons of organizations and nations globally using the same servers and application files, hence giving one user access clearly compromises the entire credibility of their servers carrying other users’ data. It is like a bank. customer demanding access to the bank’s server because of an alleged entry in his statement of account, whereas the same server holds thousands of other customers’ financial and personal data. Your request will render Election Buddy Inc liable professionally and contractually to other users of their platform, ence unacceptable.
b. Access to the election systems architecture documentation.
This was provided to the Electoral Committee of the Nigerian Bar Association (ECNBA) at the bidding stage and a copy will be provided with this response (See Annexure C).
c. Complete database records, including voter information and voting transactions.
Voter information concerning voters cannot be provided as this is a direct violation of the privacy of their ballot choices and infringes the Data Privacy Act. Except you provide us with the consent letters of the voters whose voting transaction data you seek, we cannot ex-pose to you such private data of voters choices.
d. Network traffic logs from the election
The network traffic logs requested encompass much more information than just data pertaining to this NBA election, as Election Buddy system supports multiple clients simultaneously, Sharing these logs would risk exposing sensitive. information unrelated to the NBA vote, compromising the privacy and security of others.
To address the integrity and transparency of the election process, a certification of results letter signed by the President of Election Buddy, a Certified Public Accountant (CPA), Dave Bodnarchuk, was provided. This certification, attached here, attests to the fairness and accuracy of the election, ensuring that only eligible voters as represented on the Voters list participated, each voter only voted once, and all votes were securely processed and recorded. Based on the independent review and the stringent criteria applied, we are confident in. the integrity and security of the election process. The attached certification letter (Annexture D) and final results provide detailed attestation to the credibility of the election.
We trust this certification letter, along with the detailed procedures it outlines, address your concerns regarding the election’s transparency and accuracy.
e. All incident response documentation or reports from the election cycle.
No incidents to report. The ECNBA will receive a detailed post-election audit report from Election Buddy/INlTl’S Consortium as captured in the terms for the purposes of documenting all activities, lessons and recommendations.
f. Details of security measures and protocols implemented for the election
- Secure software development life-cycle implementation
- SSL,TLS transport security
- Data validation and sanitization, Database Boundarv validations before data persisted
- Database encryption
- Content distribution networks integration to prevent DDOS
- Web application firewall
- Black Box/white Box penetration tests
g. Detailed logs of all voter authentication attempts, successful and unsuccessful, to investigate the reported identity theft issues.
The information you request is considered sensitive and private. These logs contain data that can potentially correlate with the ballot choices made by voters, thus compromising their anonymity and violating the principle of the confidential voting process promised. Protecting the identity and privacy of voters is of utmost importance, hence sharing these detailed information, even for investigative purposes, that may be copied and further shared to your team, could inadvertently ex-pose voter identities and private information, which we must avoid, to maintain the integrity of the electoral process.
Nevertheless, to assist your inquiry, if you still require it, we may be able to arrange a joint sit-down review of the logs with our Service Provider,at which meeting you may explore and ask questions on it. We are however unable to provide you a copy of confidential data that may expose voter choices.
h. A complete record of voting timestamps for all cast ballots to analyse voting patterns and potential anomalies.
This is only provided here on an hourly basis to preserve the identity of the voters. Attached as Annexure “A” to this response is the related information.
i.Documentation of any changes or updates made to the voting system before, during,or immediatelyafter the election period.
No changes were made. Penetration Testing results were shared with the ECNBA regarding the security posture of the platform before the elections and no modifications to the architecture or components were carried out during and immediately after the election.
j. Records of all individuals who had administrative access to the voting system during the election period.
For security and privacy reasons, we are unable to disclose specific details about administrative access beyond that this was highly limited and an admin audit shows no changes were made or votingcredentials revealed or accessed throughoutthe election. Limited administrativeaccess was granted within Election Budd/NITS consortium only, following stringent security protocols and was monitored to ensure the integrity and confidentiality of the election process.
k, Copies of all data backups taken before, during, and after the election process.
The backup containsproprietary,and other clients data as ElectionBuddy provides services to other clients. The backup consists of other clients data and therefore could not be shared due to confidentialityand contractualclauses.
l. All documentation of APIs and their usage logs.
APIs are proprietary and for use in the elections onlv.
m. Detailed logs of any system errors, including timeouts and database update freezes.
The platformwas over provisioned for compute, storage and database. Therefore, we did not have any update or system/database freezes during the election.
n. All formal records of voter complaints or reported issues during the election.
This has been categorized and a summarv will be shared along with this response (See Anne.xure B).
o. Data on system performance throughout the election period, including server response times and load
Prior to and during the election period, comprehensive data on system performance was collected, including server response times and load statistics. The ECNBA had requested thorough load testing to ensure system robustness. As part of these preparations, server configurations were optimized to handle a peak load of 75 votes per second.
Throughout the voting process, the system performed efficiently, with server usage metrics indicating that the infrastructure was well within operational limits. Specifically, the maximum server usage recorded was about 20% for the database servers and 14% for the application servers, This indicates that the system was operatingwith significantheadroom,ensuringsmooth and responsiveperformance even at peak times.
Additionally, server response times remained consistently low, ensuring a seamless voting experience for users, Load statistics showed that the system could comfortably handle the voting traffic, with no significant latency or downtime.
These metrics highlight the effectiveness of the load testing and server tuning efforts undertaken prior to the election, ensuring a reliable and efficient voting process.
p. Detailed logs of all PNG image uploads to the ecnba.org/results/ portal, including timestamps, file sizes, and the account or process responsible for these uploads.
The PNGs were snapshots of the tallies of ballots that were cast and saved at that point in time and were automatically updated. The latest P’.\’G replaced the previous one to ensure any visits to the results viewing page would always return the latest snapshot of the results. The PNGs had an average size of 283KB. Only the latest and final PNG taken at the end is available. This is available as Annexure E.
q.Documentation on the process and protocolsused to transfer data from the primary election platform (electionbuddy.com) to the display portal (go.ecnba.org).
There was no transfer of data from the primary election platform to the display portal. The go.ecnba.org portal was merely a presentation laver to what was available from the ElectionBuddy results page.
r. All third-party service logs and reports from these services.
Logs for third party services like CDN providers cannot be provided as multiple customers use the sen ice and reports will contain information for unrelated users.
CONCLUDING STATEMENTS BY ECNBA
It has been a grueling and tasking assignment organizing a seamless Bar elections in 2024 given our past experiences. Viie left no stone· unturned, anticipating all probabilities and challenges and remedying same ahead of the elections. The above responses and explanations clearly show the interest of ECNBA and om Sen ice. Providers were clearly to ensure a credible and transparent process and election, and as much as possible avoid past system challenges and attendant controversies. This is evident in our multiple messaging, notices, engagements with stakeholders, etc. vVe sourced for and deployed upscaled technology, redesigned a fail-proof system structure, all in a bid to assure our candidates and voters of a very credible election and process, and provide a satisfactory voter experience. Voterswho called our helplines had their issues either satisfactorilv sorted, explained, resolved or politely declined where the demand was beyond EC~BA mandate or incapable of being addressed. Our final reports will contain re.commendations from ECNBA and our Service Providers, of ways and steps to even make the process more seamless beyond the success of the 2024 elections.
While we appreciateyour disappointment at the Joss of an election, we do not think every loss should be attributed to mischief and unwholesome practices as alleged by your complaints. ECNBA members and our Service Providers at commencement were required to sign up to undertakings warranting no conflict of interest in respect of our assigned tasks, all in a bid to ensure full commitment of all, even at the risk of actionable legal steps against such, where any conflict of interest issue arises against any member or provider. Besides, we can attest to the credibility and authenticity of the voting process and re.suits as me.e.ting a significantly substantial compliance test measured on all parameters. ViTe would expect that where candidates do not quite understand an employed process or system, a simple question to ECNBA, rather than published accusations and allegations would provide valuable answers to clarify. The ECNBA, Candidates and NBA Members are Partners in progress for the purpose of our common objective of electing officers.
We do hope the above preliminary response provides you both valuable insights and answers to your contestations and requests. Should you have further need for more information, you may provide us specific details of instances of any infraction with traceable data of persons affected and we shall interrogate and provide you further answers, otherwise we advise that you kindly await our final post-election report and audit in the next few weeks, for an even more detailed information.
Thank you and accept. our sincere regards. Yours faithfully,
Dated this 25″ July 2024