Cybersecurity Expert on Fraud Claims and Voting Safeguards in Venezuela’s Presidential Election

Venezuelan opposition supporters have circulated many theories since the July 28 elections. They have suggested that the electoral system was mired in fraud in order to, according to them, steal the election from Edmundo González, a right-wing candidate supported by María Corina Machado. We interviewed Víctor Theoktisto, a computer science professor at Simón Bolívar University, to address many doubts that have arisen regarding the Venezuelan electoral system.

In Venezuela, the Sunday, July 28, presidential elections closed normally. The president of the National Electoral Council (CNE), Elvis Amoroso, announced the results at 12:13 a.m. on July 29: Nicolás Maduro obtained 5,150,092 votes (51.20%) and Edmundo González, the main opposition candidate, obtained 4,445,978 votes (44.2%).

This announcement would not have been different from the many other elections held in Venezuela, if not for two things:

1. Amoroso reported that there was a cyberattack against the data transmission system, which caused delays, and

2. Throughout the night, the supporters of González and María Corina Machado were posting photos of voting machine tallies on social media, claiming they had won, and rejecting the announcement of Maduro’s victory.

The next day, Machado and González announced that they had a large number of tally sheets (initially 40% of the total, then 70%, then 80%) and eventually provided their own results, which currently stand at 7,156,462 votes for Edmundo González (67%) and 3,241,461 votes for Nicolás Maduro (30%).

It is not the first time the opposition has cried fraud; similar allegations have occurred in almost all major elections in Venezuela. But, on this occasion, the opposition launched not one, but three websites where they published 24,000 alleged tally sheets issued by the voting machines.

In Venezuela, elections are automated and each person votes at a machine, which prints a receipt that the voter places in a box. The machine keeps track of each vote, and at the end of the process, the polling station members, accompanied by political party witnesses, conduct a closing protocol that sees the machine print a paper report.

Then, the machine connects to a CNE tallying center and transmits the results. Copies of the tally sheet are printed for the witnesses of each political party.

The opposition claims that the tally sheets were collected by its witnesses and that the records from 24,000 polling stations are uploaded (there were 30,026 polling stations in total). Within 48 hours, the paper tallies were scanned, photographed, and classified on a website by state, municipality, and voting center, allowing people to review the results. In addition, anyone can download a CSV spreadsheet with all the data from those 24,000 polling stations, and summed-up results match the numbers published by Machado’s team.

The CNE has never published scanned tallies on its website, but it has been publishing polling station results for almost 20 years. That is, after the initial results are announced, you can go to the CNE website and see the broken down results by state, municipality, voting center, and polling station. If you are a political party witness, you can compare the printed copy of the receipt from that polling station with the result published by the CNE on its website, and both results should match, providing transparency and reliability to the process.

The publication of results by polling station is usually done a few hours after the first electoral bulletin is released. The problem is that the CNE website has been down since before the elections, and it has not been possible to verify this data. CNE president Elvis Amoroso reported that the organization was the victim of a cyberattack, but did not provide further details.

In light of these problems, President Nicolás Maduro, who was proclaimed the winner on Monday by the CNE, went to the Supreme Court of Justice (TSJ), specifically the Electoral Chamber, on Wednesday, July 30, to request an investigation and clarification of the process. He requested that all candidates, as well as the National Electoral Council, be summoned, and that all necessary records and legal documents, including the tally sheets, be submitted. He also offered to provide 100% of the tally sheets from his party’s witnesses.

The TSJ’s Electoral Chamber summoned the ten candidates to appear, and on Friday, nine of the ten candidates attended. The only one missing was Edmundo González, the one who has made the fraud accusations.

With the CNE and the opposition offering two completely different results, it is obvious that one of the two parties is lying. The Venezuelan people are waiting for evidence and answers not only to confirm or know who won the elections, but also to find out who is lying and causing unrest and chaos in a country that has been under continuous attack from foreign powers for at least 20 years, and whose people are not allowed to live in peace.

It is worth recalling that the Machado and González fraud claims were accompanied by violent protests in several cities across the country on Monday, July 29, and Tuesday, July 30, which left several people dead, dozens injured, and caused damage to numerous institutions and public infrastructure. The Venezuelan government has reported that several of the people captured causing violent acts are part of criminal gangs, and many have confessed to being hired to create chaos.

Maduro has denounced an ongoing coup supported by the United States government, and the US Secretary of State, Antony Blinken, made unsurprising statements backing González as the supposed winner of the elections.

The Venezuelan electoral system has been ranked as one of the best and most secure in the world. However, when such incidents occur, the system’s own complexity prevents many people who are not experts in the technical area from understanding how secure it is, and often leads to the spread of far-fetched theories.

Interview with Víctor Theoktisto

To address some of the questions people are asking on the street and on social media from a technical perspective, we consulted Professor Víctor Theoktisto.

He is a tenured professor in the Department of Computing and Information Technology at Simón Bolívar University (USB), and was part of a team of expert auditors from the university who were called upon by the CNE in 2021 and 2024 to review and provide their opinion on the Venezuelan electoral system. They studied the system in depth and prepared reports with recommendations.

They were also joined by computer science professors from other universities, such as the Central University of Venezuela (UCV), all with a range of political positions but with significant experience in computing and mathematics.

This auditing process was also broadcast on a YouTube channel created by the CNE at that time.

It is important to remember that the system was originally developed by Smartmatic, and in recent years, the Argentine company Ex-cle has also been involved. The professors reviewed the source code of the system line by line, programmed in C# (C-Sharp), including the fingerprint scanners, voting machines, and the transmission and tallying systems at both CNE locations (Plaza Venezuela and Plaza Caracas).

Professor Theoktisto explained that the security measures are “ridiculously exaggerated,” particularly those used for transmission, which include algorithms such as SHA-256 and AES in three or four layers. To decrypt or modify the information transmitted through these layers, someone would need to run extremely powerful computers for some 400 years.

He explains, as a result, that there are no reports of data being modified or altered during transmission.

At least two attacks

So far, there are reports of two distinct attacks:

1. The attack on the National Electoral Council website (where election results, including results by polling station, should be published).

2. The attack on the transmission system, which slowed down the transfer of information from the voting machines to the tallying centers for a few hours (there are two tallying centers: one at the CNE headquarters in Plaza Venezuela and the other at Plaza Caracas).

Tallying Centers

We asked about the attack on the tallying process and how it could have been carried out if the center is not connected to the Internet. Theoktisto explains that, thus far, neither the CNE nor (state telecommunications company) Cantv have provided details, so answering that question falls into the realm of speculation.

Indeed, the voting machines transmit to the tallying centers via a network that is physically separate from the internet and is equipped with encryption and encoding protocols (which encode the information and ensure it is not altered in transit). They can transmit via dial-up telephone lines, Movilnet lines (state-owned mobile network), or satellite in more isolated areas.

Theoktisto says that there are “spoofing” technologies that allow for impersonating a cellular network’s transmission cell, so that the phone or mobile device believes it is connecting to a legitimate network when it is actually connecting to a malicious cell aiming to obtain data. There are also methods for physically intervening in fiber optics with devices that are placed “in the middle” between two targets. Additionally, dial-up lines and the “dead network” can also be physically intercepted. All these methods require people within the country, or even potentially inside the institutions, but this needs to be investigated and verified by authorities.

Another theory is that the attackers might have made hundreds or thousands of calls to the tallying center phone numbers, temporarily occupying the lines and thereby preventing the voting machines from connecting.

However, he noted that, even if such techniques were used, it does not mean that the transmitted data was altered due to the protective mechanisms in place.

It is important to remember that these are speculations and hypotheses; official agencies have not yet issued any formal reports, and there are likely agencies with experts currently conducting forensic IT investigations into the reported attack.

CNE Website

Regarding the National Electoral Council website, Theoktisto explains that, days before the elections, the site received denial of service attacks (DDoS), where an attacker coordinates hundreds or thousands of computers on the internet to send traffic and requests to a specific address. This overwhelms the website trying to handle all the requests, making it impossible for legitimate users to access the site, resulting in error messages.

Theoktisto argued that the CNE website received several types of DDoS attacks (there are about 25 different types of DDoS attacks in total), “at a volume that we simply cannot combat in the country.” He also mentioned that some of the attackers were in Venezuela.

The USB professor pointed out that a part of the attack from abroad had its final exit point in North Macedonia, but “we know that was just a bridge for VPNs from other locations,” meaning the attackers were likely in another country but used VPN networks or compromised computers in North Macedonia to carry out the attack.

“We expected the attack, but not on such a massive scale,” he stated. The professor believes that “a governmental actor is indispensable,” meaning a hostile government was involved in the attack. Alternatively, several private bot services might have been hired to conduct this attack against the CNE website.

In response to these attacks, the CNE has decided to take down or shut down its website entirely. This has prevented, among other things, the CNE from publishing results by polling station.

We asked why the CNE has not considered publishing these results through other means (for example, distributing a spreadsheet with the results to journalists and media, electronically signed to ensure its authenticity), but Professor Theoktisto said he does not know the reasons.

Why doesn’t the PSUV publish its tally sheets?

Another frequently asked question is: If María Corina Machado’s team has published 24,000 tally sheets (or 9,000 according to Jorge Rodríguez), why doesn’t the United Socialist Party (PSUV) publish its own tally sheets to back up the results? It is worth noting that the PSUV has done this in the past, for example after the 2013 elections.

A PSUV source, an expert in legal matters who requested not to be named, shared the following information:

They explained that the PSUV had witnesses at all polling stations across the country (about 30,000), and therefore has all the issued tally sheets. In contrast, González’s team had witnesses at only 30 or 35 percent of all polling stations (Vente Venezuela claims to have tally sheets from 80% of the stations, around 24,000, but Jorge Rodríguez said in a press conference last Friday that they only had 9,000 tally sheets).

The PSUV suspects that the opposition might be falsifying the tally sheets, a claim that Rodríguez and Diosdado Cabello have publicly made in recent days.

Thus, according to the confidential answer provided, the PSUV plans to go to the Electoral Chamber of the Supreme Court of Justice, submit all the tally sheets, and wait for the opposition to do the same. The TSJ will use the CNE’s authentication mechanisms to determine which set is genuine.

There is concern that if the PSUV publishes its records on a website without first having them certified by the TSJ, the opposition might obtain and use them (especially those they do not have) to create or falsify tally sheets (facsimiles), potentially generating media noise or sowing doubts.

The fact that González did not appear before the Electoral Chamber last Friday raises many questions. If they have the evidence, why not challenge the elections before the appropriate body? Are they willing to have their election evidence verified?

On the other hand, Professor Theoktisto reminded us that, legally speaking, the valid tally sheet is the electronic record transmitted by the voting machine to the tallying center. “By law, the valid tally sheet is the digital package, electronically signed with the various encryption schemes used to protect both the security and authenticity of the data and its transmission.”

The first printed tally sheet, which is placed in an envelope and sent to the CNE, is also important, although it serves as a physical backup to the electronic tally sheet. The copies held by political parties are merely backups and have no legal standing unless there is a challenge to the election.

Can tally sheets be falsified?

Someone with access to an identical printer used by the voting machines and the same type of special paper (which includes anti-counterfeiting mechanisms, marks, and CNE protections) could potentially print a tally sheet that appears identical to those from the voting machines, inserting their own data. They could even generate a QR code, which is not particularly difficult.

The key detail is that each tally sheet has a unique code or “hash” printed at the bottom. This hash is unique to each tally sheet from each polling station.

The hash is generated from a large amount of data, such as the polling center code, the polling station number, the votes for each candidate, and the time of closing, as well as certain cryptographic keys from the machine that were created beforehand. The time is recorded with nanosecond precision. Additionally, a random number is generated, with its seed formed from machine state variables (such as component temperature, fan speed, CPU frequency state, and others). This makes the hash values unique and virtually impossible to replicate.

The data is fed into a hash function, which generates a code. This hash function is a “one-way algorithm,” meaning that while the same data will always produce the same hash code, there is no way to “reverse engineer” the code to obtain the original data. Mathematically, it is not possible to take the hash code, “decode” it, and discover the polling center, the closing time, or the votes for a candidate.

Professor Theoktisto reminds us: “Even with the same data (polling center, number of votes, etc.), you will not get the same hash” due to the security variables used to create the random number, explained the professor. Thus, the hash is unique and impossible to replicate.

If two tally sheets were to appear for the same polling station, each with different data, the authentic tally sheet would be the one with the hash matching the one stored in the electronic tally sheet.

Where are the tally sheets?

The tally sheets are not just electronically stored on the servers of the tallying centers. Theoktisto reminded us that the content and memory of the voting machines cannot be erased for a certain number of days after the election for legal reasons; additionally, the data from each machine and its results are also stored on a USB drive with proper encryption; the CNE also has a printed copy of the tally sheet, and once the machines and electoral materials leave the polling station, they are sealed, locked, and stored in CNE warehouses.

With so many security measures in place, it is impossible to do what some have rumored or insinuated: that a group of people is secretly manipulating the machines to reprint tally sheets with numbers favorable to the government.

Key generated in parts

One reason why this cannot be done is that all voting machines and the tallying system operate with a key generated in parts or segments. These parts are held separately by different entities: political parties, the CNE itself, the company Ex-cle, and other participants. Each participant has a piece of the key and does not know the pieces held by others. This key is used to generate digital signatures, and if for any reason the process needs to be repeated or redone, it requires re-generating the digital signature, which necessitates the presence of all actors to reintroduce their respective key segments.

From the information provided by Professor Theoktisto, we understand that if the CNE, hypothetically, wanted to commit fraud and attempted to repeat the process (for example, to create new tally sheets with false numbers), they would have to do so with a new or different key, which would generate digital signatures completely different from those already held by party witnesses, leaving traces and evidence everywhere.

However, the professor warns that the opposition also has a history of creating spectacles and it is very likely they might refuse to acknowledge the Electoral Chamber of the TSJ, as suggested by González’s failure to appear for the scheduled hearing.

“The opposition must challenge the results before the TSJ, not in public opinion or international media,” stated the professor.

An election repeat?

We also asked Professor Theoktisto if repeating the elections would be a viable solution. He reminded us that at all polling stations, physical votes are preserved in sealed and locked containers. In fact, a citizen audit (with the presence of voters) was conducted on 54% of the polling stations on the night of July 28. The remaining 46% would need to undergo a vote-by-vote audit, or, in an extreme case, the entire process could be repeated at all polling stations, but he does not see it necessary to repeat the electoral process.

We hope these details help people form an understanding of whether the electoral system was compromised or not.

The views expressed in this article are the author’s own and do not necessarily reflect those of the Venezuelanalysis editorial staff.

Translated by Venezuelanalysis.

Source: Alba Ciudad