NAMFREL

Did we ever have the PCOS source code? Can we still use the 82,000 machines we purchased?

from NAMFREL Election Monitor Vol.2, No.28

A lawsuit filed by Smartmatic in September against Dominion Voting Systems in the state of Delaware in the United States has recently surfaced and covered by Philippine media. In the lawsuit, Smartmatic seeks compensation from Dominion for allegedly withholding technology and services licensed to them. Smartmatic, which is the Comelec-contracted technology provider for the Philippine automated election system, acts as system integrator and provides election automation solutions using technologies it has licensed from other companies. According to Smartmatic's complaint (which can be accessed HERE), in 2009, or a year prior to the 2010 Philippine presidential elections, Dominion granted Smartmatic "a worldwide license to market, make, use, and sell precinct count optical scan ('PCOS') voting systems utilizing Dominion's optical scan voting system technology." According to Smartmatic, the license agreement required Dominion to provide Smartmatic with the hardware, software, firmware, and technical support needed to enable Smartmatic to deliver its services to its clients, which include the Republic of the Philippines.

However, in the complaint, Smartmatic alleges that Dominion breached its obligations under the agreement between the two companies by, among other things:

-	"failing to deliver fully functional technology for use in the 2010 Philippines national election;
-	"failing to provide timely technical support during and after the Philippines election;
-	"failing to place in escrow the required source code, hardware design, and manufacturing information."

It will be recalled that prior to the 2010 election, Philippine IT groups and civil society organizations raised concerns regarding the vulnerabilities of the automated election system chosen by the Comelec to be used for the 2010 polls. One of the main points of contention is the access to the machines' source code. The source code, as the Philippine election automation law (RA 9369) defines it, is the "human-readable instructions that define what the computer equipment will do." The source code tells the machine how to function. The automation law further requires the Comelec to have the machines certified as operating properly, securely and accurately after subjecting them to rigorous field tests, and, among other things, a successful completion of a source code review, and a certification that the source code is kept in escrow at the Bangko Sentral ng Pilipinas. The law further stipulates that "Once an AES technology is selected for implementation, the Commission shall promptly make the source code of that technology available and open to any interested political party or groups which may conduct their own review thereof."

.
In February 2010, after disputes on the procedure to allow interested groups to review and test the source code, the Comelec announced that SysTest Labs, a U.S. firm based in Denver, Colorado, had completed the source code review and certified it for use in the 2010 election. SysTest Labs was awarded by the Comelec in 2009 a Php 70 million contract to conduct the testing and certification of the automated election system. In September this year, the Comelec awarded the contract to do the same to the same company, now renamed SLI Global Solutions. In a short ceremony covered by the media on February 9, 2010, the Comelec turned over the source code to the Bangko Sentral ng Pilipinas for safekeeping. According to reports, the source code was brought to the Philippines by SysTest Labs, "encoded in two compact discs, placed in a small black safety box with the hash codes, locked, and sealed with four Comelec stickers." The box was to be kept at the BSP in escrow for over a year, according to then-Comelec Chairman Jose Melo.

According to Smartmatic, their 2009 agreement with Dominion requires Dominion's authorization and participation in the event that the technology needs to be modified. It also requires Dominion to make available and put in escrow all relevant materials in connection with the licensed technology, which includes the source code. Their license agreement states, "In the event Dominion breaches its obligations to provide the products or support it is obligated to provide under this Agreement...such escrowed materials shall be released to Smartmatic for the sole purpose of providing such products or services that Dominion failed to provide."

In March 2012, in the context of the Philippines exercising its option to purchase the Smartmatic's machines, the Comelec requested enhancements and modifications to the system as conditions for the eventual purchase. Smartmatic would then need Dominion's approval and participation. However, according to Smartmatic, Dominion "purported to terminate the Agreement on May 23, 2012;" this was one of the main reasons for the lawsuit. Smartmatic would then need the escrowed materials to modify the licensed products. However, according to Smartmatic, when they checked with the escrow agent, they "confirmed that Dominion International has not deposited a complete set of these materials: Dominion did not place in escrow any of the required materials until May 2012, despite its prior representations to the contrary, and even then only deposited with Iron Mountain (the escrow agent) an older version of them, although the License Agreement requires Dominion to deposit in escrow the current version and the immediate prior version of its Source Code and relevant intellectual property." In a footnote, Smartmatic said in the complaint that "in March 2010, Dominion provided a certificate of deposit stating that the escrowed materials had been deposited with Iron Mountain. Smartmatic relied upon this representation and further believed that Dominion continued to place in escrow new versions of these materials as they were developed."

Smartmatic's statements in its complaint against Dominion now raise the question of whether the Philippines truly got a copy of the machines' source code in 2010. What did the Comelec receive from Smartmatic and SysTest Labs? Could Smartmatic give the source code to a client without Dominion's consent? Could the source code have been tested without Dominion's prior approval? With the termination of the agreement between the two companies, albeit unilaterally it seems, what does this mean for the automation of the 2013 Philippine elections? It should be noted that the Comelec's contract is with Smartmatic only; any dealings with Dominion is solely Smartmatic's responsibility.

Smartmatic's complaint also sheds some light to the hasty recall of PCOS storage cards mere days before the 2010 election, well after the AES system and the source code were certified as sound: "During a test of the automated voting system conducted shortly before the Election, Comelec and Smartmatic discovered a defect in the Licensed Technology -- Dominion International's software failed to correctly read and record the paper ballot. Once Dominion acknowledged the problem with the software and proposed a solution, Smartmatic International had to obtain, load, distribute, and install new memory cards with the reprogrammed software to over 76,000 PCOS voting systems, most of which had already been delivered to the various polling stations. These steps were necessary to ensure the correct interpretation of votes cast on approximately 50,000,000 paper ballots that had already been printed and were ready for use." The problem was discovered during field tests of the PCOS machines less than a week before the elections. At that time, Smartmatic said the error occured because when the local election ballots were being printed, there was a change in the formatting of the ballots that the machines were not programmed to read. Comelec and Smartmatic then replaced the memory cards with cards that they have on hand, and had to order more memory cards from local and international suppliers in record time. Further testing and sealing of PCOS machines--required by law to be conducted three to seven days before the elections--were canceled pending the replacement.

In its response in October to Smartmatic's complaint, Dominion Voting System denies most of the allegations and statements of Smartmatic, including those referring to the nature of their license agreement as stated by Smartmatic in its complaint. Some important points from Dominion's response are:

-	that Smartmatic did not provide Dominion with a copy of the Comelec option to purchase the voting products and systems, the terms of the option, and that "Dominion was not told and did not understand that any such option would provide Comelec with the 'perpetual right to use and modify the Licensed Technology in all future elections'"
-	that, in connection with the 2010 election, "Smartmatic failed to control processing and delivery timelines nd as a consequence failed to conduct standard and routine industry-wide testing of the voting system prior to deployment despite the fact that Dominion International had told Smartmatic that it was standard and routine in the industry and needed to be done, and despite the fact that Smartmatic had known the necessity of such testing and conducted such testing in prior elections in other countries" pertaining to the 2013 Philippine elections, that "the requested work for the 2013 election did not fall within the initial SOW (Statements of Work) and would require a new SOW, but that Smartmatic International and Dominion International did not finalize a new SOW prior to May 23, 2012. Dominion further admits that Dominion International terminated the License Agreement on May 23, 2012"
-	pertaining to Dominion's obligation to assist Smartmatic in modifiying the software and Smartmatic having access to the source code in escrow, Dominion states that "Dominion lacks knowledge or information sufficient for forming a belief as to whether Smartmatic International could make the requested modifications and enhancements with the use of source code materials in escrow with the escrow agent (“Escrow Agent”). Dominion further states that, due to the valid termination of the License Agreement by Dominion International and the expiration of the initial SOW, Dominion International has no obligation to provide such assistance and Smartmatic is not entitled to access the Escrowed Materials"
-	that "Smartmatic International refused to provide information to Dominion International about payments by Comelec, even though Comelec payments triggered Smartmatic International’s obligations to pay Dominion International," and that "Smartmatic International breached the License Agreement by not disclosing payments by Comelec and by not paying Dominion International as specified in the initial SOW"
-	pertaining to the agreement between Comelec and Smartmatic-TIM regarding the purchase of 81,000 PCOS machines in March 2012, in addition to the 920 machines already purchased in 2010, that "the sales contract required upgrades, which would involve revisions to Dominion’s software, not previously provided to Smartmatic International. Only Dominion has the expertise necessary to perform the required upgrades," and that "on June 14, 2012, Dominion International, through counsel, wrote to Smartmatic International to advise it that, due to the termination of the License Agreement, Smartmatic International was no longer licensed to provide those 81,000 machines to COMELEC, and that Dominion had no obligation to undertake the upgrades."
-	that "neither Smartmatic International nor Smartmatic-TIM is licensed to provide such upgrades to Comelec"
-	"Smartmatic’s continued efforts in the Philippines to sell 81,000 prospectively- upgraded Dominion PCOS voting machines to Comelec without a license from Dominion International and without a new SOW violates Dominion Canada’s and Dominion International’s ownership rights in the voting machines and associated technology"

The Philippines has already decided to purchase Smartmatic's PCOS machines for use in future elections; the Supreme Court even declared it legally sound. As of early November, the Comelec is still looking for suitable warehouses to stock the 82,000 machines, after Smartmatic's agreement with the warehouse in Cabuyao, Laguna had expired. Two public bids for a three-year lease of warehouses have failed.

(Source: Smartmatic complaint; Dominion response; various news sources)

.
.
.