After recovering from their stunned disbelief at the results of the national elections on May 9, 2022, certain prominent senior citizens formed an informal group that is now trying to rouse Filipinos into questioning the vote count which, they said, had been rigged even before the first ballot was cast.

One of them, retired brigadier general Eliseo Rio Jr., a former acting secretary of the Department of Information and Communications Technology, scrutinized the election results as a vote-protection volunteer for then presidential candidate Panfilo “Ping” Lacson, whom he met as a cadet when he was teaching at the Philippine Military Academy.

Lacson, a former senator, got only a little over 800,000 votes, much less than what he garnered in the 2004 presidential race, in which he landed in third place with more than 3.5 million votes behind winner Gloria Macapagal Arroyo and her closest rival, Fernando Poe Jr.

“That is how my advocacy started. I could not believe that Ping Lacson, who already ran for president, got such a small number of votes,” Rio, 79, said in an interview. “We were surprised why, in the 2022 elections, he got less than 1 million votes. How was that possible?” 

The question pushed Rio, a former military intelligence officer, to investigate.

On May 25, 2022, Congress proclaimed Ferdinand Marcos Jr. as the Philippines’ 17^th president with 31,629,783 votes (or 58.77% of the total), and his running mate Sara Duterte vice president with 32,208,417 votes (or 61.33%).

Their strongest rivals were Vice President Leni Robredo (15,035,772 votes, or 27.84%) and her running mate, Sen. Francis Pangilinan (9,329,207 votes, or 17.82%).

TNTrio

Rio, who once headed the National Telecommunications Commission, said he found several statistical improbabilities, if not impossibilities, in the elections that made him skeptical of the results and later convinced him that the vote had been rigged from the beginning.

The outcome of the polls and the high-speed count also aroused suspicions in businessman and former banker Franklin F. Ysaac, 72, and Augusto Lagman, 83, a retired commissioner of the Commission on Elections (Comelec) who was a longtime chair of the poll watchdog National Citizens’ Movement for Free Elections (Namfrel).

Rio, Lagman and Ysaac have a strong academic and professional background in computer programming, information technology and electronic networking. Previously only casually acquainted with each other, they now stand as the foundation of TNT—the Trust and Transparency movement, earning the moniker TNTrio.

They have since been joined by retired colonel Leonardo O. Odoño, 80; Edwin Fernandez, 73, a former president of the Financial Executives Institute of the Philippines (Finex) like Ysaac; and retired Comelec lawyer Melchor Magdamo, who was a coconvenor of the Citizens for Clean and Credible Elections.

According to Rio, there is a “preponderance of evidence” of vote rigging based on available official documents from the Comelec itself, plus several “unusual events” before, during and after the polls.

The most remarkable, he said, was the “unbelievable” speed with which an “incredible peak count” of over 20 million votes were sent from more than 39,000 vote counting machines (VCMs) during the first hour after polling precincts were supposed to close at 7 p.m. on Election Day. These votes showed Marcos and Duterte already winning by a landslide.

Related Story: Bogus vote tallies, candidate disqualifications top Election Day disinformation, Petitioners want Smartmatic out of next polls for ‘meeting with Marcos Jr.’s wife in March 2022’

Shock and awe

Rio said he had never seen such a large number of votes counted in such a short period in elections in the Philippines or elsewhere.

In the first hour after the polling stations closed, a “very successful strategic plan of shock and awe” was employed to make an emphatic declaration that “tapos na ang boksing (the fight is finished),” according to the former Army general.

“Once you shock and awe your enemy, they will surrender. Up to now, they are surrendering,” Rio said, citing the opposition’s continuing stunned submission to its loss. “The only way that you can do shock and awe is that in the first hour you really show [you have] a large number of votes.”

He said it was physically impossible to start transmitting results soon after the precincts closed as teachers comprising the board of election inspectors have to first perform nine tasks, one after another. These tasks mandated by election rules, including the printing of eight copies of the election returns (ERs), take at least 19 minutes to accomplish and must be finished before the ERs are transmitted.

Election returns

The first ER was received by the transparency server in Manila at 7:08 p.m. By 8:02 pm, 20,676,855 votes had been counted from more than 39,512 out of close to 107,000 ERs. The transparency server was where political parties, the media and poll watchdogs got the results of the balloting.

According to Lagman, who has monitored elections since the 1980s, there was a “deluge” of votes from across the country during the first hour. “I was really surprised,” he said. “It was my first time to experience that, and I have been an observer for many years, many elections.”

The votes poured in during the first hour but inexplicably came in trickles in the next hour, the period when most teachers would have been finished with the nine tasks and were free to transmit the ERs, Rio said. Only 13.2 million votes were counted in the second hour, the Comelec documents showed.

There were also “highly statistically improbable” data showing an almost constant ratio of votes received by all candidates for president and vice president.

‘Smoking gun’

But for Rio and his group, the “smoking gun” evidence of vote rigging was the alleged private network with private internet protocol (IP) addresses that sent ERs directly to the transparency server, instead of through the public networks of the telcos—Globe, Smart, Dito—that had been contracted by the Comelec.

The private network was discovered by Rio and volunteer IT professionals from the raw files that were surprisingly posted by the Comelec on its website only in March 2023 following persistent demands by the TNTrio since July 2022 for the release of the telcos’ transmission logs. 

Rio suspects that a Comelec “whistleblower” was responsible for uploading the files.

Under the automated election system (AES) set up by Smartmatic in a P1.053-billion contract with the Comelec, the ERs are supposed to be transmitted directly to the transparency server through the telcos’ networks using their SIM cards plugged into the VCMs. 

Rio said the telcos’ transmissions ended at the private network after seeing the Comelec’s raw files showing the ERs received by the transparency server came from a private, not a public, IP address. A private IP address appearing in the transparency server’s reception log means it is directly connected to the server’s local area network and did not have to come in through the internet like the telcos.

Raises questions

This raises several questions: Who authorized the setting up of the private network? Who maintained it? Who knew about it? Where was it physically located?

Only after the TNTrio exposed this in July 2023 did Comelec Chair George Garcia admit on July 25 that the poll body deployed 20,300 VCMs which had modems that had identical IP addresses—192.168.0.2.

Modems are electronic devices through which data are transmitted and received. Each modem has a unique IP address to distinguish it from the millions of others on the internet. Thousands of modems with the same IP address would be a networking anomaly that will cause conflict in data exchange, according to Rio, who had set up electronic networks for the military.

Though the Comelec did not disclose this prior to the polls, Garcia said it was not illegal. But Rio, who served as head of the Comelec Advisory Council in 2019, said the use of a private network and private IP addresses was not allowed under the end-to-end transmission path that was presented before the polls to the public, particularly to the political parties.

Man-in-the-middle device

Rio said no one outside the Comelec knew that a private network using the 192.168.0.2 IP address and about two dozen other private IP addresses had been put up. It was established secretly and it acted like a man-in-the-middle (MITM) device, a hacking tool.

The clandestine MITM stands between networks that exchange data. It captures all the data from a sender, who isn’t aware of its existence, before relaying the intercepted data to the intended destination. Such a setup could also mask or hide the original source of the transmitted data, in this case, the VCM.

Before Garcia’s admission, Rio and his team of volunteer IT professionals had already identified around 17,000 VCMs with private IP addresses in the National Capital Region (NCR), Batangas and Cavite—all vote-rich areas and where the 20,300 modems admittedly were deployed.

Same private IP Address—192.168.0.2

There were 10,562 VCMs throughout the NCR on Election Day. More than 82.6% had the same private IP Address—192.168.0.2. This same IP address was found in 95.5% of 3,371 VCMs in Cavite and in 81% of 2,858 VCMs in Batangas. The remaining VCMs have different private IP addresses.

“One hundred percent of the ERs in the [transparency] server are all coming from this private network, none from the telcos. Majority of these came from the private IP address 192.168.0.2,” Rio said.

Garcia, who was not yet chair of the Comelec during the May 2022 polls, said it did not matter how the votes were transmitted as long as these were properly counted. He pointed to the random manual audit of ballots which showed that the vote count was more than 99% accurate.

Rio, however, questioned the integrity of the ballots taken from around 750 VCMs randomly selected around the country because these were not accompanied by poll watchers from the precincts all the way to Diamond Hotel in Manila where the votes were manually tabulated.

Standing midway in the transmission path, an MITM, as a hacking tool, could “massage” the data to produce the desired end-results before passing them on.

‘Preprogrammed’

But the TNTrio believes that the VCMs themselves had already been “preprogramed” to “preload” the vote counts so that even the poll watchers could attest that an ER from a specific precinct matched the ER received by the transparency server. In this case, the MITM served merely as the gateway to the transparency server.

Fernandez, the former Finex president, said he had only four words to describe the MITM private network – secret, unnecessary, illegal and expensive.

“Our point,” Rio said, “is if the VCM is preloaded, it does not matter anymore whatever the vote of the people was; this is what it will send. Whoever was manipulating the [transparency server] already knew what the election results will be.”

He challenged the Comelec to prove them wrong by making public all transmission data, including a full disclosure of the call detail records (CDR) of each of the telcos. This will show whether over 20 million votes from more than 39,000 VCMs indeed poured into the transparency server through the telcos’ public network, as specified in the contract with the Comelec, during the first hour after polling precincts closed.

The CDR will show the exact time, down to a hundredth of a second, when a VCM of a particular precinct transmitted its ER. The next step would be to check the time the transparency server received the ER and the number of votes. The time stamp on some printed ERs checked by Rio’s group against the Comelec’s raw files showed a technical anomaly—the ERs were received before they were even transmitted.

Request to Comelec

On July 14, 2022, Rio’s group wrote the Comelec requesting the transmission logs for the first hour of the vote count to the telcos. The request was ignored, but three months later, on Oct. 18, Garcia publicly committed to compel the telcos to submit the transmission logs within a few days.

Under the contract with Smartmatic, these logs would have already been in the Comelec’s possession by that time. When the Comelec did not produce the logs as promised, Rio, Lagman and Ysaac petitioned the Supreme Court on Nov. 3, 2022, to order the Comelec, Smartmatic and the telcos to preserve the logs. Under the law, telcos can hold on to their CDRs up to six months from Election Day before they may discard them. The sixth month fell on Nov. 9, 2022.

The last recourse to prove or disprove the group’s allegations of vote rigging is to conduct a random manual audit of the ballots from the 20,300 VCM machines with identical IP addresses, and determine whether they contained the same votes as those received by the transparency server, according to Rio.

‘Count them’

“It will not be the same. I am sure of that,” Rio said confidently. “Check the votes. Count them. We are sure they will not match.”

He said that if there were no irregularities, the Comelec should have nothing to hide. “We would be the ones put to shame, won’t we? They are making so many excuses,” he said.

The public, including the political opposition, has been lukewarm toward the allegations made by the TNTrio.

Last December, Robredo said they had a team of lawyers and a team of computer experts to examine allegations of cheating and these teams “did not see anything.” No election protest was filed in order not to give false hopes to her supporters, she said.

The outcome of the polls was not at all a surprise to supporters of the Marcos-Duterte Uniteam and some political analysts, who pointed to the last pre-election survey by Pulse Asia less than a month before the polls indicating a landslide win for the team. 

Survey respondents were asked to “elect” their candidates using a mock ballot. The survey showed Marcos “winning” with 56% of the votes, trouncing Robredo’s 23%. Duterte got 55% against former senator Vicente Sotto III (18%) and Pangilinan (16%).

In addition to the fastest vote count in the first hour, the 2022 elections also produced two other records. It was the first time that a vice presidential candidate got more votes than the president and the first time that the president got more votes than the top senator (Robin Padilla).

‘Uncanny consistency’

The Center for People Empowerment and Governance (Cenpeg), a nonprofit that looks into public policies, noted the “uncanny consistency” between the surveys and the final votes.

Excluding allegations of election fraud, Cenpeg cited the impact of six factors to help explain the vote results, namely: 1) political bailiwicks as base for national candidates worked in favor of Marcos and Duterte; 2) former president Rodrigo Duterte’s continued high survey ratings translated into votes for his daughter and Marcos; 3) a divided opposition was unable to “mount a more focused challenge” to the Marcos-Duterte team; 4) the systematic campaign of “disinformation and historical revisionism” resulted in voters embracing the “rebranding” of the Marcoses; 5) the “huge” financial resources available to the Marcos-Duterte team; and 6) problems related to the AES as managed by the Comelec and Smartmatic in which results of the vote could not be confirmed conclusively.

Cenpeg itself was “incredulous” about the final results showing that Robredo gained only a “4% measly” increase in the number of votes she received when she defeated Marcos in the 2016 vice presidential election, and that her rival added a whopping 124% more votes than what he got in their first encounter at the polls.

Yes and No

Asked whether he agrees with assertions by politicians and political analysts that there really was no cheating because the election results confirmed the surveys and the surveys were reliable predictions of the outcome of the vote, Lagman said: “Yes and no.”

“Because,” he said, “cheating does not only happen during elections. It can happen even before. Disinformation is a form of cheating since you are telling the public wrong information.”

“It was very well done,” he added. “It was like nothing left to chance … And then, of course, they started like 10 years before the 2022 elections. It was not done overnight.”

Rio said “we are on our own” at this point in the campaign to expose the supposed election rigging. “If politicians want to support us, its okay, but we are not pulling them in.”

Ysaac said it was not up to their group to determine what would happen next as a consequence of their exposè.

“I was asked, ‘What’s your ending?’ I said, ‘You decide.’ We have no political ambitions. After this, we are done. Once we are done, it’s over. Change whatever change the people want,” Ysaac said.

Fernandez said they only wanted to show that the election process was fraudulent and that the country should junk the current AES, cut ties with Smartmatic and adopt a hybrid election system, as Lagman had long proposed. The proposal simplifies the ballot, holds a manual count at the precinct, and transmits and consolidates votes electronically.

“We are simply for the truth. We are not saying that Leni won or that BBM lost,” he said.