By Eshioromeh Sebastian
The presidential candidate of the African Democratic Congress (ADC), Atiku Abubakar, has raised alarm over the continued use of outdated operating system software on the Bimodal Voter Accreditation System (BVAS), warning that the vulnerability could expose the 2027 general elections to cyberattacks and manipulation.
Speaking in a statement issued by his media office in Abuja on Tuesday, Atiku cited the recent mock accreditation failures in Osun State on August 1, 2026, and Monday’s revelation by the Independent National Electoral Commission’s (INEC) Director of ICT, Dr Lawrence Bayode, who disclosed on Arise TV that the BVAS, first deployed in 2021, is still running on Android version 10.
Atiku noted that Android 10 reached end-of-life in 2023 and no longer receives security patches or updates. He argued that running a critical election technology platform on an obsolete operating system poses “severe cyber and operational risks.”
According to Atiku, the vulnerability could allow “criminal elements or hackers to bypass the BVAS application entirely, gain root access to the device file system, and potentially alter cached voter logs or polling unit result files before they are transmitted.”
The former Vice President also flagged significant risks around data transmission, noting that BVAS machines send polling unit results over weak public telecommunication networks to the INEC Result Viewing (IReV) portal. He warned that outdated cryptographic protections raise the danger of Man-in-the-Middle attacks, through which “sophisticated actors could intercept, block, or manipulate data packets over the air.”
On the device’s biometric functions, Atiku said an outdated framework could end up “reducing the system’s accuracy and resilience against spoofing methods such as fingerprint and photo bypasses.” He also expressed concern that “bugs or memory leaks within legacy system frameworks can cause the app to crash during peak voting hours,” potentially resulting in technical glitches and delayed accreditation similar to what was witnessed during the Osun mock exercise.
Atiku questioned why INEC, despite its substantial budget, had failed to upgrade the software ahead of 2027 or test a newer version during off-season elections. He described the commission’s handling of the matter as suspicious, alleging that it could amount to “a deliberate attempt to subvert the integrity of the country’s elections.”
He further supported the position of cybersecurity experts that “running critical national infrastructure on an end-of-life operating system creates a broad attack surface,” and called for an independent, comprehensive code and hardware audit of BVAS devices, insisting that such a step was “vital to safeguard election integrity.”
Meanwhile, INEC’s ICT Director, Dr Lawrence Bayode, had earlier defended the commission’s position, stating that the BVAS was not relying solely on the Android operating system for security. “We are not relying solely on the security of the operating system. We’re also deploying our own security on the BVAS that ensures that our BVAS is secured,” Bayode said during the same Arise TV interview.
Bayode explained that upgrading the BVAS operating system was not a straightforward process, as moving to a newer Android version would require significant hardware adjustments, including upgrades to RAM and other components to prevent the system from slowing down. He maintained that the devices were procured with Android 10 specifications and the commission was comfortable with that version at the time of deployment.
Atiku, who is seeking the presidency in 2027 on the platform of the African Democratic Congress, has remained a vocal critic of the electoral commission’s preparedness, urging INEC to urgently address the identified vulnerabilities ahead of the general elections.
Discussion about this post