2027 Elections: Atiku Raises Alarm Over Outdated BVAS Software, Warns of Manipulation Risks

2027 Elections: Atiku Raises Alarm Over Outdated BVAS Software, Warns of Manipulation Risks

Former Vice President and African Democratic Congress (ADC) presidential candidate Atiku Abubakar has raised serious concerns over the continued use of an outdated operating system on the Bimodal Voter Accreditation System (BVAS), warning that the technology could expose Nigeria’s 2027 electoral process to cybersecurity threats and manipulation. Atiku’s concerns follow the recent mock accreditation exercise conducted in Osun State on August 1, 2026, and comments by the Independent National Electoral Commission’s (INEC) Director of ICT, Dr Lawrence Bayode. During an interview on Arise TV, Bayode disclosed that the BVAS devices, first introduced into Nigeria’s electoral process in 2021, currently operate on Android version 10.

In a statement issued by his Media Office in Abuja on Tuesday, Atiku pointed out that Android 10 reached its end-of-life status in 2023 and no longer receives regular security updates or patches. He argued that running critical electoral infrastructure on an end-of-life operating system creates a broad attack surface that could be exploited by cybercriminals. The ADC presidential candidate questioned why INEC, despite what he described as its substantial budget, had failed to upgrade the BVAS software ahead of the 2027 general elections. He also asked why upcoming off-cycle elections, including the Osun governorship election, could not be used as an opportunity to test an upgraded system.

Describing INEC’s handling of the matter as “suspicious,” Atiku alleged that continued reliance on outdated technology could undermine public confidence in the electoral process. He warned that vulnerabilities in the legacy operating system could potentially be exploited to gain unauthorised access to BVAS devices and tamper with stored voter accreditation information or polling unit result data before transmission. The former Vice President also expressed concern over the transmission of polling unit results through public telecommunications networks to the INEC Result Viewing Portal (IReV). He argued that outdated security and cryptographic components could expose the transmission process to cyber threats, including attempts to intercept, block, or manipulate electoral data. He specifically warned of the risk of Man-in-the-Middle attacks, through which sophisticated actors could intercept, block, or manipulate data packets over the air.

READ ALSO:

• Nigerian Army Opens 2026/2027 Short Service Combatant Commission Recruitment – Apply Now
• US, Iran Nearing Peace Agreement, Pakistan Defence Minister
• Jingir Defends Muslim-Muslim Ticket Stance, Insists Position Predates Tinubu Administration

Atiku further raised questions about the biometric functions of BVAS, which rely on fingerprint and facial recognition technologies for voter accreditation. He argued that an outdated biometric framework could affect the accuracy and reliability of the accreditation process and potentially make the system more vulnerable to attempts to bypass its verification mechanisms. He also warned that software defects associated with legacy systems could result in application crashes, particularly during periods of heavy usage, leading to delays in voter accreditation at polling units. Against this backdrop, Atiku backed calls by cybersecurity experts for an independent and comprehensive audit of the BVAS hardware and software before the 2027 elections. He maintained that deploying critical national infrastructure on an end-of-life operating system could widen the system’s attack surface and expose Nigeria’s electoral process to avoidable risks.

In a related development, a coalition of civil society organisations under the aegis of the Nigerian Civil Society Situation Room has raised concerns over INEC’s introduction of an electronic EC8A on the BVAS and a new backend validation process before results are published on IReV. The groups warned that the validation process is not visible to the public, polling agents, or election observers, while INEC has yet to explain what is being validated, who conducts the review, or how long the process should take. The CSOs argued that the introduction of the electronic EC8A could create multiple versions of the same polling-unit result, potentially generating confusion in the event of discrepancies. They urged INEC to abolish the backend validation of transmitted results before publication on IReV or, at the very least, subject the process to public and independent scrutiny.

However, INEC has previously stated that upgrades have been introduced to the BVAS system to curb manipulation of results transmitted to IReV. INEC Chairman Prof. Joash Amupitan disclosed that the BVAS system now performs internal validation checks to ensure that the total votes entered do not exceed the number of accredited voters, with over-voting automatically flagged. Amupitan noted that these upgrades were tested during the FCT Area Council election and found to work correctly, with an average of 97 per cent of results uploaded to IReV. The commission has also indicated it is considering conducting a comprehensive audit of its electoral technology systems and staging a mock presidential election as part of efforts to strengthen preparations for the 2027 general elections.

2027 Elections: Atiku Raises Alarm Over Outdated BVAS Software, Warns of Manipulation Risks