Republic of the Philippines
HOUSE OF REPRESENTATIVES
Quezon City

EIGHTEENTH CONGRESS
Second Regular Session

House Bill No. 7923

Introduced by Representative PABLO JOHN F. GARCIA

EXPLANATORY NOTE

The Philippines is a democratic and republican State.’ Sovereignty resides in the
people and all goverment authority emanates from them.? Elections are the ultimate
expression of sovereignty.

Former Chief Justice Reynato Puno described the electoral process in this manner*:

The electoral process is one of the linchpins of a democratic and republican
framework because itis through the act of voting that government by consent is
secured. Through the ballot, people express their will on the defining issues of
the day and they are able to choose their leaders in accordance with the
fundamental principle of representative democracy that the people should elect
whom they please to govern them. Voting has an important instrumental value in
preserving the viability of constitutional democracy. Ithas traditionally been taken
as a prime indicator of democratic participation.

In general, suffrage may be exercised by all citizens of the Philippines* and it is the
objective of the State to pursue the holding of free, orderly, honest, peaceful, and credible
elections.’ Congress is also mandated to provide a system for securing the secrecy and
sanctity of the ballot.

The advent of smartphones and mobile applications has changed the world forever.
Statista, a German statistics company, reports that the Philippines had around 36.35 million
‘smartphone users as of September 2019’—a little more than one smartphone for every three
Filipinos. We Are Social and Hootsuite, social network and media companies based in London
and Vancouver respectively, also report that for 2018 “[iJn the Philippines, time spent online

* Const. art. Il, § 1.

2d.

Dissenting, Tolentino v. Comm'n on Elections, G.R. No. 148334 (2004).

* Const. art. V, § 1.

5 See Const. art. IXC., § 4.

© Const. art. V, § 2.

7 Available at https://www.statista.com/statistics/748053/worldwide-top-countries-smartphone-users/.


daily soared [x x x] to 10 hours and 2 minutes this year, the highest in the world.”* It is also
interesting to note that social media penetration among Filipinos is at 99% of intemet users
and that we also spend the most time on social media at 4 hours and 12 minutes per day.°
“Fixed intemet speed grew from 15.19 Mbps [on] average to 19 Mbps.""°

In contrast, however, voter tumouts show that participation in elections has not been
as widespread"':

Year of Elections Turnout
2007 73.10%
2010 74.99%
2013 77.31%
2016 81.95%
2019 75.90%

One in four Filipinos has not been able to exercise their right to vote.

This bill seeks to enable the full expression of the electoral process by allowing citizens
to opt in and vote using a smartphone application for future electoral exercises. The system
will complement the current arrangements available to the Commission on Elections and the
voting public.

Electronic voting systems have been around for some time"? and the Philippines saw
its first automated elections just around a decade ago. Electronic voting has shown its benefits.
In India, "fijntroduction of {electronic voting machines} led to a significant decline in electoral
frauds [x x x] [and] strengthened the weaker and the vulnerable sections of the society [x x
x"."? For example in Brazil, “[e]stimates [x x x] indicate that electronic voting reduced residual
(error-ridden and uncounted) votes and promoted a large de facto enfranchisement of mainly
less educated citizens.”"*

® Gelo Gonzales, Filipinos spend most time online, on social media worldwide - report, available at
https://www.rappler.com/technology/news/222407 -philippines-online-use-2019-hootsuite-we-are-
social-report.

Sid.

1d,

* Addie Pobre, IN NUMBERS: How PH voted in last two midterm elections, available at
https://www.rappler.com/newsbreak/iq/voter-tumout-elections-philippines (28 March 2019). Philippine
Center for Investigative Journalism, Data analysis of votes, voters, and winners, available at
https://pcij.org/articie/3034/data-analysis-votes-voters-and-winners (13 May 2019) for the year 2019.
%2 See Britannica, ProCon.org, Historical Timeline, Electronic Voting Machines and Related Voting
Technology, avaitable at https://votingmachines.procon.orgihistorical-timeline/.

' Sisir Debnath et al., The Impact of Electronic Voting Machines on Electoral Frauds, Democracy,
and Development, available at https://papers.ssrn.com/sol3/papers.cfm?abstract_i
*4 Thomas Fujiwara, Voting Technology, Political Responsiveness, and Infant Health: Evidence From
Brazil, available at hitps://onlinelibrary.wiley.com/doi/abs/10.3982/ECTA11520.



While electronic voting systems have not always been perfect, it is more crucial in a
democracy to bridge the gap in voter involvement, especially in the face of pandemics such
as COVID-19 where physical participation is discouraged, especially for the elderly and the
immunologically vulnerable. This bill eases the load on the current system and further provides
voters with greater isolation from external pressures and threats.

Cutting-edge cybersecurity mechanisms and tools such as end-to-end verification,
risk-limiting audits, encryption, biometrics, secure channel technologies, blockchains, and
future technologies will address vulnerability concerns.

The Constitution declares that “[s|cience and technology are essential for national
development and progress” and mandates the State to “give priority to research and
development, invention, innovation, and their utilization [x x x].""® This bill embodies seeks to
give expression to these constitutional ideals to provide greater access to the ultimate
expression of democracy.

The urgent passage of this bill is earnestly sought.

Rep. PABLO’ JOHN F. GARCIA
3rd District, Province of Cebu

*© Const. art. XIV, § 10.


Republic of the Philippines
HOUSE OF REPRESENTATIVES
Quezon City

EIGHTEENTH CONGRESS
Second Regular Session
7929

House Bill No.

Introduced by Representative PABLO JOHN F. GARCIA

AN ACT
AUTHORIZING THE COMMISSION ON ELECTIONS TO USE A
COMPLEMENTARY SMARTPHONE VOTING APPLICATION SYSTEM FOR THE
NATIONAL AND LOCAL ELECTORAL EXERCISES, PROVIDING FUNDS
THEREFOR AND FOR OTHER PURPOSES

Be it enacted by the House of Representatives and the Senate of the Congress of the
Philippines in session assembled:

Section 1. Short Title. - This Act shall be known as the “Smartphone Voting
Act of 2020”.

Section 2. Declaration of Policy. - It is policy of the State to ensure free,
orderly, honest, peaceful, credible and informed elections, plebiscites, referenda,
initiatives, recall and other similar electoral exercises by improving on the election
process and adopting systems including the use of a smartphone application that
ensures the secrecy and sanctity of the ballot as well as all election, consolidation, and
transmission documents in order that the process remains transparent and trusted and
that the results shall be fast, accurate, and reflective of the genuine will of the people,
who must always be empowered to be able to exercise their right of suffrage. The
State recognizes the mandate and authority of the Commission to prescribe the
adoption and use of the most suitable technology of demonstrated capability taking
into account the situation prevailing in the area and the funds available for the purpose.
The State shall, finally, ensure that all available state-of-the-art and well-researched
methodologies and technologies are used in harmony to achieve the goal of enabling
Filipinos the fullest expression of their democratic will.


Section 3. Definition of Terms. - For purposes of this Act, the following terms
shall be defined as follows:

(a) Biometrics is a field of science that uses computer technology to
identify people based on physical or behavioral characteristics;

(b) Blockchains are tamper evident and tamper resistant digital
database ledgers implemented in a distributed or decentralized fashion and
which enable a community of users to record or audit transactions in a shared
ledger within that community, such that under normal operations, no transaction
can be changed once published;

(c) Cybersecurity refers to the collection of tools, policies, risk
management approaches, actions, training, best practices, assurance and
technologies that can be used to protect digital environments and assets;

(d) A Denial of Service attack is an assault on a network by which a
user or organization is deprived of the services of a resource they would
normally expect to have;

(e) Encryption refers to the cryptographic process of transforming
electronic information into a scrambled form which can only be read by
authorized persons or entities which know how to translate the code using
algorithms, keys, passwords, and other data protection tools;

(f) End-to-End Verification or end-to-end verifiability is the process
or quality of a voting system which enables voters to verify that (without needing
to trust a separate entity to do so on their behalf):

(i) his orher choice was correctly denoted on the ballot by the
system and thus was cast as intended or that he or she must be able to
confirm that the vote was cast correctly;

(ii) his or her ballot was received the way it was cast or
recorded as cast or that he or she must be able to check that the system
included their votes in the final tally; and

(iii) his or her ballot counts as received or is tallied as recorded
or that he or she is able to count the recorded votes and double-check
the announced outcome of the election;

(g) Malware, or malicious software, consists of programming
designed to disrupt or deny operation, gather information that leads to loss of
privacy or exploitation, gain unauthorized access to system resources, and/or
other abusive behavior. Malware interferes with normal computer functions or
sends personal data about the user to unauthorized parties over the Internet.


Malware includes computer viruses, worms, Trojan horses, spyware, browser
hijackers, and dialers;

(h)  Risk-Limiting Audits are election accuracy audits that operate
transparently and dynamically by examining individual randomly selected
ballots until sufficient statistical assurance is obtained while making certain
privacy is not compromised. This statistical assurance ensures that the chance
that an incorrect reported outcome escapes detection and correction is less
than a predetermined risk limit;

(i) A Secure Channel, in cryptography, is a way of transferring data
free from overhearing, manipulation, or tampering;

i A Smartphone is a mobile telephone or telecommunications
device with many features of a computer included in its functions. A smartphone
is required to have a camera, facial recognition, fingerprint recognition, and
internet connection capabilities for purposes of this Act; and

(k) White Hat Hackers are computer security experts who specialize
in penetration testing and in other testing methodologies that ensure the
security of an information system. Black hat hackers, in contrast, are those with
malicious or criminal intent.

Section 4, Authority and Mandate to use a Smartphone Voting System. -
To carry out the declared policies in Section 2, the Commission on Elections
(“Commission”), is hereby authorized and mandated to use, on an opt-in basis for
voters, a Smartphone Voting Application System (“System”) for future electoral
exercises, in such manner as the Commission may deem appropriate and practical for
the process of voting, counting of votes and canvassing or consolidation, the
transmission of results, or any part of any electoral exercise. This System shall
complement existing voting systems and arrangements currently being used by the
Commission.

The Commission is hereby authorized to procure by purchase, lease, or
otherwise any supplies, software, licenses, applications, equipment, materials, and
other services needed for the holding of these electoral exercises and to achieve the
purposes of this Act.

Section 5. Advisory Council. - The Commission shall create an Advisory
Couneil (“Council”) which shall be convened not later than two (2) months after the
effectivity of this Act.

The Council shall be composed of the following members, who must be
registered Filipino voters, of known independence, competence, and probity:


(a) The Secretary of of Information and Communications
Technology, who shalll act as the Chairperson of the Council;

(b) One (1) representative from the Department of Science and
Technology;

(c) One (1) representative from the Department of Education;
(d) One (1) representative from the National Privacy Commission;
(e) One (1) representative from the Philippine Statistics Authority;

(f) One (1) representative from the Department of Computer
Science, University of the Philippines-Diliman;

(g) Three (3) members representing professional cybersecurity or
information communications technology ("ICT") organizations to be selected by
the chairperson of the Council from among the list of nominees submitted by
Philippines-based ICT professional organizations. Nominees shall be
individuals, at least one of whom shall be experience in managing or
implementing large-scale information technology projects; and

(h) Three (3) members representing non-governmental electoral
reform organizations, to be selected by the chairperson of the Council from
among the list of nominees submitted by the country's non-governmental
electoral reform organizations.

A person who is affiliated with any political party or candidate for any national
position, or is related to a candidate for any national position by affinity or
consanguinity within the fourth civil degree, shall not be eligible for appointment or
designation to the Council. Should any such situation arise at any time during the
incumbency of a member, the designation or appointment of that member shalll ipso
facto be terminated.

Any member of the Council is prohibited from engaging, directly or indirectly,
with any entity that advocates, markets, imports, produces or in any manner handles
software, hardware, or any equipment that may be used for election purposes for
personal gain.

Any violation of the two immediate preceding paragraphs shall disqualify said
member from the Council and shall be penalized in accordance with Republic Act No.
3019, otherwise known as the Anti-Graft and Corrupt Practices Act, and/or other
related laws.


The Council may avail itself of the expertise and services of local or international
resource persons who are of known independence, competence and probity, are
nonpartisan, and do not possess any of the disqualifications applicable to a member
of the Council as provided herein. The resource persons shall also be subject to the
same prohibitions and penalties as the members of the Council.

Section 6. Functions of the Advisory Council. - The Council shall have the
following functions:

(a) Recommend the most appropriate, secure, applicable and cost-
effective software, hardware, infrastructure, services, and technologies to be
applied for the use of Filipino voters regarding the System;

(b) Participate as non-voting members of the Bids and Awards
Committee in the conduct of the bidding process for anything deemed
necessary for the System. Members of the Council representing ICT
professional organizations are hereby excluded from participating in any
manner in the Bids and Awards Committee;

(c) Participate as non-voting members of the steering committee to
be created by the Commission tasked with the implementation of the System.
Members of the Council representing ICT professional organizations are hereby
excluded from participating in any manner in the steering committee;

(d) Provide advice and assistance in the review of the System's
planning, inception, development, testing, operationalization, and evaluation
stages. For this purpose, the Council may employ programs such handing out
bounties to white hat hackers that discover bugs and vulnerabilities in the
System;

(e) Provide advice and/or assistance in the identification, assessment
and resolution of the System’s problems or inadequacies as may surface or
resurface in the course of the bidding, acquisition, testing, operationalization,
re-use, storage, or disposition of System equipment and/or resources as the
case may be;

(f) Provided advice and/or assistance in the risk management of the
System especially when a contingency or disaster situation arises;

(9) Prepare and submit a written report, which shall be submitted
within six months from the date of the election to the Commission and the
Congressional Oversight Committee, constituted hereunder, regarding the use


and as a technical evaluation of the System. The necessary recommendations
in areas where there is need for legislative action shall be included in this report.

The Council shall be dissolved after the submission of the written report
described herein, unless later reconstituted by the Commission for whatever purpose
in the furtherance of the objectives of this Act and its declared policies.

Nothing in the roles of the Council or any outside intervention or influence shall
be construed as an abdication or diminution of the Commission's authority and
responsibility for the effective development, management, and implementation of the
System and the provisions of this Act.

The Council shall be entitled to a just and reasonable amount of per diem
allowances and/or honoraria to cover the expenses of the services rendered
chargeable against the budget of the Commission.

Section 7. Qualities Required of the System. - The System shall adhere to
the following standards:

(a) Accuracy — The System should record the votes correctly;

(b)  Auditability - There should be reliable and demonstrably
authentic election records. The System should provide a mechanism for an
audit trail which can help to verify that the votes are accounted for correctly in
the tally and that overall security is maintained;

(c) Authentication — Only the eligible and valid voters can vote
through the System;

(4) Certifiability - The System should be testable against essential
criteria;

(e) Confidentiality - The System must ensure that votes are only
received by the intended recipient;

(f) — Cost-effectiveness — The System should be affordable, efficient,
and provide the best value for the money spent;

(g) Flexibility - The System should allow for a variety of ballot
question formats suitable for any electoral exercise;

(h) Integrity - Votes should not be able to be modified, manipulated,
faked, or deleted without detection;


(i) Multiple Language Accessibility — Voters should be able to use
the System using any of the major languages of the Philippines;

() —_ Non-coercibility - Voters should not be able to prove how they
voted;

(k) Privacy and Secrecy — No person or entity should be able to
determine how any individual voted;

() Reliability - The System should work robustly, even in the face of
numerous difficulties;

(m) Security - The System must be impregnable from adversaries
such as nation-state actors, black hat hackers, terrorists, criminals, insiders,
and partisan or politically-motivated groups and/or individuals and the like;

(n) Transparency - Voters should be able to possess a general
understanding of the whole process. Voters should clearly understand the
mechanism of the System and know whether their votes have been correctly
inputted and counted;

(0) _ Uniqueness — No voter should be able to vote more than once;

(p) Usability and Intelligibility - Voters must find the System intuitive
and user-friendly; and

(q)___Verifiability - Voters should receive proof that their selections
have been included, unmodified, in the final tallying of all collected ballots.

For this purpose, the Commission and the Council shall adopt state-of-the-art
cybersecurity and cryptographic techniques, methods, and technologies such as but
not limited to biometrics, blockchains, end-to-end verification, end-to-end encryption,
risk-limiting audits, secure channel technology usage, and mechanisms which resist
or prevent malware, denial-of-service attacks, and any security threat in all phases,
parts, and components of the System’s processes.

Section 8. Philippine Identification System Integration. - The Philippine
Identification System, as established by Republic Act No. 11055, and its components
such as the “ Phill”, shall be integrated with the System and shall form as the basis
for registering and/or authenticating the identity of a particular voter for purposes of
using the System and to ensure security and privacy.


This Section is without prejudice to any other voter registration requirement
and/or process the Commission may impose. Existing voter registration and eligibility
systems may be integrated with the System.

Section 9. Process of Voting using the System. - Without prejudice to
whatever modifications, improvements, and/or adjustments the Commission may
prescribe, after due consultations with the Council, in observation of the provisions of
this Act and in pursuit of its declared policies, the following are the steps in voting using
a smartphone application via the System:

(a)

(b)

(c)

Application Registration and Logging-in:

(i) The voter, after opting in to use the System, shall
download the Commission-approved smartphone application with
which to vote and which detects if the voter's smartphone has
been compromised by any malware. The detection and presence
‘of malware or any other unauthorised software, as the
Commission may prescribe in the Implementing Rules and
Regulations, shall disallow the voter from casting any vote
through his or her smartphone unless such malware or
unauthorised software is removed.

(i) The voter shall then log-in and register with the
application via inputting his or her email, mobile phone number,
and a subsequent one-time-password text verification code.

(iii) The voter shall then choose a password and/or
fingerprint validation before being allowed access to the main
application screen.

Voter Identity Verification and Authentication:

(i) The voter shall then take picture(s) of his or her
PhillD using the application and shall pair his or her password
and/or fingerprint verification with biometrics such as but not
limited to a picture of his or her face and/or a recording of his or
her voice.

(ii) Once paired and after the voter's identity shall have
been verified by the System, any identifying information regarding
the voter shall be expunged.

Voting Proper:
(i) Once authenticated, the voter shall then choose

which active electoral exercise is available for his or her lawful
participation and shall cast his or her vote(s). Voters shall be


promptly notified if they have selected erroneously (e.g.
accidentally selecting two candidates for the same position).

(ii) The voter may review and thereby change his or her
choices before submission. Votes shall not be submitted unless
the voter re-confirms his or her identity using the paired password
and/or fingerprint validation or other such biometric identifier.

(ii) After submission, the voter may change his or her
vote before the close of the electoral process, subject to such
reasonable regulations that the Commission may prescribe.

(d) Verification:

(i) The Voter shall then receive an anonymized and
encrypted receipt which assures him or her that his or her vote(s)
was/were sent and tabulated unmodified.

(ii) This receipt shall assist in any auditing process
without unreasonably prejudicing the privacy and secrecy of the
voter.

(iii) The receipt shall be designed to self-delete after
being accessed by the voter.

(e) _ Integration:

(i) Votes cast via the System shall then be added to
the tallies of the other methods currently in use by the
Commission.

Section 10. Information and Education Campaign. - The Commission shall,
not later than six (6) months before the actual use of the System, undertake a
widespread voter information and education program, through mass media such as
the internet, newsprint, radio, television, and the like, as well as through seminars,
symposia, fora and other nontraditional means, to educate the public and fully inform
the electorate about the System and to inculcate the values declared in Section 2. The
Commission shall also educate the public about possible election offenses and
penalties when violating the integrity of the System by referencing Batas Pambansa
Big. 881, as amended, otherwise known as the “Omnibus Election Code of the
Philippines”, and other election laws such as but not limited to Republic Act No. 8436,
as amended by Republic Act No. 9369.

Section 11. Appropriations. - The amount needed for the initial
implementation of this Act shall be taken from the current fiscal year’s appropriation of
the Commission and the other government agencies and institutions mentioned in the
Council. Thereafter, the amounts needed for the proper fulfillment of this Act shall be
included in the annual General Appropriations Act.


Section 12. Implementing Rules and Regulations. - The Commission and
Council shall convene within within thirty (30) days from the latter's first convention
as provided for in Section 5 and shall promulgate the necessary implementing rules
and regulations within three (3) months thereafter.

Section 13. Joint Congressional Oversight Committee. - There is hereby
created a joint congressional oversight committee to monitor the implementation of
this Act. The committee shall be composed of five (5) senators and five (5)
representatives to be appointed by the Senate President and the Speaker of the
House of Representatives, respectively. The majority and minority parties shall, as far
as practicable, be equally represented in the committee. The oversight committee shall
be co-chaired by a senator and a representative designated by the Senate President
and the Speaker of the House of Representatives, respectively.

The oversight committee shall conduct a comprehensive assessment and
evaluation of the performance of the System and shall make appropriate
recommendations to Congress.

The mandate given to the joint congressional oversight committee under this
Act shall be without prejudice to the performance of the duties and functions by the
respective existing oversight committees of the Senate and the House of
Representatives.

Section 14. Applicability. - The provisions of Batas Pambansa Big. 881, as
amended, otherwise known as the “Omnibus Election Code of the Philippines”, and
other election laws, such as but not limited to Republic Act No. 8436, as amended by
Republic Act No. 9369, not inconsistent with this Act, shall apply.

The penal provisions of such laws, as amended, shall also apply accordingly.

Section 15. Repealing Clause. - All other laws, decrees executive order, rules
and regulations, or parts or provisions thereof which are not affected shall continue to
remain in full force and effect.

Section 16. Separability Clause. - If any part or provision of this Act is held
unconstitutional or invalid, other parts or provisions thereof which are not affected shall
continue to remain in full force and effect.

Section 17. Effectivity. - This Act shall take effect fifteen (15) days following
completion of its publication in at least two (2) newspapers of general circulation.

Approved,