Forensic evidence debunks myth of fully audited and flawless 2024 election system

Forensic Analysis

Sizwe Dlamini | Published 1 minute ago

RECENT political commentary and statements from high-profile figures have sought to dismiss allegations of electoral irregularities in the 2024 South African elections as baseless political noise.

The prevailing narrative insists that the Independent Electoral Commission’s (IEC) systems are robust and fully audited and that the results are beyond reproach, urging the public to trust the technology.

However, a deep dive into the forensic Information and Communication Technology (ICT) expert reports, authored by independent information systems expert Dr Vusi Mhlongo, reveals a significantly different reality.

The documents dismantle the mainstream narrative, exposing a system plagued by mathematical impossibilities, a lack of genuine auditing, and a defensive institutional culture that refuses to acknowledge glaring errors.

Political analysts and commentators have frequently asserted that allegations of rigging “should be supported by credible evidence” and have characterised the challenges as “repeated claims without evidence”. Yet, a founding expert report seen by the Sunday Independent details a massive, empirical forensic data analysis that directly contradicts this claim.

In June 2024, Dr Vusi Mhlongo was approached to assess the integrity of the Electoral Commission of South Africa’s (IEC’s) ICT system. His methodology involved writing custom specialised programmes to systematically download and analyse all 23 291 Voting District (VD) level reports from the IEC’s own public dashboard. The findings were not baseless political assertions; they were mathematical certainties.

Mhlongo discovered that the national and regional ballot reports for the exact same voting stations were identical, a logical impossibility. Furthermore, the system failed to filter data by ballot type, resulting in independent candidates (who only run on regional ballots) incorrectly appearing with votes on National ballot reports.

Most damningly, the analysis revealed that the “Total Valid Votes” listed at the bottom of the VD reports were inflated to almost double the actual votes cast. Mhlongo noted: “For the national ballot results, the excess of total valid votes plus spoilt votes over and above the total votes cast reported in these reports is 15 858 564 votes. For the regional ballot results, the excess… is 16 038 258 votes.”

Consequently, the total valid vote percentages exceeded 100% in virtually every district. As Mhlongo stated unequivocally: “The total valid votes percentage reported on both the national and regional ballot voting station results reports exceeded 100% for all voting stations where votes were recorded (23 288 voting stations). The national ballot total valid votes percentage was, on average, 199%, and as high as 1 195%… The regional ballot total valid votes percentage was, on average, 201% and as high as 1 533%.”

To claim that such tangible, mathematical proof constitutes “claims without evidence” is to ignore the forensic reality of 46 582 analysed reports.

A central pillar of the defence of the IEC’s system is that it is “trusted” and has been independently reviewed by major auditing firms. President Cyril Ramaphosa and other defenders of the process have pointed to these audits as proof of a free and fair election.

Mhlongo’s reports expose this narrative as fundamentally misleading. The IEC relied heavily on a report by Deloitte to prove the system’s integrity. However, Mhlongo’s analysis of the Deloitte report reveals it was strictly limited. It was explicitly excluded from performing a “cybersecurity assessment" and a “code level analysis”, and did not “assess the capacity and performance of the NPE results system”.

More critically, the review was not even conducted on the live system used on election day. Mhlongo highlighted that “Deloitte’s review was only carried out on a copy of the IEC’s ICT system and not on the production/live system itself”. The review on this “pilot” copy concluded on May 27, 2024, weeks before the election, leaving a blind spot regarding any changes made to the live production system in the interim.

Mhlongo was scathing in his assessment of this arrangement: “Deloitte’s review was an attempt by the IEC to obtain a rubber stamping on the integrity of their system, without a thorough evaluation of the system.” He compares a functional user-interface review to “placing a test driver into a car and asking them to test drive it”, noting that this “will have absolutely no bearing on any hidden issues within the engine or any concealed buttons and controls”.

Without a line-by-line audit of the live production source code, Mhlongo warned that: “Undetected hidden threats lurking in the code, whether intentional or accidental, simply cannot be ruled out,” including malicious backdoors or logic bombs.

The narrative that the IEC’s technology is infallible was severely damaged by the events of May 31, 2024. On this date, whil…