Will auditing and cleaning up give us a credible register?

Gabby Asare Otchere-Darko

Last week, the NPP led a brave charge for a new register at a public forum which I maintain was arranged to reject that very proposition. Leading the vociferous charge against disturbing the current register was the ruling National Democratic Congress, supported by parties, most of whom exist only on paper, but have reserved seats at the IPAC table.

Such is the colour of irony that as NDC General Secretary Aseidu Nketia was on his feet at the Alisa Hotel, trying to convince the nation that even if the register was bloated throwing it away was not the answer, 7 miles across the road in the capital, at Teshie, the Ledzokuku constituency, the NDC was busily giving a practical demonstration of what they do when faced with a bloated register: burn the entire document.

Angry NDC members, believed to be supporters of the Ledzokuku MP, Sena Okitey Duah, said the party register for this month's parliamentary primary was bloated. They alleged that it was bloated with non-members of the NDC, specifically NPP members. They did not want a situation whereby NPP members would be deciding who to represent the NDC in 2016.

They were not prepared to do what their General Secretary was recommending to the nation. Their way was to tear up the register and set it up in flames even before the electoral roll was distributed for exhibition across centres in the constituency.

With a few exceptions (including IDEG and PPP), I was disappointed by the quality of presentations at the two-day public forum last week (Oct 29-30), which was billed to interrogate whether or not the solution to Ghana's register, if bloated, was to compile a new one or not. It was as if the stage was set to interrogate only the position of those who wanted a new register. No effort, no question, no presentation was made to interrogate the other twinned option – auditing and cleaning up -- the very option which many anticipate the panel will end up recommending.

Auditing and cleaning up are both technical, and if you were eagerly waiting to here the IT expert on the panel, Dr Nii Narku Quaynor, to ask probing questions on that, then I am sorry if you were left disappointed.

An audit is not a solution. It is only to point the way to what needs to be done. We have elections in exactly 12 months time. If we are to have an audit we must define the scope of the audit, what it is supposed to achieve, when it will be done and who must do it and get on with it.

It must be noted, however, that just three months ago a performance audit of the EC was done by the UNPD. Surprisingly, this important fact did not get a single mention at the forum. Is it because the UNPD audit report is extremely critical of the management and integrity of the Commission's database system and the nature of the contractual relationship between the EC and its vendor, STL?

"The electoral process in Ghana is faced with a number of challenges such as electoral fraud, violence, bloated register, and intimidation of election officials," the UNDP report bleats.

That report, titled "Conduct of an Institutional Assessment and the Development a Strategic Plan for the Electoral Commission of Ghana", wasissued 16 August 2015 -- two days even before the NPP came out with its 'bombshell' press conference, showing how the register was allegedly bloated with cross-border registrations, fake entries that could only have been fraudulently inserted by staff with privileged access to the EC central database system and huge statistical variance between Ghana's population trends and the growth in numbers in the electoral roll of certain constituencies.

An overwhelming majority of those who were given the opportunity to speak at the EC forum, mainly political parties and civil society groups, preferred the auditing and cleaning up of the register to scrapping it altogether to compile a new one. It was obvious after Charlotte Osei spoke for the EC that the Commission was for maintaining the existing register. In fact, she went as far as to claim that the EC had upgraded its AFIS software, as if to say it was quite capable of undertaking any clean up exercise by itself.

Yet, when the EC attempted to do a little demonstration on Friday in front of TV cameras to show how reliable its system was, it suffered an embarrassing system failure. It was a propaganda exhibition, with Koku Anyidoho tellingly as its volunteer, which went terribly wrong. To me, that system failure was microcosmic of the kind of Mandelbug virus responsible for the varicose veins affecting the healthy management of our electoral roll. The Mandelbug is a bug whose causes are so complex it defies repair. Not a single question was asked at the public forum about how the Electoral Commission and its vendor, STL, were managing our database.

The forum completely ignored probing the technical challenges confronting the EC information system in order to help the panel make an informed recommendation on the way forward. How was this possible, a cynic might ask, when the EC, in its wisdom, settled on an IT expert for the five-member panel, who is a leading member of the party that is leading the campaign that says, "all is well with the EC"?

Again, the EC did not tell Ghanaians when and how it intends to give effect to the October 2014 Supreme Court decision and allow the estimated four million people who registered in 2012 using an NHIS card to register again; but, this time with an identity card that is constitutional.

AUDITING

Instructively the UNDP report remarks, "STL has not been transparent with the officials of the IT department to enable the latter to understand how the system functions even though STL officials are based in the IT Department of the EC." (The full UNDP report can be downloaded fromwww.danquahinstitute.org)

The report laments, "The management of biometric database has been outsourced to STL who was expected to train and fully hand over the system to the IT Department of the EC before the 2012 elections. STL has not respected this component of the contract as at this assessment in August 2015. The implication is that the EC will be unable to conduct biometric registration without STL."

The UNDP has already done a general performance audit of the EC. What is required is a specialised information systems kind, called "automated data processing and computer audits", to examine the authenticity of the voter information collected, the system's efficiency and security protocols, and the governance or management controls of the EC's entire information technology infrastructure. We need an IT audit to tell us whether the current infrastructure is safeguarding our electoral roll, maintaining its data integrity and, therefore, fit for the purpose of giving us a credible base document for credible elections.

What Ghana's electoral body requires is an independent forensic audit of the biometric register and this must be done by an ISACA-certified information systems auditor, who must be picked through an open, competitive international tender process. There has to be, for instance, an audit trail to determine if any breach in security of the EC database has occurred and if so, who did it, when was it done and what actions can be taken to prevent future breaches. "These inquiries must be answered by independent and unbiased observers," according to renowned experts – see Rainer, R. Kelly, and Casey G. Cegielski. Introduction to information systems. 3rd ed. Hoboken, N.J.: Wiley ;, 2011. Print.

A complete audit will determine the main problematic areas where a lot of people (or ghosts) have been registered illegally and also bring out the structural weaknesses apparent in the current system relied on by the EC. The audit should start by analyzing and biometrically comparing each voter's biometric record against every other record in the current database. This comparison should use at least 4 to 6 fingerprints of every voter. The audit should also include a thorough analysis of the personal information of voters to determine patterns that may point in the direction of duplicated or invalid information.

With the biometric duplicates and other possible faulty records identified, we could ensure that only unique records are left to be analysed. The next step would be to determine if there are minors or deceased people registered as voters. One of the ordinary ways to ensure having correct information would be to compare against the available information in the national Births and Deaths Registry and other third party source registries available. But, this is Ghana.

When all is said and done, the most effective way available to us to rid the registry of ghost names, the genuinely dead and to a significant degree, reduce the number of people who cross over our borders to register, is to introduce what worked in Nigeria beautifully: the Permanent Voter Card. In Nigeria, when you take out the 100,000 cards that were not ready before the March 28 poll, the use of the PVC alone took out 10 million names from the register!

CLEANING UP

The problem in Ghana, like Nigeria found out, is with the database. This takes us to the other twin to auditing: cleaning up. Nigeria used a two-phased approach to achieve what has been described as one of the most successful elections in Africa. Prof Jega's INEC first did an internal review process, followed by an independent post-election audit (after 2011), conducted by an independent committee of election experts. After that he set about doing two things: cleaning up and offering actual voters an opportunity and/or the responsibility to come forward to authenticate their existence and eligibility on the voter list.

The result was that in between the last two elections, some 18% of entries were effectively deleted from Nigeria's 73.5 million electoral register. That will be equivalent to over 2.5 million names being deleted from Ghana's current register! Nigeria, it must be stressed, effectively compiled a new register and updated it without calling it so. And, it did so by simply introducing the Permanent Voter Card. I will return to the Nigerian experience later.

I remember asking Prof Attahiru Jega, the then INEC Chairman when he visited Ghana on March 7, 2012, on the invitation of IDEG, how come after de-duplication, Nigeria's biometric register rather went up by six million names more than the provisional figure. His simple but not-so-convincing answer then was that the final list corresponded with Nigeria's census figures. But, deep down I suspected he knew something was not right. He was new to the job. He soon set about correcting it. His initial clean up exercise only took out 680,000. For the next four years he managed to clean up another 4 million or so to bring the list down to 68.8 million.

PVC

Then in October 2014, he introduced the PVC. The PVC has an embedded chip that contains all the biometrics of a legitimate holder (including fingerprints and facial image). On Election Day, it is swiped with a Smart Card Reader at the polling station to ensure 100% authentication and verification of the voter before he/she is allowed to vote.

The exercise was effective because ghosts in Nigeria could not make their way to the collecting centres to hand in their old voter IDs, have their fingerprints biometrically verified, their image cross-checked, to pick up their new card, PVC. Also, a law was passed to ensure that only voters who had their PVCs were allowed to vote.

The impact in Nigeria was clear. 2015 was the most competitive race in Nigeria and voter turn out was expected to reflect this. The fact that total votes cast saw a 25% reduction to 2011 was rather a truer reflection of the situation; more a reflection of the reality that the spiritual exercise of resurrecting ghosts was not that effective this year. Also rejected ballots reduced from 10% in 2011 to 1%!

NATIONAL ID

A non-contestable suggestion at the EC's public forum last week was the obvious point that Ghana needs a single national identification source in order to have a credible register. There too, Ghana can learn from Nigeria. INEC, knowing it had very little time left, introduced the PVC. Nigeria, after the 2015 elections, has now set about the important task of compiling data for a national identification system, free from the undue pressures of election considerations and ensuring that non-nationals stay completely out of the electoral roll.

It is worth noting that the person who until recently was in charge of Ghana's National Identification Authority and the issuance of the Ghana Card, Dr William Ahadzie, is now the Director of Research for the NDC. At last week's forum, seated right next to him was Sylvester Mensah, a staffer at the Flagstaff House now, who until recently was the CEO of the National Health Insurance Authority. It was the NHIS that allowed non-nationals, including international tourists, access to NHIS cards.

The point really is that, whiles important, the broader project of a national ID must be put on hold and addressed in 2017, when Ghana turns 60 and hopefully mature enough to do the right thing.

In conclusion, if the EC says it is not convinced it needs a new register then let it do so scientifically based on credible evidence. That can only happen by first accepting the content of the UNDP report and taking the requisite extra step to commission an independent assessment of the effectiveness of its exiting architecture and security of the deployed biometric systems and their proper alignment with the EC's constitutional goal of providing us a with a credible register for free and fair elections.

If we are to have an audit it must mean just that: an unbiased, independent, systematic examination and evaluation of our biometric data to present a true and fair view of the concern. If done properly it is what should give stakeholders the opportunity to effectively evaluate and take the follow-up measures to improve the effectiveness of risk management, control, and the governance process of our electoral roll database, whether new or cleaned.

The author is the Founder of the Danquah Institute, a public policy research centre. gabby@danquahinstitute.org