INEC BVAS runs on Android 10, an OS that hasn't been updated in 3 years

When INEC conducted its mock accreditation exercise in Osun State on August 1, ahead of the August 15 gubernatorial election, the Bimodal Voter Accreditation System (BVAS) devices failed at some polling units. The INEC chairman, Professor Joash Amupitan, said the issue was fixed within an hour. That assurance has done little to settle the nerves of election observers.

But information from a subsequent interview on Arise TV added a new layer to the conversation. Dr Lawrence Bayode, INEC’s Director of ICT, confirmed that the BVAS devices run on Android 10, a version of Google’s mobile operating system that has not received mainstream security updates since 2023. For a device that verifies voters biometrically and transmits election results in real time, that is a technical specification worth scrutinising.

Bayode was quick to address the concern directly. He said the Android operating system on the BVAS is not the security risk it might appear to be. This is because the device runs on a heavily customised and locked-down version of the software with additional security layers built on top.

The applications running on it- accreditation and result uploading- are isolated from the standard Android environment that would be vulnerable to conventional exploits. His position was that the age of the base operating system does not reflect the actual security posture of the device as deployed.

That explanation may be technically sound, but what it does not fully address is the confidence problem. At a moment when INEC is trying to convince Nigerians that its technology is ready for a 2027 general election involving tens of millions of voters, disclosing that its primary accreditation hardware runs on an operating system that hasn’t been updated in three years is the kind of detail that lands badly, regardless of the technical merits of the argument.

Bayode explained that the glitches on August 1 were not a random hardware failure. The mock exercise surfaced a specific technical issue: PVC data from 2011, older voter registration records, was producing high similarity scores in the biometric matching system, causing the BVAS to flag legitimate voters as potential duplicates. The system was adjusted after the problem was identified, and Bayode maintained that the mock exercise served its purpose.

“It was not a failure,” he said. “It was a test. That is what a mock exercise is designed to do.”

That framing is reasonable in isolation. Testing a system before deployment is standard practice, and finding a problem during a test is preferable to finding it on election day. But INEC’s credibility on this specific question, whether its technology works reliably under real circumstances, was already strained by what happened in 2023, when BVAS devices failed in multiple states during the presidential election, batteries died, and servers became unreachable.

The 2026 Electoral Act has since made the consequences of a repeat stringent. Under Section 47(3), if a BVAS device fails at a polling unit and is not replaced with a functioning device, the election at that unit must be cancelled. If INEC determines that the cancelled unit’s results would have materially affected the outcome, a fresh election must be conducted within 24 hours. Not a week later. Not as part of a supplementary process. Twenty-four hours.

Similar read: “If BVAS fails, election must be cancelled and redone in 24 hours”- 2026 Electoral Act says

In practice, that timeline is extremely difficult to meet in many parts of Nigeria, particularly in the 12 local governments in Osun that INEC itself has flagged as problematic ahead of August 15, and even more so in remote constituencies that would face that clock in 2027.

Osun is not just an election. It is a dress rehearsal for the largest electoral season in Nigeria, and everyone involved knows it. Bayode acknowledged this directly, framing the August 15 election as part of INEC’s preparation for the 2027 general elections.

The commission says it is confident in its readiness for Saturday. The accreditation and result uploading applications are functioning. The team is prepared. The issue identified in the mock exercise has been corrected.

What remains unanswered is the broader question that Osun has put back on the table: what happens when the system falters not during a test with a room full of engineers available to fix it, but on an actual election day in a polling unit in a community where the nearest technical support is hours away?

INEC has a law that tells it what it must do in that scenario. Whether the infrastructure exists to actually do it, within 24 hours, across every corner of Nigeria, is the question that August 15 cannot fully answer but 2027 will.

Read also: 2027 elections: INEC required to create permanent database of polling unit results

Get the best of Africa’s daily tech to your inbox – first thing every morning.Join the community now!

Thanks for subscribing. Please check your email to confirm your subscription.

If you’d like to get featured on our Entrepreneur Spotlight, click here to share your startup story with us.

Get the best of Africa’s daily tech to your inbox – first thing every morning.Join the community now!

Thanks for subscribing. Please check your email to confirm your subscription.