Former Vice President and the African Democratic Congress (ADC) presidential candidate, Atiku Abubakar, has raised the alarm over the alleged use of an outdated operating system on the Bimodal Voter Accreditation System (BVAS), warning that the development could expose Nigeria’s 2027 elections to serious cyber and operational risks.
This followed the August 1, 2026 mock accreditation exercise in Osun State, which recorded failures, and revelations by the Independent National Electoral Commission’s (INEC) Director of ICT, Dr Lawrence Bayode, that the BVAS devices introduced into Nigerian elections in 2021 currently run on Android version 10.
In a statement issued by his media office on Tuesday, Atiku argued that Android 10 had reached end-of-life in 2023 and no longer receives regular security updates or patches.
He questioned why INEC, despite its “humongous budget”, had failed to upgrade the BVAS operating system ahead of the 2027 general elections or use upcoming off-cycle elections, including the Osun governorship election, to test upgraded technology.
“The Osun State mock-accreditation failures of August 1, 2026 and Monday’s revelation by the Independent National Electoral Commission’s (INEC) Director of ICT, Dr Lawrence Bayode, has exposed the inadequacies of the BVAS, a critical asset in the conduct of elections in Nigeria,” Atiku said.
The ADC candidate described the continued use of what he called obsolete technology for a critical national electoral process as disturbing, alleging that the development could undermine confidence in the integrity of future elections.
He said the situation was “suspicious” and accused INEC of displaying a “nonchalant attitude” towards the BVAS issue, which he alleged could amount to a deliberate attempt to subvert the credibility of Nigeria’s elections.
Atiku further warned that running BVAS on an outdated operating system could potentially create vulnerabilities that cybercriminals might exploit to compromise the devices.
According to him, sophisticated attackers could potentially bypass the BVAS application, gain access to the device’s file system and manipulate cached voter accreditation logs or polling unit result files before transmission.
He also raised concerns over the transmission of polling unit results through public telecommunications networks to INEC’s Result Viewing (IReV) portal.
Atiku warned that outdated cryptographic foundations could heighten exposure to cyber threats, including so-called Man-in-the-Middle attacks, in which attackers could potentially intercept, block or manipulate data transmitted between devices and servers.
The former Vice President also expressed concern over the biometric functions of BVAS, which capture fingerprints and facial images for voter accreditation.
He argued that the continued use of an outdated biometric framework could reduce the accuracy and resilience of the system against spoofing attempts, including fingerprint and facial-image bypass techniques.
Atiku further warned that legacy software could experience crashes, bugs and memory-related failures during periods of heavy usage, potentially causing the type of “technical glitches” and delayed accreditation experienced in previous elections.
Citing cybersecurity experts, he said, “Running critical national infrastructure on an end-of-life operating system creates a broad attack surface.”
He therefore called for an independent and comprehensive audit of the BVAS hardware and software before the 2027 elections.
“To safeguard election integrity, it is vital to perform an independent, comprehensive code and hardware audit of the BVAS devices,” Atiku said.
He urged INEC to urgently address the concerns surrounding the electoral technology and ensure that all vulnerabilities are identified and resolved well ahead of the 2027 general elections.
