Android 10, N209 Billion and the BVAS Question INEC Has Not Answered
An INEC director confirmed on live television that the accreditation machines run an operating system Google stopped patching in 2023. Atiku wants an independent audit. The commission says it built its own security on top. Nobody outside INEC can check either claim.
An admission on live television started it
The row that is now dominating Nigeria's pre-2027 electoral conversation did not begin with a politician. It began with an INEC official answering a straight question on air.
TheCable, Legit.ng and Sahara Reporters all reported that Dr Lawrence Bayode, the Independent National Electoral Commission's Director of Information and Communication Technology, confirmed during an Arise TV appearance that the Bimodal Voter Accreditation System runs on Android 10. Intercept NG dated the appearance to 10 August, on The Morning Show, and quoted Bayode explaining the choice: "We prioritized stability and compatibility when selecting Android 10 initially. Upgrading now would require a comprehensive overhaul of both software and hardware."
The problem with that answer is arithmetic. Android 10 was released in 2019 and, as Legit.ng noted in its report, reached end of life in 2023, meaning it no longer receives updates or security patches from Google. INEC introduced BVAS into Nigerian elections in 2021 and intends to run the 2027 general elections on it.
Atiku's intervention
Atiku Abubakar, now the presidential candidate of the African Democratic Congress, moved on it within a day.
The Whistler reported that a statement from his media office in Abuja on Tuesday warned that running a sensitive election technology platform on an obsolete operating system poses severe cyber and operational risks. Legit.ng attributed the detailed technical argument to his media adviser Paul Ibe.
The specific risks listed were unusually granular for a Nigerian political statement. According to The Whistler's account, Atiku's camp warned that criminal elements or hackers could bypass the BVAS application entirely and gain root access to the device file system; that outdated cryptographic protections leave result transmission exposed to man-in-the-middle attacks in which actors could intercept, block or manipulate data packets; that legacy biometric frameworks reduce accuracy and open the door to fingerprint and photo bypasses; and that bugs or memory leaks in old system frameworks can crash the application during peak voting hours.
Vanguard reported that Atiku described INEC's handling of the matter as suspicious and warned it could undermine the integrity of the country's elections. His demand, as reported by both Vanguard and TheCable, is a single specific thing: an independent, comprehensive audit of BVAS hardware and software before 2027.
What actually happened in Osun on 1 August
The reason this is not an abstract argument is the mock accreditation exercise INEC ran in Osun State ahead of Saturday's governorship election.
The commission conducted the exercise on Saturday, 1 August, across 12 local government areas, four in each senatorial district. Tribune Online and other outlets listed Osogbo, Olorunda, Ifelodun and Boripe in Osun Central; Ilesa West, Ilesa East, Oriade and Obokun in Osun East; and Egbedore, Ede North, Ede South and Ejigbo in Osun West. Tribune Online also reported that INEC deployed 4,427 BVAS devices for the Osun poll and extended PVC collection.
Premium Times reported that during the exercise BVAS devices stopped recognising voters' fingerprints, facial features and PVC details across multiple sites, and that INEC's Public Relations Officer confirmed the malfunction without immediately explaining its cause. The Coalition of Concerned Nigerian Citizens, quoted by Premium Times, was scathing: "A mock exercise is meant to inspire confidence. It is the dress rehearsal before the main performance. But what we witnessed today is not reassuring. It is alarming."
INEC's own account is different. Leadership reported that INEC chairman Professor Joash Amupitan, who toured polling units during the exercise, expressed satisfaction with BVAS functionality and declared the commission ready. TheCable reported the commission's position that the rejection of old PVCs during the exercise was promptly resolved. Bayode, quoted by Intercept NG, was firmer still: "The mock did not fail. It worked fine. We were able to accredit over 1,000 people who came out on the day."
He also argued that the operating system is not the whole of the commission's defence. "Yes, security has improved on the current Android versions, but we are not relying solely on the security of the application system. We are also deploying our own security on the BVAS to ensure it is secure," he told The Morning Show.
A researcher says it may be older than Android 10
The most awkward contribution came from outside politics. Oluwafemi Adebayo, Head of Research and Strategy at the Kimpact Development Initiative, argued that INEC's own published material suggests the devices may be running something even older.
Quoted by All Time Post, Adebayo said: "Looking at the official screenshots of BVAS in INEC's documents, if you examine the customisation, the icons, the layout and the widgets, it is leaning towards BVAS operating on Android 6 or Android 7." Those versions date from 2015 and 2016. His evidence is visual analysis of interface elements in INEC's manuals rather than a device teardown, and INEC has not conceded the point, but the claim sharpens the central question: nobody outside the commission actually knows what is on those machines.
That is the gap an independent audit would close, and it is the gap Atiku is pointing at.
The money and the scale
The scale involved makes the question expensive to ignore. Nigeria has over 93 million registered voters. P.M. News reported that INEC registered 6,885,330 new prospective voters across the three phases of continuous voter registration that closed in July 2026 ahead of 2027.
On cost, INEC has proposed N873.778 billion for the 2027 general elections, of which N209.206 billion is earmarked for technology, according to reporting on the commission's budget submission. A commission asking for that much for technology while running its accreditation backbone on an operating system Google stopped patching three years ago is going to be asked why, repeatedly, between now and 2027.
Why this fight is really about 2023
BVAS carries a political weight that has nothing to do with Android versions. It was sold to Nigerians as the machine that would end rigging, and its accreditation function is embedded in the Electoral Act 2022. When the presidential result upload to the INEC Result Viewing portal faltered on 25 February 2023, the commission's explanation of a technical glitch became the central grievance of the opposition's court challenge, one Atiku himself ran all the way to the Supreme Court and lost.
So when the same commission now says stability and compatibility justified freezing the software stack in 2021, it is not only making a procurement argument. It is asking a country that already suspects the machine to trust the machine again, on the commission's word alone, without an external audit.
INEC had not issued a formal response to Atiku's specific demand at the time of writing.
Strip the politics out and Atiku's camp has raised a legitimate procurement question that INEC has not answered.
The commission's own ICT director confirmed on Arise TV that BVAS runs Android 10, and Intercept NG quoted his justification: "We prioritized stability and compatibility when selecting Android 10 initially. Upgrading now would require a comprehensive overhaul of both software and hardware."
Read that carefully, because it is an admission of a planning failure, not a defence. It means the devices were bought in a configuration that could not be maintained through their service life. Every serious deployment of field hardware, in banking, in health, in logistics, budgets for operating system support windows at the point of purchase, because manufacturers publish those windows in advance. Google's Android support timelines were not a secret in 2021.
So the position INEC is now in is that upgrading is too expensive and not upgrading is a risk, and it has arrived there by not planning for either. Meanwhile the commission has proposed N873.778 billion for the 2027 elections with N209.206 billion for technology. If that sum cannot buy a supported operating system, Nigerians are entitled to ask what exactly it does buy.
Then there is the credibility problem underneath. Oluwafemi Adebayo of the Kimpact Development Initiative, quoted by All Time Post, argued from screenshots in INEC's own manuals that the devices may be running Android 6 or 7. He may be wrong. That is not the point. The point is that a researcher has to guess the operating system of a national election device from pictures in a PDF, because there is no published technical specification and no independent verification.
An independent audit of BVAS hardware and software, with the findings published, would settle the Adebayo claim, test Bayode's assurance that INEC deploys "our own security on the BVAS", and cost a rounding error against N209 billion.
INEC should welcome it. A commission confident in its machines has nothing to lose from an audit, and everything to lose from refusing one for eighteen months while the opposition asks why.
Nigerian elections are not stolen at the polling unit. They are stolen after it, and the Android 10 argument, whatever its technical merit, risks pointing the country's attention at exactly the wrong stage of the process.
Think about what BVAS actually does. It verifies that the person standing in front of the presiding officer is on the register, and it uploads a picture of a result sheet. It does not stop a mob dispersing voters in a ward where the numbers are not going the right way. It does not stop money changing hands under a tree fifty metres from the queue. It does not stop a collation officer entering figures that do not match the sheet. It does not stop a tribunal deciding, months later, that the errors were not substantial enough to matter.
Every one of those failure points is human, and none of them is fixed by a software patch.
Look at what is happening in Osun this week and the point makes itself. Governor Adeleke told the Arise town hall, as Legit.ng reported, "Why are you using federal might to arrest, to intimidate, to scare people?" Vanguard reported him asking the Inspector-General of Police to arrest a serving senator over an alleged threat against opposition party members. Soldiers have been deployed to the state INEC office. None of that has anything to do with which version of Android is on the accreditation device, and all of it will shape Saturday's result more than any operating system will.
There is a further irony. The 2023 grievance was never that BVAS failed to accredit voters. It was that results did not reach the IReV portal in real time on presidential election night. That was a transmission and process failure, and it was the human explanations around it, not the hardware, that destroyed public trust.
So yes, audit the devices. Publish the specification. But if Nigerians spend the next eighteen months arguing about Android versions while ballot snatching, collation fraud and a slow judiciary go unreformed, we will have run a very sophisticated technical debate and lost the actual election anyway.
