The Bimodal Voter Accreditation System (BVAS) devices deployed by Nigeria's Independent National Electoral Commission (INEC) operate on Android 10, a version of Google's mobile operating system released in September 2019 that has not received mainstream security updates since 2023. The disclosure was made by Dr. Lawrence Bayode, INEC's Director of ICT, during an interview on Arise TV, adding a new dimension to the debate over electoral technology readiness just days before the August 15 gubernatorial election in Osun State.

BVAS was introduced to replace INEC's earlier Smart Card Reader technology, marking a shift toward biometric fingerprint and facial recognition for voter accreditation. The revelation follows INEC's mock accreditation exercise conducted in Osun on August 1, during which BVAS devices failed at several polling units. INEC Chairman Professor Joash Amupitan stated that the issue was resolved within an hour, but the assurance has done little to ease concerns among election observers.

For a device tasked with biometric voter verification and the real-time transmission of election results, the underlying operating system is a critical technical specification. Bayode addressed cybersecurity concerns directly, explaining that the Android OS on the BVAS does not represent the security risk it might initially appear to be. According to Bayode, the devices run on a heavily customized and locked-down version of the software with additional security layers built on top of the base operating system. The core applications — voter accreditation and result uploading — are isolated from the standard Android environment that would typically be susceptible to conventional exploits. His position was that the age of the base operating system does not accurately reflect the actual security posture of the device as deployed.

While that explanation may be technically sound, it does not fully resolve what has become a confidence problem. At a moment when INEC is working to convince Nigerians that its technology infrastructure is ready for a 2027 general election involving tens of millions of voters across Africa's largest democracy, the disclosure that its primary accreditation hardware runs on an operating system that has not been updated in approximately three years is the kind of detail that raises concerns regardless of the technical merits of the argument.

Regarding the August 1 failures, Bayode clarified that the glitches were not the result of random hardware malfunctions. The mock exercise surfaced a specific technical issue: Permanent Voter Card (PVC) data from 2011 — older voter registration records — was generating high similarity scores in the biometric matching system, causing the BVAS to flag legitimate voters as potential duplicates. The system was subsequently adjusted after the problem was identified.

"It was not a failure," Bayode said. "It was a test. That is what a mock exercise is designed to do."

That framing is reasonable in isolation. Testing a system before full deployment is standard practice, and identifying a problem during a controlled exercise is preferable to discovering it on election day. However, INEC's credibility on whether its technology can perform reliably under real-world conditions was already strained by what occurred in 2023, when BVAS devices failed across multiple states during the presidential election, batteries died, and servers became unreachable.

The 2026 Electoral Act has since established stringent consequences for any recurrence of such failures. Under Section 47(3), if a BVAS device fails at a polling unit and is not replaced with a functioning device, the election at that unit must be cancelled. If INEC determines that the cancelled unit's results would have materially affected the outcome, a fresh election must be conducted within 24 hours — not a week later, and not as part of a supplementary process.

In practice, that timeline is extremely difficult to meet across many parts of Nigeria. INEC itself has flagged 12 local governments in Osun as problematic ahead of August 15. The challenge would be even more acute in remote constituencies that would face the same 24-hour deadline during the 2027 general elections, where Nigeria's vast geography and uneven infrastructure — including unreliable power supply and inconsistent connectivity in rural areas — compound the logistics of rapid device replacement.

Bayode acknowledged the broader stakes, framing the Osun election as an integral part of INEC's preparation for the 2027 general elections. The commission has expressed confidence in its readiness for Saturday's vote, stating that the accreditation and result-uploading applications are functioning, the team is prepared, and the issue identified during the mock exercise has been corrected.

What remains unanswered is the larger question that the Osun election has placed back on the table: what happens when the system falters not during a controlled test with a team of engineers on standby, but on an actual election day in a polling unit located in a community where the nearest technical support is hours away?

INEC now has a legal framework that dictates what must be done in that scenario. Whether the infrastructure exists to execute it — within 24 hours, across every corner of Nigeria — is a question that the August 15 election cannot fully answer, but the 2027 general elections certainly will.