HONDURAS Elections 2017 - Technical Report

HONDURAS 

Elections 2017 – Fraud Analysis 

Technical Report 

Grupo de Amigos en Norte América en Software 

- GANAS 

ganasusa@gmail.com 

Version: December 15 th , 2017

TABLE OF CONTENTS 

ANALYSIS AND SOFTWARE ...............................................................................1 

GRATITUDE ................................................................... 3 

BALLOT MODIFICATIONS AND ALTERATION IN THE TRANSMISSION SYSTEM ...4 

BALLOT REPORTS RECEIVED DIRECTLY FROM VOTING 

PRECINCTS ................................................................... 5 

REPORT ON NUMBER OF VOTES ON BALLOT REPORT CARDS 

WITH ATX AND THOSE WITHOUT THE ATX INFORMATION 11 

SECURITY MEASURES ELIMINATED FROM BALLOT REPORT 

CARDS ........................................................................ 14 

SiGNATURE COMPARISON IN ALL BALLOT REPORT CARDS 19 

TRANSMISSION SYSTEM CONCLUSIONS .........................................................24 

PUBLICATION SYSTEM (WEB) .........................................................................26 

BALLOT REPORT CARDS IN AMAZON S3 ......................... 26 

API TSE ...................................................................... 30

Amazon S3 .................................................................. 32 

NUMBER OF IMAGES INSERTED PER DAY AND VOTE COUNT 

.................................................................................. 35 

CONTENT OF ALL UPLOADED FILES ................................ 37 

PDF Generating and TAGGING ....................................... 37 

downloads.hn ......................................................... 38 

processtoPDF.py ..................................................... 38 

findresoultions.py .................................................... 39 

votecount.py .......................................................... 40 

parselista.py ........................................................... 42 

IMAGE PATTERNS ...........................................................................................43 

PATTERNS BY SIZE .................................................. 43 

Different Resolutions for Images PUBLISHED ONLINE ....... 47 

Growth Behavior is directly proportional to the Ballot 

Record Card ID ....................................................... 51 

More than 100% at TSE.HN ...................................... 53 

ADDITIONAL SOFTWARE AND BENFORD TEST ................................................54 

VOTO SOCIAL ......................................................... 54 

BENFORD ANALSYSIS .............................................. 55 

CONCLUSIONS ON THE PUBLICATION SYSTEM ...............................................59

OVERALL CONCLUSIONS .................................................................................61 

REFERENCES AND LINKS .................................................................................63 

CONTACT US - GANAS USA ............................................................................65

ANALYSIS AND 

SOFTWARE 

The electoral process in Honduras took place on November 

26 th , 2017. By 4 P.M. local time, all voting locations and 

precincts were closed (per request from the National 

Tribunal of Election, “TSE”) and all appointed 

representatives from all political parties proceeded to open 

and count all ballot boxes for Congress, Municipality, and 

Presidential races. 

Once the count was completed, a designated official was in 

charge of electronically sending a scanned copy of what we 

called a “Ballot Report Card or Acta.” This process was 

conducted using a device called “ATX” or a secured scanner 

using a GPRS/3G/4G LTE modem card. The designated 

individual verified that the report card included all official’s 

signatures in the watermarked paper, and proceeded to

send it to the “TSE.” A hard copy of the card was shared 

among all parties that participated in the count. 

The transmission of the report card included information 

from the scanner itself (called “ATX Information”). The ATX 

information included the device identifier and a time stamp 

of that transmission. 

Although many anomalies were reported during this election 

process, this report analyzes the transmission system, 

makes an initial forensic analysis of the scanned images, 

and to finalize, analyzes the internet publication platform. 

The collected information shows evidence of fabrication of 

electoral cards, removal of security features in the scanned 

images, and other system anomalies that enabled easy 

tampering and modification of the final result. 

Specially, the collected evidence contradicts the “rural vote” 

theory that was being circulated by Honduran Government 

officials. The evidence shows that in all cases where the 

report cards were send by car, Juan Orlando Hernandez wins 

by a disproportionate amount versus the votes counted from 

the cards sent digitally from the ATX machine. 

The report focuses specially in an explanation on how the 

discrepancy between the results reported by TSE at 1:47 AM 

Honduras time on the 27 th of November differs from Today’s 

report. We find that the system was tampered and modified 

to favor Juan Orlando Hernandez. 

2 GANAS USA | ganasusa@gmail.com

At that time, it was reported that Mr. Nasralla had won the 

election after transmitting and TSE reviewed over ~12K 

precincts (around 70%) of the voting locations providing 

Nasralla a ~5% lead over Juan Orlando Hernandez. After 

counting the remainder number of votes, which were sent by 

land/car and scanned at a different location, Juan Orlando 

Hernandez won the election by overcoming over the 

120,000 votes lead to finalize with approximately 50,000 

votes over Nasralla. 

This final report does not include any analysis on the TSE 

servers “going down” and other difficulties reported by the 

National Tribunal of Elections (TSE) during that time. 

GRATITUDE 

We used in a great degree the project posted by “Win2013” 

on github 1 and the source code to process and creation of 

PDF files from TSE APIs, all scanned “Actas” or “ballot report 

cards” provided in the posted repository and used by this 

project. Also, VOTO SOCIAL for providing information during 

their own count. 

1 

Github is a place to share and post software projects with 

source code. 


BALLOT 

MODIFICATIONS AND 

ALTERATION IN THE 

TRANSMISSION SYSTEM 

Our team reviewed all ballot report cards provided by each 

electoral ballot box that Hondurans call as “MER” or “Mesa 

Electoral Receptora.” A device called ATX (a scanner with 

authentication features) sends a digital copy of the ballot 

report card to TSE and copies to all political parties, the 

National Tribune of Elections (“TSE”) and other interested 

entities. 

We compared the images and vote counts against what is 

was received by hand or snail mail from the “Rural” areas at 


a location called INFOP, or a similar place where the ballot 

reports were rescanned. 

The review included analysis per pixel, image filtering using 

digital signal processing techniques, and detecting changes 

that compared information with those scanned images and 

voting count. 

The first set that was sent from the ballot precinct included 

12,917 ballot box locations and 5,417 ballot cards collected 

and sent by land to INFOP. 

BALLOT REPORTS RECEIVED DIRECTLY FROM VOTING 

PRECINCTS 

Each of the ballot report cards were sent directly to all 

political parties and to the national tribune of elections. The 

precinct sent a scanned copy of the ballot reporting card at a 

resolution of 1600x978 pixels attaching the ATX Identifier in 

the left-hand corner of the report card (as shown below) and 

a time stamp, as show in FIG 1. 


FIG 1. Ballot Report Card with ATX Information – 

Scanned from Prescinct MER 0306 for President 

The images scanned from the 12,917 locations were 

delivered over secured lines using the ATX device 

transmitted an JPEG encoded image with RGB colors a depth 

of 8 bits and 72x72 DPI (Dots Per Inch), as described by the 

tool called “exiftool” 


Resolution : 72 

Y Resolution : 72 

Image Width : 1600 

Image Height : 974 

Encoding Process : Baseline DCT, Huffman coding 

Bits Per Sample : 8 

Color Components : 3 

Y Cb Cr Sub Sampling : YCbCr4:2:0 (2 2) 

In contrast, the images sent from INFOP, which total 5,497 

precincts were encoded as well in JPEG at a resolution of 

2790x1699 and 1 color component, removing the YCbCr 

components. The same format was later used to post on 

Amazon’s S3 system for public viewing. 

X Resolution : 200 







Image Size 

: 2792x1699 

The difference between these two scans is significand and 

despite increasing the resolution to 2790x1699, we observe 

a deliberated effort to eliminate all YcbCr4 components that 

include all the security features inherent of the ballot report 

card. This new JPEG scan eliminated all watermarks, 

backdrop images, and the ATX Identifier. 

TSE personnel proceeded to also convert the JPEGs with ATX 

Information with the YCbCr component, and width and 

height of 1600x974, and were up sampled to width and 

height of 2792x1699 removing the YCbCr component from 

the ballot report card. 


The importance of these images is that, you can compare all 

the voting precinct scanned images that contain the 

metadata and ATX identifiers (including time stamps) with 

the ones from INFOP that were removed. 

We reviewed all the images that were claimed to be sent 

from INFOP and 99.7% of those images have all the ATX 

information removed as well as all the ballot report card 

security watermarks are no longer detectable. This makes us 

believe that a different scanner was used to scan these 

images and that there is no way to know when they were 

scanned. 

As you can see in the following paragraph, a list of all 

scanned documents with the ATX metadata information from 

MER 1 thru 18600. These presidential ballot report cards can 

be reviewed and downloaded in your local filesystem. 

• Listing of all ballot report cards without MER/ ATX Information 

https://huladrive.com/elections/1/ATX_Info_fake.pdf 

• Listing of all ballot report cards sent from “ INFOP” with 99.7% without MER/ATX Information 

https://huladrive.com/elections/1/ATX_Info_Infop.pdf 

• Full listing of all ballot report cards with or without ATX Info from MER 1- 18575. 

https://huladrive.com/elections/1/ATX_info1000.pdf 



















As an example, we chose a sample range between voting 

precincts 3051 to 3056, as shown in the following section 

and that can be located within the file ATX_info4000.pdf. 

As one can observe, FIG 2 shows the MER identifier 3051 

(3051104.jpg) and do not include the ATX Information 

signature and coincidently was not ever sent to the political 

Parties in dispute. 

In fact, none of the ballot report cards that were sent from 

INFOP includes the ATX Information, but all the ones that 

were received from the precincts contain the ATX 

information as in 3052, 3053, and 3054. 

The curious aspect is that any of the deputy officers in 

charge of sending the report card, could use any adjacent 

ATX, as in the FIG 2 and FIG 4, there were adjacent ATX 

devices. but for an unknown reason the ballot card was later 

sent by snail mail to the national tribunes of elections and 

captured at INFOP. 

NOTE: You can find all Ballot Report Cards at using the 

BARCODE (or Bard Code Information) which is nothing ty 

the MER identifier plus the string “104.jpg” for all 

presidential race. 

https://huladrive.com/elections/1/.jpg as 

an example, we can find 

https://huladrive.com/elections/1a/03651104.jpg the same 

card was also posted as received by the political parties 

https://huladrive.com/elections/1/03651104.jpg Se bellow, 


00305104.jpg was not transmitted. This example repeats 

throughout the PDF files aggregating all the ATX information 

for all voting precincts. 

FIG 2. MERs and ATX Information in the PDF File for 

the Identifier 3000 to 4000 range. 


“All ballot report cards that were 

sent from the voting precinct 

included the ATX Information and 

were received by the political 

parties. All the other cards were 

sent manually and did not carry 

the ATX Information and time 

stamp” 

REPORT ON NUMBER OF VOTES ON BALLOT REPORT CARDS 

WITH ATX AND THOSE WITHOUT THE ATX INFORMATION 

• An account of the total number of votes received by all 

ballot precincts account in favor of Salvador Nasralla 

with 118,000 votes over Juan Orlando Hernández as 

reported by the TSE the night of the 27 th of November 

• All other additional ballot report cards that were sent 

afterwards and send without the ATX Info and with all 

eliminated security features from the ballot report card 

Salvador Nasralla loses by 172,000 votes in favor of 

Juan Orlando Hernandez. 


FIG 3. Visual comparison of the Ballot Report Cards 

arriving from the MER and scanned from INFOP. 

The images in FIG 3 show a qualitative difference between 

the ballot report card sent from the precinct and the one 

sent from the INFOP location. As shown the left image, it 

includes the “ATX Identifier” and the date that it was sent 

(In a great majority Nov 26 th from 5pm-midnight). The on 

the right does not. 

This can be verified by running the program 

ImageSearch.py and creating all PDFs with all the 

information from all the first 25 pixels where the ATX 

information resides. 2 

2 

One can use “ImageSearch.py” to generate this PDF at 

http://github.com/win2013/honduras_tse_pdf 


FIG 4. PDF Sample with MERS from Voting Prescints 

from MER ID 135 to 140 

As shown in FIG 4, a list of ballot report cards is shown here. 

These cards were transmitted with the ATX information and 

some don’t from a school located in TOCOA, COLON. 

Like in this figure, many non-rural places, the ballot cards 

were not sent or delivered from those precincts 

electronically. Even when adjacent locations had an available 

ATX device, and Honduran law allows the designated official 

to use any available ATX to transmit cards. 

Instead, these images were later rescanned from INFOP 

even from urban locations in Tegucigalpa, San Pedro Sula, 

and other cities, where internet was available and ATX 

devices were used by adjacent places. 


SECURITY MEASURES ELIMINATED FROM BALLOT REPORT 

CARDS 

A forensic analysis was performed to the scanned images 

(Ballot Report Cards). One can run a similar analysis using 

the site: https://29a.ch/photo-forensics/#error-levelanalysis, 

and the following filters were applied to the 

images: 

• Error Level Analysis, 

• Level Sweep, 

• and Principal Component Analysis. 

The ballot report cards arrived from all the precincts and in 

many cases included the ATX information and Card Security 

features (ATX ID and time of transmission). These security 

features (watermarks) can be seen by zooming in and 

without a particular filter. These features can be clearly 

detected using simple image processing (e.g. Principal 

Component Analysis filter). You can clearly appreciate the 

watermarks with texts such as “TSE”, “2017” and “Todos 

somos Democracia” among others. 

As an example, you can find the following number “7” 

(inverted) amplified after applying a “Principal Component 

Analysis” Filter in FIG 5. 


FIG 5. Security Watermarks in the Ballot Report Card 

using the Principal Component Analysis tool. 

In contrast, the great majority of all ballot report cards 

scanned from INFOP have this information deliberately 

removed by the encoding settings chosen by TSE. 

Additionally, the ATX information was removed from the 

ballot report cards that were transmitted originally from the 

voting precinct, in an attempt to make all cards look 

homogeneous. In other words, in publication they wanted 

INFOP cards look the same as the ones sent from the voting 

precinct initially with all security watermarks. 

As shown below in FIG 6, it is very difficult or impossible to 

determine if the ballot report card was an original or a fake. 


FIG 6. INFOP Ballot Report Card without Security 

Features (Watermarks) transmitted 

As shown here, any person can try different image filters 

from other sources or the ones from this site, and in a great 

majority of cases all the INFOP scanned images have all the 

security features removed or impossible to detect. These 

types of changes that were made to the image makes it very 

difficult and impossible to validate and claim any 

authenticity. 

Any alteration, changes, or modifications made to the ballot 

report card from this point forward is now easy to be 

performed and changes are harder to be noticed. 

As it is observed in the above ballot report card (“Acta”) and 

after applying a filter called “Level Sweep” with the 


parameters (1.0, 59, 1.00). Yu can observe that, the sticker 

information that can be seen in all the other cards, seems to 

be homogenous with the same pixel color, which could have 

been doctored. 

FIG 7. Level Sweep Filter applied to the Ballot Report 

Card, showing the sticker over the count area (MER 

00491). 

In contrast, the MER report card in FIG 7 includes the box 

with the sticker that was placed on top of the ballot numbers 

and vote count information. 

In the entire TSE web system, we could only find, a single 

image of a ballot report card that preserved the ATX 

Information, and that was 03036 as shown here: 

https://actas.tse.hn/03036104.JPG): 


FIG 8. Image Corresponding to the MER 03052 in the 

same area with the sticker on top of the vote count. 

It is clear in FIG 8 and FIG 9 that by simple visual 

comparison you cannot see the particular pixilation from the 

security sticker place on top of the voting count. This is then 

repeated in great majority most of the ballot cards scanned 

from INFOP. This is clearly an issue as any ballot report 

card without this security feature could be changed, 

tampered, and modified with a simple image editing library 

in a systematic way 3 . 

3 

More complex FFT-based and cross-correlation analysis can 

be performed or using OpenCV or other open source tools, 

but we do not anticipate major differences to what we 

observed herein. 

https://en.wikipedia.org/wiki/Data_analysis_techniques_for_ 

fraud_detection 


FIG 9. Pixilation seen by the sticker, see signature in 

on MER ID : 00021 

SIGNATURE COMPARISON IN ALL BALLOT REPORT CARDS 

About 17,000 precincts images were converted to PDF and 

placed in https://huladrive.com/elections/. These files are 

all in PDF format and include cards for congress, 

municipality, and presidential races. As shown in FIG 10, 

you can clearly visualize a ballot card rescanned from INFOP 

(on Top and larger) and a congress card scanned from the 

voting precinct (Bottom and smaller), all in one file. 


2790x1980 

Lower Quaity 

No Security Info 

1680x960 

More Quality 

Security Information 

FIG 10. PDF file used for signature comparison (MER 

6064) – Congress and President Cards 

As shown, it is unknown then why the congress race card 

was preserved and not rescanned and why only the 

presidential race card was rescanned removing all security 

watermarks. 


As a sample, we picked a random precinct in the PDF format 

and compared signatures as shown in FIG 11 

(https://huladrive.com/elections/00109.pdf), You can now 

compare the signatures from the deputy appointees from all 

parties and examine difference. Clearly, manipulation and 

validity of these new ballot card is under question as the 

signatures appear to be now forged, creating a question that 

the ballot report card in INFOP is a fake. 

(a) President Info (b) Congress Info 

FIG 11. Signatures in Precinct MER: 109 for 

President and Congress 


In some other cases, the signatures were missing and later 

on were counted, as shown in FIG 12 a) and 12 b) as the 

new ballot card with higher resolution received signatures 

from an unknown source. 

(a) MER 13014 – Without Signatures – with ATX Info as of 

Nov 27 th , 2017 

(b) MER 13014 – With Signatures / Same Information – 

Rescanned at 2700x1900 – As of Nov 30 th , 2017 

FIG 12. Same card polled at different times with 

signature and without signatures – Same vote count. 


As a curious fact: 

“Honduran National 

Tribunal of Elections had an 

online website to validate 

‘Cedulas’ or ID Cards. This 

system has been down 

since November 27 th , 2017” 


TRANSMISSION SYSTEM 

CONCLUSIONS 

• All images and scanned “Actas” that were sent to 

INFOP had no ATX Information and all security features 

from the ballot report card were removed from the 

scan. It is unknown when those cards were transmitted 

and all security features were removed. 

• The images and scans with the ATX information in all 

“Actas” that were also received by the Political Parties 

from each precinct included ATC information and 

corresponding timestamp, and were encoded including 

all security features from the ballot report card. 

• These different scanned images are also directly 

correlated to the fact that in all report cards without 

ATX information, SN loses by 174,000 votes and with 

all the ones that were received with the ATX 

information wins by 118,000 votes 

• There is no direct correlation on rural or urban vote as 

in many precincts where an ATX was used for 


transmission it was not used and many were sent from 

the same precinct 

• A simple comparison with the ballot report cards where 

INFOP scans were made, there are mismatches from 

the signatures in many of the ballot report cards. 

• TSE remove deliberately all security features from the 

ballot report cards that were scanned from INFOP and 

there is no way to know what or when that was 

scanned. 

• It is unknown how the validity of a name or a signature 

is done as the ID validation system has been down 

since November 27 th , 2017 

• Many precincts with several functional ATX machines 

opted for not sending the ballot report electronically in 

a systematic fashion in many urban and rural locations. 


PUBLICATION SYSTEM 

(WEB) 

BALLOT REPORT CARDS IN AMAZON S3 

The ballot report cards that are available to the public are 

located on a website located at: 

http://resultadoselecciones2017.tse.hn/ In each of the 

receptor boxes or precincts an identifier is assigned by the 

TSE and using this web portal anyone can visualize each 

level of election that means president, mayor, and 

congressman. 


FIG 13. TSE’s HTML pointing to AMAZON AND 

JAVASCRIPT TO HANDLE Image Requests. 

As the ballot report cards were scanned and stored in 

Amazon S3, each file was saved in JPEG format and Amazon 

was used to store each precinct information. The ballot 

report cards have an associated bar code with a termination 

string labeled as 104, 405, and 606 plus the extension “JPG” 

(FIG 13). Each report JPEG File contains metadata that can 

be extracted with exiftool. 


ExifTool Version Number : 10.55 

File Name 

: 00001.JPG 

Directory 

: presidente 

File Size 

: 515 kB 

File Modification Date/Time : 2017:12:01 01:11:08-05:00 

File Access Date/Time : 2017:12:04 02:57:15-05:00 

File Inode Change Date/Time : 2017:12:01 11:06:57-05:00 

File Permissions : rw-r--r--A 

File Type 

: JPEG 

File Type Extension : jpg 

MIME Type 

: image/jpeg 

JFIF Version : 1.01 

Resolution Unit : inches 








Image Size 

: 2776x1699 

Megapixels : 4.7 

This metadata includes the report card resolution and 

encoding information. 

The exiftool program shows a size of 2776x1699 at a 

resolution of 4.7 Megapixels 4 . However, we also detected 

many other variations of resolutions and this varies 

depending on the report card. In a very particular case, a 

ballot report card was found published and processed in the 

publication system with an image taken not form an ATX nor 

from INFOM but from an iPhone or an Android device, at a 

resolution of 1.6 Megapixels. This image was part of the 

MER ID and a report for municipality with ID: 14834 

4 

Removing the Chroma scanned images totaled 20GB, 

which fits in a 64GB flash drive 


(https://huladrive.com/elections/14834.pdf). As you can 

visualize, the 3 rd page of the PDF and was replaced by a 

different scan (As shown in FIG 14). 

This even seems isolated however it is concerning that some 

other device other than an ATX or INFOP was able to 

bypass all the security that TSE supposedly had in place. 

This occurrence was detected once and no other capture was 

detected from a mobile phone. 

In summary, the image resolutions found in TSEs publication 

system were of 2792x1696, 1600x977, 1600x917 and small 

variations on width/height of 1-3% across all JPEGs 

investigated here. 

FIG 14. Image found in MER 14834 taken from a 

Mobile Phone (for Municipality Race) 


File Name 

: 14834.JPG 

Directory : . 

File Size 

: 340 kB 




File Permissions : rw-r--r-- 

File Type 

: JPEG 


MIME Type 

: image/jpeg 











Image Size 

: 1600x977 


During the timeframe of Nov 28-Dec 4 th , most of the images 

stored for congress and municipality were at the original ATX 

resolution of 1600x977 but have been rescanned as 

indicated in the 1 st section of this document. 

Amazon’s S3 security is high, as it requires access to the 

AWS system that may include “two factor authentication” 

and special keys that are generated to “mount” Amazon’s 

filesystem remotely. 

API TSE 

The National Tribune of Elections, TSE, provides an API to 

remotely pull data from the system, generating a JSON 


esponse with the content shown in FIG 15. The URL 

requesting information is shown here: 

https://api.tse.hn/prod/ApiActa/Consultar/1/ 

In general, a sample command with curl 5 would provide the 

following response: 

curl https://api.tse.hn/prod/ApiActa/Consultar/1/14343 

{"CodActa":14343,"NumNivel":1,"NomNivel":"Presidente 

(a)","CodMER":14343,"CodDepartamento":15,"CodMunicipio":1,"NomDepartamento":"OLANCHO"," 

NomMunicipio":"JUTICALPA","CodCentroVotacion":1,"NomCentroVotacion":"ESC. PERFECTO 

GUIFARRO","CodEstado":10,"NomEstado":"Divulgacion","NumVotosValidos":163,"NumVotosBlancos 

":3,"NumVotosNulos":10,"NumVotosTotal":176,"NumPapeletasRecibidas":0,"NumPapeletasSobrant 

es":0,"NumPapeletasUtilizadas":0,"CodBarra":"14343159","Url":"https://actas.tse.hn/14343159.JPG 

","Votos":[{"CodCandidato":11541,"NomCandidato":"JOSE ALFONSO DIAZ 

NARVAEZ","IdentidadCandidato":"1804198202879","CodPartido":5,"NomPartido":"PARTIDO 

UNIFICACION 

DEMOCRATICA","NumVotos":2,"NumPosicion":1,"NumPosicionActa":1},{"CodCandidato":6033,"No 

mCandidato":"SALVADOR ALEJANDRO CESAR NASRALLA 

SALUM","IdentidadCandidato":"0801197715391","CodPartido":67,"NomPartido":"LIBRE- 

PINU","NumVotos":34,"NumPosicion":2,"NumPosicionActa":2},{"CodCandidato":24067,"NomCandid 

ato":"ELISEO VALLECILLO 

REYES","IdentidadCandidato":"0501195304045","CodPartido":10,"NomPartido":"PARTIDO VA 

MOVIMIENTO 

SOLIDARIO","NumVotos":0,"NumPosicion":3,"NumPosicionActa":3},{"CodCandidato":8729,"NomCan 

didato":"LUCAS EVANGELISTO AGUILERA 

PINEDA","IdentidadCandidato":"0605195800105","CodPartido":4,"NomPartido":"PARTIDO 

DEMOCRATA CRISTIANO DE 

HONDURAS","NumVotos":0,"NumPosicion":4,"NumPosicionActa":4},{"CodCandidato":1,"NomCandid 

ato":"LUIS ORLANDO ZELAYA 

MEDRANO","IdentidadCandidato":"0801196705668","CodPartido":1,"NomPartido":"PARTIDO 

LIBERAL DE 

HONDURAS","NumVotos":25,"NumPosicion":5,"NumPosicionActa":5},{"CodCandidato":19319,"Nom 

Candidato":"ROMEO ORLANDO VASQUEZ 

VELASQUEZ","IdentidadCandidato":"0318195700057","CodPartido":8,"NomPartido":"PARTIDO 

ALIANZA PATRIOTICA 

HONDUREÑA","NumVotos":0,"NumPosicion":6,"NumPosicionActa":6},{"CodCandidato":21513,"Nom 

Candidato":"ISAIAS FONSECA 

5 

https://curl.haxx.se/docs/httpscripting.html 


AGUILAR","IdentidadCandidato":"0801198704025","CodPartido":9,"NomPartido":"PARTIDO FRENTE 

AMPLIO","NumVotos":0,"NumPosicion":7,"NumPosicionActa":7},{"CodCandidato":14219,"NomCandi 

dato":"MARLENE ELIZABETH ALVARENGA 

CASTELLANOS","IdentidadCandidato":"0703198501047","CodPartido":6,"NomPartido":"PARTIDO 

ANTICORRUPCION","NumVotos":0,"NumPosicion":8,"NumPosicionActa":8},{"CodCandidato":3017," 

NomCandidato":"JUAN ORLANDO HERNANDEZ 

ALVARADO","IdentidadCandidato":"1301196800305","CodPartido":2,"NomPartido":"PARTIDO 

NACIONAL DE HONDURAS","NumVotos":102,"NumPosicion":9,"NumPosicionActa":9}]} 

FIG 15. JSON received from API.TSE.HN 

As shown in the FIG 15, there is an array called 

data[“Votos”] containing the information for presidential 

candidates at index 1 an 8. Also, the JSON(as shown in FIG 

15) provides metadata that was used to tag and search 

voting precincts and compare information. 

Function calls index /2/ and index /3/ did not return a 

valid response as there is a different set of APIs used to pull 

data for congress and municipalities. The documentation 

available is basically inexistent. 

In fact, we observed many timeout issues with API calls and 

inconsistent vote count results, in some cases and for 

several days we observed an additional count of 20,000 

votes in favor of Juan Orlando Hernandez. 

AMAZON S3 

As we described, all the files are stored in Amazon S3, 

however the API and JSON responses the domain name that 

is pointing to actas.tse.hn and uses DEFENSE.NET as well 

as part of the platform front-end landing page (Amazon 

Cloud front). 


The Amazon’s S3 “Bucket” is called uploadtrailhn. 

https://actas.tse.hn/14343159.JPG 

FIG 16 – Special Scrutity Card for MER 14343 

All the JPEG files for president, municipality, and congress 

were locally stored from Amazon’s S3 to proceed in multiple 

image comparison and analysis. The command in 

downloads.sh were sufficient to download and store these 

files locally. 


curl -o "#1.JPG" https://s3.amazonaws.com/uploadtrailhn/[00001-18128]104.JPG 

curl -I -o "#1.timestamp.txt" https://s3.amazonaws.com/uploadtrailhn/[00001-18128]104.JPG 

cd.. 

cd diputados 



cd .. 

cd alcalde 



At the same time, Amazon S3 provides a “Header” 

information that includes the “Last-Modified” field 

indicating when the file was changed last.: 

As an example, we can see the information below in FIG 17, 

as follows: 

HTTP/1.1 200 OK 

x-amz-id-2: d28sTR7t399E+4LsL1p0zqYXUweM2PdsQFbRKRKcr98gzN5AAdtTr5PgV7iiYyeF 

x-amz-request-id: D563D0BD7D4644ED 

Date: Fri, 01 Dec 2017 19:08:49 GMT 

Last-Modified: Wed, 29 Nov 2017 04:27:49 GMT 

ETag: "4a1c27e6a951ff487ba1992569d114bd-1" 

x-amz-version-id: null 

Accept-Ranges: bytes 

Content-Type: image/jpeg 

Content-Length: 362371 

Server: AmazonS3 

FIG 17. Metadata from AMAZON S3 – “Last-Modified” 

Wed, 29 Nov 2017 04:27:49 


The timestamp of the file was stored locally as of Dec 2 nd, 

2017 and later on December 9 th, 2017. 

NUMBER OF IMAGES INSERTED PER DAY AND VOTE COUNT 

In summary, these are the number of images that were 

being scanned and inserted into the publication system from 

Nov 27 th thru Dec 2 nd : 

FECHA 11/27 11/28 11/29 11/30 12/1-2 

Number 

of 

Images 

7,180 11,036 11,558 18,790 2443,419 

As shown here and FIG 18, a great majority of the files were 

updated on Nov 30 th , especially presidential ballot report 

cards. 


FIG 18 – Number of Images uploaded wth Vote Count 

Votes inserted per candidate from Nov 27 th – Dec 2 nd . 

SN 0 29,443 326,218 337,301 591,938 1,560 0 

JOH 0 24,902 392,698 362,884 551,752 1,645 0 

As shown in FIG 18, the data was being presented to the 

public in ways that were not in according to the data that 

was being shown in the front-end. There is a deliberate 

attempt to insert over 120,000 votes to 90,000 in favor of 

Juan Orlando Hernandez and later add 40,000 votes to 

Salvador Nasralla, ending up with a difference of 50,000 

votes in favor of Juan Orlando Hernandez. 


The thesis that “Rural Vote” was being received is then false, 

as the data shows that the distribution was uniform in all 

dates. 

CONTENT OF ALL UPLOADED FILES 

The information was collected from December 1 st to 2 nd and 

all images were “Last-Modified” on: 

• Nov 27 - 30, 2017 

• Dec 1 – 2, 2017 

Near 17,000 files were stored the 1 st round and 18,500 a 2 nd 

run for major, congress and president. An approximate 

storage size of 9GB for president, 7.4GB for municipalities 

and 7.3GB for congress. 

The files are then stored in four subdirectories; 

alcalde/ presidente/ diputado/ and escrutinioesp/ 

The programs used for this analysis depend on the libraries 

fPDF and Pillow. The capturing of all JPEG images and 

generating PDF files with them while capturing metadata and 

number of votes per precinct. 

PDF GENERATING AND TAGGING 

In order to facilitate viewing, comparison and analysis, we 

converted all ballot report card images into PDF with tags 

that made it easier to recognize names, insert text and 

identify image patterns. Our team used the project 

“honduras_tse_pdf” and converted all files from a local 


storage system: 

https://github.com/win2013/honduras_tse_pdf 

This project includes the following components: 

downloads.hn 

This program uses CURL to download the patterns 

associated with president, alcalde, diputado, and escrutinio 

special: 

• President [00001-18128]104.JPG 

• Congress [00001-18128]405.JPG 

• Municipality [00001-18128]606.JPG 

• Special Cases [00001-18128]159.JPG 

processtoPDF.py 

ProcesstoPDF is the program that will connect with 

API.TSE.HN and pull the content from the local repositories 

and creates a 3-page PDF file precinct document. This 

python program can run on Linux and MacOS. The command 

processtoPDF read the files from the drives, presidente/*, 

alcade/* y diputados/* and generates a PDF info directory 

pdfs/* 

All PDF generated files were uploaded intro Dropbox and Los 

PDFs stored into HULADRIVE (Cloud storage system). 

• DROPBOX 

https://www.dropbox.com/sh/43gorhq81xrfwhx/AAAv 

WUt36Pitwa-uHh8VSWkTa?dl=0 


• HULADRIVE – Interface Web (FIG 19) 

https://huladrive.com/elections/ 

FIG 19. HULADRIVE.COM – ELECTIONS Directory 

At the same time, the program generates a CSV file with the 

dates all images were uploaded into Amazon S3 or its 

timestamp, and were used to check per-hour what files were 

uploaded into the Amazon’s S3 bucket. 

findresoultions.py 

This program uses the information on each image and the 

vote count to analyze resolution versus the number of votes, 


valid votes, and other permutations. The CSV file created is 

called data_mining.csv 

python findresolutions.py 1 1000 data1000_test.csv 

00001, 2776, 1699, 2787, 1696, 2782, 1696, LIBRE-PINU, 81, PARTIDO NACIONAL DE HONDURAS, 40, 

144, 355, 149, CENTRO EVANGELICO BETHEL, LA CEIBA, ATLANTIDA 















votecount.py 

Once all PDF files are generated, searches can be made per 

municipality, department, or school. For example, “SANTA 

BARBARA” was used to validate this sample (shown in in FIG 

20). 


FIG 20. SANTA BARBARA 

This script uses the PDF generated files and uses the script 

uses a the data_mining.csv table and computes the total 

number of votes per area within a directory. 

For Example: 

python votecount.py data_mining.csv pdfs/Santa\ Barbara 

Total SN/ALianza: 

90803 

Totl JOH/PNH: 


88652 

parselista.py 

This program passes the database or a list of MERs and 

inserts them into a directory to be copied and then be 

analyzed with vocount.py or any other program. 


IMAGE PATTERNS 

The content of the ballot report images on Amazon’s S3 and 

the uploaded segment of the files from Nov 27 – 30 and Dec 

1 st and 2 nd . Most the files, 40% was uploaded into the TSE’s 

main publication site. 

PATTERNS BY SIZE 

• The size of the archives was ordered from smaller to 

larger file. 

• The ballot report cards that did not find an image for 

municipality and for congress was marked with the tag 

“NOT FOUND” 

• In those cases, where no information was found then a 

“VOTER MISSING” text was inserted. 


Images ordered by Size 

The images that were place in directory with 2 or less report 

cards (as seen on FIG 21) were classified arranged to detect 

irregularities in the fields or the images. 

FIG 21 – List of Images with only 2 report cards as of 

Dec 1 st , 2017 

o We observed a pattern of uploads that are in 

sequence and on with dates Nov 29-30 th , 2017 

GMT at short intervals of less than 1 second. In 

other words, On Nov 28 th , 8:00 GMT the following 


files were uploaded at the same time for instance, 

followed by 336 other files. 

The following MER IDs: 

08636,08637,08639,08642,08643, 

08645,08646,08648,08653, 

08659,08660. 

FIG 22 – Update Count of all Images being 

Published into Amazon’s S3 from TSE. 


o We observed that at MER ID of 11,879 

(https://huladrive.com/11879.PDF) which on Dec 

2 nd , 2017, was uploaded as part of another 

sequence of tiles from Nov 30, 9:36 GMT thru 

9:39 GMT (Thru MER ID 1289)7 

(https://huladrive.com/12897.pdf ) . 

o More sequences are observed the dates that 

followed as shown in the FIG 22. 

• This does not match the argument made by TSE about 

“Voto Rural” for example: 

The following MER IDS were uploaded Nov 28 th at 

18:00GMT Which corresponds to Nov 18 th , 1:00 pm 

Honduran time. 

11048,11050,11051,11052,11053,11054,11055, 

11056,11057,11059, 11060,11061,11062 

Most of these precinct reports were in CEDROS, 

FRANCISCO MORAZAN and were uploaded then, 

however the 11053, 11054, 11055, 11056 was 

received by the TSE Nov 26 th , 2017 at 18:18 GMT from 

ATX ID: 03113 and 03114 

The entire argument of “Voto Rural” does not add up as 

there are sequences of MERs that were uploaded to the 

system all together, even though they had already arrived 

via ATX. Like in the example above. 


It appears that systematically the ballot report cards were 

being uploaded into the system, although something else 

was being reported to the public. The process continued in 

all the subsequent days and in a controlled fashion. 

DIFFERENT RESOLUTIONS FOR IMAGES PUBLISHED ONLINE 

As expected, large number of images were loaded to 

AMAZON S3 at different resolutions but in its majority, were 

published with 2700x1699. 

• In the rang MERS between 11000-1300 Juan Orlando 

Hernandez wins with 100 votes of difference, with some 

exception such as in MER ID 12299.PDF and 12852.PDF 

in which Nasralla wins over Juan Orlando Hernandez 

• These MERs can be found at 

https://huladrive.com/12299.pdf and 

https://huladrive.com/elections/12652.pdf 

Similarly, most of the uploads in 30 de NOV only very few 

ballot report cards were uploaded 27 de NOVIEMBRE a las 

09:47 GMT (FIG 23), as shown here: 


FIG 23. Ballot Record Card 12299 and 12652 

transmitted on NOV 27 9:47GMT 


As expected the resolution is different and distinct: 

xifTool Version Number : 10.55 

File Name 

: 12652.JPG 

Directory 

: ../presidente 

File Size 

: 329 kB 





File Type 

: JPEG 


MIME Type 

: image/jpeg 











Image Size 

: 1600x973 


ExifTool Version Number : 10.55 

File Name 

: 12299.JPG 

Directory 

: ../presidente 

File Size 

: 300 kB 





File Type 

: JPEG 


MIME Type 

: image/jpeg 











Image Size 

: 1600x973 



• All the evidence indicates that files were uploaded in 

batches in intervals of 1 hour each (as shown in FIG 

22), and in sequence. The file mers_by_date.txt 

contains per hour the identifiers of what ballot IDs were 

uploaded and for what type of report. 

NOV 27, 2017 

OTHER DATES 

TOTAL IMAGES 7,180 6 All the rest 

IMAGE 

RESOLUTION 

JPEG 1600x973 

JPEG 

~2700x1699 

6 

The TSE is systematically replacing all MER information 

from 1600x860 to 2700x1700 


Growth Behavior is directly proportional to the Ballot Record Card ID 

A video was taken where you can observe the growth of 

votes for one candidate versus the other. As shown, the 

proportion of votes changes from MER ID 10,000 thru 

13000, in this timeframe the advantage that Salvador 

Nasralla had over Juan Orlando vanishes and the growth 

rate of Juan Orlando increases drastically. 

https://www.dropbox.com/s/kbz5lpazxqb9akd/IMG_6781.M 

OV?dl=0 

• Review time from 0:00 and at 4:24 you can see how 

the trend changes to 3100 votes in favor of Juan 

Orlando Hernandez 

• The area of 1 – 11,000 MER identifiers is where all 

remains about constant in terms of growth and data 

converge. 

The explanation of this phenomena is simple, there were 

more than 5500 MERs without being transmitted to the 

political parties. Most of these MERS were located from MER 

ID 10,000 thru 18,000 with more than 60%. In other 

words, 4000 MERs were not known or available at that 

range. 

The missing voter information is shown in the following 

figure (FIG 24). As expected, the modifications made in all 

the ballots record cards took place in the higher ranges as 


those where the majority of votes that were not yet 

recorded not received by all political parties. 

FIG 24 – Number of Missing MERs per Prescint’s 

Range Identifierfs (President) on NOV 27, 2017 

RANGE MERS PERCENTAGE 

0 to 1k 61 1% 

9 to 10k 67 1% 

4 to 5k 84 2% 

10 to 11k 119 2% 

5 to 6k 194 4% 

17 to 18k 206 4% 

3 to 4k 211 4% 

6 to 7k 231 4% 

1 to 2k 235 4% 

8 to 9k 318 6% 


2 to 3k 386 7% 

7 to 8k 395 7% 

14 to 15k 412 8% 

16 to 17k 417 8% 

15 to 16k 437 8% 

12 to 13k 499 9% 

11 to 12k 518 10% 

13 to 14k 569 11% 

As shown, it is now obvious why the video depicts an 

inflection point at MERID = 13065 as this range had the 

majority of ballot report cards that were not transmitted to 

the political parties. 

More than 100% at TSE.HN 

In and around Nov 30 th thru Dec 2nd of 2017 if you 

manually added al percentages obtained by all candidates 

the total returned 100.9%, which was later on corrected. 


ADDITIONAL SOFTWARE 

AND BENFORD TEST 

VOTO SOCIAL 

“Voto social” was used with the data provided by TSE and 

the population converged at 10% of the samples. In other 

words, at 10-20% it was easy to observe a 40/39% 

distribution among the candidates in dispute. Hence, the 

theory that a rural population was the one shifting the 

election is flawed and bogus (As shown in FIG 25). 

However, the election shifted as the higher MER ids had an 

enormous difference in distribution and Juan Orlando 

Hernandez won at 60/40%. 


BENFORD ANALSYSIS 

FIG 25. VOTO SOCIAL – User Interface 

The Benford test applied to the 1 st digit is used to validate a 

population and numbers and detect anomalies and potential 

fabrication of information. This test was used in financial 

systems and is also used to detect voting fraud. The Test 

follows the “Benford Law’ distribution where each digit 

probability is Log(N)-Log(N-1). The computation is quite 

simple and requires the use of the command LEFT using 

“LEFT (cell_id, 1))” and applying the frequency counter 

with l “COUNTIF(range, id of integer)”. 


The Benford law can be found described in Wikipedia 

(https://en.wikipedia.org/wiki/Benford%27s_law) and a 

distribution of the 1 st digit is expected as shown in FIG 26. 

FIG 26 – Benford Law Distribution for 1 st Digit 

This test can be applied to detect voter fraud and election 

rigging and according to this publication in “Stats in The 

Wild” it can be applied in many elections: 

https://statsinthewild.com/2016/11/26/fun-with-benfordslaw-election-2016-edition-whats-up-with-iowa-andmississippi/ 


Some results were shown including another study for 

Romney vs Obama in 2012 (FIG 27) or Clinton vs Trump in 

2016. 

FIG 27. ROMNEY vs OBAMA Benford Test 

This distribution technique was applied in Honduras voting 

information and failed as shown the orange line reports the 

Benford curve and the bars the distribution of the 1 st digit in 


Honduras 2017 election, as shown in FIG 28, the curve 

depicts fraud and number fabrication. 

FIG 28. Benford Test applied to Honduras Election of 

2017 to the 1 st Digit (18,000 samples) 

. 


CONCLUSIONS ON THE 

PUBLICATION SYSTEM 

• We suspect that other means besides ATX devices were 

used to update Ballot count reports (ACTAS) as shown 

in MER ID 14834 sent from a mobile phone. 

• All time stamps in all images indicate an elaborate and 

non-random process of updating all the voting 

information. 

• Most of the images were updated and changed from 

1600x970 to 2700x1700 and published like that on the 

web, removing all watermarks and all ATX information. 

• The shift seen from MER ID 10000 to 18000 is seen as 

more than 60% of the missing MER ids were located 

within that range coinciding with the shift in the trends. 


• Benford test fails in all number of votes on the 1 st digit 

indicating some fabrication and election rigging. 

• “Voto social” showed that the population of voters is 

homogeneous and there is no shift in percentages from 

ballots coming from rural areas as with 10% of the 

population the results converged. 

• More than 40% of the IMAGES were updated NOV 30 th , 

and it seems to follow a systematic updating process, 

with ranges of images uploaded at different dates. 


OVERALL CONCLUSIONS 

In summary, there is a direct correlation between a winning 

number of votes seen in MERs that were sent from INFOP, 

that were allegedly manually counted, manually scanned, 

without ATX Information, without security watermarks 

versus the MERs that were received from each precinct the 

day of the election. 

Besides changing a voting trend being statistically 

impossible, the addition of 174,000 votes in 5,000 precincts 

to overcome 118,000 vote leading count by the other 

candidate, is highly suspicions and more so when the votes 

counted show numerous anomalies. 

This discrepancy can only be attributed to manipulation and 

fabrication as shown in the results herein. 

. 



REFERENCES AND LINKS 

• Amazon S3 – Bucket ofl TSE 

https://s3.amazonaws.com/uploadtrailhn/ 

• API TSE – https://api.tse.hn/ 

• TSE.hn http://www.tse.hn 

• Results TSE https://resuldadoshonduras2017.tse.hn/ 

• Github project honduras_tse_pdf 

http://github.com/win2013/honduras_tse_pdf 

• HULADRIVE - https://huladrive.com/elections/ 

• DROPBOX 

https://www.dropbox.com/sh/43gorhq81xrfwhx/AAAv 

WUt36Pitwa-uHh8VSWkTa?dl=0 

• Benford Test/Law – Wikipedia 

https://en.wikipedia.org/wiki/Benford%27s_law 

• Pillow, fPDF : https://github.com/Setasign/FPDF.git y 

https://github.com/python-pillow/Pillow.git 


EXHIBITS 

Nov 27th, 2017 – Dec 2nd, 2017 

File: mer_by_date.txt 

Description: MERS uploaded by date into Amazon S3 

per hour and date 

https://drive.google.com/open?id=19oiTqvJHv1C 

sQKn_5bWfrJJIojDHc4tc 

File: Data_Mining_Dec09.csv 

Description: Information Captured from API.TSE.HN 

including resolution of each image. 

https://drive.google.com/open?id=1TjrgsSvrhZFg 

JjXYt1b-Uma3MXqt6Q_i 

File: fake_mers_imageinfo.csv 

Description: Image Information of all MERS received by 

INFOP – Resolution of each image 

https://drive.google.com/open?id=1guxKJYwKyw 

7lrTTSw6AbvFN2dIKQVQXh 


. 

CONTACT US - GANAS 

USA 

Group of US/Honduran software engineers with expertise in 

software and information systems. We worked in the US and 

Honduras. We have reviewed publicly available information 

and provided all methods and source code for anyone to 

reproduce the same results. 

The facts speak for themselves, we are just the messenger. 

For questions please send them to ganasusa@gmail.com 


We access to all the files, images, documents, and document 

count. 

• ALL TSE Images Snapshot – Dec 1 st , 2017 with all 

timestamps 

• ALL TSE Images Snapshot – Dec 9 th , 2017 with all 

timestamps 

• TSE Vote count several dates 

• Files from ALIANZA OPOSITORA and PARTIDO LIBERAL

HONDURAS Elections 2017 - Technical Report

Create successful ePaper yourself

Delete template?

Save as template?