What BallotGuard offers

Who it is made for

Two readings of each sheet

IReV publishes images and PDFs. It does not publish a finished results list. BallotGuard stores each original file once, by its SHA-256, and opens a new version when the file changes. Two readings extract the same fields. Where they agree, the tally uses the lower confidence. Where they disagree, or where confidence is low, the sheet waits for a person. Those sheets still count toward coverage. They do not count toward vote totals. An analyst can accept or reject the reading. An accepted reading is still an extracted figure.

A blank accreditation cell on the sheet is not treated as the accredited total. Accreditation figures that arrive with the portal file are kept with the source and are not copied into the accredited total.

Validation flags

A flag is a screening rule with the numbers it used. It is not a finding of fact, and confirming a flag does not make the figure official. The percentages below are the standard rule on the public desk. A signed-in person can keep that rule, or enter their own turnout percentage and dominant share. They can also set the dominant share for the ward comparison, and how far a unit must sit from the other units in the ward. The choice is saved on their account. It changes the flags, filters, alerts, and downloads they see. Everyone else still sees the standard rule. A flag that used their numbers is labelled Custom thresholds, with those percentages. It does not change the vote totals.

• Over-voting: ballots cast are above the accredited figure on the sheet.
• Totals that do not add up: the party lines differ from the valid-votes cell, or valid votes plus rejected ballots differ from total cast.
• Accredited voters above the registered figure on the sheet, or the registry when the sheet cell is blank.
• A missing stamp or a missing required signature.
• A late upload: the sheet was first archived long after election day.
• A replaced upload: a later version of the same sheet changed the figures. The earlier file is kept.
• High turnout and a dominant candidate, only when both are true: votes cast are at least 55% of registered voters, and one candidate has at least 75% of valid votes. Votes cast are valid plus rejected when both cells exist, otherwise the accredited figure. Either condition on its own does not raise this flag.
• A ward-peer turnout outlier and a dominant party, only when both are true: turnout is at least 2.5 standard deviations from the other units in the same ward, and one party has at least 75% of valid votes. Turnout here is total cast divided by registered voters. The explanation shows the ward average, how far this unit sits from it, and the share. Either half on its own stays quiet.
• Observer concern: at least one observer report on the polling unit was marked as a concern, or an older note matches a phrase such as violence, ballot snatching, vote buying, a changed result, or agents excluded. The flag is labelled as an unverified report. It does not remove the sheet from the tally.

BallotGuard also checks high rejected and cancelled rates, a handwritten correction that raises one party, a mutilation cue from the reading, identical and near-identical vote patterns, round numbers, a last-digit uniformity test that stays silent on small samples, a spike in ballots cast, a ward missing a large share of uploads, a cluster of higher-severity flags in one ward or local government, a polling-unit code on the sheet that differs from the registry, and whether the image looks edited. The last-digit test is not classical Benford. An image check is a weak signal, not evidence of forgery. The standard rule is 55 percent turnout, 75 percent of valid votes, and 2.5 standard deviations from the other units in the ward. A signed-in account can choose different percentages for its own view. The public desk stays on the standard rule.

How a number gets onto the desk.

Aggregation

Every total on the desk and in a download is calculated the same way. Agreed polling-unit records are grouped to ward, local government, state, and national level. Each level shows coverage, valid votes, rejected ballots, ballots cast, and party shares. You can open a state, a local government, a ward, or a polling unit, and search by code or name. Where coverage is partial, a projection scales the mean of the included sheets to the registry and says so. Missing uploads are not a random sample, and the interval is not an official projection.

Alerts

A signed-in account can watch a polling unit, a ward, a local government, a state, or the whole election, and can set a minimum severity. BallotGuard stores an in-app notice when a flag is raised or a sheet is replaced. Email and phone notifications are sent when those channels are on. A burst of flags becomes one digest. An account with no credits still receives a headline. Staff, and accounts with credits still inside their life, receive the flag text. An alert is not an official result.

Exports and evidence packages

A download of a scope is an Excel workbook, a ZIP of CSVs, a PDF summary, and a JSON file. The numbers in the file are the same numbers on the desk. The cost of locked sheets is shown against the balance before anything is spent. If the balance is short, the batch is refused and you can download sheets already unlocked. Each file has an export id and a SHA-256, and the banner states that the file is an independent compilation as of a timestamp.

A polling-unit evidence package is a separate ZIP: the archived image, the extraction, the flags, the version history, the address the sheet was taken from, the hashes, and the same banner. Observer names and contact details are left out of that package.

Observer reports

Verified observers file a note from the website or the Android app. The note can wait on the device until the connection returns, and it can carry a photo and a device location. The form asks whether the report raises a concern, and which kind: irregularity, violence, ballot snatching, vote buying, a changed result, agents excluded, or another concern. A concern flags that polling unit. Older notes that were saved before the choice existed are flagged only when the text matches one of those phrases. An observer who says the note does not raise a concern is not flagged by those phrases. BallotGuard stores the report apart from the tally and marks it unverified. The flag does not change an extracted total. Do not put someone else’s private contact details in the note.

Field copies, for comparison only

A field copy is a photo of the duplicate result sheet given to a party agent, or of the copy pasted at the polling unit. Party agents, observers, partner groups, and citizens can send one. BallotGuard stores the photo, the figures typed with it, the time, and the phone’s location. Each photo is labelled: Field copy - for comparison only, not official results.

These photos are never added to the vote totals. The totals still come only from the IReV sheet. Each photo gets a trust score from 0 to 100. A photo taken in the BallotGuard app on election day, from 2:00pm to 11:59pm, scores higher. A photo sent from the website is labelled not camera-verified and scores lower. A photo taken outside that part of election day is held back and does not count toward agreement. Where the polling unit has a matched location, a photo taken far from that place scores lower and raises Uploaded away from the polling unit, with the distance shown. A high-confidence match allows 500 metres, a medium match 1.5 kilometres, and a low match 3 kilometres. Staff can change those distances. The photo is not rejected for distance alone, and the vote totals do not change. The matched place is approximate. It comes from comparing the polling unit’s name and place description with OpenStreetMap, inside the ward where a ward boundary is on file. If there is no matched place and a ward boundary is on file, a photo taken outside that ward raises Uploaded outside the polling unit’s ward. That also lowers the trust score and does not reject the photo. If there is no matched place and no ward boundary, the location is not checked against a map and the score is lower.

One photo stays unconfirmed. It becomes a confirmed field copy only when at least two different rival parties send photos that agree, or when a checked observer or partner organisation and another independent photo agree. Photos that do not agree are flagged for review. The same photo used at more than one polling unit is flagged.

When a confirmed field copy does not match the IReV sheet, BallotGuard raises a high flag named Field copy differs from IReV. The sheet page shows the two images side by side and marks the figures that differ. An unconfirmed difference is labelled on its own, so it is not read as confirmed. If there is no IReV sheet and a confirmed field copy is on file, that is also flagged, and the field figures are shown as not official. A partner organisation can send many photos at once. Those photos are compared with IReV in the same way. The Android app takes the photo with the camera in the app. It does not accept a picture from the gallery.

How readable the photo is

Every IReV sheet is checked as soon as it is stored, and every field copy is checked when the photo is sent. The check asks whether the page can be read, whether it looks like a Form EC8A, whether the polling unit printed on it matches the unit it was filed under, and whether there is a hint of correction fluid, overwritten numbers, or a digital edit. A score from 0 to 100 says how readable the photo is. A blank page, a blurry page, another form such as EC8B, or a photo that is not a result sheet is flagged.

The flags are named Blank or empty sheet, Unreadable or blurry sheet, Not an EC8A form, Sheet from a different polling unit, and Possible alteration - needs human review. The alteration flag is a hint for a person to look. It is not proof that anyone changed the sheet. The sheet page shows a shaded picture of where that hint is. None of these checks change the vote totals. Staff can change how strict the checks are.

Official announcements, stored separately

A hand-entered announcement is kept separately, with the source description and the party totals that were typed in. The desk labels that block as a hand-entered announcement. Those figures are not added into the extracted totals.

Android app

The Android app is the same desk: sheets, flags, alerts, downloads, review, the credit balance, observer notes, and field copies. It can register the device for push alerts. An observer note can be saved offline, with a camera photo and the phone’s location, and sent when the network returns. The Android app from Google Play does not sell credits. Sign in with an account that already has them. Sheets already unlocked stay open.

Credit packs

The Citizen pack is ₦5,000 for 100 credits. Those credits last 12 months, the same as the other packs, and the pack is listed first. There is no free credit pack. National coverage and headline totals stay public. State and local-government breakdowns, polling-unit sheets, flags, filters, alerts, and downloads require prepaid credits. One credit unlocks one polling-unit result sheet for one election: the scores, the flags, the image, and inclusion in a download. Opening a sheet this account has already unlocked is free, including after the credits expire. Seats on an organisation pack share one wallet. Prices, VAT, and the credit life are on the pricing page. Buying credits does not make a compilation official.

Credit packs and prices.