Vote Tracking Infrastructure: Complete Technical Analysis

The Source Code, Database Schema, API Endpoints, and Infrastructure Behind Venezuela's Voter Surveillance System

The Source Code Discovery

On an exposed Git repository at gitlab.mtt.gob.ve/cmorales/SIGESP-MPPT.git, accessed over plain HTTP without authentication, was the complete Chamba Juvenil source code. 23,228 files. Complete application stack. Every module documented.

The vote tracking system occupied a discrete folder with its own controller, model, view layer, and JavaScript frontend. It was not legacy code. It was not deprecated. It was a fully maintained, actively used component of the registration system.

---

The Vote Registration Module Architecture

Controller: Registro_voto.php (430 lines)

The main controller handles vote data submission:

POST /post_registro_votos

This endpoint accepts:

• Name and cedula

• Organizational structure assignment (codes 2, 3, 17, 18, 19, 20)

• State, municipality, parish, voting center

• Binary vote response (yes/no)

• Latitude and longitude coordinates

• Phone number

The controller routes submissions to different database tables based on structure code:

if (structure_code in [gov_employee_codes]) {
  INSERT INTO tbl_servidores_publico
} elseif (structure_code in [organization_member_codes]) {
  INSERT INTO tbl_estructura_preorizado
} else {
  INSERT INTO tbl_registro_del_voto
}

The Statistics Function

The estadistica_votos() method is where the manipulation happens:

$raw_count = count_all_votes();
$reported_count = $raw_count + 273 + 800;
return ["resultado" => $reported_count];

1,073 phantom votes are added to every statistics report. This is hardcoded. This is by design. The reporting dashboard displays inflated participation numbers.

Database Schema

Three dedicated tables for vote tracking:

tbl_registro_del_voto — General population vote records

• id (primary key)

• cedula (citizen national ID)

• nombre (full name)

• telefono (phone)

• estado (state code)

• municipio (municipality code)

• parroquia (parish code)

• centro_votacion (voting center ID)

• voto_si_no (binary: voted or not)

• latitud (GPS latitude)

• longitud (GPS longitude)

• estructura_asignacion (organizational code)

• fecha_creacion (timestamp)

tbl_servidores_publico — Government employee vote tracking (identical structure)

tbl_estructura_preorizado — Party/organizational structure member tracking (identical structure)

Admin Interface

The voting registration form exists at /admin/registro_voto.php. It is not hidden. It has an interactive map powered by Leaflet.js for GPS coordinate capture. An admin can:

1. Search for a citizen by name or cedula

2. Select their voting center from a dropdown

3. Click on a map to capture GPS coordinates

4. Check a box for “Did they vote? Yes/No”

5. Submit

The data writes directly to the database with no validation beyond basic type checking.

---

The Three-Domain Deployment

Domain 1: Chamba Juvenil

registro.chambajuvenil.gob.ve — Youth employment job application system. 23,228 files in .git dump. Vote tracking module fully functional. Database credentials exposed in .env file.

Domain 2: Juventud Socialista

registro.juventudsocialista.org.ve — PSUV Socialist Youth organization portal. Identical code. Identical database structure. Identical vote tracking form.

Domain 3: Comunas Juveniles

comunajoven.com.ve — Communal governance organization portal. Same vote tracking infrastructure. Same forms. Same API.

Git config files show the same deployment scripts used across all three domains. The same developer (Carlos Morales, cmorales@mtt.gob.ve) committed to repositories hosting all three.

---

The Gas Distribution API Connection

Guarico State’s Gas Distribution API exposes a GraphQL endpoint with full schema introspection at:

api-distribucion-gas.guarico.gob.ve/graphql

The schema includes two critical queries:

voterByCedulaRif(cedulaRif: String!): Voter
customerByCedulaRif(cedulaRif: String!): Customer

The Voter object returns:

• cedulaRif (national ID)

• firstName, lastName

• municipalityId, parishId

• createdAt (registration timestamp)

The Customer object returns:

• cedulaRif (national ID)

• gasSubsidyStatus

• paymentHistory

• distributionCenter

Same cedula number. One query returns voting status. One query returns subsidy status. The API is architecturally designed to cross-reference them.

---

Exposed Credentials and Configuration

.env Files

Chamba Juvenil stored database credentials in plaintext .env files:

DB_CONNECTION=pgsql
DB_HOST=localhost
DB_PORT=5432
DB_DATABASE=db_chamba_produccion
DB_USERNAME=postgres
DB_PASSWORD=OUUO5bHoG4Q255Js8gevu87fM/CoBf8JhAc/Wa6raI0=

Secondary databases documented:

db_pcj_2017_17052019

SFTP Configuration

Visual Studio Code SFTP config exposed:

Server: 190.202.144.60
Port: 1022
Username: chamba
Password: 1s0p0rt3++
Remote Path: /var/www/html/registrochamba/chambajuvenilc/

Direct server access credentials for the production web application directory.

Telegram Bot Tokens

Two active Telegram bot tokens found in source code:

Bot ID: 8534453577
Token: AAHrCe_QOQRLK_nToS0pb4f5Y4ba5zBSJBQ
Chat ID: 6021886971

Bot ID: 7265564977
Token: AAHJcYuxTQX7coz-qatLEd9j5Ai1RLDv_fY
Chat IDs: 830259515, 6021886971

Both hardcoded in PHP controllers and JavaScript. Connected to the same chat group. Used for system notifications.

RSA Private Key

A full PKCS#8 RSA 2048-bit private key stored in the repository. This key can decrypt traffic, forge certificates, and impersonate services.

---

The Infrastructure Map

From Git configs and .env files, the internal network topology emerges:

Payroll Database Servers (internal IPs):

• 172.31.8.44 — Primary PostgreSQL (3 databases: 2017, 2016, induction payroll)

• 172.31.8.93 — Budget/procurement PostgreSQL

Authentication:

• 172.31.8.51 — LDAP authentication server (dc=mtt,dc=gob,dc=ve)

Services:

• proxy.mtt.gob.ve — Zimbra email proxy

• gitlab.mtt.gob.ve — Internal GitLab (where code was hosted)

• poi-r.vps.co.ve (ports 3000/3001) — API server for Ministry of Urban Agriculture

This is a partial map of the Venezuelan government’s internal network, extracted from a single exposed Git repository.

---

The Code Quality Assessment

SQL Injection: Universal

Every database interaction uses direct string concatenation:

$query = "SELECT * FROM tbl_registro_del_voto WHERE cedula = '" . $cedula . "'";
$result = $db->query($query);

The only protection is addslashes(), a function known to be bypassable since the mid-2000s. Every search box, every filter, every input field in the Chamba Juvenil system is a potential SQL injection point.

Debug Mode Enabled in Production

Every .env file contains:

APP_DEBUG=true

This means any error displays a full stack trace to the browser: file paths, function calls, variable contents, database query details.

Default Credentials Never Changed

Multiple .env files expose passwords that are framework defaults, never modified:

MySQL root: password
Yii2 user: secret

No Web Server Hardening

Not a single government server was configured to block access to sensitive files. No .htaccess rules. No nginx configuration to deny .env, .git/config, or docker-compose.yml.

Three lines of web server configuration would have prevented every finding in this report.

---

Timeline and Deployment

Git commit metadata shows:

• Initial commit: 2016

• Last update: 2019

• Developer: Carlos Morales (cmorales@mtt.gob.ve)

• Organization: Ministry of Transportation and Communications

• Repository: Hosted on internal GitLab at gitlab.mtt.gob.ve

The code was maintained across multiple Venezuelan administrations and election cycles. It was not abandoned. It was operational.

---

Replication Pattern

The vote tracking code is identical across all three domains:

• Same controller file name and structure

• Same database table schema

• Same form interface

• Same admin panel layouts

• Same statistics inflation logic

This is not independent development. This is deliberate replication of the same surveillance infrastructure across multiple government systems.

---

What the Evidence Shows

This is not hypothesis. This is not inference. This is:

• Source code you can read

• Database schemas you can analyze

• API endpoints you can query

• Configuration files you can decrypt

• Git history you can examine

• Network addresses you can map

The vote tracking system exists. It was built. It was deployed. It was connected to benefit distribution systems. It automatically inflated statistics. It was replicated across multiple government services.

The only question that remains unanswered is: how many votes were influenced by citizens knowing their voting behavior was being tracked and linked to their access to government services?

---

I investigate and expose the infrastructure of tyranny. Every article is another piece of evidence that freedom-loving people can use to understand, resist, and ultimately defeat authoritarian control.

---

Crystal Vault Investigation — Part X-B — 2026

All data sourced from publicly accessible files without authentication bypass or system compromise. Source code, Git configurations, database schemas, and API responses documented as discovered. All URLs and credentials verified to be publicly accessible at time of investigation.