How can Electronic Voting Machines (EVM) be manipulated ?
- Part 1 -

Dr. Khomdon Singh Lisam *

Electronic Voting Machines (EVM) :: Pix - TSE

Voting is a fundamental right - The heart of democracy is voting . The heart of voting is TRUST that each vote is recorded and counted with accuracy and impartiality . The purpose of an election is not to name the winner, but it is to convince the losers that they lost. - (Dr. Dan Wallach, Computer security expert, Rice University ).

Voting is a statutory right under the Representation of People Act 1950 and fundamental rights in India under Article 19(1)(a) to know the antecedent of the candidates contesting for the election. A voter has the right to know whether his / her vote has been recorded and counted . Can a voter in India today know whether his /her vote has been recorded or counted . with accuracy and impartiality If so , where is the proof and where is the accountability ? Does EVMs answer these questions ?

What is EVM ?

India's Electronic Voting Machines (EVMs) have two main components (1) CONTROL UNIT, used by poll workers, which stores and accumulates votes, and (2) a BALLOT UNIT, located in the election booth, which is used by voters. These units are connected by a 5 m cable, which has one end permanently fixed to the ballot unit. The system is powered by a battery pack inside the control unit. The ballot unit has 16 candidate buttons. If any are unused, they are covered with a plastic masking tab inside the unit.

When there are more than 16 candidates, an additional ballot unit can be connected to a port on the underside of the first ballot unit. Up to four ballot units can be chained together in this way, for a maximum of 64 candidates. A four-position slide switch in the ballot unit selects its position in the chain. The Bharat Electronics Limited (BEL) and Electronics Corporation of India (ECIL) are the manufacturers of EVMs in India and the foreign companies in US and Japan supplying microcontrollers,

When EVMs were first used ?

The electronic voting machines (EVMs) used in Indian elections are internationally known as Direct Recording Electronic (DRE) voting machines which record votes directly in electronic memory . Electronic voting machines were first introduced in India in 1982 in assembly elections on a limited basis. One such constituency where they were used was the Parur Assembly constituency in the state of Kerala. In 50 of the 84 polling stations, electronic voting machines were used.

EVMs have been in universal use in India since the general elections of 2004, when paper ballots were phased out completely. They have been deployed in all assembly polls and the general elections in 2009. Advantages of EVM Electronic Voting Machines (EVMs) have revolutionised the Indian election process. The advantages of electronic voting machines is simplicity of the procedure, the ease of tabulation of ballots into results and the faster and more accurate results .

It's easy to see the utility of the machine- it eliminates invalid votes, ends booth capturing, and makes counting easier and faster. "It is tamper-proof, error-free and easy to operate, " says the EC\'s manual for returning officers states. Is it legal to use EVM in India ? In 1984, the Supreme Court of India held that the use of electronic voting machines in elections was "illegal" as the Representation of People (RP) Act, 1951 did not permit use of voting machines in elections.

Later, the R.P. Act was amended in 1989 incorporating Section 61A. However, the amendment says voting machines "may be adopted in such constituency or constituencies as the Election Commission may, having regard to the circumstances of each case, specify." Violating the provisions of the R.P Act, the Election Commission has conducted 2004 and 2009 nationwide general elections only using electronic voting machines. Many legal experts say that going by the 1984 judgment of the Supreme Court, parliamentary elections of 2004 and 2009 may be held illegal. (GVL Narasimha Rao http://www.indianevm.com/articles/ten-reasons-for-banning-indian-evms.pdf). ( http://www.indianevm.com/blogs/?cat=3).

It will be interesting to know whether ECI specifically issue notification for use of EVM in the general election of Manipur-2012. What happens when we caste our votes ? The general process of electronic voting on the most common EVMs models goes something like this:

1. The voter checks in with the voter's ID with poll workers . The polling personnel and the agents verify the name and identify the voter . They obtained signature or thumb print of the voter . To prevent double voting, they mark the voter's right index finger with indelible ink

2. Next, a poll worker presses the BALLOT button on the control unit to allow one vote. This causes a green READY light to glow on the ballot unit.

3. The voter enters the polling booth and presses the button for the candidate of his or her choice. A red light next to the candidate button glows, the ready light turns off, and the control unit emits a loud beep to indicate that the vote has been cast. The red light then turns off automatically. This process repeats for each voter.

4. At the end of the poll, the presiding officer removes a plastic cap on the control unit and presses the CLOSE button, which prevents the EVM from accepting further votes. The ballot unit is disconnected and the control unit is placed in storage until the public count, which may occur weeks later.

5. On the counting day, the control units are delivered to a counting centre. In public view, an election official breaks a seal on the control unit and presses the RESULT button . The display on the control unit shows a sequence of outputs: the number of candidates, the total votes, and the number of votes received by each candidate.

6. The Counting officials manually record the totals from each machine and add them together to determine the results of the election. The machines are then placed in storage until the next election.

Disadvantages of EVM :

Some disadvantages of electronic voting can include viruses and hacking, as well physical tampering. Despite elaborate safeguards, India's EVMs are vulnerable to serious attacks.

1. EVM Software Isn't Safe The electronic voting machines are safe and secure only if the source code used in the EVMs is genuine. Shockingly, the EVM manufacturers, the BEL and ECIL have shared the 'top secret' EVM software program with two foreign companies, Microchip (USA) and Renesas (Japan) to copy it onto microcontrollers used in EVMs. This process could have been done securely in-house by the Indian manufacturers. Worse, when the foreign companies deliver microcontrollers fused with software code to the EVM manufacturers, the EVM manufacturers cannot "read back" their contents as they are either OTP-ROM or masked chips. Amusingly, the software given to foreign companies is not even made available with the Election Commission, ostensibly for security reasons. With such ridiculous decisions, the Election Commission and the public sector manufacturers have rendered security of the EVMs a mockery. (GVL Narasimha Rao-http://www.indianevm.com/articles/ten-reasons-for-banning-indian-evms.pdf)

2. EVM hardware Isn't Safe The danger for EVM manipulations is not just from its software. Even the hardware isn't safe. Dr. Alex Halderman, professor of computer science in the University of Michigan says, "EVMs used in the West require software attacks as they are sophisticated voting machines and their hardware cannot be replaced cheaply. In contrast, the Indian EVMs can easily be replaced either in part or as wholesale units." One crucial part that can be faked is microcontrollers used in the EVMs in which the software is copied. EVM manufacturers have greatly facilitated fraud by using generic microcontrollers rather than more secure ASIC or FPGA microcontrollers.

Not just only microcontrollers, mother boards (cards which contain microcontrollers) and entire EVMs can be replaced. Neither the Election Commission nor the manufacturers have undertaken any hardware or software audit till date. As a result, such manipulation attempts would go undetected. To detect such fraud, the upgraded EVMs have a provision to interface with an Authentication Unit that would allow the manufacturers to verify whether the EVM being used in the election is the same that they have supplied to the Election Commission. The EVM manufacturers developed an "Authentication Unit" engaging the services of SecureSpin, a Bangalore based software services firm. The Unit was developed and tested in 2006 but when the project was ready for implementation, the project was mysteriously shelved at the instance of the Election Commission. Several questions posed to the Election Commission for taking this decision went unanswered. (GVL Narasimha Rao-http://www.indianevm.com/articles/ten-reasons-for-banning-indian-evms.pdf)

3. Vulnerability to hacking: The Indian EVMs can be hacked both before and after elections to alter election results. Apart from manipulating the EVM software and replacing many hardware parts discussed above, Indian EVMs can be hacked in many ways. To possibilities may be mentioned :- Each EVM contains two EEPROMs inside the Control Unit in which the voting data is stored. They are completely unsecured and the data inside EEPROMs can be manipulated from an external source. It is very easy to read (data from) the EEPROMs and manipulate them (GVL Narasimha Rao-http://www.indianevm.com/articles/ten-reasons-for-banning-indian-evms.pdf)

The second and the most deadly way to hack Indian EVMs is by inserting a chip with Trojan inside the display section of the Control unit. This requires access to the EVM for just two minutes and these replacement units can be made for a few hundred rupees. Bypassing completely all inbuilt securities, this chip would manipulate the results and give out "fixed" results on the EVM screen. The Election Commission is completely oblivious to such possibilities. ( http://www.indianevm.com/articles/ten-reasons-for-banning-indian-evms.pdf)

Contrary to claims by Indian election authorities, these paperless EVMs suffer from significant vulnerabilities. Even brief access to the machines could allow dishonest election "Insiders " or other criminals to alter election results. There are allegations that some "insiders" demanding vast sums (Rs. 5 Crore or more for each assembly constituency) to fix election results.

Who are these insiders?

Unlike in the traditional ballot system where only the election officials were the "insiders", electronic voting machine regime has spawned a long chain of insiders, all of whom are outside the ambit and control of the Election Commission of India. There is every possibility that some of these "insiders" are involved in murky activities in fixing elections. The whole world- except us in India--is alive to the dangers of insider fraud in elections. The "insiders" include the public sector manufacturers of India's electronic voting machines namely, the Bharat Electronics Limited (BEL) and Electronics Corporation of India (ECIL), the foreign companies supplying microcontrollers, private players (some of which are allegedly owned by some political leaders) for carrying out checking and maintenance of electronic voting machines during elections. (http://www.indianevm.com/articles/ten-reasons-for-banning-indian-evms.pdf)

A team of researchers showed precisely how a display component could be replaced with a fake substitute programmed to steal a percentage of the votes in favour of a chosen candidate. They also demonstrated how stored votes could be changed between the election and the public counting session, which in India, can be weeks later, with a pocket-sized device. The team, comprising Hyderabad-based NetIndia, Dr J Alex Halderman, professor & noted expert on electronic voting security from the University of Michigan and Holland-based security expert Rop Gonggrijp, was instrumental in the ban on EVMs in the Netherlands.

To be continued...