EVM System usage in 2024 General Elections - minimum demands necessary to place before SCI and ECI

IN A DEMOCRACY PEOPLE GET THE GOVERNMENT THEY DESERVE - BUT WHAT IF THE ELECTION PROCESS IS COMPROMISED?

Anything can be made more complex than it really is. However, the looming threat due to the existing EVM System usage process, coupled with the attitude of ECI and SCI, is so serious and complex that political party leaders, technical experts, lawyers and activists must collaborate. Without collaboration and a unified approach, it will be tough to mount a credible campaign to counter the threat to "purity of the election process".

This note has references to old notes and one new note on an online solution - all links (in orange colour) provided below. Just so that we are clear of the terminology, copied below is the existing EVM usage (graphics copied from ECI website - however, red colour annotations are added):

IT IS IMPORTANT TO NOTE THAT WITHIN 15 DAYS BEFORE POLLING COMMENCES, SLU IS CONNECTED TO LAP TOP FOR DOWN LOADING THE CANDIDATES + SYMBOLS DATA FROM THE CENTRAL SERVER  AND THEN IT IS INSERTED INTO VVPAT FOR UPLOADING THE SAME - IT IS AT THIS MOMENT, A ROGUE PROGRAM CAN INFILTRATE THE VVPAT AND EVM SYSTEM COMPROMISED. HACKER NEEDS TO SUBVERT ONLY FEW FIELD STAFF IN THOSE BOOTHS WHICH MATTER MOST TO HACKER'S MASTER. AS THERE ARE OVER A MILLION EVMS TO BE COMMISSIONED, WITHIN 15 DAYS, THERE HAS GOT TO BE AN ARMY OF FIELD STAFF HIRED BY ECIL AND BEL. TO SAY THE LEAST, THIS SHOULD BE A SECURITY NIGHTMARE FOR ANY SYSTEM DESIGNER. WHY HAS ECI NOT DISCUSSED THE RISKS IN THIS SORT OF OPERATION IS A QUESTION BEGGING TO BE ASKED. It is also ironical that none of the well-known IT tycoons of India has spoken out about the obsolete design of the "EVM System" and its hackability, instead ECI is flogging the assessments of IIT Professors (on Government's payroll) about the "non-hackability" of the "EVM" (do they even know the difference between the "EVM" and "EVM System", one ought to ask). Just as the rewards or stakes of hacking India's elections bear no comparison with ordinary hacking of an organisation's or an individual's account, expectedly the calibre and organisational wherewithal of the two sets of hacker groups are non-comparable. [Read in the RELALTED links below, the story of Stuxnet virus and ECI presentations and FAQ anomalies and lies] 

In the existing process, this is what happens (or can happen):

1. An elector (voter) walks into the Polling Station (PS) with an ID proof. S/he walks up to the row of Polling Agents of Political parties and they tick off the name after verifying his/her name on the voters list. If name is not found, the voter is not allowed to vote; s/he is asked to exit the booth.
2. Indelible ink is smeared on one finger of the eligible voter.
3. The voter walks up to the Voting Compartment and waits to press a button on the BU to register his/her vote. The BU has the names of contestants and election symbols adjacent to buttons. Max 16 names per BU - they can be daisy-chained.
4. The Polling Officer with the CU presses a key to enable the BU to register a vote.
5. The voter pushes a button to register his/her vote after hearing the audio beep that tells everyone that BU is enabled to accept one vote.
6. VVPAT lights up for 7 seconds during which the voter can see the voting slip with the name of the candidate and symbol. Voter must assume that this slip is not of the previous voter - though there is no telling it could well be of the previous voter - a hacked VVPAT could behave in this manner. If the visible slip is NOT as per the vote cast then the Voter can complain and fill out a a form to nullify the "wrong vote". There is an intimidating process to rectify the error - which includes actions to "prove" that the machines are misbehaving! VVPAT is supposed to write a record of the vote in the CU; a hacked VVPAT could well write a vote in favour of a candidate of hacker's choice.
7. The voter having cast his/her vote walks out trusting the the vote is recorded correctly in the CU and that the slip s/he saw in the VVPAT has been indeed dispensed in ballot box. It could well be that the the slip has NOT been dispensed in the ballot box nor recorded in the CU. A hacked VVPAT could behave like this - hold all consecutive votes of an adversary party (adversary of the hacker's party) until a vote is cast of a different party - upon that happening, the hacked VVPAT could print and dispense all the votes it had held back, in favour of the hacker's party candidate and also record the votes in the CU consistent with the printed slips!      

 

This note is prepared with the intention to sensitise few more influencers and politicians who can mobilise public opinion against the continuance of the EVM usage in the present form. Regarding the pitch to be made before the ECI/SCI - what exactly should be the demand that is feasible to implement within weeks - to mitigate the risks of hijacking of the 2024 General Elections? We all believe that the outcome of upcoming General Election will be pivotal for the future (secular and democratic) character of the country.

1. CJI recently said, "The great stabilizing force in the country is the purity of the election process". Ironically, the existing EVM usage process is DEMONSTRABLY HACKABLE - what makes it doubly fraught is that existing rules PREVENT AUDITABILITY and ECI is not prepared to engage with the citizens who have sought a meeting. To repeat - the present processes and rules allow a certain type of hacking to be done and the hack is not provable - this is a mockery of democracy and we should jettison such a set of processes and rules. As ECI is clearly aligned with the Government, it is only the SCI that can provide a solution. If SCI does not grant the following demands, the opposition ought to boycott all elections.
   
   

1.1 DEMAND#1 THE VOTER SHOULD BE ABLE TO PICK UP THE SLIP TO VERFIY ITS CORRECTNESS AND THEN PHYSICALLY INSERT IT INTO THE BALLOT BOX.   Or else the voter should be assured that the vote slip coming out of VVPAT, after the vote is cast (by pressing the button on the BU), has the right candidate name and symbol AND it is dispensed into the ballot box. At present the slip is illuminated for 7 seconds behind a one way mirror in the VVPAT and the voter CANNOT EASILY recognise the candidate name or the symbol AND FURTHERMORE, THE VOTER CANNOT FIND OUT IF THE SLIP IS ACTUALLY DISPENSED INTO THE BALLOT BOX. THEREFORE, THE VVPAT SHOULD BE RECONFIGURED (OPENED UP) FOR ENABLING EASY RECOGNITION OF CANDIDATE'S NAME & SYMBOL ON THE SLIP AND ITS DISPENSATION INTO THE BALLOT BOX.

1.2 DEMAND#2 The results should not be based on the count read off from the memory of the Control Unit (CU) rather it should be based on a MANUAL COUNT of 100% SLIPS or RECOUNT IN CASE OF DISCREPANCY BETWEEN THE MANUAL COUNT AND THE CU COUNT. To further reduce the chances of errors of the manual count, TWO RECOUNTS MAY BE ORDERED, IF NECESSARY. 

1.3 DEMAND#3 After the Polling finishes, the CU and the Ballot Box pairs are supposed to be transported to the counting station and en route they have to be stored for many hours or even days. ECI has prescribed an elaborate and secure process for transportation and storage but it precludes presence or oversight of contestants' representatives. Fraud can be committed by replacing the sets of the pair of CU and Ballot Box. To mitigate risks - i) CU and Ballot Box pairs should NOT be transported and stored together and ii) Oversight of contestants' representatives should be allowed.

1.4 DEMAND#4 Presently a voter who complains to the Presiding Officer in the Polling Booth that his/her vote is not properly generated, i.e. the VVPAT has printed the wrong vote - is required to prove the allegation is correct through a retest - if the error is repeated well and good but if it is not repeatable, the voter can face a fine of up to Rs.1,000 and imprisonment of up to 6 months or both. It is a matter of common knowledge that hacked programs can be made to misbehave erratically or based on parameters such that without the knowledge of source code, no one can predict if the error will repeat or when it will repeat. The punishment under rule 49MA - Section 177, should be totally removed as it is illogical, and it works as a deterrent for genuine voter complaints - unelsss source code is made public and its auditability allowed before and during elections.  

2. Anything more than above demands may not be feasible to implement in the short time available before the elections. Anything less will not eliminate the threat of the election results getting hijacked. By getting bar coded slips, the counting process can be hastened by few hours. However, again the hacked VVPAT  could print a bar code different from the correct candidate id / symbol printed on the slip. So further sample audit will be needed and this is avoidable complexity. It is also doubtful if 1 million+ bar code printers can be procured and fitted up in VVPAT in the available time. The demand of junking EVMs and switching over to paper ballot is neither feasible in the short time available nor necessary. There are many advantages of continuting to use the existing infrastructure and processes in which millions of people are trained. The demands listed here are entirely feasible to make and will ensure a FAIR and SAFE process.

3. Manual count in 100% of polling stations may add one or two days which is trivial considering the elections are conducted for a period longer than a month. The 2019 General Elections were scheduled from 11-Apr-2019 to 19-May-2019. ECI website shows that over one million polling stations were setup. Each BU can accommodate only 16 names, with greater number of contestants more BUs would be required. Each CU has a capacity to record max of 2K votes.

4. In summary, the demand for software auditability will encompass disclosure of software and its revisions, setting up auditors panel, process of audit challenge by contestants and its resolution - for all of these both SCI ruling and ECI cooperation will be required which may be difficult to obtain. ECI will likely not cooperate with this demand as it is perfectly aligned with GOI. Therefore, absent the software auditability, there is no alternative to the demands formulated above. At least the first two must be acquiesced to - if any one is granted it is not sufficient. Remember the VVPAT hack can be of two types -
   
   
   4.1 the vote slip dispensed and and the vote recorded in CU are consistent but NOT according to the actual vote cast (hence demand#1 is made)
   
   
   4.2 the vote slip dispensed is consistent with the actual vote cast but the vote recorded in CU is NOT (hence demand#2 is made)
   
   
   4.3 The possibility of a fraud of replacing the CU and Ballot Box pairs is non-trivial because a RTI based PIL had revealed that whereabouts of 1.9 Million EVM Systems are not known to ECI.

4.4 The punishment should be totally removed as it is based on an illogical prmise of predictability of hacked programs and it deters gneuine complaints of voters. If source code is made public, independent auditors can confirm if VVPAT  BU and CU are working as per original program; this will allow citizens to prove hacking else it is NOT provable. Therefore, no fines or punishment should be inflicted on a complainant without the option of auditability of the source code.

  

To dig deeper, refer to other notes for which links are copied below.  

RELATED REFERENCES:

Read the "Stuxnet" virus story - how Iran Nuclear fuel processing centrifuges were knocked out by CIA even though Iran's engineers had claimed the plant had "stand alone" systems - just like ECI is claiming their devices are in a "stand alone" state - they allow connecting a SLU before commissioning the system - this is sufficient to infiltrate a rogue program into VVPAT. The hacking can be done selectively - in certain systems only - as all the machines have unique IDs. The rogue program can behave according to a date - time - number of votes cast - schedule - thus defeating the FLC which ECI pompously claims is sufficient proof of proper functioning of the EVM system. They are fooling the public or they are ignorant.

EVM System - updated website - new revelations and questions (ECI has updated its website pages; new FAQ on 7-Feb-24, Presentation too is changed; probably in response to recent protests and demos of hacking; it has now changed the definition of EVM - earlier it used to mean BU and CU but now it includes VVPAT; so, EVM now cannot be claimed to be OTP device as VVPAT has programmable memory; furthermore EVM System, is more than EVM but ECI is silent on it). 

ECI presentation on EVMs - false claims and misrepresentations discussed in this note

Are EVM System components OTP type devices? No clear answer from ECI/GOI

The hardware in EVM System of today can be easily replaced by Smartphones running a secure App - within weeks

Kannan Gopinath's interview on EVM system hackability

Read about the two hack demos. Recently hacks of EVM System were demonstrated and videos shown on 4pm News Network. In these hacks the VVPAT votes differently from the actual votes cast - the slips printed and vote recorded in the CU were consistent. Therefore, the manual count of slips and the count from the CU would match. This type of fraud can only be prevented if Demand#1 is met, else it would require software audit but that is not possible as ECI and SCI have said that software is secret. SCI on the one hand ecourages Open Source - but on the other hand, in this particular instance, it protects the IPR of a ridiculously simple program - GOI can easily get the same software developed in Open Source or buy the IPR for cost which is not likely to exceed few million rupees! Another intriguing thing to read about is that 1.9 Million EVM Systems have gone missing - The Wire article of 22-May-19 linked.

Challenges to EVM and reaction of authorities

EVM Opposition - by senior leaders - call for reforms - urgency ignored by ECI and SCI - 2024 General Elections become fraught

EVM voting & ECI processes - program, data and counting - current vulnerabilities, remedies and action required by INDIA

 

Synopsis: It is said in a Democracy people get the Government they deserve; but what if the Election System - the machines or the processes - are deficient? Then the Government ought to fix it or else the people should agitate to fix the deficiencies. Recent disclosures - as documented by independent journalists and pointed out by activists - show the Electronic Voting Machines (EVM), voting and counting processes in use in India can be manipulated (are hackable). Denying audit challenges is not consistent with democratic norms nor the Constitution of India. The Government, Election Commission of India (ECI) and Courts should accept the citizens' right to know and even provide the means to the contestants to make feasible verifications and allow them to mount audit challenges. The authorities should publish a fair process to allow and resolve contestants' audit challenges. What can be the means and processes for enabling audit challenge which will deter frauds that thwart our democracy?   

In the context of Electronic Voting Machines (EVM), how democracy is subverted, or can be subverted, is a question much debated. Concerned citizens have been agitating in India and have met with only limited success - especially now, since all pillars of the Indian democracy seem to be failing in unison.

Election Commission of India (ECI) is a constitutional body supposedly independent of the GOI. However, in reality, a whole lot of processes related with the use of Electronic Voting Machines reveal that GOI is in charge where ECI ought to be in charge. Under the bogey of secrecy for reasons of national security or abdication of judiciary to rule in its domain by calling it the domain of the executive, the democratic processes have been imperiled and even subverted.

People who have little understanding of Information Technology and Digital Security are in charge of designing policies and processes and even SCI has ruled in a way to curtail citizens rights to access programs that ought to be "open source" under the garb of "sensitive", "Intellectual Property" and "Executive Domain". After observing strange coincidences (statistical improbabilities), unexpected electoral results (outside the forecast of all pollsters) and documented anomalies (see articles below in RELATED section), this note references the on-going agitations for fair elections and prescribes what ought to be additional and very important concerns of Indian citizens and actions required for deterring electoral frauds in the future.

PETITION FILED TO ECI to conduct FREE AND FAIR ELECTIONS - Citizens campaign, started a few months ago, by concerned citizens - Petition started on 24-Aug-23 by Prof. MG Devasahayam

ADR's recommendations for Electoral Reforms, Political Reforms and Rules for ECI: PDF file from ADRINDIA.org

The above petition and recommendations miss out some of the important issues arising from the points raised in the article of 10-Nov-23 in The Wire by Meetu Jain.

Most importantly, there are three points of hacking that need to be safeguarded against for preventing subversion of the voting and counting process -

i) EVM program hack,

ii) EVM results hack and

iii) results counting by ECI hack.

>>INDIA parties should ask for the following five things in the petitions to ECI and SCI; these steps for transparency are meant to deter voting frauds without forcing withdrawal of EVM or change in any methodology ECI follows in their deployment:

1) Source code of EVM must be shared with public - (this will have to go into a review petition as SCI has already ruled against revealing the source code even to ECI for audit),

2) "Audit Challenge" to discover fraud through any EVM must be resolved through a published process that should include comparing source code of suspect EVM with master copy - can be done by Political Parties/independent auditor,

3) At the Start of voting and after close of voting, the program AND results from each EVM should be allowed to be saved in an external storage by each contestant party for fulfilling the option of an "audit challenge" - each record in the votes cast data file will contain EVM ID, date time stamp, ID of candidate voted for; voter id is not available (so secret ballot is honoured - no one can find out who voted for whom); if there is an "audit challenge" then ECI's database from which results were announced will have to be compared with records saved in external devices submitted by the challenger political party/parties; If ECI aggregates the results filed (entered online manually) by the ECI's Returning Officer (RO) at each constituency, then the audit challenge will involve comparison of the EVM wise Candidate wise counts filed by the RO i.e. the figures from each of the EVMs the RO took into account (see the ECI's counting process note here: link). It should be noted that the data copied from memory stick has only the candidate ID and NOT the name of the candidate; as ECI does not want the results to be known until all voting is completed, in multi-phase and bunched multi-State elections, the password to the list of Candidate ID + Names will be released by the ECI when it wants - i.e. after voting is over; the encrypted list of Candidate names & their IDs will be downloadable from ECI portal by authorized Party representatives and Independent candidates right at start of elections.

4) ECI must have control over randomized distribution of EVMs at State and Constituency levels,

 

5) Sample checking at random of 5% to 30% should always be done of results counted through EVMs and manually of VVPATs.

[For meeting the requirements in point# 2 (detection of program hack) & 3 (detection of "data of EVM results" AND "results transmission & counting by ECI" hacks) EVM could provide a removable memory stick (flash memory card) which can easily hold the copy of the program AND results stored in the internal memory of EVM. Memory sticks have capacities ranging from 1 GB to 1 TB and more. EVM will have to be provided two buttons - "Start" and "End" - when these buttons are pressed, BOTH - the program and results data will be copied into the memory stick - further, only after the Start button is pressed, voting can commence and after the End button is pressed, voting will cease - i.e. the EVM will not be usable for any further voting until it is initialised for next round of election through the existing ECI processes. Using the removable memory stick, the ECI's booth officer and contestants' representatives will be allowed to copy the program + data into their own phones or computers - twice - at the time of Start event and also at the End event]

If these requests (#1 to #4) are denied, all Opposition parties should resist the use of EVMs henceforth and INDIA parties could use Point#5 - for negotiating 100% of VVPAT counting AND for the printed slip to be physically picked up by the voter and for the voter to push it into the box of votes for counting - ONLY the physical count would be treated as the final result - not the EVM memory results (in case they differ). See the hack video in the Notes below on Challenges to EVM and reaction of authorities (presently 5% VVPAT vs EVM counting comparison per constituency has been allowed - this is pointless in view of the hack of EVM + VVPAT actually demonstrated).

Reference: EVMs and VVPATs - purpose and ruling by SCI

10-Nov-23 The Wire Article by Meetu Jain - What we know and don't know about EVMs Link

Most disconcerting facts and revelations uncovered by the staff of The Wire and reported in the article (verbatim extracts):

(1) In September, the Supreme Court refused to entertain a public interest litigation that asked for an audit of the source code of the Election Commission’s electronic voting machines (EVMs) by an independent agency. While dismissing the case, the court said “there is no material on record to indicate the Election Commission is not fulfilling its mandate.” 

(2) The TEC in fact recommended again and again that the veil of secrecy surrounding source codes should be lifted. In 2013, the TEC said that a facility be provided so the “code in the EVM units can be read out by an approved external unit and the code so read may be compared with corresponding reference code to show that code is same as that in the reference units. The scope of comparision is only to ensure that there is no trojan or other malware for EVMs in use.” 

This report of 2013 was the last the government shared with activist Venkatesh Nayak via RTI. No report has been made public post 2013. 

(3) India’s disproportionate secrecy is in marked contrast to other countries still using electronic voting devices. 

(4) Emails and phone calls to officials of the ECI and spokesperson elicited no response. However, government officials told The Wire, “There is no reason why the source code information should be shared. People have gone to the Supreme Court again and again on this matter and their efforts have been rebuffed. The Election Commission has answered the court each time. These are nothing but motivated questions.” 

Former CEC, Ashok Lavasa, says, “There have been a number of discussions on making source code public though the ECI goes by what the TEC says. The ECI prefers to be guided by academics like those at the TEC and go with their wisdom.” 

(5) In an RTI response to Venkatesh Nayak, BEL admitted that the chip they are using is from US-based NXP semiconductors. In addition, the NXP website says, this is not OTP. Instead, it has three different kinds of memory – SRAM, FLASH AND EEPROM. All three types can erase and rewrite data, or retain data bits in its memory or the memory can be electronically erased and rewritten. In other words, software that can be overwritten or reprogrammed cannot have the safeguards of being one time programmed. 

In a paper on EVMs in 2010, a committee including Michigan University professor Alex J. Halderman had this to say with reference to expert committee members picked for EVMs: “This time the committee members were A.K. Agarwala and D.T. Shahani, with P.V. Indiresan serving as chair. All three were affiliated with IIT Delhi, but, like the first committee, none appear to have had prior computer security expertise. Again, the committee members did not have access to EVM source code and relied on presentations, demonstrations, and site visits with the manufacturers. 

“In their report, the ECI has reiterated its view that the machines were “tamper-proof”. 

In fact, Professor Indiresan is reported to have once said that questioning the ECI’s integrity is like asking Sita to undergo trial by fire.

Observations on the above facts and revelations:

(1) Judgment of SCI is beyond ridiculous - judiciary needs education on the concept of "Open Source" (ironically CJI, DY Chandrachud is a votary of "Open Source" technologies - having introduced a number of open source ICT based innnovations he only needs to be reminded of the benefits of Open Source in a voting system which is plainly a public service system); citizens right to know that fair processes are in place for elections is non-trivial; knowledge of source code cannot compromise national security; policy of executive is violative of citizens right to information; finally the alibi of IPR in not sharing the source code is a big joke - the program for EVM is one a junior programmer can write - even an elevator operations program will be more complex in comparison! 

(2) TEC report of 2013 is absolutely correct - made by competent people of integrity

(3) India can learn from USA, Australia and many other countries before claiming to be mother of democracy - the article cites many examples

(4) ECI boss needs to show some spine, it is doable - s/he can take inspiration from late T.N. Seshan

(5) These so called ECI's tech experts claiming the EVMs are tamper proof and that ECI cannot be questioned - are at best digital illiterates or worse - individuals of compromised integrity - like Sita, they must be subjected to undergo trial by fire!

======================

RELATED

Challenges to EVM and reaction of authorities: Notes

(See the link in the notes to the most ingenious hack - 4pm New Network - viral video)

See in this 5 min video the striking pattern of BJP wins whenever the counting happened after a delay of a week or more of polling; BJP lost more seats whenever the counting happened soon after polling..

Ds4 News clipping of 5M:53S

EVM AND BJP winning pattern - mere coincidence?

8-Dec-23 INC TV Chhatisgarh voting % changed by ECI after having announced the voting percentage two days earlier and confirming that EVMs were sealed and placed in a strong room. ADR representative has pointed this out. Reply from ECI? Tweet

Citizens’ Commission on Elections’ Report on EVMs and VVPAT - Report of 11 pages of 8-Apr-21 - recently signed by 6,500 eminent people Report

EVM Voting anomalies and ECI's stonewalling - Research paper and articles: Link

12-Dec-23 The Wire - Meetu Jain's article on the bill GOI intends to pass that will replace CJI by a Minister of PM's choice in the Committee that appoints CEC and ECs - making ECI totally subservient to the Government: Link

Electoral Reforms India urgently needs - Anil Srivastava's blog:  Link