Electronic Voting Machines could be hacked, but casting aspersions on instrument without proper proof is unjustified

Editor’s note: The article was originally published on 4 July, 2009 on Pragati. In light of the ongoing EVM debate, and given that the argument is still valid today, the article has been re-published here with the permission of the author.Is any device, electronic or not, tamper-proof? The answer, of course, is no, it is not. Given enough technical, logistical and human resources, one can tamper with any device. This is as true of a laptop as it is of a “black box” flight recorder or the Indian electronic voting machine (EVM). Whether one should worry about a device being tamper-proof depends not on the theoretical feasibility of tampering but on the practical realities of pulling it off without detection — and the gains to be had by such tampering.The results of the 2009 parliamentary elections in India seem to have surprised everyone, including the victorious UPA coalition. The NDA’s shock of losing has also been huge, and a hunt for reasons for the defeat is on.[caption id="attachment_5939761" align="alignnone" width="1024"] While it might be possible to hack an EVM, doing so might not be feasible and will draw too much attention. Image: Reuters[/caption]It is basic human nature to externalise blame for a loss, at least in a short-term, knee-jerk fashion. Students blame out-of-syllabus questions for their failure in a test, and not their own lack of preparation. Cricket teams blame incompetent or partisan umpires for a defeat, and not their own sloppy performance. Civil servants blame “the system” for poor delivery of civic services, and not their own incompetence. With some exceptions, most BJP politicians, and BJP supporters, are doing the same in their post-election analysis of reasons for the defeat.One of the reasons being pushed — mercifully only by a fringe of serious commentators — is that the EVMs were “hacked” by the ruling coalition, and the results were manipulated.Subramanian Swamy (June 17, The Hindu) and Rajeev Srinivasan (May 17, Rediff.com) have tried to make the integrity of Indian EVMs an issue. While Mr Srinivasan’s article bordered on paranoid schizophrenia (“I do not trust computers” — a direct quote, and a reasonable summary of his fears) and can be dismissed as mere rumour-mongering, Mr Swamy’s critique is baffling, to say the least.[caption id="attachment_5939851" align="alignnone" width="1280"] A polling official seals an EVM. Image: Reuters[/caption]He cites an article (“Trustworthy Voting: From Machine to System”, Computer, 42:5, pp 23-29, May 2009) that described a nine-step process to ensure free and fair elections. These steps are:Step 1: Generate & distribute precinct master keysStep 2: Create voter registration recordsStep 3: Mail proof of registration to votersStep 4: Prepare voting machinesStep 5: Assemble key pairs at precinctsStep 6: Check in votersStep 7: Have voters cast their votesStep 8: Tabulate votesStep 9: Publish resultsOne would be forgiven for assuming that Mr Swamy has not read the article he cited, because he writes “None of these nine safeguards, however, is in place in Indian EVMs.” However, the Election Commission of India does indeed create voter registration records, allow voters to check registration, prepare voting machines, check-in voters at the polling booth, has them cast their votes, tabulate votes, and publish results. Steps 1 and 5, which pertain to technical operation of EVMs, are not applicable to Indian EVMs, but are meant for much more sophisticated EVMs used in the west, specifically, in the United States. The same effect is achieved in the Indian electoral system in a much less software-intensive way. Mr Srinivasan, who distrusts computers, should in fact like the paper and people based system used in India.[caption id="attachment_5939861" align="alignnone" width="1280"] A woman prepares to cast her vote via EVM. Image: Reuters[/caption]Most Indian EVMs have been reused since their first widespread use in 1999, when a BJP-led coalition won the general elections, without any evidence of tampering having surfaced. Given the manpower-heavy nature of Indian elections (local police personnel, central paramilitary personnel, official observers from outside the state, micro-observers, independent videographers and photographers, media personnel and hundreds of voters at every booth) and the low capacity of individual EVMs (a maximum  of 3,840 votes can be recorded in one machine and a polling station typically has only 1,500 registered voters), it will take an army of highly-motivated, centrally mobilised but constituency co-ordinated, election-riggers to influence the outcome at even one constituency.Deploying such an army would reduce to zero the chances of keeping everything completely secret. Let us not forget that state secrets, known to a select few who undergo regular scrutiny by intelligence agencies, leak with alarming regularity in India. If any ruling coalition had the capability to pull such a thing off, it would also be able to deliver good governance of the kind that would render such election-rigging unnecessary.[caption id="attachment_5939901" align="alignnone" width="1280"] Policemen guard an EVM. Image: Reuters[/caption]Some important security features of the Indian electoral system and EVMs are:

1. Labels of the names of contestants/parties are attached at constituency level. This rules out systemic fraud at the manufacturing stage. Even if a political party can somehow ensure that EVMs will assign disproportionate votes to, say, the number 5 slot, it has no way of ensuring that its candidates will be assigned the number 5 slot in constituencies.
2. Agents of political parties are present at every stage of handling EVMs. This rules out systemic fraud at the constituency level. Sample voting is carried out to show the agents that EVMs are counting the votes correctly, and the agents verify that EVMs are empty of votes before polling begins. Electoral rolls are not linked to EVMs, and the agents verify that the number of votes cast is equal to the number of votes counted by every EVM.
3. EVMs are designed to record a maximum of 5 votes per minute. This virtually eliminates the kind of booth-capturing prevalent in the days of paper ballots. Even if some goons manage to take control of a booth, they can do no better than casting 5 votes per minute. At this rate, they’ll get about 300 votes in an hour. That is more than enough time for security reinforcements to arrive from elsewhere, who can be alerted immediately in our mobile phone era. In fact, an alert polling official can simply terminate the polling process by flicking a switch as soon as he senses a booth-capturing attempt is in progress. Thereafter, no amount of muscle power can reopen polling at that booth.

There is only one valid point made by the critics of the Indian EVMs: the embedded software used in them is not available for public scrutiny. However, this only leaves open the possibility of malfunctioning EVMs, not ones that can be tampered with systemically. It is not something that should keep people awake at night, agonising about the election having been stolen. A simple right to information (RTI) application, or a public interest litigation (PIL) petition, ought to address this shortcoming easily.[caption id="attachment_5939931" align="alignnone" width="1280"] EVMs being collected by a polling official. Image: Reuters[/caption]What is most saddening about the discussions surrounding this non-issue is that so many educated Indians still seem to have an inferiority complex about Indian capabilities. The derivative nature of the debate is clear when Mr Swamy and Mr Srinivasan, both highly educated people who have seen the world, compare Indian EVMs to American ones and conclude — without bothering to note the differences between them — that since the American EVMs are flawed, the Indian ones must also be so.Those who insist on scaring the Indian electorate with EVM-tampering articles must be held to account and asked to present credible supporting evidence for their views. Else, we are set to see a repeat of similar stories from fringe supporters of Congress Party when BJP wins an election somewhere, as it eventually must.