EVMs hackable in 2012, not now? 

When BJP felt EVMs were evil

BJP’s national spokesperson GVL Narasimha Rao and Vivekananda Foundation which was then headed by the present National Security Advisor Ajit Doval, spearheaded a campaign around 2008-10 against the Electronic Voting Machine. A book titled, ‘Democracy at Risk! Can we trust our Electronic Voting Machines?”, based on a research paper by Hari Prasad, a Dutch computer scientist Rop Gonggrip and Alex Halderman, Professor of Computer Science and Engineering at University of Michigan.

While Rop Gonggrip was described as a hacker, Professor Halderman specialised in computer privacy and security while Hari Prasad was the founder of Hyderabad-based Netindia, which was described as a “ IP Surveillance & Streaming Systems & Solutions company”.

Curiously while Prof Halderman and Rop Gonggrip continue to oppose electronic voting machines, BJP and Hari Prasad seem to have changed their mind about EVMs.

Hari Prasad was arrested in August 2010 for allegedly stealing an EVM from the Mumbai Collector’s office. Hari Prasad said that the EVM was given to him by an anonymous source to test for security vulnerabilities. It was accepted by one and all, including the EC, that the EVM was 100 per cent genuine. Indiaresists.com reported then, “Among his vocal and ferocious defenders was Subramanian Swamy…”

It had gone on to say, “If there is one party in India that has a first-hand understanding of the vulnerability of our EVMs, it is the BJP, because senior members of the party have been closely involved with the ‘expert’ who managed to steal, according to the EC, an original EVM.

BJP leaders had escalated the issue to the Supreme Court, which in 2012 directed the EC to upgrade the EVMs to include a paper trail.

The apex court held, “From materials placed by both the sides, we are satisfied that the “paper trail” is an indispensable requirement of free and fair elections. The confidence of the voters in the EVMs can be achieved only with the introduction of the “paper trail”. EVMs with VVPAT system ensure the accuracy of the voting system.” But if EVMs can be tampered, can VVPATs be immune?

In the book promoted by Rao, the ‘experts’ included a question & answer session. A part of it is reproduced here to provide an insight into what the BJP’s thinking was on EVMs prior to 2014.

Did you demonstrate attacks on a real EVM?

Yes. The EVM we worked with is a real EVM that has been used in recent national elections.

How could you manipulate the internal memory to change the vote records? These EVMs are sealed.

The seals quite literally consist of stickers, string, and red wax. Tampering with them would not present a challenge to an attacker. Our video has an excerpt from an official training film showing some of the seals being applied. Have a look and see if you feel you could manipulate these seals yourself.

How could a dishonest EVM know which candidate to favour?

Our dishonest display board attack adds a Bluetooth radio, so criminals could wirelessly signal which candidate to favour. Our memory manipulation attacks happen between election and counting, when everything an attacker needs to know is already public. In our paper we explain more complicated attacks that use the total number of candidates in a constituency as a signalling mechanism. These don't need radio signals and could already be hidden in the software of the EVMs today.

But I watched the election officials perform a mock poll, and that was fine.

It would be easy to programme a dishonest EVM or EVM component so that the manipulation is only performed after voting has been going on for a long time, or if the total number of votes is in the hundreds. That way, simple mock polls will show the proper results, but all the final election results will be manipulated.

Can you help me investigate suspected fraud in the recent election?

Regrettably, probably not. If our research shows something, it is that for the concerned citizen there is very likely to be nothing to observe, study and/or investigate (either before, during or after the election) that would allow anyone to tell the difference between an honest and a dishonest election. That means you are left either trusting or not trusting your election, with no hard facts to guide you. We know that this is not a satisfactory answer, which is exactly why this type of voting machine should be abolished.

Why shouldn't India be at the forefront of technology?

We are technologists with a deep passion for things technical, but we also see the limitations of technology. These electronic voting machines have replaced decidedly imperfect but observable paper ballots with insecure and completely non-auditable technology.

Germany and the Netherlands are modern democracies. They both used electronic voting machines of the same basic type as used in India. In the Netherlands, almost 100% of voters used these machines, but when it was discovered that these machines had severe security problems and that there was inadequate transparency, the machines were abolished and paper ballots were reintroduced. Technological advance is not just about adopting the latest new inventions. Innovation also lies in the ability to take a second look and examine whether what seemed like a good idea ten years ago is still a good idea today.