The EVM and its critics
A free and fair election is the bedrock of any democracy. Given this, one would expect that someone who reports a grave fundamental problem with the process of conducting elections would be lauded the effort. Not so, it turns out, in India.
Hari Prasad, technical coordinator of Citizens for Verifiability, Transparency and Accountability in Elections (VeTA) was arrested in the early hours of August 21 in Hyderabad and transported to Mumbai, a fourteen-hour drive by road, for allegedly stealing an Electronic Voting Machine (EVM) from the Mumbai Collector’s office. EVMs have been used as the only means casting the ballot in all general and state elections since 2002 and as such underpin the democratic process. The allegedly stolen EVM was used by Mr Hari Prasad and two other researchers to analyse security and tamper resistance. This analysis resulted in a technical paper that showed that the EVMs are insecure by design and could easily be tampered with. Mr Hari Prasad later used the same EVM to demonstrate the tampering technique on television. The officers who arrested him are reported to have admitted that they were under “pressure from the top,” to arrest him and that he would be left alone if he would reveal the identity of the sources who provided the EVM to the researchers.
Mr Hari Prasad was finally granted bail seven days later. In granting the bail, the magistrate V B Srikhande observed that, “no offence was disclosed with Hari Prasad’s arrest and even if it was assumed that EVM was stolen it appears that there was no dishonest intention on his part….he was trying to show how EVM machines can be tampered with.” The court has also asked the Election Commission (EC) to approve or disapprove Mr Hari Prasad’s claims with regard to the EVMs, and that action could be taken against him if his claims were indeed false.
This dramatic collision between technology, the law of the land and the instruments of democracy has brought up some important questions and issues.
Controversies attract publicity. Thanks, in no small measure, to the publicity surrounding the arrest and resulting events, the core issue of the weakness exhibited in the EVMs have been brought to the limelight. When published a month before the arrest, the paper describing the vulnerabilities associated with the EVMs did not gather much immediate attention except in academic circles and among few activists. Mr Hari Prasad’s arrest changed that to some extent, with the media focusing on the underlying cause that seemed to have motivated the arrest. This has brought more exposure to the work and the flaws identified by voters and political parties. All opposition parties and some parties in the ruling UPA have expressed concerns over the security of the EVMs. This is for the better.
There is now a compelling case that the EVMs used in Indian elections are not tamper-proof. Insisting that they are secure as the EC maintains, amounts to ignoring scientifically determined facts. Maintaining that the EVMs are a better alternative to the paper ballot, even in terms of tamper resistance, does not cut it. While tampering with a paper-based ballot is easier—through booth capturing and other crude method—than tampering the EVMs, several things need to be kept in mind while trying to justify the use of EVMs.
First is the fact that the ability to tamper with the EVMs will only get easier as technology improves. The EVMs are based on a 1980s design, so while EVM technology has remained the same, the capability to tamper with them has grown in sophistication. In the cat and mouse game of security, unless the defender continuously evolves his design with time, it will eventually be compromised. Further, the ability to tamper EVMs introduces the risk of a systematic and widespread compromise of the election machinery than the more localised booth captures. Compared to attacks on paper ballots, the attacks on the EVMs are harder to validate, making it harder to figure out whether the election process has been rigged, even after the event. Such doubts can cast a shadow on the legitimacy of future electoral verdicts.
The EC’s reluctance to allow independent and more transparent scrutiny of the voting machines is poorly considered. While in other parts of the world, researchers have been allowed access to and been able to perform security scrutiny of the machines, the EC has steadfastly refused to allow such access. This has led researchers like Mr Hari Prasad to rely on EVMs provided by third parties to conduct their security analysis. Of even more concern is the fact that the inner working of the EVM has been not been made public. Security and privacy have been cited as the main reason for this. One of the fundamental tenets of information security is that “security by obscurity”—attempting to secure a system or a cryptographic method by obscuring its working—does not work in the long run. The EC’s approach violates this fundamental concept. What is more, the EVM design has taken it to the other extreme and disabled the ability to even check the state of the firmware that has been flashed into the device, adding a further layer of insecurity into the framework.
Finally, while there are grounds for concern over using allegedly stolen instruments for study, the actual events have left an impression that Mr Hari Prasad is being harassed for standing up against the establishment on an issue that is of paramount interest to the democratic society. Instead of working with the researchers to figure out ways to make the EVMs secure, the EC seems to have launched a witchhunt to stifle further public scrutiny. This is an ill-advised move and, as recognised by the magistrate, against the public interest.
The EC would do well to institute a properly designed process to allow scientific scrutiny of its instruments, systems and processes, not merely in reaction to the current events, but as a general policy. That would do much more to bolster the legitimacy of India’s electoral system than the current defensive approach.
Srijith K Nair is Fellow for Cyber Strategy Studies at the Takshashila Institution and blogs at Vyuha