The debate around the reliability of electronic voting machines (EVMs) was reignited after a 'cyber expert' made a series of unsubstantiated allegations against the government and the Election Commission of India (ECI), last month.
While the Election Commission rubbished the allegations and called it a "motivated slugfest", the discussion around EVM continues with elections looming around the corner.
BOOM answers 5 questions regarding electronic voting and its utilisation in the Indian sociopolitical context.
1. What is electronic voting and when was it introduced in India?
Electronic voting refers to the use of electronic methods for registering and counting votes.
Currently, there are four major electronic voting methods utilised around the world : punch-card voting, direct record electronic voting, optical scan voting and internet voting.
The EVMs used in India are direct record electronic voting machines. They are manufactured under the supervision of the Election Commission of India.
While the 2004 general elections saw the first nationwide use of EVMs in India, plans to introduce an automated vote registering and counting device go back to the early 80's.
The timeline below highlights some crucial moments in India's utilisation of EVMs.
2. Are there other countries voting electronically?
Currently, India is one of the very few countries where voting is done electronically in all elections, nationwide.
However, experiments with e-voting methods have already been going on around the world with many other countries willing to accept it, while some others abandoning it altogether.
Using data provided by the International Institute for Democracy and Electoral Support (International IDEA), we were able to identify 30 countries that are using electronic methods of voting as of 2018.
Full View
Table: List of countries that abandoned EVMs
| Country | Reasons for abandoning | Source |
| Finland | Lack of faith in e-voting methods | Ministry of Justice, Finland |
| France | Security concerns | Reuters |
| Germany | Security concerns | Deutsche Welle |
| Ireland | Security concerns | Irish Times |
| Japan | Logistical and financial burden | Mainichi |
| Kazakhstan | Lack of faith in e-voting methods | Tengri News |
| Nepal | Logistical and financial burden | Research conducted by International IDEA's Programme Assistant in Nepal |
| Netherlands | Lack of faith in e-voting methods | "We don't trust voting computer" campaign |
| Norway | Security concerns | BBC |
| Paraguay | Lack of faith in e-voting methods | Parliament.UK |
| United Kingdom | Security concerns | The Guardian |
3. What are the features of an EVM made by the Election Commission of India?
An EVM used in India consist of two components - a Ballot Unit and a Control Unit, connected by a 5 metre cable.
The Ballot Unit, containing the list of candidates and the symbol of the party they represent, is provided to the voter to cast his or her vote. The Control Unit remains with the presiding officer, who can control when the Ballot Unit can register a vote, in order to curb accidental or rogue votes.
The Election Commission of India maintains that the simplistic nature of their EVMs (ECI-EVM) make them a unique device which is 'completely tamper-proof and unhackable' and also financially more feasible than electronic devices used in other countries.
They have also emphasized that the ECI-EVMs are stand-alone devices which cannot be hacked through WiFI or Bluetooth technology.
The source code of the machine, which is a list of logical commands that is used to construct the programme that runs a device, is developed by a team of 2-3 engineers selected by the ECI.
The source code is then integrated into the microcontrollers using a machine code which protects the source code from unauthorised access.
It is important to note here that as per the Election Commission's statement, India currently does not have the capability of manufacturing semiconductor microcontrollers and imports them from abroad.
According to the Election Commission, stringent steps are taken to ensure that the source code is not compromised during its integration into the microcontrollers abroad.
In fact, the ECI keeps the source code and hardware architecture of the EVMs completely concealed from the public, citing security and intellectual property concerns.
Once the microcontrollers are retrieved, the EVMs are assembled by engineers at the Electronic Corporation of India Limited (ECIL) and Bharat Electronics Limited (BEL) - two PSUs under the Department of Atomic Energy and the Ministry of Defence, respectively.
4. Can EVMs be hacked?
In May 2017, AAP MLA Saurabh Bharadwaj demonstrated how to hack a lookalike ECI-EVM in the parliament, causing a massive uproar.
The Election Commission refuted Bharadwaj's claim by pointing out that the machine that was hacked was only a 'lookalike' and was not applicable to the real EVMs made by ECI.
According to the ECI, the arrival of EVMs has helped circumvent major disruptive issues like booth capturing and ballot stuffing, making it the most secure method of voting ever used in India.
Psephologist Yashwant Deshmukh, who is the chief editor and managing director of CVoter, an international polling agency, agrees with the ECI.
"The fact that we have achieved so many anti-incumbent election results since the implementation of the EVMs is a clear sign that these machines are immune to poll rigging," said Deshmukh, referring to the 2014 general elections and the 2018 assembly elections in Madhya Pradesh, Rajasthan, Chhattisgarh and Mizoram.
BOOM also reached out to activist Hari K. Prasad, Technical Advisor to the Government of Andhra Pradesh, who co-authored a paper on the security analysis of a 'smuggled' ECI-EVM in 2010, and was skeptical of the ECI's statement on the matter.
According to Prasad, the EVM is presented to the Indian public as a blackbox, who's inner functionalities are kept secret. Therefore, any statement by the ECI on the security aspects of the EVMs will have to be taken at face value without any proof.
The Election Commission, in a list of FAQs regarding the security features of ECI-EVMs, provides rather ambiguous answers to whether they can be manipulated.
While they state that the security protocols and checks and balances put in place protect the machines from manipulators, they fail to mention whether the machines can withstand manipulation if these security protocols and checks and balances are compromised by corrupt personnel.
Prasad, on the other hand, demonstrated two seperate techniques, which can be used to manipulate a real ECI-EVM, in his paper on the security analysis of the voting machines.
To clarify the validity of these manipulation techniques, BOOM reached out to the Electronic Corporation of India Limited (ECIL), one of the PSUs responsible for manufacturing and assembling the EVMs.
However, they declined to comment, stating they were not "authorised to discuss this matter".
According to Prasad, manipulating an EVM is only a matter of going around the security protocols that are put in place by the ECI and having physical access to the machines.
If all the protocols were met, and if these machines were kept secure from physical tampering throughout its life cycle (from manufacturing to counting), then we can say that it is secure. But how can we know that there is no lapse in security in a huge country like India?
- Hari K. Prasad, Technical Advisor, Government of Andhra Pradesh
In fact, there have been several reported instances of lapse of security protocols set by the Election Commission, over the past few years.
According to an article published by The Wire, as many as 70 cases of thefts and loot of EVMs have been reported until December 2017, as revealed by the ECI in response to an RTI enquiry by former Uttarakhand minister and Congress candidate Nav Prabhat.
The RTI response also included a statement from ECIL, informing that it had manufactured 1,97,368 more control units and 3,55,747 more ballot units than what was disclosed by the Election Commission.
In response to whether stolen EVMs are a threat to voting system, the ECI states that every machine has a unique ID which is blacklisted if the machine goes missing, and thus cannot make it back into the system.
It has, however, failed to mention whether the hardware architecture and the source code, which are considered confidential and thus concealed from the public, compromised due to the stolen machines.
If they can be hacked, why hasn't anyone been able to do so during the EVM hacking challenge by the ECI?
"Election Commission's EVM challenge is absurd. They ask you to hack the machine while the security protocols are in place, which is impossible. A real criminal will have unrestrained access to every component of the machine without the security protocols," added Prasad.
In August 2010, following his demonstration of how a real EVM can be tampered with, Prasad was arrested under suspicion of theft when he refused to reveal the identity of his source who smuggled out a real EVM for the study.
5. Are there ways to improve upon the current system?
Prasad provided us with three separate solutions that the ECI could consider if it wanted to upgrade the security of electronic voting in Indian elections and provide better transparency on the matter.
1. Voter verified paper audit trail
Only of the most popular solutions, which has already been taken into consideration by the ECI, is the introduction of VVPATs.
VVPAT or voter verified paper audit trail, is an independent verification method which provides feedback to a voter using a direct record electronic voting machine like the ECI-EVMs. The feedback is procured in the form of a paper slip which bears the name and symbol of the candidate when a vote is casted.
According to the ECI, VVPAT machines will be used, for the first time, in every single polling station in India, during the upcoming general elections.
This will provide Indian voters the opportunity to verify that the vote registered by the machine corresponds to the vote that was intended.
Nevertheless, Prasad believes that the introduction VVPAT is not enough if there is no validation process made available to the voter.
"If a voter finds out that the VVPAT slip doesn't match the intended vote, all he or she can do is complain to the presiding officer. There should be a method for a voter to validate that the vote on the Ballot Unit corresponds to the VVPAT slip - only then should the vote be registered for counting by the EVM," he said.
2. Open source code and open hardware architecture
The second solution Prasad provides is opening up the hardware architecture and source code of the machines to the public.
According to him opening the source code makes it more resilient, as it will undergo a thorough scrutiny of developers from all over the world, while making the entire process more transparent.
Yashwant Deshmukh, on the other hand, advised against Prasad's solution stating that opening up the source code will take away the commercial value of the machines and prevent ECI from being able to sell Indian EVMs to other countries.
3. Optical scan voting machine
The third solution provided by Prasad involves switching from the current direct record voting machine to optical scan voting machine.
In an optical scan voting machine, a voter obtains a paper ballot upon casting his or her vote, similar to a VVPAT slip. The voter can then verify the vote on the ballot and then feed it to an optical scanner which scans and registers the vote.
This method automatically requires the voter to verify and validate the vote before getting it scanned.
Provided that the source code in the microcontroller of the scanning machine is also open to the public, this method, according to Prasad, will provide a much higher level of transparency in the voting system.
Accountability and Transparency
With reports of discrepancies during the recent Telangana Assembly elections, there is a growing need for transparency and accountability by the Election Commission as we head towards general elections.
Some of the major concerns over the use of electronic voting method arise from the fact that the Election Commission refuses to entertain doubts and questions regarding the functioning of machines with complete transparency.
However, Deshmukh defended the ECI's stand on this matter.
"The Election Commission is the second most trusted public institution in India after the Indian Army. The Election Commission is not answerable to every single person questioning it," said Deshmukh.