Bharat Rakshak

.

This thread is BRites with EVM-phobia (like myself) as well as EVM-worshippers. Pls move all pro-EVM, anti-EVM and other balanced and objective EVM related posts here.

---

I have EVM-phobia. I believe that EVM are riggable, and worse, EVM can be rigged in unprovable and undetectable ways. Compared to that, paper ballots with a camera at booth which takes pictures every 10 seconds and send over mobile is far far less riggable. So we should use paper ballots with camera at booth.

I would let other people move their posts here, and then we can resume this debate.

As an electronic engineer who knows a bit of cryptography I believe EVMs can be made highly secure.

1. Publish the source code and the object code for the general public
2. Ensure that there is no way that EVMs can be programmed after manufacture(Storing all code on the old type ROMs)
3. Publish the cryptographic hash of the program along with the source code/object code
4. Random checks before and after the election process to make sure that the source code is the same as published.
5. After all the election results are tabulated again check exhaustively all the EVMs to make sure none of them are tampered.

EVMs are pretty useful and cost effective and it is a simple technological challenge to ensure it is tamper proof.

My Suggestion would be,

- The Voter approaches an EVM,
- Voter inserts his citizen UID smart card into the EVM
- EVM enables/activates the voting display
- The citizen votes by pressing the right button(s) and going through the voting 'wizard'.
- EVM makes a small printout of the vote, which has a barcode and voting choice clearly printed on it.
- The voter confirms that the vote is correct.
- The voter takes the printout to the polling official and in his presence and view, throws the printout into the ballot box.

Benefits:
a) Quick tallying of votes after the election through the use of an EVM.
b) In case of controversy, there can be a recount on the EVMs first.
c) In case of further dispute, there can be an recount of votes by automatic tallying of the printouts (barcodes based) and comparison of votes with those in the EVM.
d) In case of further dispute, the tallying of printouts can be done manually by election officials.

This topic should not have been in 'Strategic & International Relations' forum.

I agree with rohit 100% (maybe because me too am an electronics engineer)

But there is no way you can convince an EVMphobe about that. You can have any amount of technical security, but still you can argue to work around it. For example, assume we have a system as you have mentioned. Can't someone load a new program, rig the votes, and then load the old program after counting?

It is not technology that is the weak link. It is the trust of the official machinery that run the election. If the election officials could be trusted (with necessary checks, balances and deterrents to beat the human nature), the EVMs can be trusted. If the pandu who guard the EVMs could be bribed so that a bribed ECIL engineer can load a new programme to the EVMs, no amount of technology can save you.

For Congress/ UPA increase in vote share over the previous general elections has been 2%, (from 26-28%)

but it's increase in seat share has been astounding 15%.

Dileep,

Good point.

I really don't get it.

Let's assume that EVMs are easily rigged and hence need to be abolished.

Then what do we do?

Go back to the paper ballot system?

Will Mehta ji and others be able to vouch that the paper ballot system is less prone to rigging than EVMs?

Perhaps he needs a discussion with old timers of the West Bengal CPI(M) Coordination Committee union on this subject - how there used to be 100 per cent polling in one booth in swing constituencies in Kolkata, for example, and only 40 per cent in another less than half a km away. [Note: The Coordination Committee usually nominates polling officials in West Bengal. No prizes for guessing the usual party affiliations of these gentlemen]

It can, however, be argued that in a paper balloting system both the ruling party as well as opposition get a chance to rig the polls at particular booths/constituencies where they are strong while in an EVM system only the party controlling the government machinery can do that, one reason me thinks both the BJP and CPI(M) - and their supporters - agree that EVMs are bad after this election and not before.

The point is - as Dileep says - any system is only as good as the person(s) who are responsible for it. To call the EVMs evil and easily riggable just to go back to the old paper system without building up the system to be tamper proof is stupid to say the least.

And if you build a system to be tamper proof, then what's wrong with EVMs?

This debate reminds me of the campaign against computerisation which the CPI(M) ran in West Bengal in the 1980s. It ran something like this:



Of course it could be that those with heebiejeebies' about EVMs may actually think computerisation is a bad thing!

Bottom line the campaign (and perhaps the focus of this thread) should be how to set in place a tamper proof system of balloting rather than focusing on whether we need to go back to good old days of paper and chop voting by discontinuing what is really a Indian technological marvel - a robust, cheap and reliable electronic voting machine which can even run on car batteries.

JMT

I think that is what psephologists call the swing factor. That really comes into play in multi-cornered contests.

If you blame that on EVMs then you must be one of the folks who looks under the bed before going to sleep every night.

Cross posting:

Please note that nothing has been proved yet with respect to the rigging of EVMs. All Mr. Saigal has done is to get a software developed that will ensure that every 5th vote goes to a particular candidate. This is similar to me writing a program on a PC that will print "You are a fool" every 5th time you turn on your computer. This does NOT automatically imply that all PCs in the world have that program and we should dump all PCs.

Having the capability and getting it on 10 lakh EVMs is a different matter altogether. Mr. Saigal has not proved the latter.

Of course, the EC should audit the EVMs at the earliest, no doubt about that.

This 5th vote to certain party is utter BULLSHIT. Why? The presiding officer is the only person who has access to the EVM. So, the party will have to give him the sequence of key codes and make him do it on the sly. It is a tough call to do, without taking the other polling officials also into confidence.

And think about it. We live in an aggressively open society, where "people will know if you pee while in the water" (as my mom used to say). No one, absolutely no one, has come out with ANY proof or even leads. Do you think the "chaiwale" at BEL and ECIL, let alone at the subcons will keep quiet?

BUT!! BUTT!!, Sitadevi MUST be verified to be chaste, right? Conduct an audit of the EVMS. Connect JTAG. Remove and read the flash chips. Ask IIT guys to check the software. De-compile it and verify it. Do the agni-pariksha.

Back to the ballot, lest the bullets fly!

The EVM's can be manipulated at two points,
At the factory.
At the gun point..CPM style.

But the Ballots can be manipulated at a single point:
At the Gun Point.

Also i feel that whatver can be done to ballots,can be done to EVM plus this code thing.Except of course Urination proof(I remember one case where someone urinated in the ballot).

This level of distrust is mainly due to the corruption in election comission.I think BJP and others are more worried about the naveen chawla+EVM combination.

Well, unlike you I do not make any such inference from a statistical comparison. A fair swing for a 2% vote share shift might mean at most 4-6%, anything more is madrassa ...

Raju,

The 2% swing was the minimum. It was anywhere between 2 - 28%
http://www.zeenews.com/news532875.html

So it is not fair to say that 2% change in votes caused a 15% change in seats.

Thing to look at is which seats were border line wins for either parties, what was the vote shift in terms of percentage and then analyze. We dont have that data yet.

Prior to counting can we extract the binaries from the flash and compare them with the original binaries. Though, there is a very very slim chance that after changing the source code the binary would remain the same this could be one of the measures employed prior to counting. Ofcourse, we need to review the source code of the software, which should also include the bootstraping code(or the bootloader given there is no kernel). One more thing that we need to verify is the pcb design. It is very difficult to find a timer circuit made of r-c-i bank which would kick in after a random amount of time and then pull the signal lo/high.

I presume when the ballots are manipulated, one is aware of the manipulation.

When a machine is programmed for manipulation, one is not aware that it has been done so.

The satisfaction level I presume would be different.

The "Factory" manipulation option needs key-in programming/activation in the field, which is gun-point. You can't pre-program the positions, because you don't know where a party will appear in the ballot.

The EVMs we use is a stupidly simple device. It would use a simple microcontroller, probably a PIC or Atmega. No bootstrap/os, nothing. That makes it much tougher to manipulate.

There is this step called mock-poll. The polling officials and the polling agents can mock poll as much as needed, and verify the results. The votes are then cleared, and the key that enables the clearing is sealed off by the presiding officer. The number of votes cast is always tallied with the number shown on the machine. This gave rise to some problems. Someone left without casting the vote, and the votes didn't tally. In order to close polls, the presiding officer, with approval from the polling agents, made the one missing vote to an independent candidate.

With mock polls, I can't imagine how a "factory set" option can play out. Maybe you can program the logic to kick in after polling 100 votes, who knows. Still, it seems extremely difficult to pull off.

I think the modus operandi is someone enters a fixed code and then the fraud begins. For this to work, someone MUST be able to do the following

• Have a thorough knowledge of the EVM software
• Be able to write the replacement firmware
• Have the hardware knowledge to replace the ROM (AFAIK, the ROM is not field programmable, so it has to be replaced. No idea how long that may take)
• Be in a position to control the assignment of doctored EVMs to the desired constituency

Additionally, I dont know if the doctored software needs to be re-written for each constituency since the number of candidates and their order is different.

All this points to tremendous amount of resources and people involved. There are 1 lakh EVMs in total. Even if we restrict ourselves to the borderline cases, that is still 7000 EVMs to change. The chances of being undetected are slim

Replacing the ROM in field is out of question. The only option to install spurious software is to do it in the factory. If you do that, you can "activate it" with a key sequence in the field.

All these are all fantastic ideas. They can't be pulled off without raising a scandal.

This is the fundamental to India's EVMs. However, the guys who talk about EVMs broadly refer to something in Germany and other foriegn countries where the banned EVMs there are Operating System based EVMs with more intelligence into the systems. Those systems are not hack proof. The folks who are building a case against Indian EVMs need to take this difference into their consideration before using a broad brush.

A paper trail and a provision to manual recount even two years after the polls should be provided to close the suspicion.



Are all these manufactured only at ECIL and BEL? Is the manufacturing outsourced to some smaller companies and ECIL/BEL did only quality checking? This is one of the issues that is being discussed in the anti-EVM groups.

To rig EVM, you need a few people at EVM storing warehouse and support of CEC. Something that can be managed.

To rig even 5% of 700,000 booths i.e. 35000 booths, you need 3 criminals per booth i.e. 100,000 criminals at least. Not as easy as CEC bribing.

So paper ballot with camera at polling booths are safer than EVMs

No, I think, we should have the Right to Recall EVMs by paying Rs. 3 to the talati....

We don't know the internal details of the EVM and its design; however we do know that it is not earth shattering and must be using elementary DSD concepts and off shelf components onlee. Theoretically is is possible to put in a BUG..? YES ; practically ...well is it that difficult to pull it in India .

On a serious note even if there was no such foul play involved ; its always good to scrutinize a machine which is gonna decide the future of our country . Specially when a cabinet minister won an election after a 'recount' ... .

No, that can not be managed easily, and without leaks.

And with the proposed audit on the software, what is the problem?

Dileep,

The people who rigged EVMs are smart enough that they would have replaced the software now.

So audit will be buy NOTHING.

I am game for open-source software, and third party audit of the machines.

When we implemented the ISO9001 system in 1994, our ASSessor made a crazy demand. We had a piece of software that is used to run functional test. He wanted to make sure that "it doesn't deteriorate over time" and "calibrate it". Now, that would happen if you promote a ship inspector to a system ASSessor.

No, he was NOT a paki, nor madrassa educated.

Any amount of explaining didn't make headway. So, I wrote a system, where the floppies are "controlled". The quality team should do a disk comparison with a master copy periodically. He was happy and the NC closed.

After running it for TWO years, I moved the MRM that ZERO DEFECT was found in the past, so this procedure may be withdrawn. The procedure was thus officially withdrawn.

I will give two pieces of universal wisdom.

1. You can't convince all fault finders.
2. You can't win an argument with Rahul Mehtaji.

Guys it is hard to imagine that there would be no bootstrap code, I am sure you all would agree that after a processor is taken out of reset it has to initialise the ram, on the minimum atleast setup the clocks for the ram(unless that is hardwired which i dont think makes any design sense). What i was hinting at is apart from the application code that is processing the balloting operations we need to review the code that is executed after the processor comes out of reset. If we dont review the code it is always possible to embed a piece of code that gets executed after says x number of processor cycles.

Reprogramming the flash without a second stage bootloader(the bootloader should have support for a serial itnerface) is impossible. I guess there are only two ways one with JTAg(or some flash programmer) and the other at factory. For the JTAG(or flash programmer) you need some kind of electrical interface out to connect it with the programmer.

So given these it is VERY hard to do the following
1. Replace flash chips
2. Change the source code

Ofcourse, if you were able to manage programming at the factory then yes the evm can be made to behave differently. The most effective way of preventing is to open up the source code and the design and then check binaries before counting. May be BEL will lose some business from Zambia etc

One downside of this could be that smart alecs could come up with identical pcbs and replace them at a place where the EVMs are stored, we can definitely prevent this using some software techniques like encryption at the poll-booth using different encrypting keys on completion of polling.


Anyways, the point i am trying to make is we need to add in additional system checks to make this system more robust

If there are doubts about EVMs in the minds of some people, just replace it. Period.
Do not argue that it saves money and time, so we should continue with EVMs.

Just to clarify, Do you mean replace it with paper ballot or another kind of EVM ?

Here's something that may help the discussion:

Expert Committee Report on EVM

The Bombay Ballot

cross posting from other thread ...

http://pragati.nationalinterest.in/2009/07/are-electronic-voting-machines-tamper-proof/
http://pib.nic.in/release/release.asp?relid=49746

One question I want to ask,Why we need EVM so dearly? when we can do it by ballot counting,we have the manpower ..
What if some high tech sabotage happens at the central vote counting system and sleepy babus could not recognize or desperately ignore, isn't it possible ,like that happend in iran?

EVMs are far more economical than papar ballots, and the tallying takes place much more quickly.

We don't need to get rid of the EVMs but enhance the EVMs with a verification system which is missing. The verification system has to be through a separate system than the EVMs.

We only need to enhance it with small printouts, which can be verified by the voter and later be deposited in a 'ballot' box (technically it is not the ballot) by him.

Needed Criteria are:
1. Easy to manage
2. Cheap
3. Fast
4. Difficult to circumvent
5. Verifiable

Can somebody find fault in the following proposal, based on EVMs with Paper Trail?

- The Voter approaches an EVM,
- Voter inserts his citizen UID smart card into the EVM
- EVM enables/activates the voting display
- The citizen votes by pressing the right button(s) and going through the voting 'wizard'.
- EVM makes a small printout of the vote, which has a barcode and voting choice clearly printed on it. From the barcode one can ascertain a unique vote ID (not to be mixed up with voter ID, there is no correlation), and also the serial number of the EVM.
- The voter confirms that the vote is correct, by looking at the printout.
- The voter takes the printout to the polling official and in latter's presence and view, inserts the printout into the 'ballot' box.

Benefits:
a) Quick tallying of votes after the election through the use of an EVM.
b) In case of controversy, there can be a recount on the EVMs first.
c) In case of further dispute, there can be an recount of votes by automatic tallying of the printouts (barcodes based) and comparison of votes with those in the EVM.
d) In case of further dispute, the tallying of printouts can be done manually by election officials.

Yes, discontinue EVMs until rohits suggestions above are implemented. The phobia on the part of the manufacturer and EC to publish code means something's not quite the way it should be.

The phobia, unfortunately, lies elsewhere.

^^^

Absence of evidence is not evidence of absence. Why are they unwilling to publish the code?

Bangalore Club has had the same EVMs for its elections as the one's used in India's elections. After the 2007 club elections there was a hue and cry that the polling had been rigged. As a result of that two independent bodies were appointed to examine the EVM's for the possibility of rigging and both passed the machines. The issue was further debated in a hot debate in the 2008 general body meetings of the club, and the audit reports were accepted so that those machines continue to be used.

The KGA golf club also has an electronic voting system with a numeric pad slaved to a computer. The computer screen displays the picture and name of the candidate with a number. You select the number on your keypad and then confirm or reverse (in case you have erred). At the end a printer next to you hands you a printout of your selection that you post in a ballot box.

RajeshA's suggestion is what could eliminate any cries of 'foul'.

We use totalizers because we are afraid that goondas will come after people after the elections if a particular booth votes went in the wrong way and now people want to provide with evidences of how each person actually voted

back to reality guyz.

In india,i dont think pulling this off would be difficult.People are afraid of scandalizing against rulers now adays because you usually end up on railway tracks(Anil Ambani fiasco) nowadays.