Should we discontinue EVMs?

[ArmenT]

^^^^
Smoke and mirrors sir. There are quite a few flaws in your theory. I'll bang out a longer post when I come back from my dinner date.

[Raja Bose]

In the radio enabled EVM, the radio signal receiving elements are on PCB put in a way that naked eye examination cannot reveal the difference between radio enabled PCB and actual PCB.

----
blah blah blah
http://sites.google.com/site/evmproc/

blah de blah tra la la
4. Boxes of CPU chips got replaced inside PCB making company. So the chips used to make PCB were tempered chips.

blah blah encore

Yippee! RM is back!!! Now I see a clear path to nischit jeet over Oldie status.

RM ji, please articulate how you will place radio signal receiving elements on PCB such that naked eye cannot distinguish it? - I would love to hear your theories on this.

BTW CPU chips don't come in boxes.

[Raja Bose]

^^^^
Smoke and mirrors sir. There are quite a few flaws in your theory. I'll bang out a longer post when I come back from my dinner date.

You are reading EVM thread before going on dinner date with your TFPE SHQ???? Have you no shame, have you no fear of indigestion at the wrong moment, has LMU taught you nothing?@#$%@

[Dileep]

Welcome back, RM. Honestly, I was a bit concerned about you, and thought e-mailing you.

Since you went away, I had started another project, which is half done. But I sure will try to timeslice to respond.

[Rahul Mehta]

At this stage, it might be prudent to point out that security is a process, not a product. Sure it is very possible to make a compromised program, but the problem is to bypass all the security checks and balances in the process and insert that crocked binary into an EVM chip. With proper security processes enforced, it will be very difficult to do so.

ArmenT,

If Bill Gates and FBI himself want to put a trojan or backdoors in Windows , which process in the world will stop them? NONE. Well, only thing that will stop them is the FACT that windows binaries do go to commons, and so by reverse engineering , one can find them out. So it is not manufacturing process that may stop Gates, but it is fear of public finding out which may stop him.

In case of EVMs, CE has paid experts to create a myth that giving EVMs to public will create security breach of apocalyptic levels. And using elaborate process babble and techno babble, these experts claim that EVM design, chip, source etc should be NOT given in public. And EVMs are not given to public. Hence the possibility that tempered code will get detected post-facto is zero.

-------

The dishonesty of experts in India on EVM issue is mind blowing. EC recently held a tamasha where they asked people to "prove" that 100 EVMs they handpicked have riggable code. Obviously, Chawala has picked EVMs with no rigged code in it. And when anti-EVM people failed to rig those specific 100 EVMs on display, the experts on BR and outside BR claimed it a "fair" victory !! Not even one expert in India claimed that what EC did was useless. If EVMs are unriggable, hackers from public have to be giving any EVMs they ask (for cost) and given time to hack EVMs. No such step was taken. And yet experts are claiming that EC has "proved" that EVMs are unriggable, and that too unriggable at factory level !!

These experts should apply for a job in PwC. PwC really needs experts like this. Or they should also apply for job in judiciary. Judiciary is also in dire need of such experts.

[Dileep]

In the radio enabled EVM, the radio signal receiving elements are on PCB put in a way that naked eye examination cannot reveal the difference between radio enabled PCB and actual PCB.

This point had been disproven many times.

1. There is no available technology to fabricate a radio receiver and a microcontroller on the same silicon chip. So, the notion that the controller chip containing the radio is technically impossible.

2. If an external receiver is used that will be clearly visible on the PCB.

http://sites.google.com/site/evmproc/

Above is an example of an elaborate process-babble and nothing more.

The following is what you asked for

Pls put the "sample" EVM manufacturing process steps here or a separate website. Once you have posted the full process will personnel count and approx salaries of each, I will show which 10 people can be convinced to put tempered code in EVM and how.

I did EXACTLY that. But now you complain. What else did I expect!!

Thru an elaborate process-babble, Dileep claims that he has proved that "BEL can never make an EVM with tempered code in it".

Thanks for the admission

Which is same as proving that "no factory in world can make a calculator which would say 2 + 2 = 5 "!!

No, it doesn't prove that. It proves that and external agency can not make the change maliciously.

So much for his proof.

Yes, the proof is solid. You promised to

I will show which 10 people can be convinced to put tempered code in EVM and how.

And could do squat about that. That my friend, is the PROOF.

No wonder why he opposes giving EVMs to public. Because if EVMs are given to public then his myth that EVM with tempered code will get shattered within weeks.

Do not try to weasel out now. Deliver on your promise of I will show which 10 people can be convinced to put tempered code in EVM and how.

Now Dileep, the deal was to give a process that BEL follows.

No. Your exact wording was "Pls put the "sample" EVM manufacturing process steps here or a separate website."

Did you forget that the posts are not editable after 24 hours? Go back and read your own promise!

You have given a 5-page long description of how PCBs are made. But most likely, BEL did NOT make PCBs. PCB making was outsourced.

Prove that BEL outsources that PCB assembly, then I will change my process model.

BTW, PCB making is the process of producing the bare board. PCB assembly is the process of putting components on them by soldering.

You have cited 10s of titles and 50-100 people involved in making PCB, who have no role to play in inserting tempered code and have no means to know or stop insertion of tempered code. All the description of PCB manufacturing process was utterly irrelevant.

It is clearly mentioned who is responsible for the control, and their job titles and salaries are given. The other positions are given for completeness of information, to pre-empt the argument that you can't have a huge amount of QA/QC people.

Now, deliver on your promise. Once you have posted the full process will personnel count and approx salaries of each, I will show which 10 people can be convinced to put tempered code in EVM and how.

OR show that the process model I gave is incorrect or unfeasible.

BEL has refused to disclose the process they used to make EVM.

Did you ask? Did ANYONE ask, and BEL REFUSED? Show proof of that. You could have gone to the EC meet and asked them!

And assuming that BEL chief, BEL EVM head wanted to have tempered code in EVM, we can assume that they used all their administrative powers to ensure that process looks OK, but has enough room to put tempered code.

Show me how. You saw the process. You promised Once you have posted the full process will personnel count and approx salaries of each, I will show which 10 people can be convinced to put tempered code in EVM and how

Deliver on that!!

So here is the process they could have followed
1. BEL Chief appoints his pet as EVM Software unit head, EVM hardware unit head
2. BEL Software unit head is also the team lead and a coder himself

This is not a garage operation. This is a public sector conglomerate. It is totally against the management practices, and a glaring red flag among the whole company. So many people will see the infraction, and create an issue.

3. EVM hardware unit head is in-charge of verification of chips.

Same again. You can't do it in a big company. It would be a glaringly obvious attempt of corruption. So many people will see that and complain.

With collusion of these 3 people alone, a tempered code can be inserted into EVM. There are verification teams, but they will not able to notice.

It is impossible to do that without creating a scandal among the thousands of employees of the firm. That is the protection mechanism in EVERY security system, be it control of money, assets, or weapons.

How?

1. The software head will put random bytes in the unused space in ROM. The "random" bytes will not be random but will have additional code to add votes to the preferred candidate in encrypted form. So the OFFICIAL copy of the ROM code has the tempered code in it. So testers will not notice foul play when chips come with these "random" bytes, as they were supposed to have these random bytes.

This is just a magician's trick of complicating things. If you can put modified code, there is no need of encryption. And you can't call the encrypted code without modification to the main code anyway.

All these are solidly refuted earlier, but you are hanging on to them. Just because they seem exotic.

2. The chip has two versions a)untempered version b)tempered version. The tempered version has additional microcode to decrypt the tempered code and execute it

And you have never explained how the tampered and untampered versions will be identified, tracked and controlled. Refer to the process document.

4. Boxes of CPU chips got replaced inside PCB making company. So the chips used to make PCB were tempered chips.

First prove that the PCB assembly is subcontracted before you make this argument.

OR

Show how that is done from the process I gave.

5. When PCBs came, the BEL scanned only PCBs and did not scan the chip at gate level. So now BEL testers have no way to notice that chip is different from what they tested and chip has tempered microcode in it.

First prove that the PCB assembly is subcontracted before you make this argument.

OR

Show how that is done from the process I gave.

So I need only 3-5 people in BEL.

Do not try to build on thin air.

Show which are the 3-5 people in the list I gave you, by designation

And I need co-operation from PCB making company owners to ensure that Box-A containing chips that BEL sent is trashed and instead chips from Box-B are used.

First prove that the PCB assembly is subcontracted before you make this argument.

And I need Hitachi to send me two boxes of chips : Box-A has chips with untempered microcode and Box-B has chip with additional microcode. The ROM code in both chip is same.

All these are refuted a thousand times already.

And in addition, BEL chief need to pay "experts" to tell public that EVMs must not be given to public. And he needs to pay experts to explain why transparency is a bad idea !! And experts will gladly do that (eg PwC). In fact, I know "experts" who go around claiming that transparency is bad idea and EVM must not be given to public. With this, EVMs with tempered code and tempered microcode will never come in light.

Are you accusing that myself, RB, Tanaji, or anyone else who defend the EVMS are being paid by someone?

Be clear here. Are you making an accusation?

[Raja Bose]

Be clear here.

Here you are asking too much from RM ji

[Raja Bose]

If Bill Gates and FBI himself want to put a trojan or backdoors in Windows , which process in the world will stop them? NONE. Well, only thing that will stop them is the FACT that windows binaries do go to commons, and so by reverse engineering , one can find them out. So it is not manufacturing process that may stop Gates, but it is fear of public finding out which may stop him.

RM, have you ever worked in a company with few 10s of 1000s of employees? I am guessing not, becoz the fact that you didn't get what ArmenT was saying and your above fascinating statement just proved it.

In case of EVMs, CE has paid experts to create a myth that giving EVMs to public will create security breach of apocalyptic levels. And using elaborate process babble and techno babble, these experts claim that EVM design, chip, source etc should be NOT given in public. And EVMs are not given to public. Hence the possibility that tempered code will get detected post-facto is zero.

So technical details is techno-babble, details about the manufacturing process is process-babble. My dear Mehta ji, the operations and manufacturing of EVMs is not some chai-biskoot hisaab-kitaab matter discussed at the corner chaiwallah - they are precise, detailed, scientific and logical. Basically your statement tells me that you are not the least bit interested in finding out whether EVMs are actually tamperable or not - You are only interested in making an issue out of it for peddling whatever cheap crap you dole out. Your intellectual dishonesty is amazing - I am seriously beginning to doubt the caliber of IIT CSE grads (the next IIT fella I interview is going to be interrogated SOG style, courtesy your pathetic performance ).

The dishonesty of experts in India on EVM issue is mind blowing. EC recently held a tamasha where they asked people to "prove" that 100 EVMs they handpicked have riggable code. Obviously, Chawala has picked EVMs with no rigged code in it.

Well...well...well...after the EC event is well over we have again grown a pair, have we? Where was all this bombast when you had a chance to go to the event and ask the EC the exact same questions you are belatedly asking here? In the light of all this, all your claims for standing for commons, honesty, transparency is frankly hilarious.

You are unable to even respond to Dileep's simple process description - your downhill skiing is befitting a true seasoned neta, Congratulations!

[Raja Bose]

X-posting from Judge, Neta, Judiciary thread. My 1601st post! Yippeeeee!!
----

And in that thread, Tanaji, Dilip and Raja Bose etc have "proved" that it is impossible for anyone in world to make an EVM with tempered code in it !! And they claim that laws of physics prevent that. Thats like "proving" that no factory in world can ever make a calculator which would say 2 + 2 = 5 !!

Ironic that RM ji is talking about honesty when he just made a dishonest statement himself above - what has been conclusively shown in the EVM thread is that based on available evidence it has NOT been proven that EVM can be tampered in a way which will influence the outcome of an election - I would say this is slightly more complicated than making ONE calculator which can show 2+2=5. In fact I even exchanged emails (and posted the same on EVM thread) with a researcher in US who recently was in the news for hacking a US EVM - his method demonstrated that EVM can be hacked (and so can any other electronic or mechanical device) but like all others before him showed that it is not yet possible do so without arousing attention/requiring massive manpower/indulging in flights of fantasy (like our Mehta ji).

And how did they prove this? In the end, they resorted to techno babble, gave 5 page long process description, claiming that BEL follows that procedure without any proof and showing that tempered code can never get into chips !! So much for their honesty.

oh, so detailed technical explanations is techno-babble. Obfuscating details or ignoring well-known facts is honesty.
A detailed process description by someone who does this for a living (Dileep) is dishonesty. Running away and disappearing for 2 weeks so that one doesn't have to provide proof is honesty.

RM ji, you had asked Dileep to provide a detailed process so that you could suggest ways how it will be subverted. Dileep provided the process but as usual you did not come up with the proof.

So let me take out my calculator which is tampered to calculate 2+2=5 ( ) and tally up these so-called "acts of honesty" by RM ji:

(1) RM claims he has code to tamper EVMs with. He is asked to publish the assembly code - he hems and haws and refuses and then claims he can give code in Visual BASIC! (as if the EVM runs VB). Ofcourse he has no idea how the code will get in which is when he starts claiming Hitachi CEO is a CIA stooge - that Mahabharat of Comedy is there in the EVM thread for all to enjoy so I wont replicate it here....its too long anyways!

(2) RM makes ludicrous claims about embedded systems technology without bothering to learn. For example, he claimed ROM cannot be read by any methods. He is provided links to reference books which teach you how to do so (it is a normal procedure used worldwide for ages). As usual he is active in making allegations and lazy in learning or providing proof. He conveniently ignores well-know facts and claims there must be ROMs which cannot be read since otherwise his theories go phut.

(3) When the Election Commission asks for people to step forward and try to hack the EVMs (a week-long event), RM is requested by people on EVM thread to go there and at least ask tough questions. As usual RM backs out (we are seeing a pattern here, aren't we? ) and claims EC is all corrupt, its a waste of time,...blah blah. He gives the cost of travel as something which one would only incur if they stayed at the finest hotels in Delhi - so much for him claiming to be a common.

(4) RM asks Dileep for a detailed manufacturing, quality testing process for hardware manufacture and firmware programming. Dileep provides that but as usual RM does not respond and disappears from the thread.

(5) Throughout the thread, RM says time and again that people must provide him with proof that EVM is NOT tamperable. Very convenient situation for him I must admit - Make wild allegations and then ask other people to do the legwork to prove you wrong!

(6) Do note that RM claims that since a calculator can be tampered to output 2+2=5 hence EVM is bad. But then in the EVM thread he proceeds to give his own "solution" which involves the use of a digital camera - ofcourse since tampering a camera's IC/CCD is suddenly not possible whereas altering IC design in case of EVM apparently is!

(7) RM claims his detractors are elitemen yet he is the one who claims he has crores of property and thinks that entire India has reliable mobile signal coverage (which clearly means that he never steps out of Ahmedabad). I wonder who is the real eliteman here?

(...Please add more stuff since I think I forgot a few more stellar examples.... )

So, based on the above evidence I would be very skeptical about RM ji's honesty since all I see is a person who high on rumour-mongering and emotional appeals and low on facts and proofs.

I had called RM ji a Militant Activist in the EVM thread and as it turns out he has proven me right time and again - he displays certain characteristics which are unique to the Militant Activist (of the likes of A. Roy):

a) Make unfounded allegations backed by plausible-sounding fallacious arguments

b) Obfuscate details and try to oversimplify the problem

c) When cornered or asked for proof (see EVM thread for details), nimbly skip to some other issue

d) When all else fails, try to play with people's emotions (after all if logic fails, emotion rules)

I would say : pls just IGNORE remarks of all anti-RM elements. They hate me ONLY because they hate the laws I have proposed.They hate these laws, because they want to ensure that we commons remain slave of elite till eternity.

Again stellar logic on display. People don't care two hoots about what laws he proposes. What they do take a objection to is the use of fundamental dishonesty and proposing laws which favour his brand of the elite (despite all the Gandhi-topi clad neta references to being one of the commons).

[ArmenT]

In the radio enabled EVM, the radio signal receiving elements are on PCB put in a way that naked eye examination cannot reveal the difference between radio enabled PCB and actual PCB.

Sez you. Real world doesn't work that way yet, my friend. If you can do this, you could be a billionaire.

----

http://sites.google.com/site/evmproc/

Above is an example of an elaborate process-babble and nothing more. Thru an elaborate process-babble, Dileep claims that he has proved that "BEL can never make an EVM with tempered code in it". Which is same as proving that "no factory in world can make a calculator which would say 2 + 2 = 5 "!! So much for his proof. No wonder why he opposes giving EVMs to public. Because if EVMs are given to public then his myth that EVM with tempered code will get shattered within weeks.

Nope. If a company wishes to make a calculator that says 2 + 2 = 5, they can do so. If they decide to make a calculator that says 2 + 2 = 4, but one small group of people inside it wants to make it say 2 + 2 = 5, then it is much harder to hide their deception because of the process and number of people involved.

Now Dileep, the deal was to give a process that BEL follows. You have given a 5-page long description of how PCBs are made. But most likely, BEL did NOT make PCBs. PCB making was outsourced. You have cited 10s of titles and 50-100 people involved in making PCB, who have no role to play in inserting tempered code and have no means to know or stop insertion of tempered code. All the description of PCB manufacturing process was utterly irrelevant.

BEL says they make the machines, so it is up to you to prove that they in fact don't make the PCBs. So far you haven't shown any proof towards your assertion that they don't make the PCBs. The PCB manufacturing process is very relevant because it is part of the build process.

BEL has refused to disclose the process they used to make EVM. And assuming that BEL chief, BEL EVM head wanted to have tempered code in EVM, we can assume that they used all their administrative powers to ensure that process looks OK, but has enough room to put tempered code. So here is the process they could have followed

Heh, you had your chance when they held a open house for questions. You could have asked them personally yourself.

.... snipped the rest of the stuff about alleged procedure....
The problem with your theory is that you assume that only the head of the dept. is working with stuff and all his minions are deaf and dumb and have no way to communicate with each other. If the head of Software changes the binary, the MD5 and SHA sums will be different. Are you expecting his juniors won't notice this fact and not report it.

Also your 3-5 people can't man all the shifts for a 24/7 factory operation to pull their skullduggery. They need more people to cover other shifts, which means they'd have to bribe people under them.

[Dileep]

The problem with your theory is that you assume that only the head of the dept. is working with stuff and all his minions are deaf and dumb and have no way to communicate with each other. If the head of Software changes the binary, the MD5 and SHA sums will be different. Are you expecting his juniors won't notice this fact and not report it.

Rahul Mehta is incapable (or pretends to be incapable) to understand the enormity of the industrial setup that is needed to produce the required quantity of EVMs. He always assumes a garage based operation where the CEO sits and programmes the chips.

You have a 50,000 sqft factory that runs 3 shifts throughout, employing 770 people in the plant itself, apart from admin and support functions.

A mere, little, trivial detail in RahulWorld.

[Rahul Mehta]

ArmenT,

The radio in radio enabled EVM is recieve only, no send. So it is smaller than RFID. It has to receive only 10-15 bytes and no more to get the candidate number, and send nothing. The sender is a van size device located at some 100 mt. So sender is quite powerful. So this receive-only circuit is small in size and wont be visible from naked eye, if stuffed in the middle layers of PCB.

----

A few pages ago, Dileep mentioned that PCB production is outsourced to a private company. And even otherwise, it does not matter. Essentially, the chips have to be replaced after they are tested. It can be done inside BEL as well with 2-3 more guys. My point is : Dileep has added PCB design description which has no value to discussion and is just a process-babble. The PCB staff can do nothing to stop the trojan from getting in.

------

Nope. If a company wishes to make a calculator that says 2 + 2 = 5, they can do so. If they decide to make a calculator that says 2 + 2 = 4, but one small group of people inside it wants to make it say 2 + 2 = 5, then it is much harder to hide their deception because of the process and number of people involved.

Not if just the chip is replaced, after verification. It is possible that chips are tested before PCB making. But once they go on PCB and go inside box, it is unlikely that chip's gate level design is scanned again. And in the rigging method I suggested, the ROM binary in the rigged chip is same as ROM binary in unrigged chip, only the microcode in the rigged chip is different.. So to differentiate rigged chip with unrigged chip, one will need to scan the chip at microcode/gate level, which may not be part of production production after PCB is made.

Heh, you had your chance when they held a open house for questions. You could have asked them personally yourself.

No. EC had just held a Tamasha and nothing more. It got a bunch of dishonest "experts" (kind of experts you see in PwC) and experts kept murmuring same thing "here are 100 EVMs, you cant open them, now rig them". Only a total dishonest person would throw such a challenge. Next, these dishonest experts cooked eloberate theories why EVM information should be kept confidential and/or given only to a "chosen" group of experts. In US example, the Computer Science professor was not "chosen" by authority but he was able to buy machine and hack it. The "experts" in India insist that EVM must not be given to anyone, and then anti-EVM should be asked to hack them. Such dishonest experts are not worth even talking too.

The problem with your theory is that you assume that only the head of the dept. is working with stuff and all his minions are deaf and dumb and have no way to communicate with each other. If the head of Software changes the binary, the MD5 and SHA sums will be different. Are you expecting his juniors won't notice this fact and not report it.

The MD5 hash etc wont matter, as the actual binary itself has trojan code in encrypted form. So binary never changes and so hash or checksum remains same. The only difference in rigged EVM and unrigged EVM is that the chip in rigged EVM has different microcode. There may 1000 people involved in factory, but only 2-3 of them will have authorization to open the chip and also have the equipment necessary to scan the microcode. They will do it once the chips come from Hitachi. And after verification, chips are replaced with rigged chip i.e. chips with same ROM binary and different microcode. These rigged chips go in PCB and they wont be scanning the chips again as it was not part of the process. So remaining 1000 person in factory will not matter.

[Raja Bose]

The radio in radio enabled EVM is recieve only, no send. So it is smaller than RFID. It has to receive only 10-15 bytes and no more to get the candidate number, and send nothing. The sender is a van size device located at some 100 mt. So sender is quite powerful. So this receive-only circuit is small in size and wont be visible from naked eye, if stuffed in the middle layers of PCB.

Please provide links and references which prove that:
(a) Your radio unit will be smaller than what a naked eye can see - your simply saying so does not make it so.
(b) Such a unit can be "stuffed" into the middle layers of PCB
(c) Such a unit can function as intended after being "stuffed" into the middle layers of PCB.

Proof, Mehta ji, proof! In the end everything rests on proof - and you seem to get a fever every time someone asks you for proof.

[Rahul Mehta]

If Bill Gates and FBI himself want to put a trojan or backdoors in Windows , which process in the world will stop them? NONE. Well, only thing that will stop them is the FACT that windows binaries do go to commons, and so by reverse engineering , one can find them out. So it is not manufacturing process that may stop Gates, but it is fear of public finding out which may stop him.

RM, have you ever worked in a company with few 10s of 1000s of employees? I am guessing not, becoz the fact that you didn't get what ArmenT was saying and your above fascinating statement just proved it.

In case of calculator which says 2 + 2 = 5, the end user will notice the error.

In case of EVM, the end user will never notice the rigging as there is no paper trail. Which is why EC is refusing paper trail (paper trail to go in ballot box). Because of paper trail is added, rigging will become impossible. And shameless dishonest experts are supporting EC even on this - they insist that there must not be any paper trail with EVMs.

------

Dileep,

Regarding allegations.

I am not making any allegations that you, Tanaji, RB, Armen etc are paid by anyone. But some of you have demanded that EVM details should be kept confidential. This demand is utterly dishonest as it only helps to hide the the factory level rigging and thus it promotes factory level rigging. And if disclosing EVM details can increase the chances of rigging, then damage is already done because Sonia, CIA etc have all design details of EVMs. No matter how many process babble you throw, even BEL chief will agree that CIA *can* steal design documents from BEL.

[Raja Bose]

^^^ Once again, you missed the meaning by a mile (perhaps deliberately). The question is not what will happen after an EVM is rigged - anybody can figure that out. The question is how will you rig an EVM in such a way that:
(1) The rigging is undetectable
(2) The rigging is practical (fancy theories involving djinn technology don't stand up)
(2) It can influence election outcome and still satisfy (1) and (2).

[Dileep]

The radio in radio enabled EVM is recieve only, no send. So it is smaller than RFID. It has to receive only 10-15 bytes and no more to get the candidate number, and send nothing. The sender is a van size device located at some 100 mt. So sender is quite powerful. So this receive-only circuit is small in size and wont be visible from naked eye, if stuffed in the middle layers of PCB.

A receive only circuit, and its interface to the controller, can not be made small enough to be unseen by the naked eye. In fact the smallest form factor physically possible to mount on a PCB is the SOT package, which is 3mm square.

It is physically impossible to have an IC package smaller than that

A few pages ago, Dileep mentioned that PCB production is outsourced to a private company.

The bare board manufacturing, ie laminating the copper and dieelectric and etching the traces, is subcontracted, because it is a process industry. The assembly, ie, mounting the components by soldering, is done in house.

And even otherwise, it does not matter. Essentially, the chips have to be replaced after they are tested. It can be done inside BEL as well with 2-3 more guys.

Prove it. Specify the people by designation in the process, and how they would do it without anyone else knowing.

My point is : Dileep has added PCB design description which has no value to discussion and is just a process-babble. The PCB staff can do nothing to stop the trojan from getting in.

Prove it. Specify the people by designation in the process, and how they would do it without anyone else knowing.

Not if just the chip is replaced, after verification. It is possible that chips are tested before PCB making. But once they go on PCB and go inside box, it is unlikely that chip's gate level design is scanned again. And in the rigging method I suggested, the ROM binary in the rigged chip is same as ROM binary in unrigged chip, only the microcode in the rigged chip is different.. So to differentiate rigged chip with unrigged chip, one will need to scan the chip at microcode/gate level, which may not be part of production production after PCB is made.

First of all prove how the rigged chip could be inserted into the production line without detection.

DO NOT WEASEL OUT NOW.

[Dileep]

Rahul Mehta,

I did my part of the deal.

Either you prove your point by listing the people by designation, and how exactly they will do the tampering.

Or Better, Fold your tent and LEAVE.

[Pranav]

Statement of Dr.Subramanian Swamy, President of Janata Party, made in Chennai on 5.9.2009
http://www.janataparty.org/pressdetail.asp?rowid=58

The Election Commission of India (ECI) on September 3rd halted the demonstration initiated by the technical experts led by V.V. Rao, who had earlier filed a writ petition in the Hon’ble Supreme Court. The Supreme Court had referred the matter to the Election Commission to consider our claims on the possibility of rigging elections with EVMs. I was as an adviser to the team and party, present during this aborted demonstration, on a written invitation of the Election Commission to demonstrate tamperability or riggability of EVM’s.

Our team began the inspection process led by Hari Prasad, a technical expert from NetIndia, by noting in writing the flaws in the EVM’s, but the ECI representatives and technical committee experts protested holding such noting as intrusion into their intellectual property!

I also took serious objection to a legal notice sent to Hari Prasad by the ECIL, one of the manufacturers of EVM’s, threatening criminal and civil proceedings for defamation for highlighting concerns regarding the tamperability of EVM’s. The threat of legal action by one of its EVM suppliers, [the ECIL] amounted to intimidation of petitioners who were pursuing a cause in public interest, and on the direction of the Supreme Court. The ECI officials informed us that they had advised the ECIL to withdraw the legal notice.

However, the ECIL claimed that the Intellectual Property Rights (IPR) of the EVM technology belonged to the ECIL and not Election Commission of India!!

On the advice, Dr. P.V.Indiresan, the ECI’s ‘expert’ on EVMs the Commission officials halted the demonstration process, stating that they needed to seek the permission of all the Election Commissioners, before going further on the demonstration process.

The meeting abruptly ended in the middle of the demonstration, with the ECI informing the petitioners that a new date would be fixed for a demonstration after obtained permission of the Election Commissioners for our procedure.

The EVMs are world-wide held to be hackable and riggable, for which I have given the ECI several authorities holding this view (see enclosed letter of mine to the ECI).

We are ready the demonstrate that the EVMs as presently manufactured by ECIL and BEL are riggable to safeguard against it. I want the Election Commission to enable a printed receipt for every voter, just as we get from ATMs after cash withdrawal. This paper receipt is a requirement under the Information Technology Act of 2000, which the ECI is presently adamantly and obstinately refusing to comply with.

(SUBRAMANIAN SWAMY)

[Pranav]

^^^
Really surprised to read about Indiresan's conduct, halting the demo halfway!

The EC is behaving in a really shifty manner!

[vera_k]

^^^

Well, what is new? IMO Indiresan is invested in preserving the EVMs for some reason seeing the half-hearted technical report prepared by the committee having his name earlier.

[Pranav]

One one hand EVM supporters shout from the rooftops that EVMs are unriggable. And when somebody like Hari Prasad expresses concerns he gets threatened with a criminal defamation suit by ECIL!

It's getting increasingly surreal. The brutish intimidation tactics being used by the establishment are outrageous.

Are we in India or in the People's Republic? (Although, if you compare with Navin Chawla's baking alive of people during the Emergency, then the People's Republic is an oasis of humane enlightenment.)

[Raja Bose]

Why doesn't ECIL make them sign an NDA at the very least. Stopping demos in the middle just shows lack of planning and ignorance on part of ECIL representatives.

The EVMs are world-wide held to be hackable and riggable, for which I have given the ECI several authorities holding this view (see enclosed letter of mine to the ECI).

This is a malicious statement as it is vague and attempts to oversimplify and gloss over essential details.

1) All EVMs are not equal in system design. Hence, there is no one-hack-fits-all golden mechanism to subvert all EVMs.

2) "Holding a view" is NOT equivalent to proving something. What is needed is proof NOT rhetoric or "views".

3) Proving that one machine can be rigged does not imply it can be rigged undetected and in a way that can subvert the results of a large election of the scale of Indian general elections. These latter 2 points is where all contemporary rigging attempts have stumbled and fallen hence, showing they are possible in practice is essential to prove that EVMs are vulnerable to election fraud.

[Dileep]

There is no need to program the empty space in a mask programmed chip.

In the spec for the OTP chip of Atmel, there is a recommendation to program random bytes, to prevent the encryption array from being read. This is an invalid suggestion. the correct method is to program ZEROes in the empty space. Because:

1. Programming ZERO will prevent the reading of the encryption array, equally well as random bytes.
2. Programming ZERO will prevent any modification to the empty area.

So, the accepted technique is to fill with ZEROes, not random bytes. So, random bytes could not be inserted with the collusion of EVERYONE who is involved in the code development and review. If you have their collusion, you don't need the random bytes. You can put the code directly in.

So, the Random bytes argument is PROVEN INVALID.

[Muppalla]

Why doesn't ECIL make them sign an NDA at the very least. Stopping demos in the middle just shows lack of planning and ignorance on part of ECIL representatives.

This is the ridiculous thing that ECIL did and will only increase the "devil in the machines" theory.

[Dileep]

Why doesn't ECIL make them sign an NDA at the very least. Stopping demos in the middle just shows lack of planning and ignorance on part of ECIL representatives.

This is the ridiculous thing that ECIL did and will only increase the "devil in the machines" theory.

Absolutely. They should have got an NDA signed, that is all

[Dileep]

Too bad Sukhdeo was banned. Since this thread is in the open area, I hope you read it all nevertheless.

[Pranav]

The software used for randomization of EVMs is supplied by the EC. So we can assume that the randomization is rigged.

Once the machines are assigned to a constituency they are kept in a strong room. Candidates have the option of putting their seal on the locks, but beyond that the candidates do not keep watch over the strong room.

So, keypad based activation, using the internal clock, can be carried out before the rigged randomization, at the district level warehouses. It can also be carried out at the constituency level strong rooms, if the EC's agent can be given access for this purpose.

Furthermore, the transportation process from the District warehouses to the constituency strong rooms may provide opportunities for EC agents to do the activation. In fact, one of the points raised by GVL Narasimha Rao is that private parties are being given access during transportation.

In any case, if the returning officer is considered trustworthy by the EC, then the returning officer himself can do the activation at the polling booth.

So, although wireless activation is a feasible and attractive scenario, we see that rigging is quite easily possible even with keypad based activation.

[Dileep]

The software used for randomization of EVMs is supplied by the EC. So we can assume that the randomization is rigged.

The randomization software is in fact made by the state's CEO. It is a just a random random number generator, which assigns an EVM pulled from stock into a constituency. I am not sure what rigging can happen there.

Once the machines are assigned to a constituency they are kept in a strong room. Candidates have the option of putting their seal on the locks, but beyond that the candidates do not keep watch over the strong room.

So, keypad based activation, using the internal clock, can be carried out before the rigged randomization, at the district level warehouses.

Read the procedure. The EVMS are stored with the batteries removed, and in a sealed condition, till the "commissioning" stage, where they are removed, and checked by BEL representatives.

It can also be carried out at the constituency level strong rooms, if the EC's agent can be given access for this purpose.

What about the seals? Fake them?

Furthermore, the transportation process from the District warehouses to the constituency strong rooms may provide opportunities for EC agents to do the activation. In fact, one of the points raised by GVL Narasimha Rao is that private parties are being given access during transportation.

The transportation is done under proper police escort, which include party representatives. The strong rooms there are also sealed.

In any case, if the returning officer is considered trustworthy by the EC, then the returning officer himself can do the activation at the polling booth.

the RO has no business in polling booth on polling day. He is REQUIRED to be present at his office all the time, an will be very busy monitoring and sending reports.

So, although wireless activation is a feasible and attractive scenario, we see that rigging is quite easily possible even with keypad based activation.

Read the procedure please, and then raise your points.

[Raja Bose]

Once the machines are assigned to a constituency they are kept in a strong room. Candidates have the option of putting their seal on the locks, but beyond that the candidates do not keep watch over the strong room.

On the contrary according to the press release which was posted on this thread a month back, the strong room is locked and monitored with video cameras 24/7 and the candidates' party workers are physically present for monitoring at the strong room facility. In fact, this is a low-tech yet strong deterrent - security is a system. The guy who hacked the US EVM was taking advantage of the non-existence of this deterrent in US elections to claim that his field hack was feasible. In US I guess it is more about being chi-chi and proper so a bunch of rowdy unshaven party workers are not allowed to guard the EVMs of their leader's constituency.

[Dileep]

Think about it.

How much time it will take to do keyboard activation? You need to open the CU box, unpack the machine, install battery, connect to a BU, do tens of keypresses in exact sequence, disconnect the BU, pack the machine and seal the box.

At least 5-10 minutes per machine? Would it be feasible to do it secretly at the warehouse? How many people needed?

[Pranav]

All your objections can be answered. Let's go one step at a time. First, the randomization. Are you saying each CEO writes his own software? And even if that is the case, what would prevent him from writing rigged software. Please provide references for every statement you make. Thanks.

The software used for randomization of EVMs is supplied by the EC. So we can assume that the randomization is rigged.

The randomization software is in fact made by the state's CEO. It is a just a random random number generator, which assigns an EVM pulled from stock into a constituency. I am not sure what rigging can happen there.

Once the machines are assigned to a constituency they are kept in a strong room. Candidates have the option of putting their seal on the locks, but beyond that the candidates do not keep watch over the strong room.

So, keypad based activation, using the internal clock, can be carried out before the rigged randomization, at the district level warehouses.

Read the procedure. The EVMS are stored with the batteries removed, and in a sealed condition, till the "commissioning" stage, where they are removed, and checked by BEL representatives.

It can also be carried out at the constituency level strong rooms, if the EC's agent can be given access for this purpose.

What about the seals? Fake them?

Furthermore, the transportation process from the District warehouses to the constituency strong rooms may provide opportunities for EC agents to do the activation. In fact, one of the points raised by GVL Narasimha Rao is that private parties are being given access during transportation.

The transportation is done under proper police escort, which include party representatives. The strong rooms there are also sealed.

In any case, if the returning officer is considered trustworthy by the EC, then the returning officer himself can do the activation at the polling booth.

the RO has no business in polling booth on polling day. He is REQUIRED to be present at his office all the time, an will be very busy monitoring and sending reports.

So, although wireless activation is a feasible and attractive scenario, we see that rigging is quite easily possible even with keypad based activation.

Read the procedure please, and then raise your points.

[Dileep]

All your objections can be answered. Let's go one step at a time. First, the randomization. Are you saying each CEO writes his own software? And even if that is the case, what would prevent him from writing rigged software. Please provide references for every statement you make. Thanks.

RO's Handbook, section 3.6.
Instruction # 31.

The CEO doesn't personally write the software. The exact instruction is:

Database & software should be prepared and developed by the CEO and distributed among DEOs. District Election Officers should obtain a complete database of officers eligible for polling party duties from respective authorities. All relevant information should be entered into an electronic database of the computerized randomization application software approved by the CEO for that State.

This is about randomizing of poll parties. Reading the RO handbook shows that the same system, and mostly the same software, would be used for EVM randomization as well.

[ArmenT]

Software randomization algorithms are not true randomization, but rather pseudo-randomization. This is because, given the same starting sequence (the seed value), the same set of random numbers are reproducible. That's why most algorithms use a random event to set the starting seed value (such as hundredth of second of the current time, when the user clicks on the start button).

It must be noted that good software randomization algorithms (such as the standard Mersenne Twister algorithm) easily pass statistical tests such as the Monte Carlo test for random numbers. Given a random starting seed, these are usually good for most applications (including distributing machines randomly in an election).

There are also hardware generators that read from random events in nature e.g. place a geiger counter near a radioactive source, line noise from electronic components etc.

On many *nix systems, the OS uses hardware interrupts as a source of random numbers, e.g. getting the hundredths digit of the second when the user hits a key on the keyboard or a packet is received by the network card.

[ArmenT]

So, although wireless activation is a feasible and attractive scenario, we see that rigging is quite easily possible even with keypad based activation.

Sir, are you agreeing with Mr. Mehta that it is indeed possible to stick an RF receiver inside the main CPU on the board? As the others have noted, doing that would violate laws (not legal laws, but the laws of physics!) and references for this have been provided already.

If you're suggesting an external RF chip, then wireless activation could be more likely, but you'll need a fairly decent sized antenna to work. Not to mention that this would need to pass through the manufacturing process and all the workers on the line need to be bribed as well.

[Dileep]

Let us get this straight about the randomizer.

There is no need to have a cryptographically qualified random number. We are just pulling out one EVM, and allocating it randomly to a constituency. A simple pseudorandom generator, seeded with the clock count would do.

The purpose of rigging that software is to send certain serial numbers of machines to certain constituency, while appearing to be allocating them randomly. For this to happen, the EVMs should be pulled from stock at certain precise sequence, in co ordination with the (pre-rigged) sequence generated by the software.

This is humanly impossible to do, since the randomization is done in the presence of all stakeholders.

[Pranav]

Let us get this straight about the randomizer.

There is no need to have a cryptographically qualified random number. We are just pulling out one EVM, and allocating it randomly to a constituency. A simple pseudorandom generator, seeded with the clock count would do.

The purpose of rigging that software is to send certain serial numbers of machines to certain constituency, while appearing to be allocating them randomly. For this to happen, the EVMs should be pulled from stock at certain precise sequence, in co ordination with the (pre-rigged) sequence generated by the software.

This is humanly impossible to do, since the randomization is done in the presence of all stakeholders.

What would happen is that the serial numbers would be entered into the system, which would give out the allotments.

An opposition candidate might be satisfied if he were given the opportunity to pull out the machines one by one - that would amount to another level of randomization. But the the question arises as to which candidate should be given that right. So, even if any pulling out was being done, it would be done by EC appointees, which is far from satisfactory.

[Pranav]

So, although wireless activation is a feasible and attractive scenario, we see that rigging is quite easily possible even with keypad based activation.

Sir, are you agreeing with Mr. Mehta that it is indeed possible to stick an RF receiver inside the main CPU on the board? As the others have noted, doing that would violate laws (not legal laws, but the laws of physics!) and references for this have been provided already.

If you're suggesting an external RF chip, then wireless activation could be more likely, but you'll need a fairly decent sized antenna to work. Not to mention that this would need to pass through the manufacturing process and all the workers on the line need to be bribed as well.

Printed microstrip antenna, or coiled antenna. Battery issues, power consumption in sleep state - that has all been clarified. The modified PCBs would be installed during the maintenance process by the EC-chosen maintenance contractors.

[Dileep]

Printed microstrip antenna, or coiled antenna. Battery issues, power consumption in sleep state - that has all been clarified. The modified PCBs would be installed during the maintenance process by the EC-chosen maintenance contractors.

There is absolutely no proof, or even credible allegation that the EVMS are given out for maintenance my a contractor.

The ONLY mention of this is a single speech by a BJP legislator, which is NEVER repeated anywhere or anyone else. So, this is not a valid point.

[Dileep]

What would happen is that the serial numbers would be entered into the system, which would give out the allotments.

An opposition candidate might be satisfied if he were given the opportunity to pull out the machines one by one - that would amount to another level of randomization. But the the question arises as to which candidate should be given that right. So, even if any pulling out was being done, it would be done by EC appointees, which is far from satisfactory.

It is not humanly possible to selectively pull the machines in sequence without referring to a list and comparing the serial number. Since the process is done in view by everyone, this refer/verify can not be done.

Hence, the randomization process can not be corrupted.

[Raja Bose]

Sir, are you agreeing with Mr. Mehta that it is indeed possible to stick an RF receiver inside the main CPU on the board? As the others have noted, doing that would violate laws (not legal laws, but the laws of physics!) and references for this have been provided already.

If you're suggesting an external RF chip, then wireless activation could be more likely, but you'll need a fairly decent sized antenna to work. Not to mention that this would need to pass through the manufacturing process and all the workers on the line need to be bribed as well.

Printed microstrip antenna, or coiled antenna. Battery issues, power consumption in sleep state - that has all been clarified. The modified PCBs would be installed during the maintenance process by the EC-chosen maintenance contractors.

Pranav,

Regardless of whichever of the above tech. you use, it is pretty darn impossible to hide it on the PCB in such a way that the human eye cannot discern it. And sleep state does not mean pulling 0 amps - it is of the order of micro-amps hence, easily detectable.

In fact, if RM is able to come up with this tech, he can become a very rich man indeed (not that he is not one, now!).