The EVM Mystery

Asis Ranjan Sengupta

The Electoral Voting Machine, or EVM, in short, has been in the centre of Indian political controversy, since the days of inception. The technology and the machines are imported, and administered in India, by Election Commission of India, which has of late also been in the focal point of controversy. The paradox is, it is invariably the opposition politics that accuses the EVM, and the ruling party refutes the charges. The role changes, as the opposition moves up to the rulers, they assume the role of defenders, and the rulers of yesteryears, become accusers.

Before 2014, BJP and its' allies vociferously raised doubts about the credibility of EVMs, the rightist opportunist Subramaniam Swamy was vocal, and one of their think tanks, Mr G V L Narsimha, wrote one Book 'Democracy at Risk Can We Trust the EVMs?' in 2010, elaborating the details of technical data flaws, and why the inventors, discarded its' use. Strangely, both are silent now.

In 2014, BJP came to power by pressing, never to be fulfilled promises of corruption free government, with less governance, repatriation of black money, and similar other stuff. But in 2015 & 16 they lost assembly polls of Delhi and Bihar successively. The fake thukrethukre gang nationalism outrage was lost in the anger of masses post Note ban massacre. Still, curiously they clinched UP assembly polls very comfortably. That again set the alarm bells of suspicion ringing. In the intermediate period, there had been 30 Parliamentary By polls, out of which, BJP lost in 26. In the three Assembly Elections, prior to this Parliament election, BJP lost to opponents. But a few months later Parliamentary results registered drastic opposite swing, then again recent Municipal elections in Karnataka, the verdict went overwhelmingly in favour of Congress and allies. So there are mysterious swings, unexplained and baffling.

Prior to 2014 polls, Maharasthra BJP minister, late Gopinath Munde, on record claimed that he knew the technique of manufacturing results through EVMs, a lot of hue and cry was raised, and curiously he was killed in a road accident, shortly. In the last Parliament poll, Kanhaiya Kumar filed nomination from Begusarai, Bihar, at first, the BJP nominee refused to stand there from, and Uddhab Thakrey, the Shiv Sena leader of Maharasthra, openly expressed the anguish of the corporate rulers, when he requested all to stop Kanhaiya's entry in Parliament by hook or crook, if necessary, even by EVM tampering. So, there are valid reasons for controversy, not on unfounded base.

Now let us examine few technical aspects. First thing is the claim of Election Commission, that EVM is fool proof and infallible, as the software installed in the micro control unit, of the machines are "One Time Programmable" (OTP). There are three units, one input devise (with voters), one control devise (with Polling Official) and finally the storage, which store the date and gives result. The argument is, as the Micro Chip that registers, stores and produce output, need some software programming, which cannot be altered once inscribed. This is One Time Programmable. Any such claim, need be backed up by technical explanation, and acceptable logic. Sadly, the EVMs in use, in our country, lack that technological support data. Why? Let us go into little bit of detail.

Venkatesh Nayak, RTI research scholar and programme coordinator of Commonwealth Human Rights Initiative (CHRI), who filed these RTI applications, says, "While the ECI continues to claim that the micro-controller used in the EVMs is OTP, the description of the micro-controller's    features on NXP's website indicates that it has three kinds of memory-static random-access memory (SRAM), FLASH and electrically erasable programmable read-only memory (EEPROM or E2PROM). Experts who know enough and more about micro-controllers confirm that a computer chip, which includes FLASH memory, cannot be called OTP." Mr Nayak, who filed the RTI application with the ECI in February 2019, sought the following information:

l    A clear photocopy of all reports of the technical evaluation committees received since 1990 till date regarding EVMs and VVPATs, along with annexures, if any;

l    A clear photocopy of the report of the forensic examination of EVMs conducted by the Central Forensic Science Laboratory (CFSL) pursuant to the direction of the Bombay High Court in EP No. 15 of 2014 along with annexures, if any; and

l    The complete list of manufacturers of micro-controllers used in the EVMs along with their postal addresses.
In his reply, the central public information officer (CPIO) from ECI simply stated that the file, regarding compliance with the Central Information Commission (CIC)'s recommendation to make the source code related information about EVMs public, was under submission.

The CPIO stated that the report of the forensic examination of the EVMs used in the elections to the Assembly constituency of Parvati at Pune in Maharashtra, in 2014 were submitted to the Bombay High Court in a sealed cover. The ECI's CPIO claimed that information about suppliers of micro-controllers used in the latest generation (M3) of the EVMs and VVPATs supplied to the ECI were available exclusively with the manufacturers. Mr Nayak's analysis of the main findings from documents obtained through the three RTI interventions shows:

l    The micro-controllers (computer chip) embedded in the BEL-manufactured EVMs and VVPATs used in the current elections, are manufactured by NXP-a reputable multi-billion dollar corporation based in the Netherlands with offices in over 30 countries.

l    ECIL refused to disclose the identity of the manufacturer of the micro-controller used in its EVMs and VVPATs citing commercial confidence under Section 8(1)(d) of the RTI Act;

l    In 2017, some segments of the media reported that Microchip Inc, US headed by a non-resident Indian (NRI) billionaire supplied the EVM micro-controllers. Documents released under the RTI Act show, that at least BEL has not used this company's micro-controllers in the EVMs sold to the ECI for use in the current elections;

l    While the ECI continues to claim that the micro-controller used in the EVMs is one-time programmable or OTP, the description of the micro-controller's features on NXP's website indicates that it has three kinds of memory - SRAM, FLASH and EEPROM (or E2PROM). Experts who know enough and more about micro-controllers confirm that a computer chip, which includes FLASH memory, cannot be called OTP;

l    The ECI has not yet made any decision on the September 2018 recommendation of the CIC to get the competent authorities to examine whether detailed information about the firmware or source code used in the EVMs can be placed in the public domain in order to create public trust in the EVM-based voting system;

l    Despite the passage of more than five years, the ECI does not appear to have acted on the 2013 recommendation of its own technical evaluation committee (TEC) to make the firmware or source code embedded in the micro-controller used in EVMs transparent in order to ensure that there is no Trojan or other malware in the EVMs;

l    ECIL replied that the firmware or source code testing was done by a third party, namely, STQC, an agency under the ministry of electronics and information technology. But the CPIO denied access to the reports on the ground that they were too voluminous. BEL denied access to this information claiming the exemption relating to commercial confidence and intellectual property rights under Section 8(1)(d) of the RTI Act;

l    BEL won a purchase order worth Rs2,678.13 crore to supply EVMs and VVPATs to ECI. ECIL, however, refused to disclose this information also, stating that despatch data will be supplied after the general elections are completed; and;

l    While BEL claimed that the battery powering its EVM could last 16 hours of non-stop voting with 4 ballot units, ECIL claimed a battery life of two years for its EVMs!

While ECIL claimed that the firmware and source code audit related information was 'classified' and could not be disclosed under Section 8(1)(a) of the RTI Act which protects national security interests, BEL claimed commercial confidence and intellectual property rights-related exemption under Section 8(1)(d) to deny access to the same information.

Senior leader of BJP, GVL Narsimha's book, Democracy At Risk! Can We Trust Our Electronic Voting Machines? states :

"Secret" Software Revealed to Foreign Companies:

Shockingly, the EVM manufacturers, namely BEL and ECIL have shared the "top secret" software programming code used in the electronic voting machines with foreign manufacturers (Microchip, USA and Renesas, Japan) to have it fused (copied) onto the microprocessors. These chips are then delivered to BEL and ECIL through their local vendors as 'masked' microchips (in case of ECIL) or 'One Time Programmable Read Only Memory (OTP-ROM)' microchips (in case of BEL).

As the microchips delivered to the manufacturers are 'masked' or 'OTP-ROM', when the microchips are delivered, the EVM manufacturers have no facility to read back the contents in the microchips to establish whether the microchips supplied to them have the original software or not. Manufacturers of EVMs, BEL and ECIL can only carry out functionality tests on the electronic voting machines to check whether they are working properly or not. They cannot detect if the microchips supplied to them have malicious programming. To say the least, this is shocking.

If the microchips in the electronic voting machines contain malicious software (commonly referred to as Trojan), elections results can be manipulated easily.

Malicious programming can remain dormant during normal testing processes, but get activated later at the time of elections. This would result in an election fraud that can neither be detected before elections nor proved after elections.

Curiously, BEL and ECIL could have done the 'fusing' of the software onto microcontrollers in their own premises in a secure manner. That being the case, why did they prefer to do this in a foreign country? At whose instance was this decision taken and what were the compelling reasons for taking the decision? Was the Election Commission responsible for taking this decision? If no, did it approve of the decision by the manufacturers? And, was it at least aware of it?

Despite repeated queries, there are no answers forthcoming from the Election Commission to any of these questions.

According to the RTI replies given by the Election Commission, the software program (referred to as source code) in the EVMs is not available with it. The expert committee of the Election Commission, headed by Prof PV Indiresan, which approved the EVMs currently in use in elections, has done "black box testing". This means that the committee did not examine and certify the software program in the EVMs. It is the software in the EVMs that drives all its functions. By apparently not examining the software and merely relying on functionality tests, the Expert Committee has left a gaping hole in the security of the EVMs. This is horrifying.

Acknowledgement: From the webpages of Vinita Deshmukh is consulting editor of Moneylife, an RTI activist and convener of the Pune Metro JagrutiAbhiyaan. She is the recipient of prestigious awards like the Statesman Award for Rural Reporting which she won twice in 1998 and 2005 and the Chameli Devi Jain award for outstanding media person for her investigation series on Dow Chemicals.

senguptaasisranjan129@gmail.com

Back to Home Page

Frontier
Vol. 52, No. 4, Jul 28 -Aug 3, 2019