Expert Committee Report On Evm

-':11 ...

.... ..

j Ree:istered.

ELECTION COMMISSION OF INDIA Nirvachan Sadan, Ashoka Road, New Delhi-l 10 001. No 4/RTI/89/2007/JS-II '( ~ 11\f( . Dated: 4th June 2007. To i Harikumar P, Pallathadka, Kasaragod, Kerala- 671551

Subject:-

Right to Information Act, 2005-regarding.

Sir,

With reference to your application dated 27.2.2007 and subsequent letter dated 28.05.2007 on the subject cited, I am to forward herewith certified copy of the Test report of Shri P.V. Indireson Committee regarding the Electronic Voting Machines, com~ 42 pages which were inadvertently mentioned as 43 pages in Commission's earliereated 05.04.2007

Yours faithfully, Encl. - 42 pages.

~

(S.R.KAR) UNDER SECRETARY & PUBLIC INFORMAnON OFFICER

m@C0@~ @{] ~[}O@~C0@~

@@UiJi)UiJi)o1N@@

1J@[? u[}o@ u@@[}o[Ji)o@@D ~w@DOD@~o@[Ji) @{] u[}o@ MC0@[?@@]@@] ~D@@~[?@[Ji)O@ W@~O[Ji)@ ~@@[}oD[Ji)@

REPORT OF THE EXPERT COMMITTEE FOR EVALUATION OF THE UPGRADED ELECTRONIC VOTING MACHINE Acknowledt!ement The EVMs, introduced in 1990 have provided excellent service in assisting the voting process in India. These machines are now nearing the end of their life, and need to be replaced. The two PSU companies BEL and ECIL which have been manufacturing these EVMs have developed new designs incorporating some additional features as desired by the Commission. This committee was constituted by the Commission vide their reference: 51/8/16/2004 PLN-IVNol 111/804-806dated 29/12/2005 to evaluate these upgraded EVM's. The Committee met in New Delhi in January 2006 at lIT Delhi, where representatives of BEL and ECIL demonstrated their machines and presented the salient features of their respective designs, including the steps taken to incorporate the additional features as mandated by the Commission. This Committee suggested some additional technical evaluation such as on EMI/EMC standards to be performed on the machines. Subsequently in January 2006, the Committee traveled to Bangalore (BEL) and to Hyderabad (ECIL) and conducted in depth evaluation of the machines and held technical discussions with the entire development teams of BEL and ECIL. Additional essential enhancements to the design of the EVMs and their utility and feasibility were also discussed in this visit. The Committee also studied the inputs that the Commission and the manufacturers have received nom the public over the years on the EVMs. The results of this study have been incorporated into the report of the Committee. It will be in place to acknowledge that the very thorough evaluation conducted by the expert evaluation committee in 1990 on the then EVMs was also re-visited through their report and, the recommendations made by the 1990 committee being extremely important for the fair conduct of elections using EVMs and, additionally having proven their worth during elections in past 15 years, have been incorporated in this report as well. This Committee acknowledges with pleasure the cordial, stimulating and very effective interactions with the technical teams of both BEL and ECIL. Finally, this Committee gratefully acknowledges all the support of the Chief Election Commissioner and all staff of the Commission, in conducting this study.

I.

New Delhi 5thSeptember, 2006

REPORT OF THE EXPERT COMMITTEE (2006) FOR THE TECHNICAL EVALUATION OF THE UPGRADED ELECTRONIC VOTING MACIDNE

INDEX Page 1.0

Background of Electronic Voting Machine (EVM)

1

2.0

Man.ufacturers'Presentation

2

3.0

Evaluation of the Upgraded Electronic Voting Machine

2

4.0

Concerns raised by various Organizations (1990-2005)

7

5.0

Advantages of the Electronic Voting Machine

12

6.0

Recommendations...

13

7.0

Conclmions

15

REPORT OF THE EXPERT COMMITTEE (2006) FOR THE TECHNICAL EVALUATION OF THE UPGRADED ELECTRONIC VOTING MACHINE

1.0

Baclmround of Electronic Votin!! Machine (EVM)

(a)

Introduction During the seventies the Election Commission of India, put forward the idea of introducing Electronic Voting Machine (EVM) in the election process in India. Towards this end, the Election Commission induced two major industrial enterprises namely Mls. Electronics Corporation of India Ltd., Hyderabad and Mls. Bharat Electronics Ltd., Bangalore to design and develop suitable versions of the Electronic Voting Machine for introduction in elections. With the approval of the Govt. of India, in 1982, the machines were introduced in 11 constituencies and put to use. On the whole, the systems worked satisfactorily. The Electoral Reforms Committee in their review at that time suggested that the EVM be evaluated in an objective manner from the technical point of view with special reference to the possibility that the EVM can be tampered with. Accordingly, at the request by the Electoral Reforms Committee, the then Department of Electronics constituted an expert committee to carry out the technical evaluation. The expert committee in 1990 after a thorough review of the design, manufacturing, testing processes, recommended accepting the EVM's while taking certain precautions so that the EVM is easy to use, is rugged, well maintained and cannot be tampered with. The EVMs have since then been in use for over 15 years and have proved their reliability and conduct of tamper-proof elections, year after year.

(b)

Present Status: The EVMs having served over 15 years are due for replacement. Further, based on experience gained from extensive field use, the Election Commission asked BEL and ECIL to introduce additional features, to further the cause of reliability and tamperproof working in the new EVMs to be manufactured.

(c)

Expert Committee on UPgraded EVM's - 2006:

:1 t.{}The Election Commission set up a technical expert committee in Dec. 2005 under S .~'"{'"t.t.. chairmanshipofProf. P.V. Indiresen,with Prof. D.T. Shahani& Prof.A.K.Agarwala .

.

..

~

of lIT Delhi as members to examine the upgraded EVM's and give their

recommendations by Feb 2006. (Ref: 51/8/16/2004 PLN-IVNol 111/39dated 4-1-

~.'j. ~~ :W06).In view of additional testing that the committee asked from ECIL and BEL the of the committee was further extended. After explaining the findings of the study

~

_~ ~~~~"'1

I

(~~~

\'"aa"~~~ c\\o,,~l-eport

~ ~~/se ~'U"~\~ ",,1:<\

as ~e ~ain reco~endations to ~e Election Commissionon 4-7-2006 the IS bemg submItted by the commIttee.

~,"11''f\ f ,~O\/I.. 'o~ 0 ""

L'c O~~\ss__!i\."'\)\"\)O()' \ \?:,.~-, \-\\. - .~Iut:.... C~,. O \' ~,,,. .,~~\;.... ",\.-E. to. ;.>,\1'\ f'op.O. LlO"'/>. ~SP

1

2.0

Manufacturers'

Presentation

Early in January 2006 on request of the committee, Mls. Bharat Electronics Ltd., and Mls. Electronics Corporation of India Ltd., made presentations on the operational, technical and manufacturing aspects of the EVM to the committee explaining the earlier features and design and also demonstrating the additional features and new design changes incorporated. The agencies also conducted mock polls before the committee. Specifically the possible physical methods of tampering and the countermeasures incorporated in the design were also demonstrated, highlighting the enhanced security and tamper-proofness of the design. Committee members subsequently visited ECIL Hyderabad and BEL Bangalore and inspected the manufacturing and testing process of the EVM. Discussions were held in great detail with their engineers on hardware and software aspects of the design with specific reference to integrity of the voting data recorded in the EVM and possibilities of tampering this data

After the above meeting

, the

.

committee, considering the advances in technology

since 1990,made the followinginitial recommendations: (i)

BEL & ECIL to conduct EMIlEMC tests and modify hardware (if needed) so that the EVM design strictly complies with existing standards.

(ii)

Introduce Dynamic Coding of Key no's to enhance security of data transmitted from Ballot Unit (BU) to Control Unit (CU).

(iii)

Introduce Time Diversity in data recording to eliminate effects of random noise.

(iv)

Every key press on EVM, even if invalid, be electronically "date-time stamped" and kept as permanent record (in the EVM memory).

Accordingly BEL and ECIL asked for additional time for (i) EMIlEMC compliance and reported compliance to EMIlEMC standards by mid February. Implementation of points (ii), (iii) and (iv) would only enhance data security capability on lines of current practices but the operating features will remain the ~ f;~e. It was agreed by the manufacturers that these could be implemented and 'f'1 t.-S \ '-'iliat it primarily involved some alterations in the software, while hardware it' .\ design would remain the same. Once the software was modified by the manufacturers to meet the above recommendations, only a detailed check of functional working of the modified EVM would be needed, which EC as the user ., ~ could do on its ow~ or get done before inducting the upgraded EVMs.

~

~

~~~

~...( ..~~\\G~~\a ce(

~

d'

~~sy

~fJti,=,e~ ~\~c:"o~

0"\

tiOb of the U ,;,\

raded Electronic

Votin

Machine

0.).,,)\

'\'~4:>~~Theje-are 'three major points to be considered in overall evaluation of the Electronic

~ .r-~'('~'~:'...o.""StingMachine that has been developed and manufactured in the country. "fo. \ '" I' 2

I

a. b. c. 3.2

Does it meet the functional specifications of the Election Commission? Is the manufacturing quality of a high enough standard to provide adequate reliability? Is the design stable and tamper-proof?

The first question (a) is for the Election Commission as the buyer-user to examine. As for the second question (b) a detailed inspection of the machines as well as the manufacturing process at ECIL and BEL showed that they are indeed of exceptionally high quality. The third question (c) needed a detailed consideration of all aspects of design. In particular, the following points needed to be addressed to: 8. b. c. d. e. f. g.

Can the hardware units CV, BV, Cable system be altered at the site of voting? Can the system be replaced by a different mechanism (hardware or software)? Can the data be tampered with during balloting in operation? Can data be manipulated before, or after the voting period? Can battery low occurring during balloting cause incorrect data record? Is correct date-time being registered on each vote in the EVM? Is the EVM susceptible to data cOITUDtion by Electro Magnetic Interference?

The Committee addressed these questions as explained in sections below. 3.3

The EVM System consists essentially of three hardware sub-systems and one oftware, namely: 8. b. c.

Control Unit (CV) Ballot Unit (BV) Interconnection Cable between CV & BV The CV is the main unit which stores all data and controls the functioning of EVM. The voter presses his voter choice key on the Ballot Vnit (BV) and the function of the BV is basically to transmit faithfully to CV the key pressed by voter (Le. Key number of candidate voted) for being recorded in the CV memory. The data is transferred from BV to CV through the Interconnecting Cable. The faithful recording of the voting data, unbiased and tamper-proof functioning of CU is critical to the conduct of a fair election. The program embedded in the microchip in the CV dictates the functioning of CV. Thus for functioning of the system there is a fourth hidden entity namely, The program (software) embedded in the microchip in the CV. The committee looked into the possibility of tampering in respect of each one of the above mentioned four subsystems.

3.4 ,..( If the integrity of original program in the microchip is maintained, and the key .'\ ~\) 'pressed by the voter on BV is faithfully recorded by the CV, then the election through ~ I EVM ~abe fair. Firstly the tamper-proof-ness of the program is considered. With

<

~/~ac\~Wa~e ~{;r&thtfA~hip

3\"') ~,~ ~ NI\SS\ot,\~oor, . . ."..,..-:51,\Uo(l ""ci'",,~ .coNI.; ~ -;;., OC\..I'II-

technologyused and complexityinvolvedin tamperingwith the program the followingobservationare relevant.

E\..t;. ., ,\ "'. ~\:.'I\j ... :\I~': ~O!,O,I />.s\,\o,",p. .

3

(a)

The program is bumt into the microchip on a "one time programmable" basis.,l 'J..~ (OTP), and once bumt injit cannot be read, copied out, altered and re-fed into the chip at all., It is can be fed once only in the chip, and that too only at manufacturing level, is secret and not amenable to any changes once installed in the machine.

(b)

The microchip is allotted a unique ID (at manufacturing stage) embedded into its memory. The ID is a complex code or "digital signature" which can tell whether the microchip belongs to the manufacturer or not. The code is not known to any individual engineer in the production. However, it can be verified on a manufacturer test table that the microchip is genuine belonging to the manufacturer. Thus any attempt to replace the CV from some other source is detectable as the EVM would simply become inoperative.

(c)

This unique ID mates to the E2 PROM (within the CV where all the voting data will be stored during an election) and, the micro-controller, at the instant of first power-up of CV at the time of manufacturing. Subsequently, the CV will not function if the ID stored in the micro-controller memory does not match that in the E2 PROM. Thus any item to modify the data stored in the E2 PROM by replacing the E2 PROM will automatically make the EVM inoperative.

(d)

It is noted that for biasing the program to favour a particular candidate, the "key number" allotted to the candidate is essential to be known, and this information for various elections to be conducted in the future cannot possibly be known at the EVM's manufacturing stage. Hence no bias can be introduced in the program at the time of manufacture of the chip. Furthermore instead of a Static Key Code, the Dynamic Coding of key numbers of BV advised by the committee, enhances secrecy of key no's being transferred &om BV to CV so any intervention at the connecting cable end for biasing results during voting period will not be feasible. The committee examined the possibility of a "Trojan horse" sub-program being willfully activated after knowing key number allocation to favour a particular key (i.e. candidate), by activating the "Trojan Horse" through some mechanism at time of poll. Such entry is viable only thro' "specific Key presses sequence" on CV or by wireless signal or CV ports. The former activity is not viable as all "key presses" are to be time-dare-logged in the memo as er advise of committee and a "re eat attem" in all CV's at various booths can be easily visible. on post-election analysis. The activation

{) ~~, ~~ S1£ -

()

of "Trojan Horse" by wireless is also.not viable as CV does not have any high &equency receiver and data decoder for wireless, and hence cannot accept any coded signal by wireless. The CV ports accept only specially encrypted and dynamically coded data from BV. Data &om any other device cannot be

~ . ~. accepted by' CV. Hence data cannot be biased via manufacture stage program .~~{ or by wireless command or by some other unit introduced in place of BV

~

d G ptiuring voting.

~/Ma:~~t~~n agffi~er

31J1I11' ~~ 311~ NOIIhus for introducing a (tampered Trojan horse) program, considering the ECT\~~OM~I~~.11~~C'~~ture of production technology of the CV, BV electronic cards, the only EL ;>'1'J1~"l~t1:u~~E.'J~ DE.L\1\.11vopossible process is to "physically replace" the CV card by another one ASHOht' 4 I

.

r

containing a tainted micro-chip, in the time interval between knowing the candidate key-no's and polling. While continuing to explore this possibility one has to say at the outset that implementing this needs complicity of an enormous number of people at Manufacturer, Election Commission and State machinery, and is impractical realistically speaking. However, in order to defeat even such a remote possibility the committee suggests introduction of an additional seal (by EC and party representatives) on the CUIBU electronic card prior to fIXation of candidate key-nos. The Election Commission may consider thefeasibility of incorporating this seal in their poll protocol if they regard such an event realistic considering the level of security provided to EVMs in this period.

3.5

(t)

The new feature of indicating the battery charge status precludes probability of low battery occurring during balloting. Even if battery were to turn low during polling, the E2pROM storage being non-volatile memory is saved and already stored data is not corrupted. Additional feature that is built in is the shut-off of the memory much before battery reaches "brown voltage" condition.

(g)

Sleep mode features enhances battery life since even if EVM is accidentally left ON, then when not being used actively, the the EVM will go in sleep mode and this will save battery power automatically.

This leaves the question of tampering, with the Inter-Connecting cable between CU and BU. This tampering could happen in three ways: (i)

One may attach a device on top of the cable. This requires skilled operation and will naturally be visible to all the voters. At the same time, the Committee has seen the Polling booth arrangements that have been finalized by the Election Commission. The Committee notes with satisfaction that the entire cable is in the public view all the time, any such tampering becomes selfevident. Further, in case any such device has been attached to the cable, it will leave telltale punch marks which can be recognized easily. Therefore this probability also is ruled out by the Committee.

(ii)

Second method by which the system may be interfered with is to insert a device between the cable and the connector situated inside the Polling Unit. This can be obviated by a simple administrative precaution at the time the Ballot Unit is sealed. The Presiding Officer may be asked to exhibit the cable to all the Polling agents and get their certificate to make sure that no device has been inserted between the cable and the socket. Once the cable is inserted and the machine is sealed, this kind of tampering is impossible.

'. ~,Special

~

\.

I

encryption and dynamic coding of key no's recommended by the

Committee will further preclude CU from accepting data from any source other than a valid B U.

~/Mi'dhusudan ~upta ~{sec~~)~OfftCer Any illegal attempt to communicate with CU is automatically detected and a 'N1D~INK I~~6:M~S~N OFoo error is flashed on display drawing immediate attention of the poll ECT EL . ~~ ~"('11.110

~~

31'11\

~~

~1"" '

AD NEWDELH'.11o~fficers. /I,'"\OKARO.

. (iii)

3.6

The third is via wireless signal injection. This possibility has been excluded by making it mandatory that EVMs be EMI/EMC compliant to standards. Also the CU does not have wireless receiver or data decoder and hence it cannot recieve data via wireless coded/signal. The manufacturers have also reported that presence of excessive EMI causes jamming (in which case LINK error is reported by CU) but in no case it corrupts earlier stored data or record incorrect data.

In this manner, the committee to the best of its ability has looked into all possibilities of tampering with the EVM and has come to the conclusion that there is no way of altering the results of the polls before, during and after the poll duration provided, due security precautions already in force and additional modifications suggested by the committee are enforced and the sealing at various stages is adhered to. In case for any reason the Unit has been tampered, it immediately gives an indication that the system has malfunctioned and this remains as a permanent record on the Machine and this record can be checked at any time later. Most importantly it is noted that the EVM's are subject to mock-poll validation at various stages infront of all party representatives. This is the best proof of validation of fairness of the program as well as data being stored inside. The seals pre second level protection, as give highest level of access inside the machine only to the officers conducting the poll , and the party representatives procedures in full view of public and all concerned.,

3.7

In view of all these factors, the Committee'unanimously certifies that the EVM system is tamper-proof in the intended environment when due precautions are taken. For these reasons, the Committee recommends that the upgraded EVM with suggested modifications, testing and operating precautions may be accepted and put to use. '

3.8

Any system of this nature requires proper preventive maintenance. Hundreds of thousands of the units are to be used in any major election and in between they will be stored for long periods of time. During this period due to attack by vermin, rats, fungus or due to mechanical danger, the system might malfunction. Therefore, as a preventive measure, the Committee recommends that before every election the manufacturers may be asked to check (this can be done very fast through a very simple exerciser) and ensure that all the units are functioning as designed. Incidentally, this method will be checked, by what is called 'the self test signature of Machine' and thereby the Manufacturers will be able to certify that the Machine is ~~ntical to what they has supplied and it has not been modified or replaced by any

1\T1 E S 1 billet. 3.9

The Committee's main recommendation is that the upgraded EVM may be accepted subject to the following:

M~

~a;

EVM's be EMIlEMCcompliant.

(NEW)

\\I13,t\ GU\1ta

~~

~/~3,a"u~JP»«icefDynamic Coding of Key no's to enhance security of data transmitted from ~{:c ~11'\~r,~tDallot Unit (BU) to Control Unit (CU) be introduced. (NEW)

3q'>\ '\\,~(\ ~t-J\'ss'~,\'\ooo'\ Q'\ c1'{)~ c,.?' '"'~ Pc:c- i\..\"\,.,\,\QO ~'-~ ' ~'\~.. ""6."" 0 :?rt'" flOp..O.,..

~S\"\O~A

.

6

--

4.0

(c)

Time diversity in data recording be introduced to eliminate effects of random noise. (NEW)

(d)

Everv key press on EVM, even if invalid, is date-time stamped and kept as permanent record. (NEW)

(e)

Additional seal of electronic cards in CU, BU may be introduced by EC to be operated just before the candidate-list is declared as per 3.4e. (NEW)

(l)

All the instruments are checked as a matter of preventive maintenance before election and as a matter of abundant caution, to ensure that they are working satisfactorily and according to the original embedded program.

(g)

The battery condition should be in MEDIUM or HIGH at start of election as displayed on the EVM.

(h)

It is ensured in every polling booth that the cable is visible all the time.

(i)

At the time of the insertion of the cable it is formally recorded by the Presiding Officer and the polling agents, that no device has been inserted between the cable and the connector

(j)

After the polling, the cable and Balloting unit is physically inspected for any mechanical damage, or seal intact.

Concerns raised bv various Ol1!anizations (1990-2005) The concerns that arise from correspondence placed before the committee by the Commission and the manufacturers from various interested parties as regards the use/ malfunction or tampering of EVMs are listed as under:

(i) (ii) (iii) (iv) (v) (vi) (vii)

The Machine may not function properly The Machine may be damaged upsetting the Polling process The Machine could be tampered with, and design may not be secure ('Trojan Horse') The Machine denies the candidates the right to recount The Voting machines are biased against the poor Possibility of false data transfer altering or erasing voting date in CU memory before or after voting Apprehension in the form of a) changes within the machine after three hours of commencement of b) the changes in the machine data transferring (after 60% of the

1,£ ijtes polled) of the 5 lowest candidates to the favored candidates AT 'TE ~~iii) Apprehensionof Electro MagneticInterferenceaffectingthe EVM's stored data after

election but before counting and storing the machines in Electro magnetically

M ,

shielded Faraday cages. Remote signals can be send from a distance to generate

·\~ ,resonant frequency

~V

of the circuits and make the machine function in some other way.

Physic.alshock EVM can withstandon bumpy road in rural areas and possibilityof c\~M\9-mechanicalcomponentsto reset EVM or ECU due tojerk

~M~~~:1'IK>"Vi~ could contain the following flaws: Faulty logic, incorrect algorithm, erroneous

~~

~~~

~\~

~~aw,

""~ 0t1.~\s..~~\.1'\OOO~oo'\ EC1\ot-l.~, .~. .''''OE\..t\I''\'\ El. ~,. . .., N\:.J~ "I p..\<;.).'..... ,..SI-\L)I'

error in circuit design, mistakes in software code, mistake in data base 7

While most of these issues have been addressed to in section 3, they are again responded to question-wise below for sake of clarity.

4.1

Machines may notfunction properly This is a question of reliability. The reliability of an equipment depends on the design, selection of components, procurement and inspection of components, manufacturing process, storage and re-inspection mechanisms. The resultant failures may be catastrophic or non-catastrophic in nature. The design has been perfected over a long period. The manufacturers have confirmed the usage of approved components with due de-rating for reliable operation. Then have also got it certified from agencies authorized by GOI for Standards, Testing and Quality Control & EMI/EMC and representatives of Election Commission reviewed total quality assurance aspects of the Machine through the Manufacturers. The equipments have also gone through climatic tests prescribed in the Quality Assurance (QA) manuals. The Committee noted that the failure rates during the trial period are insignificant. In addition, the catastrophic failure may occur because of failure of the Microcontroller Chip, in which case re-polling may be necessary. The cases of noncatastrophic failure can be catered to by the redeployment of a spare machine. Similarly the Ballot Unit can also be replaced with a time loss of utmost 15-20 minutes in case of a catastrophic failure.

4.2

The Machine may be damaged upsetting thepoll process The damage is understood to be physical damaged and the technical consequences of such physical damage are as under: (a)

Ballot Unit damage Physically strong and agile people or mentally deranged people may damage the Ballot Unit which is stationed a little away from the Polling Officer. (i)

A "Ir"r~

,,\

tC

S"~ t1

in case of catastrophic damage (break in the Ballot Unit into pieces using hammers etc.), the Ballot Unit could be replaced without

affectingthepollingdatatillthatpointoftime.

(ii)

In case of attempted damage by making one of the switches stuck,

~,

apparently disabling the other switches, a "LINK" error is displayed , .~\;. which alerts the Poll Officer, who can then set right the mechanism; oX. ~Fd in the event .. he can. not set right the mechanism then replacement J Gu\>" al 1 bl

-rf'f1'n{~'a

_~ ~~'J~ ~

o'nUSU\1<\t\ "ice! as an \iO" 0

"J~/sec 3\\11'\"1\ '"\~o,p. ~W"~\~ ON0"'>\\"t(\cotlt~\1;;'~_"\,\(j~'I~~oM

\..~C"t,\ON"t\~.-:\\:~.,i.JD~\..t\\ ~ 3\~'" ~O~O.~ f>.s\"\O~p..

tematIve

IS aVID a e.

(b)

Cable Unit Damage No wrong information gets recorded and LINK EiTor is displayed. The cable can be replaced.

(c)

Control Unit damage If the Control Unit is damaged, the poll could be continued with a second Control Unit, since the poll data till that time is safely stored in the memory and which can retrieved with the help of manufacturer in full vision of party representatives. However it should be noted that Control Unit damage is equivalent to snatching the Ballot box, and suitable administrative procedures may be followed, including re-poll as per Election Commission norms.

(d)

EMI Jamming: EVMs can be jammed like all electronic equipment. In that event it will display LINK error, but no wrong data gets entered. Earlier recorded data remains intact and machine reverts to proper functioning after jamming influence is removed. This has been verified by manufacturers via independent EMI/EMC certifying agencies approved by GOI. Thus fair election functions cannot be tampered with by EM! jamming. Reports suggest that magnitude of radiation needed to jam is high and not very practical to generate near the polling booth.

4.3

Machinesmay be tamperedwith This seems to be major issue of concern. The committee has therefore attached high priority to it and suggested ways to make the process tamper-proof. Since the presently discussed Electronic Voting Machine is a different type of equipment than the traditional ballot box, the possible methods of tampering are different and have already been highlighted in the Section 3.2 through 3.9. However summarily one can say that the major advantage of the EVM developed in India is the fixed program nature of the system. The program is permanently fused and hence cannot be read or tampered with even if it can be accessed from other source. Even then, as a matter of abundant precaution, the instrument's signature may be tested by the suppliers before a poll to check that it has not been replaced. An additional seal on CU, BU cards prior to candidate key allocation may be introduced to ensure that the

~11

S\~

~.4

is not replaced (section 3.4 and, in particular section 3.4t).

TheMachinedeniestherighttoRecount

On the contrary, the whole process is stored in the memory, and can be dumped

.

~ough a Printer to get the detailed picture of voting. With the added administrative ~vrocedures of the Election Commission to maintain a register of the voters in the ).:J s~~Qfe of their voting, not only the process of recount is possible but also ~/Mad"\1~\1~gfi\~ation of the recount against any possible tampering is also possible. Each role ~~3qm" ~~/sec~~~d 1c6)tJJressis time/date stamped. ~~ Nof'~ '"'~ OMt/I'SS'~ '1'1000'1 '\ ELE.C1.~ON~~-g. ""'S~ OEL\"Ilo'l'lOOO 31~ ROP-o.N p.s\"Iov...P-

9

{

, 4.5

\

Bias against the poor While the comment on the bias against the poor as reflected in certain articles has been noted, the experience of the Election Commission in trials so far does not confirm the same. This is mainly because the equipment is simple and in fact even simpler than stamping the conventional Ballot paper to which the voter is already accustomed.

4.6

Possibility of false data transfer altering or erasing voting date in CV memory before or after voting. The following is noted by the committee: (a)

Security due to Encrvt>tion

(i)

The Electronic voting machine is an embedded system with fused fmnware which cannot be read copied or altered. Dual E2pROM memory with fc Protocol with digital signature during factory is incorporated so EVM can not be substituted.

(ii)

Expert committee has recommended that the encrypted code is dynamically changed by software at each vote cast, so that it cannot be decoded during time interval between two votes. Therefore, only genuine BV's can feed voting data to CV.

(Hi)

Data is stored in E2 PROM in CV which cannot be physically accessed as Election Officer seals the CV in presence of party representative.

(iv)

E2 PROM is digital signature matched with embedded processor, and hence CV will not work at all if some other E2 PROM was inserted, assuming that despite sealing attempt was made to replace it.

(v)

Data can be fed to CV E2 PROM only through BV. Special encrypting is used in passing data from BV to CV. If some duplicate BV is connected the codes can't match and CV will not accept date. LINK error is displayed.

(b)

Data Integritv Enhancement due to real time DATE-TIME stamp.

(i)

Any vote entered in CV through genuine BV has a real time clock DATETIME ~tamp. The clock is embedded in CV and cannot be changed by anybody since CV is 'Sealed' in presence party representation.

..rr'S1~\) (ii)

r

.'"\§.

"~"

During the ballot, the voting data along with the date & time stamping with internal clock (which cannot be altered after start of election) is written in the memory location. Hence all entries compulsorily have real time date stamp.

Each key press on CV also is DATE-TIMEstamprecorded.

\id n Gu\>ta

~3f'1m'1~7\'\i:~~llM~ftiC~y ~'
data fed "before" election can be recognized by date-time stamp.

~n~o ONlNlISS10N°000, E LEC~\ONf_ ~4 ~"~'; \.. '~I.'\'OOO' 31'11'

AS'"' 0

~I''''

';"'" ROAD.

NEW 0..

10

4.7

(iv)

Any data fed for "mock election" conducted by Election officer in presence of party representative is also date-time stamped.

(v)

Thus any data fed outside the ''voting period" can be easily identified by datetime stamp.

(vi)

The voting data is written serially as the voting progresses. (Close Button pressed by Election Officer in presence of party representatives at end of balloting also is DATE-TIME stamped.)

(vii)

Further as each key press in EVM units whether valid or invalid is date-time stamped and recorded no activation of a possible "Trojan Horse" by any specific key press sequence on EVM during poll can possibly go unnoticed.

(viii)

After voting is completed, the software does not permit to write any further data to any location in the memory. After the CLOSE operation, the machine permits only the display of the result. Hence no data can be fed after polling has ended.

(ix)

The machine has a facility to transfer the data out to display, printer or computer only after the result is seen at least once. Even after the issue of the data transfer command, the machine identifies the rightful gadget before the transfer of data to printer, computer. The machine has no provision to receive any data from outside devices, other than a valid BD.

Apprehension in the form of a) changes within the machine after three hours of commencement of b) the changes in the machine data transferring (after 60% of the votes polled) of the 5 lowest candidates to thefavored candidates. The EVM is an embedded and factory masked firmware and all the machines have same software & it is not polling station specific. It is based on single transfer vote to the voted candidates, and the sequence holds from the start of poll to the end of poll & is not dependent on time. Any system can be tested randomly by mock poll to prove this performance. Further as each key press in EVM units whether valid or invalid is dat-/time stamped and recorded no activation of a possible "Trojan Horse" during poll can possibly go unnoticed

4.8

~1tn

,,~,

,~..,.

Apprehension of Electro Magnetic interference effecting the EVM's stored data after election but before counting and storing the machines in Electro magnetically shielded Faraday cages. Remote signals can be send from a distance to generate resonant frequency of the circuits and make the machinefunction in some other way. (a)

The equipment has passed EMI/EMC tests as per standards

(b) CD and BD perform without malfunction even when impressed with . . ~ectromagnetic interference at levels as required by international standard, for )o\"1eCtronicequipment as per reports submitted by manufacturers.. ,~

~

- /J\I dbusudan Gupta .!."a. ieer ~~/seetlon Off 'IfI'I ~1" 31rll)"tJ

'.\ ''',,'' ~1~SION of INDIA ~lJ~C~\nN~O~~\ ~~1.1 1H~~~1001 :\11'1\

~

V ,-.\clNDEL

"'':''::,~O~f\~v'' .

11

-

4.9

(c)

CU and BU have been subjected to interference levels much higher than EMI/EMC standards and verified that voting data is not altered and no wrong data gets recorded during interference.

(d)

CU & BU can atmost be "jammed" by fields higher than, EMI fEMC standards. However, it is impractical of generate such high fields at the ballot location. Further it is much easier to "break" the CU and BU as rather than jam it.

(e)

Under no circumstance wrong data is entered in CU through BU even under severe EMI, or already stored data altered.

(I)

CU, BU resumes normal functions when strong EMI us removed. LINK Error is displayed during EMI jamming.

Physical shock EVM can withstand on bumpy road in rural areas and possibility of electra-mechanical components to reset EVM or ECU due tojerk. BEL and ECIL have reported, to cover this aspect, which is a JSS 55555, which takes care of bump test up to an acceleration of 40 g. It may also be noted that any mechanical operation, such as "re-set switch operation", cannot be realized in "power off mode" to alter the poll counts inadvertently.

4.10

_~

EVM could contain the following flaws: Faulty logic, incorrect algorithm, erroneous data flow, error in circuit design, mistakes in software code, mistake in data base. (a)

The EVM is an embedded system and all functional checks are performed and fully tested before fusing of the software. The fused firmware cannot be read and cannot be reprogrammed at all.

(b)

All write operations in memory are followed by read operation verified on spot. The committee has recommended time diversity while writing to the memory devices. All EVMs are tested for all functions prior to electioIl Number of mock polls can be conducted before start of balloting to ensure on the spot to party representatives that EVM is fairly recording. Any failure including that due to any random noise would be detected and incorrect data entry would be automatically rejected. Only correct data would be recorded. In case any hardware component results in an inoperative condition, it is detected and displayed as ERROR message and taken care of only by either removing the offending condition or replacing the EVM if need be.

r. ,~~/ ,~'\tfaving ~ ~~i

:1"'''

otticef / "'ac:\"\1~\1 /sectlOf\

considered in detail various apprehensions it will also be appropriate to the various advantages of EVMs as well.

~'<;3~~~\~ 31f!1'bf \tt&ssible reduction of time between the time of withdrawal of nominations and 3q ~~~Otll~\W';~'\'\OO,\~\QC1 commencement of Polling, resulting in considerable, saving in matters El.E.C~,' 1:\~' ';\~E.-.NC' cE.l.\-I\. J\~" ROP.C.N ,.,~\-IO"'''

12

relating to maintenance of law and order, candidates' expenditure on campaigning etc. Considerable saving in printing of stationery and transportation of large volume of Election material. Discouraging booth capture limiting the number of votes that can be cast in an hour to no more than 300 in a booth, thus allowing time for the Law and Order Machinery to take appropriate remedial action. The provision of a procedure for conducting mock-poll to verify correct functioning of the EVM before a poll and that too in full public view, generates confidence in the voting community on the fair operation of the system. The system eliminates invalid voting, which in several cases is understood to be comparable to the difference between the winning candidate and losing candidate. The counting time is drastically reduced, and eliminates mischief at counting, as well as eliminates the possible building up of tension/disorderly scenes during the counting process due to the short time in which the counting will get completed with the introduction of the EVM. The entire process of voting is recorded with real time date-time stamp in sequence and is available for analysis by the Election Commission at a later date against any contingency. Possibility of the introduction of Mobile Polling Booths to facilitate fuller participation of people in the election process. New features introduced in the present proposed EVM's in tune of recent advances, have greatly enhanced capability of conduction of fair elections with EVMs. Each vote is date-time stamped, so that any attempt at rigging say too slow voting or rapid voting in limited time, or voting before or after election period is duly recorded in memory. Data on past 20 election including mode elections giving a unique "history of use" signature which is unique to each individual CD, and in parallel the whole manual record is also available independently with EC, both of which can be checked and co-related post election, if needed.

. . .

. . .

. .

6.

Recommendations Recommendations of the committee are given in three parts, namely (i) Design changes, (ii) Polling- time precautions and (iii) Futuristic actions. The EVMs shown to the committee have undergone hardware design change to comply with EMI/EMC regulations at the suggestion of the committee. Additional

~ 1I!..:t1f11ftg~'s to improve data integrity have been discussed with the Election Commission lhiJEVM manufacturers as being desirable and feasible to implement which will however need due software changes to be done in the micro-chip. The EVM would naturally have to be fully tested after incorporation of these changes and this testing s90uld be got done by the Election Commission prior to the induction of EVMs.

~11i;.'tJ

.

.~.

\

~"S~condly /Madb~~~~

~ 3\:l~1TI ~/section """"{

'fA

certain key precautions on EVM use need to be taken during polling these have been highlighted in (ii) "Polling process precautions" part.

office

31111\11

"1~ ,"" SI ON OF INDIA ELEC110N fO~~I~:-.,:.\, -11 0001001 Jl1'II ~I~. NEW \)ELI-41.11 AS\-\Ol'A ROAD..

13

Last but not the least, it is strongly felt by the committee that while the upgraded machine with suggested changes is strongly immune to data corruption, it does not ensure "voter-identity" which is very important, and is presently accomplished using human judgement. However new technologies are emerging to be available in free market which can hopefully address to this issue. It is suggested in (Hi) "Future actions" that several methods of bio-metric identification be introduced on trial basis in the elections and feasibility of integrating them with EVM be explored, so that the next generation of EVMs can be even more comprehensive in ensuring fair elections. (i)

Design Changes

(a)

EVM's be EMI/EMC compliant.

(b)

Dynamic Coding of Key no's to enhance security of data transmitted from Ballot Unit (BV) to Control Unit (CV) be introduced. (NEW)

(c)

Time diversity in data recording be introduced to eliminate effects of noise(NEW).

(d)

Every key press on EVM even if invalid, is date - time stamped and kept as permanent record (NEW)

(e)

Additional seal of electronic cards in CU, BU may be introduced by EC to be operated just before the candidate-list is declared. (NEW). EC may examine its pre-poll security arrangements of EVMs and may introduce this seal only if they ammgements cannot be fuJJ-proof (NEW)

(ii)

(NEW)

Pre-poll, During-poll and Post-poll precautions

Pre-Poll

~".1

~S

(a).

Preventive Maintenance: Sample electrical check of the Control Unit and the Ballot Unit prior to the polling. The diagnostic check to be prescribed by the Manufacturers so as to ensure that the embedded program has not been tampered with.

(b)

Candidate key number allocation stage: Prior to this additional sealing of electronic card of CU, BU in front of party representatives. (This is a very stringent step and EC may decide whether it would like to introduce this practice with reference to (e) above)

(~)

Inspection of the Ballot Unit/Control Unit as well as the cable at the time of the insertion-of the Ballot paper by the Returning Officer with suitable aids to

.. <;{J.

ensure that duplicate equipment are not used. Ensuring, in every Polling Booth, that the inter-connecting cable is visible at

~

',:.

,~tM. "T'K~

"'j~~

~

'tl'01

"'. times. ',I~.adhusudan GuptaII 'cer ft

~/section ~'f.R

~1~

0

I

311~,"t1

1'1'" ISSION OF INDIA

ELI~C}'ON~~~~~ _\Z,,i''\1 E-~~?~~1001 c.\,1\ OAUNEWD ASHOKA R .

14

(c).

Ensuring, in every Polling Booth, that no device is inserted between the CableConnector and the Control Unit.

(d)

Conducting Pre-Poll "Mock Poll" immediate before start of balloting.

Post Poll Carrying out on a sample basis, recounting of votes in certain booths post poll at an appropriate administrative level, to act as a deterrent against potential mischiefmakers so as to generate a climate of confidence about the infallible nature of electoral process. (iii)

Futuristic actions Bio-metric ID

Notwithstanding all care taken in design of EVMs and procedures as mentioned in the report, the process of election could be vitiated if due care on voter identity is not exercised. The present procedure for voter identity verification is man dependent and its limitations are only too well known to merit explanation here. The use of biometric ID has grown significantly in many applications worldwide and the advantages in its use in an Election process can hardly be over emphasized. The committee has discussed the possibility of interfacing Biometric ID system with present EVMs. It is felt that several issues namely choice of bio-metric parameters suitable for large scale application, costs and administrative logistics, voter ID data bank, etc. need more detailed study and field trials before fmalization and introduction. Nevertheless unless some preliminary exercises are carried out the vetting of these issues would be impractical. Hence it is strongly recommended that EC motivates BEL and ECIL to initiate prototype design and development towards implementation EVM-cumDiometric ID system and trials are conducted to validate the system. For starters, simply recording voter biometric identity during election could itself be a strong deterrent to mischief-makers besides generating useful trial information required for final design. 7.0

Conclusions The committee after a review of the material presented to it has felt it necessary to highlight certain very key conclusions and recommendations as below:

(i)

The basic Electronic Voting Machine developedby Mls. Bharat Electronics

Q -Limited(BEL) and Mls. Electronics Corporation of India Limited (ECIL) is a

"'I'~

.A~~ . ~,,~

11:- . . secure system.

The securityemanatesfromtwo very importantbasic factors: I

b~a)

~,

The fixed program nature of the software which is fused into the

processorand whichis effectivelyunalterable.

danGu\ rel="nofollow">t3 ad"usu ~ er . .. . ~/sectiO~~\J) The faIthful recordmg of all events m the processor (electromcally) and 3q>W' '>\,~f.'I"i1\~s~~ of'\~~\~ the possibility of recalling the same with the added (manual)

~

cotJI~\ r;:.-~ -'\'\00 0001

EC'noN ,<\'GI':.t' "'L\-\l-'\'\ ..,' '!\~' >.'E'/'40<;. ,,1.:' RO!\ o ,'" \ ("~O\<."

EL

15

administrative procedures on BV, CV at various stages in public view prescribed by the Election Commission which make available the sequence of voters voting rendering it possible to verify the recorded vote in case of any doubt with regard to possible tampering. (H)

With the provision of non-volatile memory, any physical interruption leads to the retention of all voting information till that point.

(Hi)

With the system as designed by the above agencies having built-in security, the Election Commission and the Government only need to ensure the security of the equipment, to safeguard the sanctity of the electoral process. The procedural safeguards as stated in Section 6.0 should be implemented.

(iv)

The Committee wishes to place on record the high level of accomplishments of the Engineers and Scientists of Mls. Bharat Electronics Limited and Mls. Electronics Corporation of India Limited in developing an Electronic Voting Machine using the latest technology.

(v)

The Committee unanimously recommends the use of the upgraded EVMs in elections after due modifications stated in this report.

(vi)

Committee also recommends strongly that bio-metric method of voter identification is pursued by EC and tested for feasibility in large population & integrating this sub-system with EVM in future.

~'<j
Gupta

Officer

~H
ELECTION COMMISSION OF INDIA ":'1 ;Jt';S, "'I~ IZF~.110001 "'J \ ROAD,NEW OELHI-110001 16

REPORTOF THE EXPERTCOMMITTEE FORTECHNICAL EVALUATION OF THE ELECTRONIC VOTI11G MACHINE

APRIL 1990

a.

Can the system be altered

b.

Can the system be replaced

by a different

c.

Can the system be ta~red

with while in

The Committee

3.3

at site?

addressed itself

the Control Module

b.

the Balloting Unit: and

c.

The inter-connecting

The Committee

of three components

cable

has looked

into

betw~en

With regard involved in

the

to the nature

of

the design

is completely

be tampered Though

is to replace

this is theoretically

inspection 3.6

with

it cannot

unal terable,

and

by whic~ the s.ystern

way by which t~e System can it entirely

feasible,

of the equipment,

It is feasible

and

or access

In view of the above, the only

and the difficulty

that the program imbedded

fixed

therefore. there is no means c~n be modified from outside.

3.5

three components.

in tampering, it is noted device

the two U~its.

the possibility of tampering

in respect of each one of these 3.4

operation?

to these three questions.

The System consists essentially a.

r.:echanism?

by a new one.

by a simple physical

this can be ruled out.

to modify the Balloting

be done in such a way

Unit alone. However,

that it can escape physical

inspection.

1"1 E.S 1i;O ~,

~

L .

:.\fj'>l~

I

may

atta'ch a device

. skilled , l

operation

on

top

and will

the

naturally

cable.

This

requires

be visible to all the

~

'

lhusudan ~~;:':"'I."1(1. sectiOn0ffeer ,

G\1Y1ta

(

Page No. 4

:'

31\"'4' 'I / l

""" '~4\<.R

'>Il~"

'

311'l11'"

MISSION 0

F INDIA

ELE;~1~ON<~~~~E~"t'i~~?~~10Q' p,::';;HOKA

of

.A~ I

.

~

This leaves the ques tion of tampering with the inter connecting cable. This tampering could happen in two ways. One

ROAD,N

.,-

-.

.. r... b~~th

t : ::tl

arranQ(:~~nts

t hl

-:.:1 ::!.:cc::-.cs

:s

l t (".

with

i c vj

~ ubI -~''Jide::1t

: :".e ~';~::.::g

~:.:~ated

.':ni~

nC'tc~.

t!. (: ~{:l!

Com,i

have be:clI fini'llisL.d

t !I cJl

(:::~:::it'I.:L'

~amper~n9

\. -- .' - o. . I r,;"!,!: . (' '. n !, l

----..~ a:!ll

cJ 1)

Lt, t--

F'urtht'r.

,. 1 ; ; 1.;1

t t:t.# t:Jl.ct:on

hI'

satisfactlcl,

(: w

0

, I

t},;,t

t:

:::I:.:~ .1 n j'

::1

caSt

t!'l-

s IJ r. !I

~:;y

a

s:.rh

~it.

i

; :1

~rJ:t.:~.

I

I .

~~~e

:~at

:!n:::i ::::e

and t::e

J. a

Mac~:::e

::n t~i s

,,~

:-::anner.

sibilities

of

conclusic:1

::~at

socket.

sealed.

:~e

..

aeVlce

~:::

Once'

t~is

kind

C~:r.rr.ittee

tamper::.::g

wit~

h

the of

has

. :::een

a5

cJ.ble

Machine

way

of

:s

::.nser:ed

tar.:po:ri:~,;

looked

the

. . :~~e%:~c =~~$

i::to

and

has

:;,:po~-

all

i

;:-::-s-

co~e

t~

t~e j;

:::ere

:he polls case f~r

~r:::v~ded

~ediate11

gives

tioned

~hich

and

can

a::y

this

is

due

securlt1

i:1dication

remains

=e c::ecked

U::it

~he

~eaSC:1

a:1

no

as

a::d

t::e

precautions has been that

a

alteri::g

permanet

cress-checked

the

are

~esu:::s

::::

e;,~crced.

~~

. -- .. _ul

tampered. system

has rnalfu::c-

record

0:1 the

at

ti::-~

any

Machi::e later.

unani~ou$ly

cer-

reco~~end~

Page

"

that

/10.

5

I

3.10

Any

systcII!

tenancE'. in

any

of

this

ni'lture

~~jor

election

10n<;l ;::eri::>ds

of

vermin.

~ats,

~igh t

;:-.a1 funct

Committee

requires

of thousands

~undreds

ar.d

til:(:. or

i on.

in

du~

recommends

:~at

periC'd

mechanical

7hel e fore.

as

every {this

t"!frougn units will

a very

sirnple

exerciser}

are functioning c~e~~, what is

mitin-

to

due

to

be

USE'd

th~

and

by

SY5t~~

t i V~ !':e:asun.',

election can

for

attack

danag~,

a pn:\'en

b~fore

are

they ~1l1 b~ stor~d

thi!: to

::-rE-vf:ntiv('

thE- uni l$

b~twe~n

:'ul'ing

fungus

proper

of

the

be

d~r.c

ensur~

mdnu!ac-

.---

~cry

that

as designed. !ncidentall}', called 'the sig::ature cf

lh~ fa~l

all

t~is

t~E:

r:lethC'rJ "----

~:achin~'

;;:1J

~

thereby

~~e

Hachir.e

is identical

not 3.11

In

been brief.

the

is

the

ensured

visible

i~

all the

the

J.

physically inspected At t~e time of t~e

that

cable

4.

All

and the

tive to

no

ensure

cording

that

and

it

has

the

Sys tem

may be

precautiens: booth

t~at

:~e

the

and Balloting

cable

fer any insertion

~echanical of the

Presiding

device

cable

is

unit

is

has

da~age. c3ble. it

Officer been

and

i~serted

the

is

f,....--

polling

between

the

connector.

instruments

maintenance

supplied

tha t

polling the

by

the

that :~e

certify

time.

polli~g,

agents

t~

had

recommends

every

After

recorded

they

following

2.

mally

able

other.

Commi t tee to

be

~hat

by any

subject

It

will to

replaced

accepted

1.

Manufact~rers

are

and they

to the original

as are

checked

a matter

as

a matter

of

ef abundant

working

satisfactorily

embedded

progra~~E-.

pr evencautic:1, and

ac~

I

Page

:I

No.

«5

4.0

Is~ues l".aise-d

by

variou.s

Org~n~saqJ:ms

al)O r~L~t.e.d

TI.:.ch!}i ca}

pr<2..l?.le~s

:~

The:

lSSUE:-S

that

arise

as

under:

Hachines

are

i)

The

~achine

:.i)

The

may

~ach:::e

fr"AJn the

not

r..ay

use

f~nction ::e

of E!ectronic

VQting

properly

damagEd

upset::.ng

t~e

2011i:1g

process. iii)

The

could =e tampered

~ach:.ne

be secu~e The

~ach:.::e

denles

VI

7he

Vcti::g

~ach:.nes

issues

a::ddesign ~ay not

('~roJan Horse').

:"J)

These

with.

are

t~e

candidates

arp.

the

biased

t~

t~e

poor.

against

in

examiued

~:.;~t

detail

:::

t~.e

recount.

following

paragraphs.

4.1

~achines

~ay noe funceicn properly

This

a

is

equip:nent

",

of reliability. depends on the design.

7he reliability selecti.on of

question

procurement

and

inspection

process.

storage and

of

components.

re-inspection

of

the:

components.

!'!anufacturing

mechanis~s.

or noncatastro~hic in nature. ~he design has been ~erfected over a

The

resultant

failures

~ay

be

catastrophic

period. The Hanufacturers have confir~ed the approved components with due derating for reliable

of opera-

usage

long

"

Q

~/

..tion.

;. Co~rr.ittee consisting

And Quality

~ (,~~l'.aDefence. ~G~~~v:,e~Control

'_(;'.\!;\~~~~\~~~ ~\~Q}~ntatives ~ ~ '!1\ ~ 0 (}()\ ()\

.,

/

.'

the Directorate (STQC)

.

4<' -i}~U>,?-\-.{. c:,.?~~~,.\-\\() .\'-&~surance ~~'-1~\,\ -:t~:...,,*, ~~n~\.~\ ~-:S ~''-oIG~'~.f" .0.10 "' hc f"'''' rn-''''

G~\O~i"t,.o~~"'"

~\..~ ~ ~Of>' ~#~ . ~c:,

.

--- .--

'<j '<j7l0~S

of representatives

of

of

Standards.

~O\SS

>\\~\:,~~"~,

-: ONI ~O \\J-\~ c I\~:''J! .. '" 1\' u.' ':)3-::>"" :P ,

\)0

1"\./

.; ;)':)\~Oo\\,,\I"\~ . U~I"

..)

:>\? ,\\'<)

\",\\'-'f.S>,~ ~.

Testing

Standards

and

of the Depart::lent of Electronics. Election

Commission.

reviewed

aspects of the Hachin~ through t::e ~ " e r", ..'",,~- v " lv ""d l' n th '" "'.-c

'""'" " - - ~--'"'

'"' '"

'0 O't\ '1,.1' ,"3 N'"3~ ~V- ., )I\.')~ . \\.\,","'i~}'~\';'~O')~,.I" \,.~

I.\)~\I)(}(}\\

of

Assurance Establishment (SQAEI of Department of

..-

Quality

and Repretotal

quality

Hanufactur~rs. . ta-"~ t£!:tl::::.

-- -,.. ..-

'

Pag~ ..

No.

7

Th('

('quiJ:'r:~cnt!:

in the

prcscribe:d rr.itte~

are

hi":(,

noted

also

gone

Quality

the

that

throuQh

c1i!:ii'ltiC'

AssuranCE:

(Ql.)

manuals.

rates

durillQ

lhe

failure

t(.!:t~ The

t:-:a]

CompC:J"i"d

insignificar.t.

!n addition. !ailure

ef

::-.ay be bee

~~e catastrophic

failure

t:-Je !-:::::-:::co:'1troller

necc~s.::rj'.

ate red

7he cases

tc

Similarly loss of

t:-Je

Chip.

:; 'i

t :-Jere

of

lI'ay occur ia

which

case

non-catastrophi::

d e plo y men t

0f

of

::ecausc ,~~(,lling :":.l',;r,,,

asp

are

can

~.:a C'hi nE:.

Unit can also be replaced ~::~ a time ::-20 ~inutes in case cf a ~~:astrophic

Eallct

~t~cs:

failure. ~-"= -IiQ"":~~ ~.2

Hachines

~ay

~e

This seems te

.Annals

Yorker

of on

the same

The

ta~pered

~e

lines

major

an

7.

1988.

. :angers

advantage

tem. The progra~~e of

":11 t. ~;~ tD.dY . .

~

~ .

..

'.

as in

appeared

a press

Computer

Electronic

it

can

in

New

on

clipping ':ot::.:-::;,'

Voti~;

not

been

~eplaced.

Vot::.~g ~achine

fused

have

~achine

and hence cannot be

be accessed.

abur.dant -- precaution. -

Electronic the

Fraud

the

that

well

is permanently

be tested by the suppliers

.

as

of

of

tampered with even if

have

article.

in !ncia is t~e fixed programme nature 0: the sys-

developed

matter

issue of concern. The co~tents of

~ajor

De:;.ocracy'

Nove:::ber

with

the

before Since

E'..enthE:n.

insturnents' a poll the

signature -----

type

ciscus's-eaof equipment.

possible methods of tampering are different and have

been high

liQh ted in the Sect ion

may

to check that they

presentli'

is a different

as a

al-

J. Q.

~.

~\o~.

\)( dan G\.\\)ta

/.,h~\"\1~\1 OWICef

,~ .~'I~ / sectlo\'\ 'I\~~~ k~-<\;,
,\ Page

No.

8

~

.] 1

4.3

,

Tl1e Machine

.n:a.r be damaged upsetting the poll ;::-,''::::

The damaQe

is understood

nicaf consequences

1.

to be physical

of such physical

damaQe

damaQe

and the tech-

are a~ under:

Ballot Unit damage Physically

st~c~q and agile people or mentally dera~ged

people

may da~age

little

away :~~~ the Polling Officer.

:;'ot

the Ballot Unit which

is static~ed a

:~~o pieces using hammers e~c.). ~~e Eal-

lot U~it

c~uld

be ~~placed

without

affect:~q :he

poll u~t~ :~at point. ii}

i~

case 0: attempted

damage

by making one c: the

sw~tches stuck. apparently disabli~g the other switches. a link-error alerts the Poll Officer who

.

~

can set ~:;ht

the mechanis~:

not set =ight

the mechanism

native

2.

i~ the event ~e can replacement

as alter-

is available.

Cable Unit Damage No wrong

i~for~ation

gets

recorded.

The cable can be

replaced. J. Control Unit damage If the Control Unit is damaged.

l

in-

form.ation

the

memory. ~

.

the poll could be con-

tinued with a second Control Unit. since the poll upto

However

the

point

it should

is

safely

be ncted

stored

in

that Control

Unit

.'

~

~

I /.

Jhusud~n Gupta

3Ij'fPl

u.,.tj<Jii
.i

,\I~'I';

,);g. '1~ f~,,<-fj-110001

. ~ A::;HOKA ROAD,NEW ..! ,', ':i .... .l

DELHI-110Cj'l

Page

No.

9

damage is equivalent to snatc~i~;! :~e Ballot box. ana suitable administrative pcocedu:~s may be f~llowed. including repoll as per Election Commis~ion norms. -

.

4.4

The Machine denies

\ I

the right to Recount

.

On the contrary,

1.

the whole

ana can be dumped

through

process is stored

in the memory,

a Printer to get the detailed pic-

ture of voting. With the added administra~ive procedures of , the Election Commission to maintain a register of the voters

I

in the sequence 1

recount

of

their

is possible

voting,

but

agains~ any possible

not only

also verification

the process

of

of the recount

tampering is also possible.

I

4.5

Bias against the poor

J

While the comment in certain

on the bias against the poor as reflected

articles

has

been noted.

the experience

of the

I

Election

Commission

in

same. ~his is mainly !~c:

e':en s impl er

paper to which 5.0

because than

the voter

Advantaaes of Electronic The

Committee

Electronic Voting cussions:

*

traAls

noted

so far does

the equipment

5 tamping

not

confirm" the

is simple and in

the conven tional

Ballot

is already accustomed. Votina Machine the

Machine.

following

advantages

of

the

as they emerged in various dis-

possible reduction of tirne between the time of" withdrawal of nominations and the commencement of Polling, resulting in considerable. saving in matters relating to maintenance of law and order, candidates' expenditure on campaigning etc. cons~derable saving in printing of stationery anc. transportation of large volume of Election material.

Page No. 10

.

discoursQing booth capt~re by votes that can be cast in an hour in a booth.

thus allowinq

Hachinery

*

to take appropriate

the procedure .

for mock

tern generates

confidence

operation

*

between

the

eli~inates

elicinates

is

voting. which in several

the c~unting the counting

up

and losing candidate.

of

reduced

.

and

as well as eliminates

tension/disorderl:,' scenes

process will

to the difference

drastically

at counting.

building

due

get

to the short

completed

ti~e

i~

with the intro-

Voting Machine.

the entire process of voting is recorded in sequence and is available

for analysis

sion at a later date against *

into the sys-

in the voting community on the

to be comparable

duction of the Electronic ·

more than 300

for the !.aw and Order

incorporated

invalid

t~me

~ischief

the possible which

ot

remedial action.

the winning candidate

counti~g

during

poll

:,;.no

the number

of the system.

the system

cases is understood .

time

.

,

-..-

Possibility Booths

of

the

t~ facilitate

by the Election

any contingency.

introduction fuller

Commis-

of

Mobile

participat~on

po1"ling

ef people in

the election process.

Page No.

11

6.0

Recommen~ati0Jl! 11

1.

Sample electrical check of the Control Unit and the ,

Ballot

...

Unit prior to the Polling.

to be prescribed .

by the Manufacturers

that the embedded.-'. programm~ --- -"

2.

The diagnostic check so as to ensure -

has _n~~.be~n t~~p~~ed with.

Inspection of the Ballot Unit/Control Unit as well as the cable at the time of the insertion of the Ballot

paper by the Returning Officer with suitableaids to ensure J.

that duplicate every

equipments

Ensur:.ng.

in

polling

connecting

Cable is visible

are not used.

Booth.

t~a t :~e

i~ ter-

at all times.

Ensuring. in every Polling Booth. that ~o device is inserted between the Cable-Connector and t~e Control Unit.

5.

Carrying certain

booths

at an appropriate

to act as a deterrent so as to generate fallible

basis.

nature

against

a climate

=~c=~~ti~; 0: ~ot=~ i~ adminis~=ati7e

potential

of electoral

level.

~ischi~f-~akers

of confidence

about the in-

process.

.1hu \I' " Clpta ~d(Jn ut1lcer 'I.ql

-.111<1111

ELECTION '":OMMIS510N OF INDIA

3n11

~)~. ~r~ ~",,"-110001

ASHOKA ROAD,NEW DELHI~11000t

Page

I

'11

4.

out on a sample

,

No. 12

7.0

Conclusions The Committee

after a r~view of the material

has come to the ~ollowin9

i)

.

present~d to it

conclusions:

The basic Elect:-onicVotin9 Machine. developed by M/s. Bharat Electronics Limited (BEL) and HIs. Electronics Corporat~on

of !~dia Limited

(ECIL) under the over-all

aegis c: t~e Election Commission Elect~c~ics is a secure system.

and the Depart~ent of

T~e

very

secu:-ity e~anates

f:-om two

~=por~ant

~asic

~ac~~rs:

ai

7~e

:~:.:ed;:~og:-arnme nature

is f~sed :~to t~e processor

of

which

t~e software

which

is effectively unal-

terabl.t!.

bl 7~e f3it~ful ~eco:-ding of 'all events ~~ the ~rocessor a~d the possibility of recalling t~e same wit~ t~e acded adrninist:-ative procedures prescribed by the E:~~tio~ Cc~rnission which make available t~e.sequence of 'Joters voting- renderi~g it possible to verify the recorded vote in case of any doupt wi th regard ii)

to possible

tampering.

~ith t~e provision of non-volatile inter:-uption l~ads to the retention

memory, any physical of all infor=ation

upto t~at point. iii) With

the system as designed

built-in -1 ,,\

e.S1EOovernment equipment,

security,

the

by the above agencies with

Election

Comr:\ission and

the

only need to ensure the securi ty of the to safeguard the sanctity of the electoral

Page No. 13

. .

t

process. The Committee further recommends that c~rta~n procedural safeqaurds as stated in Section 6.0 should be. implemented. iv)

The Cc~ittee

wishes

of accomplishments M/s.

Eharat

Corporation Elect=cnic

v)

to place on record the high level

of the

Electronics of

Indi.a

Voting Machine

Engineers

Limited Limited

and Scientists

of

and M/s. Electronics in

developing

an

using the latest technology.

The C=rnmittee unanimously recommends the use of the Elect=cnic Voting Machin~s with out further loss of ~ time.

Page lIo.

14

~

..........

.

'~

C;OV[8N\ff'.-

I .

tif.~!P;~:; DEPARn.IENT

MOST

.

-

...

IMMEDIATE

BY HAND TODAY

.

5 RAVI JOINT SECRETARY TELE: 61 1320

"'~ :fr.n:

~~I:

OF EL£C-'"

~.

(,,'r;Jr:~

LOICNAYAK BHAVAH. r~)fNEW

DELHI.UlOQ

TLX. N08. 31.6S1~ I 31.81'3' G'I'" ; DEPTELECTRON

~t a,,«.

~

............

.............. OA

0.0. N:

;:."T)

(3r.fleort

snir. KHAN MARKET.

CA

~

:.,..;,

fED

DOE'1CC:::./EVM/89

................................-.-

April

11.1990

The 21ec~or3l ~eforms C~mmit~ee i~ it~ ~ee~i~g held on 31.3.90 suggested to Secre~arj'. Dep8rtme~t ~f Elec~r~nic~ that the Electronic Yoti~g H3chi~e d~veloped ~y ~/5 ECIL and Mls BEL should be objectivelY evaluated C7 3 Group of Expert~: in partic~lar from the point of vi~~ cf rigging. tha~ :s to say. ~he~her the machine could. at any point of time. be tampered uith. It h8~. therefore. been decided to form a Commit~ee of thr~e exper~~ compri~ing of a di~tinguished council member of the In~titution of Elec~ronics & Telecommunication Eng1neer~. 3 di~tingu~shed Prof. of lIT and the Direc~or of Electron!c~ ~e~e8rch & Development Centre. 7rivandrum.

It has further been decided to request you as a Council Member of the IETE to be the Chairman of the Expert P.V.lndiresan of lIT Delhi and Dr. Rao Group. Prof. C.Kasarabada Director. ER&DC. Trivandrum. are the other members. The Committee may submit its report to the Department of Electronics preferably by 24.4.90 or latest by 30th of this month 50 as to enable the Government of take a decision in the mattp.r before a Bill is introduced in the P3rliament in May 1990. Secretarial a~sistance to the Committee ~ill be provided by the Neu Delhi Centre of the Appropriate Automation Promotion With

regards.

Programme

of ~artment

c..~~.,.

~~y? .'

n

'f'\

Yours sincerely.

~ ,,~

.

Prof. S. Sampa th Chairman.

.

\

R. A. C. of

New Delhi.

Defence.

~

."\l\\o\.1 G\'\~\'i\(

.

~

(/'/' ''''ll''~~\,\S\)~:).t\ ~ice{ '" o ..

~:...

DefenceResearch& Deve~~ Ministry

of Electronics.

.

.:!~ec\\~-n\'t\ ~Q\~

~«fi~~~~.

Sena.\S\131ia.v."aeo~~\~(ot5.\:\~\.'\'\Oo

ci\o~1.\'1..

:;..1.~'l'
€\,.€ '1\'. o"'O'~ ~ y..."'~ 1»,&\,\0

1

~

S .. (J~.

5. Ravi)~

. .

COpy

1.

to:

Smt.

.

Ministry

COpy also

V.S. Rama Devi.

Secretary. Legislative of La" & Justice. Ne" Delhi.

Dep3rtment.

to:

2.

Shri a.s. Hyderabad

3.

Capt. S. Prabhala. Bangalore They

Prabhakar.

Managing

Chairroan

&

ECIL.

Director. Hg.

Direc~or.

BEL.

are requested to provide all assistance

Comro1ttee

1n their

:0

work.

/ S.

Ravi

:~~

, '11

5 -, I ,

'-

EV M MANUAL

\

.

jI

1990 ,~ "J :j ,'~ ',j ..'!

,"

1.

Commission had purchased around 10.8 lakh Electronic Voting I\.1~chinesfrom M/s Electronics Corporation of India Limited i.e. M/s ECIL, Hyderabad and M/s Bharat Electronics Limited i.e. M/s BEL, Bangalore, the two Govt. of India undertaking Companies

authorized

to

manufacture

EVMs

for

the

Commission. Out of these 1,50,000 Nos.' of EVMs are of 198990 model. 2.

Since the normal life of the EVM is roughly 15 years, as certified by the two manufacturing Companies (i.e. M/s BEL and M/s ECIL) it is risky to use EVMs older than 15 years in an election as. these

machines

contain

electronic

items

and

any

malfunctioning during poll may lead to strong criticism and reaction from all quarters. Considering this, the Commission is contemplating to replace these old machines with new ones.

3.

At the 'same time the

Commission

has suggested

the

manufacturing firms to upgrade the EVMs adding some new features. Some of these features are: Real Time Clock Better display section (alfa-numeric) Time stamping of every event conducted on the machine. .Hourly Total Battery power indication. Power saving mode. Facility for totalizing the results from various control units if connected etc.

4.

In consultation with the Commission, the two manufacturing firms have already developed the upgraded EVMs with additional features as desired by the Commission and 'demonstrated the same before the Commission on 12.12.2005.

5.

The cost of improved model of EVM will be around Rs. 1000/more than the existing one (Rs.8670/-per machine plus Excise duty, Sales tax and Transportations etc. as actual). However, the two companies, as a matter of good gesture, have informally agreed to replace 1,50,000 old machines (89-90 model) with the new upgraded machines at the present rate.

6.

The existing EVM, which is being used presently, was subjected to technical evaluation by an 'Expert Committee' in the year 1990 which comprised of Professor P.V. Indiresan, Dr. C. Rao K<:isarbadaand Prof. S. Sampath. The expert committee after going through all kind of technical detail available from the manufacturer opined that the machine is full proof and secure system without any possibility of tampering. Since the new upgraded EYM, that the manufacturer have proposed to produce is having some

o ~:(\E.~~€ A

additional features, the Commission has again constituted 'Expert Committee' (on 29th December, 2005) headed by Professor P. V.

Indiresan alongwith Prof. D. T. Sahani and Dr. A. Agarwala, lIT

-

"

\.~

~\.I

. Delhi to get. the upgraded EVMs evaluated before finally accepting

.),: )... IJ\\\1\
,

'I..

" "v"

\\\Ce{

,\\\' 0'\ () ," ,C\\ '1\

,ffi"\ ," -'. J\,-n\ or'~o "t:\'S~\,\\,\ ,t, f.\"~S\t'\'\\)\)~'\~\)\)\ ~N co\'1>~~ ~ oE.\."'" \:,C\\ <.\"1,. ~E.-.N \:,\.. :§,!,\' ~o,..o. ...o",p.. ",c;".

,11-

F/t

7.

The M/o Law & Justice has also been apprised of these progresses frornI time to time. The Commission has also forwarded a proposal to Ministry of Law & Justice to keep a provision of Rs 200 Crore for replacement of 1.5 lakh old EVMs with ~ew upgraded EVMs and a provision ofRs. 250 Crore for purchase ofEVMs that will be required due to increase in the no. of polling stations (after lowering the maximum number of electors assigned per polling stations from 1500 to 1200) in the budget for the financial year 2006-07.

8.

Th~ Expert Committee has studied the various features of the new EVMs and has visited the factories of both the manufacturers to get detailed inputs. Now they want to have a meeting with the Commission for finalising their report.

9.

The Commission's

meeting with the Expert Committee for

evaluation of the new upgraded EVMs has been fixed on 4thJuly, 2006 at 11 AM in the Commission.

. .»'. ~. \'.'

f "

\ .I .

t

DRAFT

\, .

1989-90 EVMS - REPLACEMENT

ADD~ONALFEATURESCONT&~LATED ADDJ'rIONAL

PI!ATURI!SI

1. RealTime Clock 2. Time Stamping & Event Logging 3. HourlyTotal 4. Single PollSingleVote 5. OlsplayCharacters 6. TotallzerFacility

7. FactoryProgrammedUniqueSerial Numbertor everyControl Unit ~

e. ModifiedInterfBce Between CU&BU 9. Battery Low Indication

RIALnMI

CLOCK (RTC1r

RTCIs built In the system.

RTCenables continuous dIsplay 0" Date, Month, Year and

Time on the display panel. This enables time stamping and time logging. Lithium battery used "or RTCneeds replacement In every 5-1years.

TIMI!! STAMP!NG AND TIME LOGGJNGI

Every vote Is Time Stamped, Control Unit power ONtime and activation of all functional keysare tIme loggedand stored. EnoughmemoryIs provided In the unit for the above data to be stored up to 20 elections Inclusive of First level check, Dlstrtbutlon check, Mock poll and actual poll. Roll over facility Is /'or 20 elections I.e. when 21st election commences, the 2nd election data gets erased and so on.

It Is possible to store the

result or each election. The time stamping of voter data is stored only for the election In progress and gets cleared with operation of the CLEAR key.

HOURLY TOTAL (HTlI

ThIs racllity can be made aVlIllable during the Result phase. renamed as HT. Hourly Total can be seen only after close.

~~ t)

~11~~

,

i,-

:~L'i POLL BINGI!!L VOTE (SPS.v1:

Slnole Poll ZlndSingle Vote design Is Incorporated In this eVM. 'The maximum number of votes In one EVMIs 2000. As the EVMs are being used only for one post, the MCU connector renamed as Data Interface.

DISPLAY CHARACTER:

26 Alpha Numeric characters can be providedon the display panel In two rows.

fO"ALIZI!R

PACJLlTYt

A specIally deslg~ed Totallzer will enable the summing up ~nd display of, results from

several CUs.

UNIOUI! SeRIAL NUMBERI

A unique serial number assigned to every Control Unit and programmed accordingly. This feature avoids use of the same CU repetitively (either unintentionally or Intentionally during totallzlng).

MODIFIED INTERlACI!

B!TWI!!N

CU It BUI

New design Incorporates 8 modlned Interface between CU & BU.

BATTERY INDICATIONI

Battery Power will be Indicated with the Initial power ON condition and with Total Key.