Indias unsafe EVM: Shooting the Messenger

BANGALORE, INDIA: Over the weekend, the Indian establishment demonstrated how bizarre the mix of political insecurity, intolerance to criticism, and sheer stupidity could be. The Mumbai Police arrested Hari Prasad, chief of Indian R&D firm Netindia Ltd.

Prasad is part of a team of security researchers including American computer scientist J Alex Halderman, who have been working to show that India's electronic voting machines (EVMs), like those in the US and elsewhere, are flawed, and can be hacked, altering election results.

In 2009, the Election Commission of India (ECI) publicly challenged Prasad to show that India's voting machines could be compromised. But incredibly, they did not give him access to a machine. Prasad's team managed to acquire an EVM from a source earlier this year, and soon proceeded to expose security flaws. On August 21, Prasad was arrested for refusing to disclose the identity of the source of the EVM used for the tests.

Also read: And it's time to catch election results online

Halderman wrote in his blog that early on Saturday morning, at 5:30 am, ten police officers arrived at Prasad's home in Hyderabad. They questioned him until 8 am, then placed him under arrest and drove him to Mumbai, over 14 hours away by road.

Hari K Prasad, J Alex Halderman and Rop Gonggrijp have been working on an “independent scientific study of the security of India's EVMs”. On the project's website at indiaevm.org, the team reports that the ECI has spoken of India's EVMs as "infallible and perfect", yet similar machines used around the world have been shown to suffer from serious security problems. India's EVMs had never been subjected to credible independent research, says the site.

An attacker with brief access to EVMs can tamper with votes and potentially change election outcomes. This could be done two ways: one, by replacing parts of the machines with look-alike parts (without the involvement of any local poll officials); and two, using portable hardware devices to change the vote records stored in the machines. The latter may involve local election officials, but still be undetected by national authorities or the EVM manufacturers. In one experiment the team added a Bluetooth module, to be able to swing the EVM's votes wirelessly. (The EVMs are “sealed by stickers, string, and red wax”, which are hardly any barrier to an attacker.)

The team also says that the EC-appointed expert committee which certified the EVMs as secure comprised people with no apparent EVM security credentials, who did a superficial study based on presentations and site visits, while Prasad's team worked with a real machine and demonstrated working attacks. The team notes that real criminals would probably have less difficulty in accessing one or more of India's 1.4 million EVMs than this research team did; and the real criminals would not be working to inform the public about the security problems.

There are two ways to handle the scientific critic, or the messenger of bad news.

In July, in the world's premier security conference Defcon, security researcher Chris Paget demonstrated how easy it was, using $1,500 of equipment, to intercept GSM mobile phone calls. The US government and FCC could have arrested him. They did not. The demo has been taken as a wake-up call for telecom security.

On the other hand, in China, a critic who demonstrates that a government system is flawed will get an early morning visit from the police, and will likely disappear without a trace.

Are we getting dangerously close to the China model?

There is enough evidence from global research now that there are serious concerns about EVM security. The Netherlands, once fully onto EVMs, has switched back fully to paper ballots, and other nations are contemplating following suit. It is past time for India to open up EVM security to serious scientific scrutiny, on an urgent basis. In the process, the ECI should apologize to Hari Prasad and his team, and appoint them as consultants in beefing us security for electronic voting.

If it does not do this, I have to suspect the ulterior motives of the Election Commission of India, which has been working so hard to suppress information about security flaws in its EVMs, rather than find out how to fix them.

Prasanto K Roy is chief editor (ICT) at CyberMedia, and can be found on twitter.com/prasanto or www.pkr.in

Name
Email
Comment Here
Code Verification

Google India gets forex violation notice

Websites to help you plan the 'perfect V-Day'

Five Chinese held for theft of 1,600 iPhones

Gaga launches her social networking site

Symphony merges with Teleca

Aakash tablet booking crosses 20 lakh

'IT is like a business partner for PTI'

Sleazegate: Technology spares none

Jailbreak software released for iPad 2 iOS 5.0.1

Why this blackout, Wiki?

Subscribe to PCQuest for iPad & Android tablets

Register Free at DQ Top 20 Online portal & get insights on the Indian IT Industry

Enterprise IT News and Analysis in your inbox

Subscribe to the free PCQuest newsletter

Growth of SME Sector in India

India's EXIM Policy 2010 / 11

Interaction with SMB Association Heads

Profiles of leading SMB Associations

RBI Guidelines on lending to SMEs

Sponsored Links

Custom Site

Demo Downloads On :

1-Click News Updates