-':11 ....

... ..

j

Ree:istered.

ELECTION COMMISSION OF INDIANirvachan Sadan, Ashoka Road, New Delhi-l 10 001.

No 4/RTI/89/2007/JS-II '( ~ 11\f( . Dated: 4th June 2007.

Toi Harikumar P,

Pallathadka,Kasaragod,Kerala- 671551

Subject:- Right to Information Act, 2005-regarding.

Sir,

With reference to your application dated 27.2.2007 and subsequent letter dated

28.05.2007 on the subject cited, I am to forward herewith certified copy of the Test report

of Shri P.V. Indireson Committee regarding the Electronic Voting Machines, com~

42 pages which were inadvertently mentioned as 43 pages in Commission's earliereated05.04.2007

Yours faithfully,

Encl. - 42 pages. ~(S.R.KAR)

UNDER SECRETARY &PUBLIC INFORMAnON OFFICER

m@C0@~ @{] ~[}O@~C0@~ @@UiJi)UiJi)o1N@@

1J@[?

u[}o@ u@@[}o[Ji)o@@D~w@DOD@~o@[Ji)

@{]

u[}o@ MC0@[?@@]@@]~D@@~[?@[Ji)O@W@~O[Ji)@~@@[}oD[Ji)@

REPORT OF THE EXPERT COMMITTEE FOR EVALUATION OF THEUPGRADED ELECTRONIC VOTING MACHINE

Acknowledt!ement

The EVMs, introduced in 1990 have provided excellent service in assisting the votingprocess in India. These machines are now nearing the end of their life, and need to bereplaced. The two PSU companies BEL and ECIL which have been manufacturing theseEVMs have developed new designs incorporating some additional features as desired by theCommission. This committee was constituted by the Commission vide their reference:51/8/16/2004 PLN-IVNol 111/804-806dated 29/12/2005 to evaluate these upgraded EVM's.

The Committee met in New Delhi in January 2006 at lIT Delhi, where representatives ofBEL and ECIL demonstrated their machines and presented the salient features of theirrespective designs, including the steps taken to incorporate the additional features asmandated by the Commission. This Committee suggested some additional technicalevaluation such as on EMI/EMC standards to be performed on the machines. Subsequently inJanuary 2006, the Committee traveled to Bangalore (BEL) and to Hyderabad (ECIL) andconducted in depth evaluation of the machines and held technical discussions with the entiredevelopment teams of BEL and ECIL. Additional essential enhancements to the design of theEVMs and their utility and feasibility were also discussed in this visit.

The Committee also studied the inputs that the Commission and the manufacturers havereceived nom the public over the years on the EVMs. The results of this study have beenincorporated into the report of the Committee.

It will be in place to acknowledge that the very thorough evaluation conducted by the expertevaluation committee in 1990 on the then EVMs was also re-visited through their report and,the recommendations made by the 1990 committee being extremely important for the fairconduct of elections using EVMs and, additionally having proven their worth duringelections in past 15 years, have been incorporated in this report as well.

This Committee acknowledges with pleasure the cordial, stimulating and very effectiveinteractions with the technical teams of both BEL and ECIL.

Finally, this Committee gratefully acknowledges all the support of the Chief ElectionCommissioner and all staff of the Commission, in conducting this study.

I.

New Delhi5thSeptember, 2006

REPORT OF THE EXPERT COMMITTEE (2006)FOR THE TECHNICAL EVALUATION

OF THE UPGRADED ELECTRONIC VOTING MACIDNE

INDEX

1.0 Background of Electronic Voting Machine (EVM) 1

2.0 Man.ufacturers'Presentation 2

3.0 Evaluation of the Upgraded Electronic Voting Machine 2

4.0 Concerns raised by various Organizations (1990-2005) 7

5.0 Advantages of the Electronic Voting Machine 12

6.0 Recommendations... 13

7.0 Conclmions 15

Page

REPORT OF THE EXPERT COMMITTEE (2006)FOR THE TECHNICAL EVALUATION

OF THE UPGRADED ELECTRONIC VOTING MACHINE

1.0 Baclmround of Electronic Votin!! Machine (EVM)

(a) Introduction

During the seventies the Election Commission of India, put forward the idea ofintroducing Electronic Voting Machine (EVM) in the election process in India.Towards this end, the Election Commission induced two major industrial enterprisesnamely Mls. Electronics Corporation of India Ltd., Hyderabad and Mls. BharatElectronics Ltd., Bangalore to design and develop suitable versions of the ElectronicVoting Machine for introduction in elections. With the approval of the Govt. of India,in 1982, the machines were introduced in 11 constituencies and put to use. On thewhole, the systems worked satisfactorily.

The Electoral Reforms Committee in their review at that time suggested that the EVMbe evaluated in an objective manner from the technical point of view with specialreference to the possibility that the EVM can be tampered with. Accordingly, at therequest by the Electoral Reforms Committee, the then Department of Electronicsconstituted an expert committee to carry out the technical evaluation. The expertcommittee in 1990 after a thorough review of the design, manufacturing, testingprocesses, recommended accepting the EVM's while taking certain precautions sothat the EVM is easy to use, is rugged, well maintained and cannot be tampered with.

The EVMs have since then been in use for over 15 years and have proved theirreliability and conduct of tamper-proof elections, year after year.

(b) Present Status:

The EVMs having served over 15 years are due for replacement. Further, based onexperience gained from extensive field use, the Election Commission asked BEL andECIL to introduce additional features, to further the cause of reliability and tamper-proof working in the new EVMs to be manufactured.

(c) Expert Committee on UPgraded EVM's -2006:

. . S. . :1 t.{}The Election Commission set up a technical expert committee in Dec. 2005 under

.~ '"{'"t.t.. chairmanshipofProf. P.V.Indiresen,with Prof. D.T. Shahani& Prof.A.K.Agarwalaof lIT Delhi as members to examine the upgraded EVM's and give their

~ recommendations by Feb 2006. (Ref: 51/8/16/2004 PLN-IVNol 111/39dated 4-1-

~. :W06).In view of additional testing that the committee asked from ECIL and BEL the'j. ~~ of the committee was further extended. After explaining the findings of the study

~ (~~~ as ~e ~ain reco~endations to ~e Election Commissionon 4-7-2006theI aa"~~~,,~l-eport ISbemg submItted by the commIttee.~ \'" c\\o

_~ ~~/se ~,"11''f\f ,~O\/I..~~~ ~'U"~\~ 'o~ 0 ""

~"'1 ",,1:<\O~~\ss__!i\."'\)\"\)O()'OL'c \ \?:,.~-, \-\\.

C~, \' .,~ - .~Iut:....",\.-E. . ~,,,. ~\;....to. ;.>,\1'\ f'op.O.

LlO"'/>.~SP

1

2.0 Manufacturers' Presentation

Early in January 2006 on request of the committee, Mls. Bharat Electronics Ltd., andMls. Electronics Corporation of India Ltd., made presentations on the operational,technical and manufacturing aspects of the EVM to the committee explaining theearlier features and design and also demonstrating the additional features and newdesign changes incorporated.

The agencies also conducted mock polls before the committee. Specifically thepossible physical methods of tampering and the countermeasures incorporated in thedesign were also demonstrated, highlighting the enhanced security and tamper-proof-ness of the design.

Committee members subsequently visited ECIL Hyderabad and BEL Bangalore andinspected the manufacturing and testing process of the EVM. Discussions were heldin great detail with their engineers on hardware and software aspects of the designwith specific reference to integrity of the voting data recorded in the EVM andpossibilities of tampering this data .

After the above meeting , the committee, considering the advances in technologysince 1990,made the followinginitial recommendations:

(i) BEL & ECIL to conduct EMIlEMC tests and modify hardware (if needed) sothat the EVM design strictly complies with existing standards.

(ii) Introduce Dynamic Coding of Key no's to enhance security of data transmittedfrom Ballot Unit (BU) to Control Unit (CU).

(iii) Introduce Time Diversity in data recording to eliminate effects of random noise.

(iv) Every key press on EVM, even if invalid, be electronically "date-time stamped"and kept as permanent record (in the EVM memory).

Accordingly BEL and ECIL asked for additional time for (i) EMIlEMCcompliance and reported compliance to EMIlEMC standards by mid February.Implementation of points (ii), (iii) and (iv) would only enhance data securitycapability on lines of current practices but the operating features will remain the

~ f;~e. It was agreed by the manufacturers that these could be implemented and

'f'1 t.-S \ '-'iliat it primarily involved some alterations in the software, while hardwareit' .\ design would remain the same. Once the software was modified by the

manufacturers to meet the above recommendations, only a detailed check of

~functional working of the modified EVM would be needed, which EC as the user

., ~ could do on its ow~ or get done before inducting the upgraded EVMs.~... G~~\a

~ ( ..~~\\d' ce(~~sy 0"\

~fJti,=,e~ tiOb of the U raded Electronic Votin Machine~ ~\~c:"o~ ,;,\ 0.).,,)\

~~~ '\'~4:>~~Theje-are'three major points to be considered in overall evaluation of the Electronic

~ .r-~'('~'~:'...o.""StingMachine that has been developed and manufactured in the country."fo.\ '"I'

2

a.b.

Does it meet the functional specifications of the Election Commission?Is the manufacturing quality of a high enough standard to provide adequatereliability?Is the design stable and tamper-proof?

I

c.

3.2 The first question (a) is for the Election Commission as the buyer-user to examine.As for the second question (b) a detailed inspection of the machines as well as themanufacturing process at ECIL and BEL showed that they are indeed ofexceptionally high quality. The third question (c) needed a detailed consideration ofall aspects of design. In particular, the following points needed to be addressed to:

8. Can the hardware units CV, BV, Cable system be altered at the site of voting?b. Can the system be replaced by a different mechanism (hardware or software)?c. Can the data be tampered with during balloting in operation?d. Can data be manipulated before, or after the voting period?e. Can battery low occurring during balloting cause incorrect data record?f. Is correct date-time being registered on each vote in the EVM?g. Is the EVM susceptible to data cOITUDtionby Electro Magnetic Interference?

The Committee addressed these questions as explained in sections below.

3.3 The EVM System consists essentially of three hardware sub-systems and one oftware,namely:

8. Control Unit (CV)b. Ballot Unit (BV)c. Interconnection Cable between CV & BV

The CV is the main unit which stores all data and controls the functioning ofEVM. The voter presses his voter choice key on the Ballot Vnit (BV) and thefunction of the BV is basically to transmit faithfully to CV the key pressed byvoter (Le. Key number of candidate voted) for being recorded in the CVmemory. The data is transferred from BV to CV through the InterconnectingCable. The faithful recording of the voting data, unbiased and tamper-prooffunctioning of CU is critical to the conduct of a fair election. The programembedded in the microchip in the CV dictates the functioning of CV. Thus forfunctioning of the system there is a fourth hidden entity namely,

Theprogram (software) embedded in the microchip in the CV.

The committee looked into the possibility of tampering in respect of each oneof the above mentioned four subsystems.

3.4 ,..( If the integrity of original program in the microchip is maintained, and the key

.'\ ~\) 'pressed by the voter on BV is faithfully recorded by the CV, then the election through~ I EVM ~abe fair. Firstly the tamper-proof-ness of the program is considered. With

~/~ac\~Wa~e technologyusedandcomplexityinvolvedin tamperingwiththe program< ~{;r&thtfA~hip the followingobservationare relevant.3\"') ~,~ ~ NI\SS\ot,\~oor, . .

,,~ coNI.; ."..,..-:51- ,\Uo(l""ci'" . ~ -;;., OC\..I'II-E\..t;. ., ,\ "'. ~\:.'I\j ...

:\I~': ~O!,O,I/>.s\,\o,",p. .

3

The program is bumt into the microchip on a "one time programmable" basis.,l 'J..~(OTP), and once bumt injit cannot be read, copied out, altered and re-fed intothe chip at all., It is can be fed once only in the chip, and that too only atmanufacturing level, is secret and not amenable to any changes once installedin the machine.

(b) The microchip is allotted a unique ID (at manufacturing stage) embedded intoits memory. The ID is a complex code or "digital signature" which can tellwhether the microchip belongs to the manufacturer or not. The code is notknown to any individual engineer in the production. However, it can beverified on a manufacturer test table that the microchip is genuine belonging tothe manufacturer. Thus any attempt to replace the CV from some other sourceis detectable as the EVM would simply become inoperative.

(a)

(c) This unique ID mates to the E2 PROM (within the CV where all the votingdata will be stored during an election) and, the micro-controller, at the instantof first power-up of CV at the time of manufacturing. Subsequently, the CVwill not function if the ID stored in the micro-controller memory does notmatch that in the E2 PROM. Thus any item to modify the data stored in the E2PROM by replacing the E2 PROM will automatically make the EVMinoperative.

(d) It is noted that for biasing the program to favour a particular candidate, the"key number" allotted to the candidate is essential to be known, and thisinformation for various elections to be conducted in the future cannot possiblybe known at the EVM's manufacturing stage. Hence no bias can beintroduced in the program at the time of manufacture of the chip. Furthermoreinstead of a Static Key Code, the Dynamic Coding of key numbers of BVadvised by the committee, enhances secrecy of key no's being transferred&om BV to CV so any intervention at the connecting cable end for biasingresults during voting period will not be feasible.

The committee examined the possibility of a "Trojan horse" sub-programbeing willfully activated after knowing key number allocation to favour aparticular key (i.e. candidate), by activating the "Trojan Horse" through somemechanism at time of poll. Such entry is viable only thro' "specific Keypresses sequence" on CV or by wireless signal or CV ports. The formeractivity is not viable as all "key presses" are to be time-dare-logged in thememo as er advise of committee and a "re eat attem" in all CV's atvarious booths can be easily visible. on post-election analysis. The activation

~ S1£ {) of "Trojan Horse" by wireless is also.not viable as CV does not have any high~~, ~ - &equency receiver and data decoder for wireless, and hence cannot accept anycoded signal by wireless. The CV ports accept only specially encrypted and

() dynamically coded data from BV. Data &om any other device cannot be

~ . ~. accepted by' CV. Hence data cannot be biased via manufacture stage program.~~{ or by wireless command or by some other unit introduced in place of BV

d G ptiuring voting.~ ~/Ma:~~t~~nagffi~er

31J1I11'~~ 311~ NOIIhus for introducing a (tampered Trojan horse) program, considering theECT\~~OM~I~~.11~~C'~~ture of production technology of the CV, BV electronic cards, the only

EL ;>'1'J1~"l~t1:u~~E.'J~DE.L\1\.11vopossibleprocess is to "physically replace" the CV card by another oneASHOht'

4

I

r .containing a tainted micro-chip, in the time interval between knowing thecandidate key-no's and polling. While continuing to explore this possibilityone has to say at the outset that implementing this needs complicity of anenormous number of people at Manufacturer, Election Commission and Statemachinery, and is impractical realistically speaking.

However, in order to defeat even such a remote possibility the committeesuggests introduction of an additional seal (by EC and partyrepresentatives) on the CUIBU electronic card prior to fIXation ofcandidate key-nos. The Election Commission may consider thefeasibility ofincorporating this seal in their poll protocol if they regard such an eventrealistic considering the level of security provided to EVMs in this period.

(t) The new feature of indicating the battery charge status precludes probability oflow battery occurring during balloting. Even if battery were to turn low duringpolling, the E2pROM storage being non-volatile memory is saved and alreadystored data is not corrupted. Additional feature that is built in is the shut-off ofthe memory much before battery reaches "brown voltage" condition.

(g) Sleep mode features enhances battery life since even if EVM is accidentallyleft ON, then when not being used actively, the the EVM will go in sleepmode and this will save battery power automatically.

3.5 This leaves the question of tampering, with the Inter-Connecting cable between CUand BU. This tampering could happen in three ways:

(i)

(ii)

One may attach a device on top of the cable. This requires skilled operationand will naturally be visible to all the voters. At the same time, the Committeehas seen the Polling booth arrangements that have been finalized by theElection Commission. The Committee notes with satisfaction that the entirecable is in the public view all the time, any such tampering becomes self-evident. Further, in case any such device has been attached to the cable, it willleave telltale punch marks which can be recognized easily. Therefore thisprobability also is ruled out by the Committee.

Second method by which the system may be interfered with is to insert adevice between the cable and the connector situated inside the Polling Unit.This can be obviated by a simple administrative precaution at the time theBallot Unit is sealed. The Presiding Officer may be asked to exhibit the cableto all the Polling agents and get their certificate to make sure that no devicehas been inserted between the cable and the socket. Once the cable is insertedand the machine is sealed, this kind of tampering is impossible.

'. ~,Special encryption and dynamic coding of key no's recommended by the~ Committee will further preclude CU from accepting data from any source\. I other than a valid B U.

~/Mi'dhusudan ~upta~~ ~{sec~~)~OfftCer Any illegal attempt to communicate with CU is automatically detected and aECTI~~6:M~S~NOFo

'oN1D~INKerror is flashed on display drawing immediate attention of the pollEL . ~~ ~~ ~"('11.110

31'11\ ~1""A'D NEWDELH'.11o~fficers./I,'"\OKARO .

.(iii) The third is via wireless signal injection. This possibility has been excluded by

making it mandatory that EVMs be EMI/EMC compliant to standards. Alsothe CU does not have wireless receiver or data decoder and hence it cannotrecieve data via wireless coded/signal. The manufacturers have also reportedthat presence of excessive EMI causes jamming (in which case LINK error isreported by CU) but in no case it corrupts earlier stored data or recordincorrect data.

3.6 In this manner, the committee to the best of its ability has looked into all possibilitiesof tampering with the EVM and has come to the conclusion that there is no way ofaltering the results of the polls before, during and after the poll duration provided, duesecurity precautions already in force and additional modifications suggested by thecommittee are enforced and the sealing at various stages is adhered to. In case for anyreason the Unit has been tampered, it immediately gives an indication that the systemhas malfunctioned and this remains as a permanent record on the Machine and thisrecord can be checked at any time later.

Most importantly it is noted that the EVM's are subject to mock-poll validation atvarious stages infront of all party representatives. This is the best proof of validationof fairness of the program as well as data being stored inside. The seals pre secondlevel protection, as give highest level of access inside the machine only to the officersconducting the poll , and the party representatives procedures in full view of publicand all concerned.,

3.7 In view of all these factors, the Committee'unanimously certifies that the EVMsystem is tamper-proof in the intended environment when due precautions aretaken. For these reasons, the Committee recommends that the upgraded EVMwith suggested modifications, testing and operating precautions may be acceptedand put to use. '

3.8 Any system of this nature requires proper preventive maintenance. Hundreds ofthousands of the units are to be used in any major election and in between they will bestored for long periods of time. During this period due to attack by vermin, rats,fungus or due to mechanical danger, the system might malfunction. Therefore, as apreventive measure, the Committee recommends that before every election themanufacturers may be asked to check (this can be done very fast through a verysimple exerciser) and ensure that all the units are functioning as designed.Incidentally, this method will be checked, by what is called 'the self test signature ofMachine' and thereby the Manufacturers will be able to certify that the Machine is

~~ntical to what they has supplied and it has not been modified or replaced by any

1\T1 E S1 billet.3.9 The Committee's main recommendation is that the upgraded EVM may be accepted

Msubject to the following:

~~a; EVM's be EMIlEMCcompliant. (NEW)\\I13,t\ GU\1ta

~/~3,a"u~JP»«icefDynamic Coding of Key no's to enhance security of data transmitted from~~ ~{:c ~11'\~r,~tDallotUnit (BU) to Control Unit (CU) be introduced. (NEW)

3q'>\ '\\,~(\ ~t-J\'ss'~,\'\ooo'\ Q'\c1'{)~ c,.?' '"'~ Pc:c- i\..\"\,.,\,\QO .

~'-~ ' ~'\~.. ""6."" 0:?rt'" flOp..O.,..

~S\"\O~A 6

--

(c) Time diversity in data recording be introduced to eliminate effects of randomnoise. (NEW)

(d) Everv key press on EVM, even if invalid, is date-time stamped and kept aspermanent record. (NEW)

(e) Additional seal of electronic cards in CU, BU may be introduced by EC to beoperated just before the candidate-list is declared as per 3.4e. (NEW)

(l) All the instruments are checked as a matter of preventive maintenance beforeelection and as a matter of abundant caution, to ensure that they are workingsatisfactorily and according to the original embedded program.

(g) The battery condition should be in MEDIUM or HIGH at start of election asdisplayed on the EVM.

(h) It is ensured in every polling booth that the cable is visible all the time.

(i) At the time of the insertion of the cable it is formally recorded by thePresiding Officer and the polling agents, that no device has been insertedbetween the cable and the connector

(j) After the polling, the cable and Balloting unit is physically inspected for anymechanical damage, or seal intact.

4.0 Concerns raised bv various Ol1!anizations (1990-2005)

The concerns that arise from correspondence placed before the committee by theCommission and the manufacturers from various interested parties as regards the use/malfunction or tampering of EVMs are listed as under:

(i) The Machine may not function properly(ii) The Machine may be damaged upsetting the Polling process(iii) The Machine could be tampered with, and design may not be secure ('Trojan Horse')(iv) The Machine denies the candidates the right to recount(v) The Voting machines are biased against the poor(vi) Possibility of false data transfer altering or erasing voting date in CU memory before

or after voting(vii) Apprehension in the form of a) changes within the machine after three hours of

commencement of b) the changes in the machine data transferring (after 60% of the

AT'TE ~ 1,£ ijtes polled) of the 5 lowest candidates to the favored candidates~iii) Apprehensionof ElectroMagneticInterferenceaffectingthe EVM's storeddata afterelection but before counting and storing the machines in Electro magnetically

Mshielded Faraday cages. Remote signals can be send from a distance to generate

, ·\~ ,resonant frequency of the circuits and make the machine function in some other way.

~V Physic.alshock EVM can withstandon bumpy road in rural areas and possibilityofc\~M\9-mechanicalcomponentsto resetEVMor ECUduetojerk

~~ ~M~~~:1'IK>"Vi~could contain the following flaws: Faulty logic, incorrect algorithm, erroneous~~~ ~\~ ~~aw, error in circuit design, mistakes in software code, mistake in data base

""~ 0t1.~\s..~~\.1'\OOO~oo'\EC1\ot-l.~, .~. .''''OE\..t\I''\'\

El. ~,. . .., N\:.J~"I p..\<;.).'.....

,..SI-\L)I' 7

While most of these issues have been addressed to in section 3, they are againresponded to question-wise below for sake of clarity.

4.1 Machines may notfunction properly

This is a question of reliability. The reliability of an equipment depends on the design,selection of components, procurement and inspection of components, manufacturingprocess, storage and re-inspection mechanisms.

The resultant failures may be catastrophic or non-catastrophic in nature. The designhas been perfected over a long period. The manufacturers have confirmed the usage ofapproved components with due de-rating for reliable operation. Then have also got itcertified from agencies authorized by GOI for Standards, Testing and Quality Control& EMI/EMC and representatives of Election Commission reviewed total qualityassurance aspects of the Machine through the Manufacturers.

The equipments have also gone through climatic tests prescribed in the QualityAssurance (QA) manuals. The Committee noted that the failure rates during the trialperiod are insignificant.

In addition, the catastrophic failure may occur because of failure of the Micro-controller Chip, in which case re-polling may be necessary. The cases of non-catastrophic failure can be catered to by the redeployment of a spare machine.Similarly the Ballot Unit can also be replaced with a time loss of utmost 15-20minutes in case of a catastrophic failure.

4.2 The Machine may be damaged upsetting thepoll process

The damage is understood to be physical damaged and the technical consequences ofsuch physical damage are as under:

(a) Ballot Unit damage

Physically strong and agile people or mentally deranged people may damagethe Ballot Unit which is stationed a little away from the Polling Officer.

(i) in case of catastrophic damage (break in the Ballot Unit into pieces

A "Ir"r~ S"~ t1 using hammers etc.), the Ballot Unit could be replaced without,,\ t C affectingthepollingdatatill thatpointoftime.(ii) In case of attempted damage by making one of the switches stuck,

~, apparently disabling the other switches, a "LINK" error is displayed, .~\;. which alerts the Poll Officer, who can then set right the mechanism;oX. ~Fd in the event he can not set right the mechanism then replacement

J Gu\>" al.. .1 bl

o'nUSU\1<\t\"ice! as an tematIve IS aVID a e.-rf'f1'n{~'a \iO" 0

_~ "J~/sec 3\\11'\"1\'"\~o,p.~~'J~ ~W"~\~ ON0"-

~ '>\\"t(\cotlt~\1;;'~_"\,\(j~'I~~oM\..~C"t,\ON"t\~.-:\\:~.,i.JD~\..t\\

~ 3\~'" ~O~O.~f>.s\"\O~p..

(b) Cable Unit Damage

No wrong information gets recorded and LINK EiTor is displayed. The cablecan be replaced.

(c) Control Unit damage

If the Control Unit is damaged, the poll could be continued with a secondControl Unit, since the poll data till that time is safely stored in the memoryand which can retrieved with the help of manufacturer in full vision of partyrepresentatives. However it should be noted that Control Unit damage isequivalent to snatching the Ballot box, and suitable administrative proceduresmay be followed, including re-poll as per Election Commission norms.

(d) EMI Jamming:

EVMs can be jammed like all electronic equipment. In that event it willdisplay LINK error, but no wrong data gets entered. Earlier recorded dataremains intact and machine reverts to proper functioning after jamminginfluence is removed. This has been verified by manufacturers viaindependent EMI/EMC certifying agencies approved by GOI. Thus fairelection functions cannot be tampered with by EM! jamming. Reports suggestthat magnitude of radiation needed to jam is high and not very practical togenerate near the polling booth.

4.3 Machinesmay be tamperedwith

This seems to be major issue of concern. The committee has therefore attached highpriority to it and suggested ways to make the process tamper-proof.

Since the presently discussed Electronic Voting Machine is a different type ofequipment than the traditional ballot box, the possible methods of tampering aredifferent and have already been highlighted in the Section 3.2 through 3.9. Howeversummarily one can say that the major advantage of the EVM developed in India is thefixed program nature of the system. The program is permanently fused and hencecannot be read or tampered with even if it can be accessed from other source. Eventhen, as a matter of abundant precaution, the instrument's signature may be tested bythe suppliers before a poll to check that it has not been replaced. An additional seal onCU, BU cards prior to candidate key allocation may be introduced to ensure that the

S\~ is not replaced (section 3.4 and, in particular section 3.4t).~11 ~.4 TheMachinedeniestherighttoRecount

On the contrary, the whole process is stored in the memory, and can be dumped

. ~ough a Printer to get the detailed picture of voting. With the added administrative~vrocedures of the Election Commission to maintain a register of the voters in the).:J s~~Qfe of their voting, not only the process of recount is possible but also

~/Mad"\1~\1~gfi\~ation of the recount against any possible tampering is also possible. Each role~~ ~~/sec~~~d 1c6)tJJressis time/date stamped.3qm" ~~ Nof'~

'"'~ OMt/I'SS'~ '1'1000'1 '\ELE.C1.~ON~~-g.""'S~ OEL\"Ilo'l'lOOO

31~ ROP-o.Np.s\"Iov...P-

9

4.5 Bias against the poor

{,\

While the comment on the bias against the poor as reflected in certain articles hasbeen noted, the experience of the Election Commission in trials so far does notconfirm the same. This is mainly because the equipment is simple and in fact evensimpler than stamping the conventional Ballot paper to which the voter is alreadyaccustomed.

4.6 Possibility of false data transfer altering or erasing voting date in CV memory beforeor after voting.

The following is noted by the committee:

(a)

(i)

(ii)

(Hi)

(iv)

(v)

(b)

(i)

..rr'S1~\)(ii)

Security due to Encrvt>tion

The Electronic voting machine is an embedded system with fused fmnwarewhich cannot be read copied or altered. Dual E2pROM memory with fcProtocol with digital signature during factory is incorporated so EVM can notbe substituted.

Expert committee has recommended that the encrypted code is dynamicallychanged by software at each vote cast, so that it cannot be decoded duringtime interval between two votes. Therefore, only genuine BV's can feedvoting data to CV.

Data is stored in E2 PROM in CV which cannot be physically accessed asElection Officer seals the CV in presence of party representative.

E2 PROM is digital signature matched with embedded processor, and henceCV will not work at all if some other E2 PROM was inserted, assuming thatdespite sealing attempt was made to replace it.

Data can be fed to CV E2 PROM only through BV. Special encrypting is usedin passing data from BV to CV. If some duplicate BV is connected the codescan't match and CV will not accept date. LINK error is displayed.

Data Integritv Enhancement due to real time DATE-TIME stamp.

Any vote entered in CV through genuine BV has a real time clock DATE-TIME ~tamp. The clock is embedded in CV and cannot be changed byanybody since CV is 'Sealed' in presence party representation.

During the ballot, the voting data along with the date & time stamping withinternal clock (which cannot be altered after start of election) is written in the

r .'"\§. memory location. Hence all entries compulsorily have real time date stamp."~" Each keypresson CV also is DATE-TIMEstamprecorded.

\id n Gu\>ta

~ ~7\'\i:~~llM~ftiC~y data fed "before" election can be recognized by date-time stamp.3f'1m'1 ~'<A 311U'1""f INDI~

~n~oONlNlISS10N°000,ELEC~\ONf_ ~4 ~"~'; \..'~I.'\'OOO'

'11' ~I'''' NEW 0..310 ';"'" ROAD.

AS'"'

10

(iv) Any data fed for "mock election" conducted by Election officer in presence ofparty representative is also date-time stamped.

(v) Thus any data fed outside the ''voting period" can be easily identified by date-time stamp.

(vi) The voting data is written serially as the voting progresses. (Close Buttonpressed by Election Officer in presence of party representatives at end ofballoting also is DATE-TIME stamped.)

(vii) Further as each key press in EVM units whether valid or invalid is date-timestamped and recorded no activation of a possible "Trojan Horse" by anyspecific key press sequence on EVM during poll canpossibly go unnoticed.

(viii) After voting is completed, the software does not permit to write any furtherdata to any location in the memory. After the CLOSE operation, the machinepermits only the display of the result. Hence no data can be fed after pollinghas ended.

(ix) The machine has a facility to transfer the data out to display, printer orcomputer only after the result is seen at least once. Even after the issue of thedata transfer command, the machine identifies the rightful gadget before thetransfer of data to printer, computer. The machine has no provision to receiveany data from outside devices, other than a valid BD.

4.7 Apprehension in the form of a) changes within the machine after three hours ofcommencement of b) the changes in the machine data transferring (after 60% of thevotes polled) of the 5 lowest candidates to thefavored candidates.

The EVM is an embedded and factory masked firmware and all the machines havesame software & it is not polling station specific. It is based on single transfer vote tothe voted candidates, and the sequence holds from the start of poll to the end of poll &is not dependent on time. Any system can be tested randomly by mock poll toprove this performance. Further as each key press in EVM units whether valid orinvalid is dat-/time stamped and recorded no activation of a possible "Trojan Horse"during poll canpossibly go unnoticed

4.8 Apprehension of Electro Magnetic interference effecting the EVM's stored data afterelection but before counting and storing the machines in Electro magneticallyshielded Faraday cages. Remote signals can be send from a distance to generateresonant frequency of the circuits and make the machinefunction in some other way.

~1tn,,~,,~..,. (a) The equipment has passed EMI/EMC tests as per standards

(b) CD and BD perform without malfunction even when impressed with

. .~ectromagnetic interference at levels as required by international standard, for)o\"1eCtronicequipment as per reports submitted by manufacturers..

,~- J\I dbusudan Gupta

~ / .!."a. ieer~~/seetlon Off'IfI'I ~1" 31rll)"tJ

'.\ ''',,'' ~1~SION of INDIA~lJ~C~\nN~O~~\ ~~1.1 H1~~~1001

:\11'1\ ~ V ,-.\clNDEL"'':''::,~O~f\~v'' . 11

-

(c) CU and BU have been subjected to interference levels much higher thanEMI/EMC standards and verified that voting data is not altered and no wrongdata gets recorded during interference.

(d) CU & BU can atmost be "jammed" by fields higher than, EMI fEMCstandards. However, it is impractical of generate such high fields at the ballotlocation. Further it is much easier to "break" the CU and BU as rather thanjam it.

(e) Under no circumstance wrong data is entered in CU through BU even undersevere EMI, or already stored data altered.

(I) CU, BU resumes normal functions when strong EMI us removed. LINK Erroris displayed during EMI jamming.

4.9 Physical shock EVM can withstand on bumpy road in rural areas and possibility ofelectra-mechanical components to reset EVM or ECU due tojerk.

BEL and ECIL have reported, to cover this aspect, which is a JSS 55555, which takescare of bump test up to an acceleration of 40 g. It may also be noted that anymechanical operation, such as "re-set switch operation", cannot be realized in "poweroff mode" to alter the poll counts inadvertently.

4.10 EVM could contain the following flaws: Faulty logic, incorrect algorithm, erroneousdataflow, error in circuit design, mistakes in software code, mistake in data base.

(a)

(b)

The EVM is an embedded system and all functional checks are performed andfully tested before fusing of the software. The fused firmware cannot be readand cannot be reprogrammed at all.

All write operations in memory are followed by read operation verified onspot. The committee has recommended time diversity while writing to thememory devices. All EVMs are tested for all functions prior to electioIlNumber of mock polls can be conducted before start of balloting to ensure onthe spot to party representatives that EVM is fairly recording. Any failureincluding that due to any random noise would be detected and incorrect dataentry would be automatically rejected. Only correct data would be recorded. Incase any hardware component results in an inoperative condition, it is detectedand displayed as ERROR message and taken care of only by either removingthe offending condition or replacing the EVM if need be.

r. ,~~/,~'\tfaving considered in detail various apprehensions it will also be appropriate to~ ~~i the various advantages of EVMs as well.

/"'ac:\"\1~\1 otticef_~ :1"''' /sectlOf\~'<;3~~~\~ 31f!1'bf\tt&ssible reduction of time between the time of withdrawal of nominations and

3q ~~~Otll~\W';~'\'\OO,\~\QC1commencement of Polling, resulting in considerable, saving in mattersEl.E.C~,' 1:\~' ';\~E.-.NC'cE.l.\-I\.

J\~" ROP.C.N,.,~\-IO"'''

12

.relating to maintenance of law and order, candidates' expenditure oncampaigning etc.Considerable saving in printing of stationery and transportation of largevolume of Election material.

Discouraging booth capture limiting the number of votes that can be cast in anhour to no more than 300 in a booth, thus allowing time for the Law and OrderMachinery to take appropriate remedial action.The provision of a procedure for conducting mock-poll to verify correctfunctioning of the EVM before a poll and that too in full public view,generates confidence in the voting community on the fair operation of thesystem.The system eliminates invalid voting, which in several cases is understoodto be comparable to the difference between the winning candidate andlosing candidate.The counting time is drastically reduced, and eliminates mischief atcounting, as well as eliminates the possible building up of tension/disorderlyscenes during the counting process due to the short time in which thecounting will get completed with the introduction of the EVM.The entire process of voting is recorded with real time date-time stamp insequence and is available for analysis by the Election Commission at a laterdate against any contingency. Possibility of the introduction of MobilePolling Booths to facilitate fuller participation of people in the electionprocess. New features introduced in the present proposed EVM's in tune ofrecent advances, have greatly enhanced capability of conduction of fairelections with EVMs.

Each vote is date-time stamped, so that any attempt at rigging say too slowvoting or rapid voting in limited time, or voting before or after election periodis duly recorded in memory.Data on past 20 election including mode elections giving a unique "history ofuse" signature which is unique to each individual CD, and in parallel thewhole manual record is also available independently with EC, both of whichcan be checked and co-related post election, if needed.

.

.

.

.

.

.

.

6. Recommendations

Recommendations of the committee are given in three parts, namely (i) Designchanges, (ii) Polling- time precautions and (iii) Futuristic actions.

The EVMs shown to the committee have undergone hardware design change tocomply with EMI/EMC regulations at the suggestion of the committee. Additional

~ 1I!..:t1f11ftg~'sto improve data integrity have been discussed with the Election Commission~11i;.'tJ lhiJEVM manufacturers as being desirable and feasible to implement which willhowever need due software changes to be done in the micro-chip. The EVM wouldnaturally have to be fully tested after incorporation of these changes and this testing

. s90uld be got done by the Election Commission prior to the induction of EVMs..~. \

~"S~condly certain key precautions on EVM use need to be taken during polling

/Madb~~~~ these have been highlighted in (ii) "Polling process precautions" part.~ ~/section office3\:l~1TI """"{'fA 31111\11

"1~ ,"" SI ON OF INDIAELEC110N fO~~I~:-.,:.\, -110001001

Jl1'II ~I~. NEW \)ELI-41.11AS\-\Ol'A ROAD..

13

Last but not the least, it is strongly felt by the committee that while the upgradedmachine with suggested changes is strongly immune to data corruption, it does notensure "voter-identity" which is very important, and is presently accomplished usinghuman judgement. However new technologies are emerging to be available in freemarket which can hopefully address to this issue. It is suggested in (Hi) "Futureactions" that several methods of bio-metric identification be introduced on trial basisin the elections and feasibility of integrating them with EVM be explored, so that thenext generation of EVMs can be even more comprehensive in ensuring fair elections.

(i) Design Changes

(a) EVM's be EMI/EMC compliant. (NEW)

(b) Dynamic Coding of Key no's to enhance security of data transmitted from Ballot Unit(BV) to Control Unit (CV) be introduced. (NEW)

(c) Time diversity in data recording be introduced to eliminate effects of noise(NEW).

(d) Every key press on EVM even if invalid, is date - time stamped and kept aspermanent record (NEW)

(e) Additional seal of electronic cards in CU, BU may be introduced by EC to be operatedjust before the candidate-list is declared. (NEW). EC may examine its pre-pollsecurity arrangements of EVMs and may introduce this seal only if they ammgementscannot be fuJJ-proof (NEW)

(ii) Pre-poll, During-poll and Post-poll precautions

Pre-Poll

(a). Preventive Maintenance: Sample electrical check of the Control Unit and theBallot Unit prior to the polling. The diagnostic check to be prescribed by theManufacturers so as to ensure that the embedded program has not beentampered with.

(b) Candidate key number allocation stage: Prior to this additional sealing ofelectronic card of CU, BU in front of party representatives. (This is a verystringent step and EC may decide whether it would like to introduce thispractice with reference to (e) above)

~~".1 ~S ',:. (~) Inspection of the Ballot Unit/Control Unit as well as the cable at the time of

the insertion-of the Ballot paper by the Returning Officer with suitable aids to

.. <;{J. ensure that duplicate equipment are not used.

,~tM. Ensuring, in every Polling Booth, that the inter-connecting cable is visible at

',I"'. dhusudan GuptaII times."T'K~ 'tl'01 ~.a ft'cer

"'j~~ ~/section 0 I~ ~'f.R 311~,"t1~1~ 1'1'" ISSION OF INDIA

ELI~C}'ON~~~~~_\Z,,i''\1E-~~?~~1001c.\,1\ OAUNEWDASHOKAR .

14

-(c). Ensuring, in every Polling Booth, that no device is inserted between the Cable-

Connector and the Control Unit.

(d) Conducting Pre-Poll "Mock Poll" immediate before start of balloting.

Post Poll

Carrying out on a sample basis, recounting of votes in certain booths post poll at anappropriate administrative level, to act as a deterrent against potential mischief-makers so as to generate a climate of confidence about the infallible nature ofelectoral process.

(iii) Futuristic actions

Bio-metric ID

Notwithstanding all care taken in design of EVMs and procedures as mentioned in thereport, the process of election could be vitiated if due care on voter identity is notexercised. The present procedure for voter identity verification is man dependent andits limitations are only too well known to merit explanation here. The use of bio-metric ID has grown significantly in many applications worldwide and the advantagesin its use in an Election process can hardly be over emphasized. The committee hasdiscussed the possibility of interfacing Biometric ID system with present EVMs. It isfelt that several issues namely choice of bio-metric parameters suitable for large scaleapplication, costs and administrative logistics, voter ID data bank, etc. need moredetailed study and field trials before fmalization and introduction. Nevertheless unlesssome preliminary exercises are carried out the vetting of these issues would beimpractical. Hence it is strongly recommended that EC motivates BEL and ECIL toinitiate prototype design and development towards implementation EVM-cum-Diometric ID system and trials are conducted to validate the system. For starters,simply recording voter biometric identity during election could itself be a strongdeterrent to mischief-makers besides generating useful trial information required forfinal design.

7.0 Conclusions

The committee after a review of the material presented to it has felt it necessary tohighlight certain very key conclusions and recommendations as below:

(i) The basic Electronic Voting Machinedevelopedby Mls. Bharat Electronics

"'I'~ Q-Limited(BEL) and Mls. Electronics Corporation of India Limited (ECIL) is a.A~~ 11:-. . secure system.~,,~ .

The securityemanatesfromtwovery importantbasic factors:

I b~a) The fixed program nature of the software which is fused into the~, processorand whichis effectivelyunalterable.

danGu\>t3ad"usu ~ er . .. .

~ ~/sectiO~~\J) The faIthful recordmg of all events m the processor (electromcally) and3q>W''>\,~f.'I"i1\~s~~of'\~~\~ the possibility of recalling the same with the added (manual)

cotJI~\ r;:.-~ -'\'\00 0001EC'noN ,<\'GI':.t' "'L\-\l-'\'\

EL ..,' '!\~' o >.'E'/'40<;.,,1.:' RO!\ ,'"

\ ("~O\<."15

administrative procedures on BV, CV at various stages in public viewprescribed by the Election Commission which make available thesequence of voters voting rendering it possible to verify the recordedvote in case of any doubt with regard to possible tampering.

(H) With the provision of non-volatile memory, any physical interruption leads tothe retention of all voting information till that point.

(Hi) With the system as designed by the above agencies having built-in security,the Election Commission and the Government only need to ensure the securityof the equipment, to safeguard the sanctity of the electoral process. Theprocedural safeguards as stated in Section 6.0 should be implemented.

(iv) The Committee wishes to place on record the high level of accomplishmentsof the Engineers and Scientists of Mls. Bharat Electronics Limited and Mls.Electronics Corporation of India Limited in developing an Electronic VotingMachine using the latest technology.

(v) The Committee unanimously recommends the use of the upgraded EVMs inelections after due modifications stated in this report.

(vi) Committee also recommends strongly that bio-metric method of voteridentification is pursued by EC and tested for feasibility in large population &integrating this sub-system with EVM in future.

~'<j<fo1~/Madhusudan Gupta3fj1f1Tl31~/Section Officer

~H<I f.1<rl"iA 31t"llt....

ELECTION COMMISSION OF INDIA":'1 ;Jt';S, "'I~ IZF~.110001"'J \ ROAD,NEW OELHI-110001

16

REPORTOF THE

EXPERTCOMMITTEEFORTECHNICAL

EVALUATIONOF THE ELECTRONIC

VOTI11GMACHINE

APRIL1990

a. Can the system be altered at site?

Can the system be replaced by a different

Can the system be ta~red with while in

r.:echanism?

operation?

b.

c.

The Committee addressed itself to these three questions.

3.3 The System consists essentially of three components

a. the Control Module

b. the Balloting Unit: and

c. The inter-connecting cable betw~en the two U~its.

The Committee has looked into the possibility of tampering

in respect of each one of these three components.

3.4 With regard to the nature of the design and the difficulty

involved in tampering, it is noted that the program imbedded

in the device is completely fixed and unal terable, and

therefore. there is no means or access by whic~ the s.ystern

c~n be modified from outside.

3.5 In view of the above, the only way by which t~e System can

be tampered with is to replace it entirely by a new one.

Though this is theoretically feasible, by a simple physical

inspection of the equipment, this can be ruled out.

3.6 It is feasible to modify the Balloting Unit alone. However,

it cannot be done in such a way that it can escape physical

inspection.

1"1 E.S 1i;O This leaves the question of tampering I with the inter con-~, necting cable. This tampering could happen in two ways. One

~may atta'ch a device on top of the cable. This requires

L . . skilled operation and will naturally be visible to all the

, ~ l

. .A~ I

I'1(lhusudan G\1Y1ta

~ ~ :' (1. ffeer~;:':"' l ."/ sectiOn0 ,31\"'4' 'I '

:.\fj'>l~ """ '~4\<.R 311'l11'" F INDIA'>Il~" MISSION 0

ELE;~1~ON<~~~~E~"t'i~~?~~10Q'p,::';;HOKA ROAD,N

Page No. 4

.,--.

. .r... ~ a:!ll

b~~th arranQ(:~~nts

(:::~:::it'I.:L' nC'tc~. with satisfactlcl, t},;,t t!'l-

-:.:1 t!. (: ~ ubI i c v j (: w cJ 1) Lt, t-- t: :::I:.:~ .1 n j' s IJ r. !I a

~amper~n9 ::!.:cc::-.cs ~{:l! -~''Jide::1t 0 F'urtht'r. ::1 caSt ~:;y s:.rh

~:.:~ated : :".e ~';~::.::g i ~it.

.':ni~ :s ~rJ:t.:~.;

:1II

. ..h

. . .~~~e :~at ~::: aeVlce a5 :::een :~~e%:~c =~-

i

:!n:::i ::::e socket. Once' the cJ.ble :s ::.nser:ed

and t::e Mac~:::e ,,~ sealed. t~is kind of tar.:po:ri:~,; ~$ :;,:po~-

J. a ::n t~i s :-::anner. :~e C~:r.rr.ittee has looked i::to all ;:-::-s-

sibilities of tamper::.::g wit~ the Machine and has co~e t~ t~e

conclusic:1 ::~at :::ere is no way of alteri::g t::e ~esu:::s ::::

:he polls ~r:::v~ded due securlt1 precautions are e;,~crced. ~~

j;

I

case f~r a::y ~eaSC:1 ~he U::it has been tampered. - .. . --_ul

~ediate11 gives a:1 i:1dication that the system has rnalfu::c-

tioned and this remains as a permanet record 0:1 the Machi::e

~hich can =e c::ecked a::d cress-checked at any ti::-~ later.

unani~ou$ly cer-

reco~~end~ that

Page /10. 5

"

----..- \. -- .' - o. . I , , .t : ::tl t hl Com,i l t (". r,;"!,!: . (' '. n !, l I 1 ; ; 1.;1

t !I cJl have be:clI fini'llisL.d hI' t t:t.# t:Jl.ct:on

3.10 Any systcII! of this ni'lture requires proper ::-rE-vf:ntiv(' mitin-

tenancE'. ~undreds of thousands of thE- uni l$ are to be USE'd

in any ~~jor election ar.d in b~twe~n they ~1l1 b~ stor~d for

10n<;l ;::eri::>ds of til:(:. :'ul'ing thi!: periC'd due to attack by

vermin. ~ats, fungus or du~ to mechanical danag~, th~ SY5t~~

~igh t ;:-.a1 funct i on. 7hel e fore. as a pn:\'en t i V~ !':e:asun.', lh~

Committee recommends :~at b~fore every election the mdnu!ac-.---{this can be d~r.c ~cry fa~l

t"!frougn a very sirnple exerciser} and ensur~ that all t~E:

units are functioning as designed. !ncidentall}', t~is r:lethC'rJ"----will c~e~~, what is called 'the sig::ature cf ~:achin~' ;;:1J

~

thereby ~~e Manufact~rers will be able t~ certify that :~eHachir.e is identical to ~hat they had supplied and it has

not been replaced by any other.

3.11 In brief. the Commi t tee recommends tha t the Sys tem may be

accepted subject to the following precautiens:

1. It is ensured i~ every polling booth t~at :~e cable is

visible all the time.

2. After the polli~g, the cable and Balloting unit is

physically inspected fer any ~echanical da~age.

J. At t~e time of t~e insertion of the c3ble. it is f,....--

mally recorded by the Presiding Officer and the polling

agents that no device has been i~serted between the

cable and the connector.

All the instruments are checked as a matter of pr even-4.

tive maintenance and as a matter ef abundant cautic:1,

to ensure that they are working satisfactorily and ac~

cording to the original embedded progra~~E-.

I

Page No. «5

:I

4.0 Is~ues l".aise-d by variou.s Org~n~saqJ:ms al)O r~L~t.e.d TI.:.ch!}i ca}

pr<2..l?.le~s

The: lSSUE:-S that arise:~-

fr"AJn the use of E!ectronic VQtingHachines are as under:

i) The ~achine may not f~nction properly

:.i) The ~ach:::e r..ay ::e damagEd upset::.ng t~e 2011i:1g

process.

iii) The ~ach:.ne could =e tampered with. a::ddesign ~ay not

be secu~e ('~roJan Horse').

:"J) The ~ach:.::e denles t~e candidates the ~:.;~t t~ recount.

VI 7he Vcti::g ~ach:.nes arp. biased against t~e poor.

These issues are examiued in detail ::: t~.e following

paragraphs.

4.1 ~achines ~ay noe funceicn properly

",

This is a question of reliability. 7he reliability of the:

equip:nent depends on the design. selecti.on of components.

procurement and inspection of components. !'!anufacturing

process. storage and re-inspection mechanis~s.

The resultant failures ~ay be catastrophic or non-

catastro~hic in nature. ~he design has been ~erfected over a

long period. The Hanufacturers have confir~ed the usage of

approved components with due derating for reliable opera-

" Q ..tion. ;. Co~rr.ittee consisting of representatives of Standards~/ And Quality Assurance Establishment (SQAEI of Department of

~ l'.aDefence. the Directorate of Standards. Testing and Quality(,~~

~G~~~v:,e~Control (STQC) of the Depart::lentof Electronics. and Repre-

'_(;'.\!;\~/~~~\~~~ ~\~Q}~ntatives of Election Commission. reviewed total quality

., .' ~ ~ '!1\ ~ 0 (}()\ ()\ .4<' -i}~U>,?-\-.{.c:,.?~~~,.\-\\().\'-&~surance aspects of the Hachin~ through t::e Hanufactur~rs.

~~'-1~\,\ -:t~:...,,*, ~~n~\.~\ .~-:S ~''-oIG~'~.f" .0.10 "' hc f"'''' rn-'''' ~ " e r", ..'",,- ~- v " lv ""d l'

n th '" "'.-c ta-"~ t£!:tl::::.

G~\O~i"t,.o~~"'" . --- .-- '""'" " - - ~--'"' '"' '" ..- -- -,.. ..- -~\..~ ~ ~Of>' '<j

~#~ . '<j7l0~S~c:, '0 O't\ '1,.1' ,"3

N'"3~ ~V- ., )I\.')~ '

. \\.\,","'i~}'~\';'~O')~,.I" \,.~ Pag~ No. 7I.\)~\I)(}(}\\ ~O\SS >\\~\:,~~"~, \",\\'-'f.S>,~ ..-: ONI ~O \\J-\~ c I\~:''J! . '".

~.1\' u.' ':)3-::>"" :P

, \)0 1"\./

.; ;)':)\~Oo\\,,\I"\~ ...) U~I"

:>\? ,\\'<)

Th(' ('quiJ:'r:~cnt!: hi":(, also gone throuQh c1i!:ii'ltiC' t(.!:t~

prcscribe:d in the Quality AssuranCE: (Ql.) manuals. The Com-

rr.itte~ noted that the failure rates durillQ lhe t:-:a] pC:J"i"d

are insignificar.t.

!n addition. ~~e catastrophic failure lI'ay occur ::ecausc of

!ailure ef t:-Je !-:::::-:::co:'1troller Chip. ia which case ,~~(,lling

::-.ay be necc~s.::rj'. 7he cases of non-catastrophi:: :":.l',;r,,, can

bee ate red t c :; 'i t :-Jere d e plo ymen t 0 f asp are ~.:a C'hi nE:.

Similarly t:-Je Eallct Unit can also be replaced ~::~ a timeloss of ~t~cs: ::-20 ~inutes in case cf a ~~:astrophic

failure.~-"=

-IiQ""-:~~

~.2 Hachines ~ay ~e ta~pered with

This seems te ~e ~ajor issue of concern. The co~tents of

.Annals of De:;.ocracy' an article. that appeared in New

Yorker on Nove:::ber 7. 1988. as well as a press clipping on

the same lines .:angers of Fraud in Computer ':ot::.:-::;,' have

The major advantage of the Electronic Voti~; ~achine

developed in !ncia is t~e fixed programme nature 0: the sys-

tem. The progra~~e is permanently fused and hence cannot be

tampered with even if it can be accessed. E'..enthE:n. as a

matter of abur.dant precaution.-- - the insturnents' signature may-----be tested by the suppliers before a poll to check that they

have not been ~eplaced. Since the presentli' ciscus's-ea-

Electronic Vot::.~g ~achine is a different type of equipment.

. the possible methods of tampering are different and have al-

. :11 t. ~;~ tD.dY been high liQh ted in the Sect ion J. Q." ~. '. ~.~ . ~\o~.

\)( dan G\.\\)ta.. /.,h~\"\1~\1OWICef

,~ .~'I~ / sectlo\'\'I\~~~ k~-<\;,<t\~ 3\,-n'i:,F \~Q\'"

:,q ..,,~<'b'~~\ss;~,\,\ooo' 00'1Ci\O~ C ~ ~(" E\,'\-\\o'\'\O

El.E " <:,~. ~E~ 03\'-'" ~o"'o.

,..s\-\o~'"

,\

Page No. 8

~.]1,

4.3 Tl1e Machine .n:a.r be damaged upsetting the poll ;::-,''::::

The damaQe is understood to be physical damaQe and the tech-

nicaf consequences of such physical damaQe are a~ under:

1. Ballot Unit damage

Physically st~c~q and agile people or mentally dera~ged

people may da~age the Ballot Unit which is static~ed a

little away :~~~ the Polling Officer.

:;'ot :~~o pieces using hammers e~c.). ~~e Eal-

lot U~it c~uld be ~~placed without affect:~q :he

poll u~t~ :~at point.

.~

ii} i~ case 0: attempted damage by making one c: the

sw~tches stuck. apparently disabli~g the other

switches. a link-error alerts the Poll Officer who

can set ~:;ht the mechanis~: i~ the event ~e can

not set =ight the mechanism replacement as alter-

native is available.

2. Cable Unit Damage

No wrong i~for~ation gets recorded. The cable can be

replaced.

J. Control Unit damage

l .

If the Control Unit is damaged. the poll could be con-

tinued with a second Control Unit. since the poll in-

form.ation upto the point is safely stored in the

memory. However it should be ncted that Control Unit~

.'

~ ~ I/. Jhusud~n Gupta3Ij'fPl u.,.tj<Jii<i/Section Officer

'11, d P-li1f<8 311<11..,ELECTlnN COMMISSION OF INDIA

.i ,\I~'I'; ,);g. '1~ f~,,<-fj-110001. ~ A::;HOKA ROAD,NEW DELHI-110Cj'l

..!,',

':i....

.l

Page No. 9

damage is equivalent to snatc~i~;! :~e Ballot box.

ana suitable administrative pcocedu:~s may be f~llowed.

including repoll as per Election Commis~ion norms.. -

4.4 The Machine denies the right to Recount\I

1.

I

1

I

.

On the contrary, the whole process is stored in the memory,

ana can be dumped through a Printer to get the detailed pic-

ture of voting. With the added administra~ive procedures of,

the Election Commission to maintain a register of the voters

in the sequence of their voting, not only the process of

recount is possible but also verification of the recount

agains~ any possible tampering is also possible.

4.5 Bias against the poor

J

I

While the comment on the bias against the poor as reflected

in certain articles has been noted. the experience of the

Election Commission in traAls so far does not confirm" the

same. ~his is mainly because the equipment is simple and in

!~c: e':en simpl er than 5tamping the conven tional Ballot

paper to which the voter is already accustomed.

5.0 Advantaaes of Electronic Votina Machine

The Committee noted the

Electronic Voting Machine.

cussions:

following advantages of the

as they emerged in various dis-

* possible reduction of tirne between the time of"

withdrawal of nominations and the commencement of Poll-

ing, resulting in considerable. saving in matters

relating to maintenance of law and order, candidates'

expenditure on campaigning etc.

cons~derable saving in printing of stationery anc.

transportation of large volume of Election material.

Page No. 10

. discoursQing booth capt~re by

votes that can be cast in an hour

the number ot

more than 300

!.aw and Order

-..-

:,;.no

*

in a booth. thus allowinq time for the, .

Hachinery to take appropriate remedial action.

the procedure for mock poll incorporated into the sys-.

terngenerates confidence in the voting community on the

operation of the system.

the system eli~inates invalid voting. which in several

cases is understood to be comparable to the difference

between the winning candidate and losing candidate.

the counti~g t~me is drastically reduced . and

elicinates ~ischief at counting. as well as eliminates

the possible building up of tension/disorderl:,' scenes

during the c~unting process due to the short ti~e i~

which the counting will get completed with the intro-

duction of the Electronic Voting Machine.

· the entire process of voting is recorded in sequence

and is available for analysis by the Election Commis-

sion at a later date against any contingency.

* Possibility of the introduction of Mobile po1"ling

Booths t~ facilitate fuller participat~on ef people in

*

.

the election process.

Page No. 11

6.0 Recommen~ati0Jl!

11

1. Sample electrical check of the Control Unit and the, ...

Ballot Unit prior to the Polling. The diagnostic check

to be prescribed by the Manufacturers so as to ensure. -

that the embedded programm~ has _n~~.be~n t~~p~~ed with..-'. --- -"

2. Inspection of the Ballot Unit/Control Unit as well as

the cable at the time of the insertion of the Ballot

paper by the Returning Officer with suitableaids to , I

ensure that duplicate equipments are not used. '11

J. Ensur:.ng. in every polling Booth. t~at :~e i~ter-

connecting Cable is visible at all times.

4. Ensuring. in every Polling Booth. that ~o device is in-

serted between the Cable-Connector and t~e Control

Unit.

5. Carrying out on a sample basis. =~c=~~ti~; 0: ~ot=~ i~

certain booths at an appropriate adminis~=ati7e level.

to act as a deterrent against potential ~ischi~f-~akers

so as to generate a climate of confidence about the in-

fallible nature of electoral process.

.1hu \I' " Clpta~d(Jn ut1lcer

<I 1~>'I.ql -.111<1111

ELECTION '":OMMIS510N OF INDIA3n11 ~)~. ~r~ ~",,"-110001

ASHOKA ROAD,NEW DELHI~11000t Page No. 12

7.0 Conclusions

The Committee after a r~view of the material present~d to it

has come to the ~ollowin9 conclusions:

i) . The basic Elect:-onicVotin9 Machine.developed by M/s.

Bharat Electronics Limited (BEL) and HIs. Electronics

Corporat~on of !~dia Limited (ECIL) under the over-all

aegis c: t~e Election Commission and the Depart~ent of

Elect~c~ics is a secure system.

T~e secu:-ity e~anates f:-om two very ~=por~ant ~asic

~ac~~rs:

ai 7~e :~:.:ed;:~og:-arnmenature of t~e software which

is f~sed :~to t~e processor which is effectively unal-

terabl.t!.

bl 7~e f3it~ful ~eco:-ding of 'all events ~~ the

~rocessor a~d the possibility of recalling t~e same

wit~ t~e acded adrninist:-ativeprocedures prescribed by

the E:~~tio~ Cc~rnission which make available t~e.se-

quence

verify

of 'Joters voting- renderi~g

the recorded vote in case ofit possible to

any doupt wi th

regard to possible tampering.

ii) ~ith t~e provision of non-volatile memory, any physical

inter:-uption l~ads to the retention of all infor=ation

upto t~at point.

iii) With the system as designed by the above agencies with

built-in security, the Election Comr:\ission and the

-1 e.S1EOovernment only need to ensure the securi ty of the,,\ equipment, to safeguard the sanctity of the electoral

Page No. 13

.

.t

process. The Committee further recommends that c~rta~n

procedural safeqaurds as stated in Section 6.0 should

be.implemented.

iv) The Cc~ittee wishes to place on record the high level

of accomplishments of the Engineers and Scientists of

M/s. Eharat Electronics Limited and M/s. Electronics

Corporation of Indi.a Limited in developing an

Elect=cnic Voting Machine using the latest technology.

v) The C=rnmittee unanimously recommends the use of the

Elect=cnic Voting Machin~s with out further loss of~

time.

Page lIo. 14

~.

I'~

. .

-

...

..........

MOST IMMEDIATEBY HAND TODAY

C;OV[8N\ff'.-

tif.~!P;~:; ~~I:

DEPARn.IENT OF EL£C-'" :.,..;,

"'~ :fr.n: ~. (,,'r;Jr:~ ;:."T)

LOICNAYAK BHAVAH. (3r.fleort

CA snir. KHAN MARKET.

~ r~)fNEW DELHI.UlOQTLX. N08. 31.6S1~ I 31.81'3'

G'I'" ; DEPTELECTRON

5 .RAVIJOINT SECRETARYTELE: 61 1320

a,,«. ~ ..............~t ............

OA fED ................................-.-

April 11.19900.0. N: DOE'1CC:::./EVM/89

.

The 21ec~or3l ~eforms C~mmit~ee i~ it~ ~ee~i~g heldon 31.3.90 suggested to Secre~arj'. Dep8rtme~t ~f Elec~r~nic~that the Electronic Yoti~g H3chi~e d~veloped ~y ~/5 ECIL andMls BEL should be objectivelY evaluated C7 3 Group ofExpert~: in partic~lar from the point of vi~~ cf rigging.tha~ :s to say. ~he~her the machine could. at any point oftime. be tampered uith. It h8~. therefore. been decided toform a Commit~ee of thr~e exper~~ compri~ing of adi~tinguished council member of the In~titution ofElec~ronics & Telecommunication Eng1neer~. 3 di~tingu~shedProf. of lIT and the Direc~or of Electron!c~ ~e~e8rch &Development Centre. 7rivandrum.

It hasCouncil MemberGroup. Prof.C.Kasarabadamembers.

further been decided to request you as aof the IETE to be the Chairman of the ExpertP.V.lndiresan of lIT Delhi and Dr. RaoDirector. ER&DC. Trivandrum. are the other

The Committee may submit its report to the Departmentof Electronics preferably by 24.4.90 or latest by 30th ofthis month 50 as to enable the Government of take a decisionin the mattp.r before a Bill is introduced in the P3rliamentin May 1990. Secretarial a~sistance to the Committee ~ill beprovided by the Neu Delhi Centre of the Appropriate

Automation Promotion Programme of ~artment of Electronics.c..~~.,. .

~y?~ .' 'f'\ n Yours sincerely.

~ ,,~ ~ S.. (J~. .. l\\o\.1 ~"\ G\'\~\'i\( 5. Ravi) .

Prof. S. Sampa th . . \ ~ (/'..

~~\,\S\)~:).t\o~ice{/' ''''ll'' '"

Chairman. R. A. C. ~:... .:!~ec\\~-n\'t\ ~Q\~DefenceResearch& Deve~~ ~«fi~~~~. ~Ministry of Defence. Sena.\S\131ia.v."aeo~~\~(ot5.\:\~\.'\'\Oo

New Delhi. ci\o~1.\'1.. :;..1.~'l'<IQ~\"€\,.€ '1\'. o"'O'~

~ y..."'~1»,&\,\0

1

With regards.

COpy to: .1. Smt. V.S. Rama Devi. Secretary. Legislative Dep3rtment.

Ministry of La" & Justice. Ne" Delhi.

COpy also to:

2. Shri a.s. Prabhakar.Hyderabad

Managing Director. ECIL.

3. Capt. S. Prabhala. Chairroan & Hg. Direc~or. BEL.Bangalore

They are requested to provide all assistance :0 :~~Comro1ttee 1n their work.

/S. Ravi

,'115-,I,

'-

EVM MANUAL

.\

jI

1990,~

"J: j,'~',j..'!

",

1. Commission had purchased around 10.8 lakh Electronic Voting

I\.1~chinesfrom M/s Electronics Corporation of India Limited i.e.

M/s ECIL, Hyderabad and M/s Bharat Electronics Limited i.e.

M/s BEL, Bangalore, the two Govt. of India undertaking

Companies authorized to manufacture EVMs for the

Commission. Out of these 1,50,000 Nos.' of EVMs are of 1989-

90 model.

2. Since the normal life of the EVM is roughly 15 years, as certified

by the two manufacturing Companies (i.e. M/s BEL and M/s

ECIL) it is risky to use EVMs older than 15 years in an election

as. these machines contain electronic items and any

malfunctioning during poll may lead to strong criticism and

reaction from all quarters. Considering this, the Commission is

contemplating to replace these old machines with new ones.

3. At the 'same time the Commission has suggested the

manufacturing firms to upgrade the EVMs adding some new

features. Some of these features are:

Real Time ClockBetter display section (alfa-numeric)Time stamping of every event conducted on the machine.

.Hourly TotalBattery power indication.Power saving mode.Facility for totalizing the results from various controlunits if connected etc.

4. In consultation with the Commission, the two manufacturing firms

have already developed the upgraded EVMs with additional

features as desired by the Commission and 'demonstrated the same

before the Commission on 12.12.2005.

F/t

5. The cost of improved model of EVM will be around Rs. 1000/-

more than the existing one (Rs.8670/-per machine plus Excise

duty, Sales tax and Transportations etc. as actual). However, the

two companies, as a matter of good gesture, have informally

agreed to replace 1,50,000 old machines (89-90 model) with the

new upgraded machines at the present rate.

6. The existing EVM, which is being used presently, was subjected to

technical evaluation by an 'Expert Committee' in the year 1990

which comprised of Professor P.V. Indiresan, Dr. C. Rao

K<:isarbadaand Prof. S. Sampath. The expert committee after going

through all kind of technical detail available from the manufacturer

opined that the machine is full proof and secure system without

any possibility of tampering. Since the new upgraded EYM, that

the manufacturer have proposed to produce is having some

o additional features, the Commission has again constituted 'Expert

:(\E.~~€ Committee' (on 29th December, 2005) headed by Professor P. V.~ A - Indiresan alongwith Prof. D. T. Sahani and Dr. A. Agarwala, lIT

" \.~ . Delhi to get the upgraded EVMs evaluated before finally accepting~\.I .

.),: )... IJ\\\1\<thesemachines for actual use in elections..' " "v" \\\Ce{,\\\' 0'\ ()

, 'I.. ," ,C\\ '1\ ,11-

,ffi"\ ," -'. J\,-n\ or'~o

"t:\'S~\,\\,\ ,t, f.\"~S\t'\'\\)\)~'\~\)\)\~N co\'1>~~~ oE.\."'"

\:,C\\ <.\"1,. ~E.-.N\:,\.. :§,!,\' ~o,..o.

...o",p..",c;".

7. The M/o Law & Justice has also been apprised of these progresses

frorn time to time. The Commission has also forwarded a proposalI

to Ministry of Law & Justice to keep a provision of Rs 200 Crore

for replacement of 1.5 lakh old EVMs with ~ew upgraded EVMs

and a provision ofRs. 250 Crore for purchase ofEVMs that will be

required due to increase in the no. of polling stations (after

lowering the maximum number of electors assigned per polling

stations from 1500 to 1200) in the budget for the financial year

2006-07.

8. Th~ Expert Committee has studied the various features of the new

EVMs and has visited the factories of both the manufacturers to

get detailed inputs. Now they want to have a meeting with the

Commission for finalising their report.

9. The Commission's meeting with the Expert Committee for

evaluation of the new upgraded EVMs has been fixed on 4thJuly,

2006 at 11 AM in the Commission.

. .»'.~.\'.'

f"

\

.I

. t

\,.

DRAFT

1989-90 EVMS - REPLACEMENTADD~ONALFEATURESCONT&~LATED

ADDJ'rIONAL PI!ATURI!SI

1. RealTime Clock

2. Time Stamping &Event Logging

3. HourlyTotal

4. SinglePollSingleVote

5. OlsplayCharacters

6. TotallzerFacility

7. FactoryProgrammedUniqueSerial NumbertoreveryControlUnit~ e. ModifiedInterfBceBetween CU&BU

9. Battery Low Indication

RIALnMI CLOCK(RTC1r

RTCIs built In the system. RTCenables continuous dIsplay 0" Date, Month,Year and

Time on the display panel. This enables time stamping and time logging. Lithium

battery used "orRTCneeds replacement In every 5-1years.

TIMI!! STAMP!NG AND TIME LOGGJNGI

Every vote Is Time Stamped, Control Unit power ONtime and activation of all functionalkeysare tIme loggedand stored. EnoughmemoryIs provided In the unit for the abovedata to be stored up to 20 elections Inclusive of First level check, Dlstrtbutlon check,

Mockpoll and actual poll. Roll over facility Is /'or 20 elections I.e. when 21st election

commences, the 2nd election data gets erased and so on. It Is possible to store the

result or each election. The time stamping of voter data is stored only for the ~~ t)election In progress and gets cleared with operation of the CLEARkey. ~11~~

HOURLY TOTAL (HTlI

ThIs racllity can be made aVlIllable during the Result phase.

renamed as HT. Hourly Total can be seen only after close.

,

i ,- :~L'i POLL BINGI!!L VOTE (SPS.v1:

Slnole Poll ZlndSingle Vote design Is Incorporated In this eVM. 'The maximum number ofvotes In one EVMIs 2000. As the EVMs are being usedonly for one post, the MCU

connector renamed as Data Interface.

DISPLAY CHARACTER:

26 Alpha Numeric characterscan be providedon the display panel In two rows.

fO"ALIZI!R PACJLlTYt

A specIally deslg~ed Totallzer will enable the summing up ~nd display of, results fromseveral CUs.

UNIOUI! SeRIAL NUMBERI

A unique serial number assigned to every Control Unit and programmed accordingly.

This feature avoids use of the same CU repetitively (either unintentionally or

Intentionally during totallzlng).

MODIFIED INTERlACI! B!TWI!!N CU It BUI

New design Incorporates8 modlned Interface between CU & BU.

BATTERY INDICATIONI

Battery Power will be Indicated with the Initial power ON condition and with Total Key.