The ECI must Give up Adamant Attitude; Work with Key Stakeholders to Restore Credibility

The Election Commission of India (ECI) cannot escape from addressing the questions about the credibility of the EVMs. Officially, ECI acknowledges that three versions of the machine are in use: a) Pre-2006 b) Post-2006 and c) Upgraded-Post-2006. They do not clearly explain what the key differences are in its hardware and software.

The ECI’s claims about the integrity of EVMs are based almost exclusively on what they call the “effective technical and administrative safeguards”. In other words, ECI claims that their physical custody and control of the devices make it impossible to tamper. The ECI asserts that “it always had a firm conviction and complete satisfaction that EVMs could not be tampered with” and that “no one has been able to actually demonstrate that EVMs used by the Election Commission can be tampered with or manipulated” (ECI Press Release 16-Mar-2017). Perhaps, ECI’s “faith on the machine has never wavered”. However, that of other stakeholders have. And, ECI is well aware why.

The ECI’s technical defence consists of:

1. The main chip used on EVM can only be programmed once
2. EVMs are stand-alone devices
3. They do not possess networking components
4. They do not have inbuilt wireless (WiFi or Bluetooth) capabilities

In some ways, these are naive arguments in a world where nothing is infallible. Nobody in their right senses can claim that a system is so perfect that it does not have any vulnerability – be it in hardware or software. The processes used by ECI involves self-certification when it comes to the basics of the EVM. All the design, software making and so on are all done by internal groups associated with the manufacture. All the so-called testing are limited to certain rudimentary almost naive steps such as standard random checks and mock polls.

The ECI has an obligation to explain how in Gujarat an online voting system has been 'successfully' implemented and used in the last two state-wide civic polls. How was it done when these devices do not have any sort of networking capabilities? What system of certification and evaluation was used? What was ECI’s role when a private software development and consulting firm was involved in implementing the online voting system? It is well-known that at least one of the current election commissioners was involved in the project when he was a senior official in Gujarat.

ECI cannot be oblivious to the fact that there are, today, far more sophisticated ways to ‘hack’ hardware, software and data transfers. The kind of faith ECI has is too naive by modern standards. While the use of Voter Verifiable Paper Audit Trail (VVPAT) enabled EVMs are a must, that alone is not sufficient to re-establish the credibility of the electoral process. A thorough and intensive evaluation of the EVMs covering its entire life cycle is needed – from the procurement of components, software codes, to their deployment in polling stations.

Ideally, world’s best experts should be identified and made part of an independent evaluation team. This must be done with the involvement of all the key stakeholders. It is necessary to redesign the certification systems and the checks that are carried out prior to the deploying the machines in each polling station. Further, going beyond the devices, a complete security review of all the people and facilities involved in the manufacture of the devices are also needed. ECI should give up its naively adamant attitude and the unconvincing but stubborn insistence on the infallibility of systems and processes. After acknowledging the real world possibilities for tampering and hacking, it must work with all the key stakeholders to find ways to restore credibility to itself as an institution, the establishments involved in manufacture and the entire election management system.

/* C.P.Geevan */