US scientists hack into India’s EVMs, expose flaws

India’s electronic voting machines (EVMs) with chips made in Japan and the US were designed to stop fraud and accelerate the voting process, but computer scientists say these paperless machines are vulnerable to fraud.

Professor J Alex Halderman of the University of Michigan and his computer science students say they were able to hack into the EVMs to manipulate results.

Halderman, who led the seven-month research project, with a security researcher from the Netherlands and Hyderabad’s NetIndia, said a home-made device allowed them to change results on an  EVM by sending it wireless messages from a mobile phone.

“Almost every component of this system could be attacked to manipulate election results,” said Halderman. “This proves, once again, that the paperless class of voting systems has intrinsic security problems. It is hard to envision systems like this being used responsibly in elections.”

A video on the Internet by the researchers shows two kinds of attacks. One attack involves replacing a small part of the  EVM with a look-alike component that can be silently instructed to steal a percentage of votes in favour of a candidate. The instructions can be sent from a mobile phone.

“Our lookalike display board intercepts the vote totals that the machine is trying to display and replaces them with dishonest totals — basically whatever the bad guy wants to show up at the end of the election,” Halderman told reporters.

Another attack uses a pocket-sized microprocessor to change the votes stored in the  EVMs between the election and the public counting session, which in India can be weeks later.

India uses roughly 1.4 million  EVMs in 829,000 polling stations in a general election and they are of the direct recording electronic (DRE) variety. The  EVMs record votes to the machine’s internal memory and provide no paper records for any recount. The researchers said that with DRE machines too much “absolute trust” is placed in the hardware and software of the  EVMs.

Rop Gonggrijp, a security researcher from the Netherlands, who participated in the study, slammed the paperless electronic voting system. “The research shows the longstanding scientific consensus holds true — DRE voting machines are fundamentally vulnerable.

The machines have been abandoned in Ireland, the Netherlands, Germany, Florida and many other places. India should follow suit,” he said. The researchers have offered to share their findings with India’s Election Commission.