Is it difficult to hack EVMs or simply impossible? Experts weigh in

EVMs

As the dust settles on the recently held Lok Sabha polls, the opposition once again raked up questions surrounding the soundness of the electronic voting machines (EVMs).

Days after the outcome of the Lok Sabha polls, a major political controversy erupted over a report by Mumbai-based Mid-Day newspaper that alleged that the election result of the Mumbai North West Constituency, where Eknath Shinde-led Shiv Sena’s Ravindra Waikar pipped Shiv Sena (UBT) candidate Amol Kirtikar by just 48 votes might have been due to an effort to tamper the electronic voting machine.

However, in a clarification the Mid-Day said, "The report 'Waikar's kin had phone that unlocks EVM' (page 6, June 16) inadvertently erroneously mentioned that the accused person used his mobile phone to generate an OTP to unlock EVMs. The error is regretted".

Since the declaration of the poll outcome on June 4, there have been claims of EVM tampering, hacking and unlocking using an OTP, forcing the Election Commission to hold a press conference on Sunday dismissing concerns regarding the safety and robustness of our election process.

The issue gained further traction when billionaire Elon Musk said last week that EVMs can be hacked following irregularities in Puerto Rico's primary elections. The remarks triggered a heated debate in India, with former Union minister Rajeev Chandrasekhar issuing a counter.

Are EVMs really as tamper-proof as our politicians say or is there room for debate about their efficacy? Moneycontrol spoke to experts to find out:

'EVM can return to factory-setting if it's tampered with'

Dr.  Rakesh Khosa, Professor, Department of Civil Engineering, IIT Delhi, questioned the timing of the allegations.

"The issue surrounding the soundness of our devices are raked up usually when the Opposition fails to win an election. Why should the present dispensation give details about the technical aspects of EVM functioning? It not only endangers India's electoral infrastructure, but allows anyone and everyone to raise questions regarding the credibility and efficacy of a robust public system," warned the IIT professor.

Commenting on the technical aspect, professor Khosa said: "According to people involved with the designing aspect, the EVMs, if tampered with, also have a technology to return to factory setting and stop responding completely. Hence, machines are not connected to the internet nor do they have a radio frequency (RF) to respond to Bluetooth."

'Chances of hacking EVMs minimal'

Pawan Duggal, cyber law expert and Supreme Court advocate reasoned that EVMs are electronic devices that come under the ambit of Information Technology Act.

He said that all computers, despite best security safeguards, are capable of being hacked.

“Having said this, we haven’t got our hands on the reasonable security procedures or enhanced safeguards that distinguish our EVMs from rest of the world. That information is not available in the public domain. Election Commission is undoubtedly doing a remarkable job in conducting an electoral process of this scale.”

Commenting on the lack of a law on cyber security, the expert added that India does not have a dedicated law on cyber security. He said that we also need to see if the EVMs meet with the requirements of the ISO 27001 framework.

ISO 27001 is the international standard designed for organizations to use as a reference and as a guideline within the process of implementing an Information Security Management System (ISMS).

"The domain experts need to carefully analyze whether the EVMs meet the standards of ISO 27001 framework. If it does, it is good for Indian democratic process and if it doesn’t, we need to find a way to make it fool-poof, making the Indian elections free from foreign interventions and safeguard our democratic exercise," he said.

Responding to domain experts that M3 (the Indian EVM machine model 3) EVMs have no connection to any other device, not even mains power supply, Duggal observed that in case a machine is not connected to any external connection or device, the chances of it getting hacked are minimal. “Having said that, let me warn you that there is always a way to manipulate a system and thereby temper with it,” commented the senior advocate.