B
BullettuPaandi
What manuals? Link?
The points are still valid. e-Voting IS a bad idea; it's just that in India, paper system is a worse idea.
There probably are a few more as well, so just ended with an 'etc.'
Technology Risks to EVM?
- Thread starter Neotheone
- Start date
blr_p
Oracle
See my earlier posts
He talks only from his perspective. EVM's have been shown to be more secure as well as more efficient. The totals are tallied in a much faster time than in countries with much smaller electorates. Always something to dig them with.
Best part is link to ECI under his video. Well played YT
B
BullettuPaandi
Dude, such disclosure is what making public means. So, this still stands:
blr_p
Oracle
So will you read the manuals now and then you can guide us with the details?
B
BullettuPaandi
Tell me how does it make sense to you to claim that there is an internal procedure that only the commission and parties know of & won't be made public AND claiming that the source is a pdf that is available for anyone to download and read. Not to mention, you brought this up for the checksum issue that you clearly misunderstood.
If you still claim that it is 'in there somewhere', you can help us navigate to the exact page, if you did in fact read it. But by basic common-sense, what you're talking about doesn't make any.
I haven't; and with the info from the press release that I have read, I can say that in no place, a secretive internal procedure between just the commission and parties, is even required. The answer to FAQ #11 in the release is enough to understand this.
We must understand how the process works.
And those who know still oppose EVM just because they want to speak.
EVM CAN not be Hacked. True
EVM can be tampered: Yes if you have physical access you can change it's internals but then it is not the EVM, it becomes something other.
Now, whenever an EVM is sent to a constituency, each and every machine is verified before the representative of all parties contesting the election. After everyone's satisfaction the machines are sealed and and kept and security only to obe opened on the day of election under presense of all stake holders. Seals are verified and if everything is satisfactory then only it is put in service.
Now try to create scenarios how the results can be modified in EVM.
And those who know still oppose EVM just because they want to speak.
EVM CAN not be Hacked. True
EVM can be tampered: Yes if you have physical access you can change it's internals but then it is not the EVM, it becomes something other.
Now, whenever an EVM is sent to a constituency, each and every machine is verified before the representative of all parties contesting the election. After everyone's satisfaction the machines are sealed and and kept and security only to obe opened on the day of election under presense of all stake holders. Seals are verified and if everything is satisfactory then only it is put in service.
Now try to create scenarios how the results can be modified in EVM.
blr_p
Oracle
I didn't say the source was in the manuals. That was an assumption of mine made on what I've learnt about the process. It's the representatives that monitor these things not the public who don't have access to these meetings.
I've only discovered these manuals recently and they are for those who want to understand the process in detail
Is everything transparent to your satisfaction then?
Secretive isn't the right word
Last edited:
B
BullettuPaandi
Well, there's no such thing. Given that obscurity is the chosen approach, it's perhaps better to have no such procedures with the just parties. Obviously can't handle Indian scale of public & again there's no need to.
Yes.
I do not think practical is the kind of argument that I would be convinced by. There are large power interests that would love to influence India's politics, especially given India's economic clout and India being the only meaningful force that could balance the influence of China in the region. I think you and I broadly agree that there are incentives for players who can do the impractical, by our standards.
Bold leap of faith, particularly when the EC keeps relying on security by obscurity. That is not how tech risk is mitigated. EC's approach should be much deeper, but what they are doing sounds like putting ones' head deep in the sand and just hoping that there are no powerful and well-resourced players interested in meddling in the nation's politics.
blr_p
Oracle
Why is obscurity the problem? Where is it written that whatever source code has to be public and then this idea it be open source. Why is this the right away.
That's a choice for the ECI to make.
Why do you say that? They have handled numerous national elections already which are the biggest in the world. What more do you need to demonstrate scalability. The bigger the election the more eyes there are.
Yes but impractical isn't the way to go about it for obvious reasons. What else is left?
How about creating enough doubt in the results? That would be a psychological operation. It would be a tall ask since public confidence in the system is very high.
Is the ECI's risk election risk manual any good?
B
BullettuPaandi
It is not that obscurity is THE problem. It is one approach; but a less effective one at that. After all, the latest revision which we now hail to be good-enough came from a slip in that obscurity. So, open-sourced & open to research, criticism & scrutiny is generally regarded as the better approach for developing secure tech. It is the same 'more eyes more better' you speak of that applies here.
I said so for those meetings; could've mentioned specifically. We can't afford to spare enough staff to accomodate the interested public as well for such meetings, especially when it is not really required.
1. Risk of psy-ops is there, and needs countering, but the issue should not take away the need for better disclosures. If anything, obscurity can help psyops as well. And honestly there is no easy way around in international geopolitics so psyops are just not going away, as much as we hope that they should.
2. I am not so interested in operational risk mitigation, as I believe that risk has not changed, and I am sure ECI can handle most if not all operational risks enough for it to not be statistically relevant to national poll outcomes at scale. So, I am largely with you on ops risk.
My concern however is that there could be structural vulnerabilities in the devices themselves being used that could prove to be a weak link, and potentially make a mockery of the process, and obscurity does not inspire much confidence.
Haha, this is funny. Tamizh is a way to write in Roman letters what some others write as Tamil. The retroflex "L" that is in the last syllable of the word is variously transcribed as "L" or "ZH".
But hilariously, Tamizh can be interpreted as what others write as tameez, which means something like manners or etiquette.
@blr_p
> It takes one line to say something is wrong. Very little time spend. I don't trust this or that. Well, what are you doing about it.. nothing. So keep repeating the same zero value statement. Best part here is 'maybe' wrong.
India is not a trust based society in general unlike tad early western societies.
It is about zero trust security systems in IT for a reason
You probably remembered T. N. Sheshan, he was a genius, a doyen who showed true power of ECI. However, that post was later divided between multiple officers, because political system couldn't 'en-trust' so much power with one person.
Till the day open review of h/w and s/w did not happen and obscurity is kept alive, there will be discussions. People does not need to blindly trust higher ups, it is a fact and everyone will have to deal with it. That is the side effect of security through obscurity. Once open review is there, weakness can be exposed and addressed within given limits of the system which will make system more trustable.
> It takes one line to say something is wrong. Very little time spend. I don't trust this or that. Well, what are you doing about it.. nothing. So keep repeating the same zero value statement. Best part here is 'maybe' wrong.
India is not a trust based society in general unlike tad early western societies.
It is about zero trust security systems in IT for a reason
You probably remembered T. N. Sheshan, he was a genius, a doyen who showed true power of ECI. However, that post was later divided between multiple officers, because political system couldn't 'en-trust' so much power with one person.
Till the day open review of h/w and s/w did not happen and obscurity is kept alive, there will be discussions. People does not need to blindly trust higher ups, it is a fact and everyone will have to deal with it. That is the side effect of security through obscurity. Once open review is there, weakness can be exposed and addressed within given limits of the system which will make system more trustable.
B
BullettuPaandi
I was so confused; I get it now. Thanks!
@samavery42 that's not what I meant xD. I'm from TN, so naturally it's a weird bit of pride of mine. In fact, if I know how to type 'z' with a dot under it or 'l' with an underscore under it, I would prefer to, simply because it is supposedly "more proper"
EC doesn't relies on security by obscurity. There was an open challenge that please come and hack EVM, but no one came forward to actually hack it. They all wanted physical possession.
This is not how we define hacking and if this is the case then Desktop Linux is most hackable system on planet.
Who told that there was no review of hardware and software?
EVM hardware and Software has been reviewed multiple times by select group of industry experts from govt and private sectors. Just because every TOM didn't get a chance to peep in to it doesn't makes it untrustable.
People will have opinion and discussion anyway. Tomorrow everyone will ask please tel us security plan of our country so that we can trust that we are safe.
blr_p
Oracle
The beauty of a psyops is you don't have to hack anything. Just get enough people to believe so. Use democracy to end democracy.
Anything that reduces voter confidence is a threat and why I got behind this topic since 2008.
Huh. Now this is a surprise. I think the risk of EVM's is low. Elsewhere I can only trust what the ECI says. I'm just surprised doubters aren't paying more attention to this aspect and instead getting obsessed with only EVM's. They trust the system in other words but not the EVM? Interesting
To my mind the logistical problems whether at the evm level or higher up are similar. But the payoff is larger at the higher level if successfully circumvented
If it hasn't happened in over twenty years why do you think it's likely in the future?
There is no obligation for the ECI to provide any code. And the reason is they are not convinced it will help and could even be counter productive. Open source is a still crazier idea. These are calculators. Their functionality does not change unless some additional legal requirement turns up.
No working society can function without trust.India is not a trust based society in general unlike tad early western societies.
It is about zero trust security systems in IT for a reason
Yeah, that's his name.
But if you say this to ECI. They will reply.
This is the system. Here are our procedures. Now show where is the problem. Don't waste our time on hypotheticals
I advocate people look at the whole system instead of just EVM's and see if they can find any loopholes. For ten years this discussion never moves beyond EVM's. Everybody trusts the rest of the system though
People are just asserting at this point. Like those whose party lost the election.
People obsess about their phone being hacked but if some site that stores their info was targeted instead the payoff is orders of magnitude more isn't it.
Last edited:
@blr_p
> No working society can function without trust.
Trust is not a one way street, parties involved should be able to mutually trust each other, there should be maximum possible transparency for that.
> I advocate people look at the whole system instead of just EVM's and see if they can find any loopholes. For ten years this discussion never moves beyond EVM's. Everybody trusts the rest of the system though
When people are discussing about EVM's they are not discussing about EVM h/w and s/w alone, they also might be considering other facets they does not fully trust. For eg.,
H.K. Patil seeks judicial probe into 19 lakh ‘missing’ EVMs
https://www.thehindu.com/news/natio...into-19-lakh-missing-evms/article65394244.ece
Pune Cops Recover Stolen Control Unit Of EVM, Arrest 2
The control unit of an electronic voting machine (EVM) was allegedly stolen from the office of a revenue official in Maharashtra's Pune district.
https://www.ndtv.com/india-news/pune-cops-recover-stolen-control-unit-of-evm-arrest-2-5014413
Cloud of Silence Hangs Over One-Third of VVPAT Machines in Use Since 2018, Deemed ‘Defective’
thewire.in
"...means that over one-third (37%) of these machines have now been found to be defective by the Election Commission.
What is even more surprising is that entire series of VVPATs are being replaced..."
Remember reading somewhere that alleging (baseless?) complaints against EVMs is illegal / offense. So, I fully 'trust' EVMs. As mentioned, EVMs are only way forward. Here, discussions are only about making it and the whole system more trustworthy by being transparent and thorough open audit / review.
@bigbyte
> Whoever opposes EVM shall Either prove conclusively that it is not safe OR present a better alternative.
Canary in mines and canary resuscitator cage provided later to proect them comes to mind.
> No working society can function without trust.
Trust is not a one way street, parties involved should be able to mutually trust each other, there should be maximum possible transparency for that.
> I advocate people look at the whole system instead of just EVM's and see if they can find any loopholes. For ten years this discussion never moves beyond EVM's. Everybody trusts the rest of the system though
When people are discussing about EVM's they are not discussing about EVM h/w and s/w alone, they also might be considering other facets they does not fully trust. For eg.,
H.K. Patil seeks judicial probe into 19 lakh ‘missing’ EVMs
https://www.thehindu.com/news/natio...into-19-lakh-missing-evms/article65394244.ece
Pune Cops Recover Stolen Control Unit Of EVM, Arrest 2
The control unit of an electronic voting machine (EVM) was allegedly stolen from the office of a revenue official in Maharashtra's Pune district.
https://www.ndtv.com/india-news/pune-cops-recover-stolen-control-unit-of-evm-arrest-2-5014413
Cloud of Silence Hangs Over One-Third of VVPAT Machines in Use Since 2018, Deemed ‘Defective’
Cloud of Silence Hangs Over One-Third of VVPAT Machines in Use Since 2018, Deemed ‘Defective’
An ex-chief election commissioner says some machines being defective is routine, but 6.5 lakh is too high a number and is a “serious” matter. Experts have called for more transparency. The Election Commission is yet to respond to our queries.
What is even more surprising is that entire series of VVPATs are being replaced..."
Remember reading somewhere that alleging (baseless?) complaints against EVMs is illegal / offense. So, I fully 'trust' EVMs. As mentioned, EVMs are only way forward. Here, discussions are only about making it and the whole system more trustworthy by being transparent and thorough open audit / review.
@bigbyte
> Whoever opposes EVM shall Either prove conclusively that it is not safe OR present a better alternative.
Canary in mines and canary resuscitator cage provided later to proect them comes to mind.
Without ever having physical access to EVM. Interesting. Anyway since there is a risk of it getting heated unneccessarily, and nobody seems to want to discuss the technology risks because ops risk control is seen as enough, I'd say lets end it here and agree to think differently. I don't think we have much disagreement, but I also do not see people willing to see what I'm trying to say.