Technology Risks to EVM?

[blr_p]

@blr_p

Mumbai: Police find relative of Shiv Sena MP who won by 48 votes used phone connected to EVM

Mangesh Pandilkar, a relative of Ravindra Waikar, Shiv Sena's elected MP who narrowly won the Mumbai North West Lok Sabha seat by 48 votes, was found using a phone connected to the Electronic Voting Machines (EVMs), according to Vanrai Police in Maharashtra.

maktoobmedia.com

Row Over ‘Unlocking’ Of EVM By Shinde Sena MP’s Relative - HW News English

Senior poll official Vandana Suryavanshi dismissed allegations of EVM hacking in Mumbai North West, asserting that EVMs

hwnews.in

Track it.

Another speculation. Same empty arguments made by that English guy. Anything is possible, in theory

 

[Emperor]

This English Guy want lower tax on Tesla Electric Cars that are Made in China (even lower tax than what Govt. offers to home bound brands TATA, M&M, Hyundai, MG etc.) and want it to sell in India but as Modi Govt. smart enough not to bend in front of Western Tactics & Pressure... he/they (and some Brilliant Intellectual Indian Politicians too) keep ..... about EVM .. but who cares !!!

 

[TEUser2K1]

What did Mid-Day claim?​

The Mid-Day report claimed that Mangesh Pandilkar, the brother in law of Ravindra Waikar, had used a mobile phone to “unlock” an EVM when the votes were being counted, allegations which returning officer Vandana Suryavanshi and Mumbai police rubbished. Mangesh Pandilkar and a polling official Dinesh Gurav have been booked by the Vanrai Police under section 188 of the Indian Penal Code for flouting the EC ban on mobile phones inside counting centres.

https://www.hindustantimes.com/india-news/huge-political-slugfest-over-evm-hacking-charge-poll-officer-reacts-to-otp-claims-who-said-what-10-points-101718581630760.html

 

[blr_p]

What did Mid-Day claim?​

The Mid-Day report claimed that Mangesh Pandilkar, the brother in law of Ravindra Waikar, had used a mobile phone to “unlock” an EVM when the votes were being counted, allegations which returning officer Vandana Suryavanshi and Mumbai police rubbished. Mangesh Pandilkar and a polling official Dinesh Gurav have been booked by the Vanrai Police under section 188 of the Indian Penal Code for flouting the EC ban on mobile phones inside counting centres.

https://www.hindustantimes.com/india-news/huge-political-slugfest-over-evm-hacking-charge-poll-officer-reacts-to-otp-claims-who-said-what-10-points-101718581630760.html

Wait for the ECI investigation to conclude. It could be weeks

Not falling for any masala narratives

 

[Neotheone]

keep .... about EVM . but who cares!!!

Its interesting to see this level of bias on a technology forum. It is obvious because Elon's comments were not relevant only to India, although these were made in the US context. The point made is simply that there is no such thing as a 100% hack proof technology.

Unfortunately, many members are too blinded by their political stance to let it remain a technology discussion and absolutely always resort to personal attacks instead of even bothering to discuss the technology risks. Asking for significantly higher transparency is also probably too much for them.

 

[blr_p]

Its interesting to see this level of bias on a technology forum. It is obvious because Elon's comments were not India specific, and the point made is simply that there is no such thing as a 100% hack proof technology.

Still a speculation as the supreme court judges called it

Yes, musk's statement is true. So show where and how our systems can be hacked

Unfortunately, many members are too blinded by their political stance to let it remain a technology discussion and absolutely always resort to personal attacks instead of even bothering to discuss the technology risks.

I'm interested in keeping it real...grounded with sources. Tangible takeaways instead of theoretical waffling

Technology Risks to EVM?

@blr_p > The ECI disagrees so we have to work with what we got. Now we reached a platitude :D There is still quite a lot to discuss > And what it got ain't bad. We shouldn't be settling with half good. Hah, we got definitely more than half good > You said something about transparency. Bet...

techenclave.com

^That's a valid tech vulnerability. Can't deny this one. How many here even acknowledged it?

There's a more recent one where this guy 'controls' an evm with his phone. Investigation pending.

Asking for significantly higher transparency is also probably too much for them.

I've already pointed to the government's answers about transparency. Who bothered to review their answers?

They've addressed this in five different ways. Nobody has bothered to challenge it. How come?

 

[honest1]

What did Mid-Day claim?​

The Mid-Day report claimed that Mangesh Pandilkar, the brother in law of Ravindra Waikar, had used a mobile phone to “unlock” an EVM when the votes were being counted, allegations which returning officer Vandana Suryavanshi and Mumbai police rubbished. Mangesh Pandilkar and a polling official Dinesh Gurav have been booked by the Vanrai Police under section 188 of the Indian Penal Code for flouting the EC ban on mobile phones inside counting centres.

https://www.hindustantimes.com/india-news/huge-political-slugfest-over-evm-hacking-charge-poll-officer-reacts-to-otp-claims-who-said-what-10-points-101718581630760.html

They have issued apology for giving wrong report, right ?

This English Guy want lower tax on Tesla Electric Cars that are Made in China (even lower tax than what Govt. offers to home bound brands TATA, M&M, Hyundai, MG etc.) and want it to sell in India but as Modi Govt. smart enough not to bend in front of Western Tactics & Pressure... he/they (and some Brilliant Intellectual Indian Politicians too) keep ..... about EVM .. but who cares !!!

His statement was for EVM's which are used in USA and not India !
Just because they are called EMV, doesnt make them identical !!

 

[Neotheone]

His statement was for EVM's which are used in USA and not India!
Just because they are called EMV, doesnt make them identical!!

I trust that you do not have a bias, so you should be able to see that Elon's core point is not about US, although the context was RFK's comment regarding US elections. However, it takes just one minute of independent thought to see that the relevant quote (given below), is applicable globally:
"The risk of being hacked by humans or AI, while small, is still too high.".

Elon clearly recognizes that risks are low, but not zero. Unless someone has their heads up their backsides, they should be able to see that over the long term, risks will continue to rise, as technological development will only pick up pace with emergence of AI. This is most relevant because many well-funded state and non state actors have incentives to interfere in elections.

In case it is not clear to you or others: the word "risk" refers to a possibility of something dangerous or unpleasant happening; a situation that could be dangerous or have a bad result. Anyone bringing up a risk does not imply that the probability of such an event is 100%. Yet, for such an important technology, denying the obvious risks is simply foolhardy, especially in the long term.

 

[altair21]

Its interesting to see this level of bias on a technology forum. It is obvious because Elon's comments were not relevant only to India, although these were made in the US context. The point made is simply that there is no such thing as a 100% hack proof technology.

with Melon Husk, you can be atleast 99% sure that idiot's just screaming bullshit and while the 1% that idiot might be right, we have other ****ing idiots like Rahul Gandhi who would happily treat it as a justification to throw shade at it and erode public's trust on it,

In case it is not clear to you or others: the word "risk" refers to a possibility of something dangerous or unpleasant happening; a situation that could be dangerous or have a bad result. Anyone bringing up a risk does not imply that the probability of such an event is 100%. Yet, for such an important technology, denying the obvious risks is simply foolhardy, especially in the long term.

just scrutinise the EVM process once before saying its risky, the only way a party can scam EVM is if they pay off all election officials in that district, all opposition party workers and somehow replace the entire ****ing thing from right under Army/Police's nose so that they get other party's votes.

I think its pretty safe to say that EVM is as bulletproof as it comes as long as all the related parties conform to the rules

 

[Neotheone]

with Melon Husk, you can be atleast 99% sure that idiot's just screaming bullshit and while the 1% that idiot might be right, we have other ****ing idiots like Rahul Gandhi who would happily treat it as a justification to throw shade at it and erode public's trust on it,

just scrutinise the EVM process once before saying its risky, the only way a party can scam EVM is if they pay off all election officials in that district, all opposition party workers and somehow replace the entire ****ing thing from right under Army/Police's nose so that they get other party's votes.

I think its pretty safe to say that EVM is as bulletproof as it comes as long as all the related parties conform to the rules

You have a clear bias because instead of using reasons for why there is reason to believe that India has invented the world's only lowest risk EVM which should not be questioned, you resort to ad hominem attack, attacking Elon and Politicians. You also imply that questioning EVM erodes public trust so it should not be done, which is quite laughable from a technology security standpoint, even if you think for two minutes about it.

This discussion isn't about people or politics. Its core is about technology risks. It isn't about process risks as well although process related measures are well intentioned but not fool proof in the long run as there can be regimes in the future who may subvert the process. And even 1% risk is very high for EVMs and needs to be mitigated through transparency which leaves a lot to be desired.

And sorry, but "maintaining public trust in EVM" is frankly a shallow argument to put it kindly. The argument completely lacks merit, so I presume it is your sheer bias. Appeal to trust is not an argument for not asking tough questions and doing rigorous testing. That argument is similar to saying that banking technology systems security should not be repeatedly questioned/tested to keep trust in banking system to avoid bank runs. Thankfully, RBI does a great job organizing repeated security testing to ensure they are a step ahead of hackers most of the times. And hacks still happen.

Technology risks are mitigated only through regular well established security procedures. Public trust can not be blind trust of bureaucrats but should be based on transparency and frequenct testing by state of the art security researchers.

 

[blr_p]

India has invented the world's only lowest risk EVM which should not be questioned

This not true at all. In fact it's a strawman argument. Any demonstration of possible vulnerabilities will immediately be addressed.

Like the preloading of party symbol images. That's the latest. I'm sure there will be more in the future if a genuine case is raised. I wanted this thread to document all the instances where exactly this happened in the past. So I have linked to past judgements where this happened to no positive response here.

You also imply that questioning EVM erodes public trust so it should not be done, which is quite laughable from a technology security standpoint, even if you think for two minutes about it.

Raising concerns with no demonstrable claims does exactly that.

This discussion isn't about people or politics. Its core is about technology risks. It isn't about process risks as well although process related measures are well intentioned but not fool proof in the long run as there can be regimes in the future who may subvert the process.

Nobody denies this. As I said earlier..

Democracies aren't setup with the expectation that angels will enter office. They are setup so that if your PM turns out to be a crook you have adequate means of redressal.

And sorry, but "maintaining public trust in EVM" is frankly a shallow argument to put it kindly. The argument completely lacks merit, so I presume it is your sheer bias. Appeal to trust is not an argument for not asking tough questions and doing rigorous testing.

It's not an appeal to trust. The SC has to date disposed off nine petitions spanning a few years now seeking a return to the paper ballot. I don't know if that's your position but it clearly is with the people that filed those petitions and their driving agenda was a blind distrust that was not justified.

That argument is similar to saying that banking technology systems security should be repeatedly tested to keep trust in banking system to avoid bank runs. Thankfully, RBI does a great job organizing repeated security testing to ensure they are a step ahead of hackers most of the times. And hacks still happen.

A bank run as I'm sure you know stems from a lack of confidence in how the bank has been run. Rumours that it's over leveraged, over extended etc. Less for a fear it will be hacked or I'm not aware of such instances

Your statement is confusing to me otherwise.

Technology risks are mitigated only through regular well established security procedures. Public trust can not be blind trust of bureaucrats but should be based on transparency and frequenct testing by state of the art security researchers.

And those researchers want access to the source codes that the ECI considers a risk to be released. The best argument I've seen in this thread is the mantra 'security through obscurity is no security'.

So outright dismiss the concerns of the very people tasked with maintaining the system. Why is their objection not valid?

The ECI has supervised four successful general elections. Not to mention many more state elections. They are very confident they're on the right path

 

[Emperor]

LS Polls: ‘ Terrible conspiracy to influence general election in India ’, shocking claims in Disinfo Lab report​

https://www.amarujala.com/india-new...n-india-2024-06-19?src=aamnesaamne&position=2

 

[Neotheone]

LS Polls: ‘ Terrible conspiracy to influence general election in India ’, shocking claims in Disinfo Lab report​

https://www.amarujala.com/india-new...n-india-2024-06-19?src=aamnesaamne&position=2

It seems that irrelevant conspiracy theories are the only argument that you and the likes of you have to anyone who raises the need to use time tested technology security principles regarding EVMs as well.

In good faith, I presume you are not ill intentioned, so I would like to think that this is probably your bias which makes you use a "strawman" argument of "external forces trying to influence general election" in this context. The context is clear enough if you read the thread title, and if you still cannot see it - it is "Technology Risks to EVM".

If someone has even a rudimentary understanding of risks and their mitigation in technology driven systems, then one can contribute to a reasoned discussion here. Unfortunately, it seems you and many others are so blinded by the official narrative, and full of hostility towards any alternative views or possibilities, that you cannot have a discussion on this without bringing in a strawman into the argument. The recurring use of fallacies on a technology risk discussion is a bit surprising for a tech forum. I hope you and the likes of you know what logical fallacies are and how to spot them, but your abuse of logic is so remarkably consistent, that I would be surprised if you do.

 

[blr_p]

LS Polls: ‘ Terrible conspiracy to influence general election in India ’, shocking claims in Disinfo Lab report​

https://www.amarujala.com/india-new...n-india-2024-06-19?src=aamnesaamne&position=2

https://thedisinfolab.org/the-invisible-hands/

That's their source with a report to download. These guys are more into info warfare. Their coverage is about influence operations etc. I'll know more once I read through their report

Nothing on EVM's

People like Soros et al. were lamenting how their efforts to 'save democracy' weren't getting much traction in India. These efforts remain limited thanks to the fcra restrictions on NGO's back in 2015.

Not much info about who runs this website. No names mentioned but the content is familiar to me

 

[JMP]

Its core is about technology risks.

I am not able understand what you are hoping would be discussed here.
Are we to speculate on hypothetical possibilities of how electronic components inside an EVM could be hacked in the future?
Every system, irrespective of whether it is open or closed can be hacked. Risk mitigation is about creating barriers such that the juice is not worth the squeeze for a malicious actor.

It isn't about process risks as well although process related measures are well intentioned but not fool proof in the long run as there can be regimes in the future who may subvert the process.

From my cursory reading of the thread, people are bringing up processes because they are a vital and inseparable part of the system. The probability of hacking is mitigated by both reasonable electronic measures - OTP & Air Gapping, and processes - VVPAT, pre-poll tests by candidate representatives, vote count slip at the end of the day in each polling station etc.

And even 1% risk is very high for EVMs and needs to be mitigated through transparency which leaves a lot to be desired.

More transparency is always good, yes we citizens can ask the ECI to publish the schematics or conduct a thrid party audit of the system by credible individuals. But that does not prove that paper based voting is in any way better than the system we presently have. I think this was the point made by the Supreme Court - ask for improvements to the system, for example the statistsical probablity aruugment made eariler in this thread is a very good suggestion, but the claim 'anything electronic can be hacked' hence we should not use EVMs and go back to paper ballots is illogical. Niether Elon Musk's nor Tom Scott's arguments against electronic voting are applicable to the Indian context because we don't have purely electronic voting, we have all the charactericsts of manual paper based voting, including the paper, with an added device for convenience.

 

[Neotheone]

I am not able understand what you are hoping would be discussed here.

Please refer post #1.

Are we to speculate on hypothetical possibilities of how electronic components inside an EVM could be hacked in the future?

No. I am only interested in any known or potential tech security vulnerabilities. I mistakenly thought a tech forum might lead to fruitful open discussions.

Transparency is always good, yes we citizens can ask the ECI to publish the schematics or conduct a thrid party audit of the system by credible individuals.

Thanks. Appreciate that.

But that does not prove that paper based voting is in any way better than the system we presently have. I think this was the point made by the Supreme Court - ask for improvements to the system, for example the statistsical probablity aruugment made eariler in this thread is a very good suggestion, but the claim 'anything electronic can be hacked' hence we should not use EVMs and go back to paper ballots is illogical.

I am nearly fully with you on this.

Niether Elon Musk's nor Tom Scott's arguments against electronic voting are applicable to the Indian context because we don't have purely electronic voting, we have all the charactericsts of manual paper based voting, including the paper, with an added device for convenience.

I get your point but it at best gives me some hope that we might be ok in the near term.

Over the long term, I respectfully disagree because to my view both tech and process vulnerabilities can potentially compromise the entire system over the course of years and decades.

There can be unknown unknowns, among other risks which should always be looked out for, because the stakes are as high as they get and well funded state/non state actors might want to play foul, and at least some of these would likely have access to unpublished technology. The only way to mitigate risks as much as possible is to keep both tech and process risks as fool proof as possible and absence of transparency does not inspire confidence.

On the process front, there is also a risk that a future draconian powerful government can use the state machinery to subvert the process safeguards to stay in power. And bureaucrats often dance to the tune of those in power.

Surprising that somehow it inspires blind confidence among so many tech enthusiasts. I suspect it comes from a place of faith, maybe optimism, but not so much reason.

 

[Emperor]

https://thedisinfolab.org/the-invisible-hands/

People like Soros et al. were lamenting how their efforts to 'save democracy' weren't getting much traction in India. These efforts remain limited thanks to the fcra restrictions on NGO's back in 2015.

.. and we all know who oppose Govt.'s above decision !!!

 

[TEUser2K1]

Soros is a problem, but we can have our own ways to stay better.
edited.

 

[Emperor]

Yes, but what to do with inner bunch of EDUCATED idiots who just for politics (money/power) always create doubt on good decision and genuine govt. institutions too, mainly when results not came in their favors?

 

[JMP]

Over the long term, I respectfully disagree because to my view both tech and process vulnerabilities can potentially compromise the entire system over the course of years and decades.

There can be unknown unknowns, among other risks which should always be looked out for, because the stakes are as high as they get and well funded state/non state actors might want to play foul, and at least some of these would likely have access to unpublished technology.

If your point is that we need to be vigilant for possible threat vectors, yes I agree with you.
But state actors who intend to bring about political change in a country don't need secretive technology they have been doing it for decades via disinformation, exploiting known fault lines and social engineering. Also, I don't see why an actor with such unpublished technology would wait for years and manipulate EVMs, which have minuscule target surface and a physical paper trail, rather than disrupt our banking, energy, transportation or defense systems which are far more vulnerable, since the ensuing chaos will bring about political change.

The only way to mitigate risks as much as possible is to keep both tech and process risks as fool proof as possible and absence of transparency does not inspire confidence.

Agreed, but the processes are open to public scrutiny and accessible to anybody who wants to know about them. We can communicate improvements / additional safeguards to the ECI and compel them via courts if need be. VVPATs were brought about this way.
ECI must be a lot more upfront about data (voter list, number of votes cast), and we could ask them to publish the schematics of the EVM, but apart from these I don't see what else the ECI needs do to improve transparency.

There is also a risk that a future draconian powerful government can use the state machinery to subvert the process safeguards to stay in power.

A malicious government can do that irrespective of the type of ballot, case in point Indira Gandhi. This vector cannot be addressed by technical solutions.

Surprising that somehow it inspires blind confidence among so many tech enthusiasts. I suspect it comes from a place of faith, maybe optimism, but not so much reason.

I don't think people here believe an EVM is some kind impregnable fortress. But, since axiomatically we cannot discuss unknown unknowns and it is highly unlikely any member here knows about unpublished tech or capabilities of a state level actor, the only possible way this discussion could have headed was EVMs as they exist today and associated processes. If any member has insights into possible future or tech vulnerabilities I am happy to know more.