Security analysis of India's electronic voting machines

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2010, Pages 1-14

  Wolchok, Scott ^a   Wustrow, Eric ^a   Halderman, J Alex ^a   Prasad, Hari K ^b   Kankipati, Arun ^b   Sakhamuri, Sai Krishna ^b   Yagati, Vasavya ^b   Gonggrijp, Rop ^c  

^a UNIVERSITY OF MICHIGAN   (United States)

^b Netindia (P) Ltd   (India)

^c NONE

Author keywords

Design; Human factor; Security

Indexed keywords

CUSTOM HARDWARES; DESIGN AND OPERATIONS; EASE OF USE; ELECTRONIC VOTING; ELECTRONIC VOTING MACHINES; HUMAN FACTORS; INDIAN ELECTIONS; SECURITY; SECURITY ANALYSIS; SECURITY EVALUATION; TRUSTED COMPUTING BASE;

HUMAN ENGINEERING; SECURITY SYSTEMS; VOTING MACHINES;

MACHINE DESIGN;

EID: 78649988287     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1866307.1866309     Document Type: Conference Paper

References (57)

1. A. K. Agarwala, D. T. Shahani, and P. V. Indiresan. Report of the expert committee for evaluation of the upgraded electronic voting machine (EVM). Sept. 2006. http://www.scribd.com/doc/6794194/Expert-Committee-Report-on-EVM, pages 2-20.
2. R. Anderson and M. Kuhn. Tamper resistance: A cautionary note. In Proc. Second USENIX Workshop on Electronic Commerce, Oakland, CA, 1996.
3. A. W. Appel. Certification of December 1, 2008. http://citp.princeton. edu/voting/advantage/seals/appel-dec08-certif.pdf.
4. A. W. Appel, M. Ginsburg, H. Hursti, B. W. Kernighan, C. D. Richards, G. Tan, and P. Venetis. The New Jersey voting-machine lawsuit and the AVC Advantage DRE voting machine. In Proc. Electronic Voting Technology Workshop/Workshop on Trustworthy Elections (EVT/WOTE), Montréal, Canada, Aug. 2009.
5. A. Aviv, P. Cerný, S. Clark, E. Cronin, G. Shah, M. Sherr, and M. Blaze. Security evaluation of ES&S voting machines and election management system. In Proc. USENIX/ACCURATE Electronic Voting Technology Workshop (EVT), San Jose, CA, July 2008.
6. D. Bowen. "Top-to-Bottom" Review (TTBR) of voting machines certified for use in California. California Secretary of State, Aug. 2007. http://sos.ca.gov/elections/elections vsr.htm.
7. J. Brunner. Evaluation & Validation of Election-Related Equipment, Standards & Testing (EVEREST). Ohio Secretary of State, Dec. 2007. http://www.sos.state.oh.us/SOS/Text.aspx?page=4512.
8. Bundesverfassungsgericht (German Constitutional Court). Judgment [.] 2 BvC 3/07, 2 BvC 4/07, official English translation. Mar. 3, 2009. http://www.bverfg.de/entscheidungen/rs200903032bvc000307en.html.
9. K. Butler, W. Enck, H. Hursti, S. McLaughlin, P. Traynor, and P. McDaniel. Systemic issues in the Hart InterCivic and Premier voting systems: Reections on Project EVEREST. In Proc. EVT, San Jose, CA, July 2008.
10. J. A. Calandrino, A. J. Feldman, J. A. Halderman, D. Wagner, H. Yu, and W. P. Zeller. Source code review of the Diebold voting system. Part of California TTBR, Aug. 2007.
11. J. A. Calandrino, J. A. Halderman, and E. W. Felten. Machine-assisted election auditing. In Proc. EVT, Boston, MA, Aug. 2007.
12. C. Castelluccia, A. Francillon, D. Perito, and C. Soriente. On the diffculty of software-based attestation of embedded devices. In Proc. 16th ACM Conference on Computer and Communications Security (CCS), Chicago, IL, pages 400-409, Nov. 2009.
13. M. Chatterjee. Tribal voters in Jharkhand reckon with EVM technology. In Indo-Asian News Service, Nov. 20, 2009.
14. D. Chaum. Secret-ballot receipts: True voter-verifiable elections. IEEE Security & Privacy, 2(1):38-47, Jan. 2004.
15. D. Chaum, A. Essex, R. Carback, J. Clark, S. Popoveniuc, A. Sherman, and P. Vora. Scantegrity: End-to-end voter-verifiable optical-scan voting. In IEEE Security & Privacy, 6(3):40-46, May 2008.
16. D. Chaum, P. Y. A. Ryan, and S. A. Schneider. A practical, voter-verifiable election scheme. University of Newcastle upon Tyne, Technical Report CS-TR-880, Dec. 2004.
17. S. Checkoway, A. J. Feldman, B. Kantor, J. A. Halderman, E. W. Felten, and H. Shacham. Can DREs provide long-lasting security? The case of return-oriented programming and the AVC Advantage. In Proc. EVT/WOTE, Montréal, Canada, Aug. 2009.
18. CNN-IBN TV. Interview with P. V. Indiresan. July 20, 2009. http://ibnlive.in.com/videos/97488/evms-rigged-poll-panel-challenges-doubters. html.
19. A. U. de Haes. Dutch government bans electronic voting. In IDG News Service, May 19, 2008. http://news.idg.no/cw/art.cfm?id=003AE63C-17A4-0F78- 31DDDC0DCFA62609.
20. Election Commission of India. Election laws. http://eci.nic.in/eci main/ElectoralLaws/electoral law.asp.
21. Election Commission of India. Protocol for first level checking of EVMs before elections. Oct. 12, 2007. http://eci.nic.in/eci main/CurrentElections/ECI Instructions/ins 121007g.pdf.
22. Election Commission of India. Handbook for presiding officers. 2008. http://eci.nic.in/ecimain/ElectoralLaws/HandBooks/Handbook for Presiding Officers.pdf.
23. Election Commission of India. Handbook for candidates. 2009. http://eci.nic.in/ecimain/ElectoralLaws/HandBooks/HandbookforCandidates.pdf.
24. Election Commission of India. Handbook for returning officers. 2009. http://eci.nic.in/ecimain/ElectoralLaws/HandBooks/Handbook for Returning Officers.pdf.
25. Election Commission of India. Schedule for general elections, 2009. Mar. 2009. http://www.elections.tn.nic.in/forms/pn020309.pdf.
26. Election Commission of India. Information under RTI on EVMs. July 2009. No. RTI/2009-EMS/39.
27. Election Commission of India. Electronic voting machines-Regarding. Aug. 8, 2009. No. PN/ECI/41/2009.
28. Election Commission of India. The Commission's reply to Sh. V. V. Rao. Mar. 29, 2010. http://eci.nic.in/ecimain/recent/reply sh.VVRao.pdf.
29. A. J. Feldman, J. A. Halderman, and E. W. Felten. Security analysis of the Diebold AccuVote-TS voting machine. In Proc. EVT, Boston, MA, Aug. 2007.
30. R. Gonggrijp and W.-J. Hengeveld. Studying the Nedap/Groenendaal ES3B voting computer: A computer security perspective. In Proc. EVT, Boston, MA, Aug. 2007.
31. A. Goodnough and C. Drew. Florida to shift voting system with paper trail. In The New York Times, Feb. 2, 2007.
32. The IDA Pro disassembler and debugger. http://www.hex-rays.com/idapro/.
33. Irish Department of the Environment, Heritage & Local Government. Minister Gormley announces Government decision to end electronic voting and counting project. Apr. 23, 2009. http://www.environ.ie/en/LocalGovernment/ Voting/News/MainBody,20056,en.htm.
34. R. G. Johnston. Tamper-indicating seals. In American Scientist, pages 515-523, November-December 2006.
35. C. R. Kasarbada, P. V. Indiresan, and S. Sampath. Report of the expert committee for the technical evaluation of the electronic voting machine. Apr. 1990. http://www.scribd.com/doc/6794194/Expert-Committee-Report-on-EVM, pages 21-37.
36. A. Kerckhoffs. La cryptographie militaire. In Journal des Sciences Militaires, 9:5-38, Jan. 1883, :161-191, Feb. 1883.
37. S. T. King, J. Tucek, A. Cozzie, C. Grier, W. Jiang, and Y. Zhou. Designing and implementing malicious hardware. In Proc. First USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET), San Francisco, CA, Apr. 2008.
38. T. Kohno, A. Stubblefield, A. D. Rubin, and D. S. Wallach. Analysis of an electronic voting system. In Proc. IEEE Symposium on Security and Privacy, Oakland, CA, pages 27-40, May 2004.
39. R. K. Kumar. The business of 'black-marking' voters. In The Hindu, Mar. 17, 2004. http://www.hindu.com/2004/03/17/stories/2004031700571300.htm.
40. S. Liton. E-voting in DCC polls. In The Daily Star, Apr. 14, 2010. http://www.thedailystar.net/newDesign/news-details.php?nid=134325.
41. R. Mehta. How 100,000 EVMs can be tampered by just 10-12 people at top. http://rahulmehta.com/evm1.pdf, 2009.
42. R. Mercuri. Electronic vote tabulation: Checks and balances. Ph.D. Thesis, University of Pennsylvania, 2001.
43. C. A. Neff. Practical high-certainty intent verification for encrypted votes. Oct. 2004. http://votehere.com/old/vhti/documentation/vsv-2.0.3638.pdf.
44. K. Nohl and D. Evans. Reverse-engineering a cryptographic RFID tag. In Proc. 17th USENIX Security Symposium, San Jose, CA, July 2008.
45. Office of Chief Electoral Officer, Delhi. Documentary on preparation of EVM at R.O. level. http://www.youtube.com/watch?v=wRJQTTrumNI.
46. S. Popoveniuc and B. Hosp. An introduction to Punchscan. In Proc. IAVoSS Workshop on Trustworthy Elections (WOTE), Cambridge, UK, Oct. 2006.
47. Press Trust of India. Singapore, Malaysia, South Africa approach BEL for EVMs. Apr. 12, 2009. http://www.hindu.com/thehindu/holnus/002200904121051.htm.
48. Press Trust of India. Compulsory voting not practical, says CEC. Apr. 26, 2010. http://news.rediff.com/report/2010/apr/26/compulsory-voting-not- practical-says-cec.htm.
49. RABA Innovative Solution Cell. Trusted agent report: Diebold AccuVote-TS voting system. Jan. 2004.
50. G.V.L. N. Rao. Democracy at Risk! Citizens for Verifiability, Transparency & Accountability in Elections, New Delhi, 2010. http://indianevm.com/book.php.
51. S. Ravi, A. Raghunathan, P. Kocher, and S. Hattangady. Security in embedded systems: Design challenges. In ACM Trans. Embed. Comput. Syst., 3(3):461-491, Aug. 2004.
52. R. L. Rivest and J. P. Wack. On the notion of "software independence" in voting systems. http://vote.nist.gov/SI-in-voting.pdf, 2006.
53. N. Sastry, T. Kohno, and D. Wagner. Designing voting machines for verification. In Proc. 15th USENIX Security Symposium, Vancouver, Canada, July 2006.
54. Science Applications International Corporation. Risk assessment report: Diebold AccuVote-TS voting system and processes. Sept. 2003.
55. G. Shah, A. Molina, and M. Blaze. Keyboards and covert channels. In Proc. 15th USENIX Security Symposium, Vancouver, Canada, July 2006.
56. UNICEF. India statistics. http://www.unicef.org/infobycountry/india statistics.html [accessed Apr. 17, 2010].
57. Wikipedia. Results of the 2009 Indian general election by parliamentary constituency. http://en.wikipedia.org/w/index.php?title= Resultsofthe2009Indiangeneralelectionbyparliamentaryconstituency&oldid= 347683199 [accessed Apr. 17, 2010].