EVMs or Electronic Voting Machines are not much in the news. But quietly, this technology is enabling world’s democracies to elect their leaders in an efficient and secure manner. This includes prominently in India, proudly world’s largest democracy, which completed its multi-round election spread over 6 weeks earlier this summer, an election that reached out to about a billion eligible voters. EVM is arguably simple technology, but it is technology that is vital to ensuring the reach of democracy to the farthest corners of a country, especially a developing one where safety and security of the voting system could otherwise have been an issue.
In recent years, we have seen a general global decline in the health of democracies around the world. Nevertheless, elections are being held in many large countries this year, including India, as mentioned above, France, and the US soon. EVMs in various forms have enabled voting to happen efficiently and securely for the most part, and for the results to be determined quickly. As a security researcher, I am well aware of the numerous weighty and sound research studies exploring the vulnerabilities of EVMs, e.g., [ WWW-2004 ] and [ WWW-2010 ]. There is definitely work to be done by researchers and practitioners working together to make this critical bedrock technology more secure. Thankfully, the vulnerabilities have not been exploited to create any large-scale compromise of the election system, yet.
The Benefits
Let’s look at the most notable advantages of EVMs. First, they solve a logistical nightmare of printing paper ballots and shipping them to the farthest corners of countries. In many of these countries, transportation and roadways are a challenge. In electoral contests, candidate slate may change late in the day and electronic forms make it infinitely easier to accommodate such changes.
Second, EVMs make it much simpler to monitor the integrity of the voting process. I am aware that this is a topic of some debate in security research circles as there are attacks that have been shown that call this into question. Thankfully, if not perfectly reassuringly, such attacks have been demonstrated under lab conditions, such as at DEF CON 2023’s “Voting Village”. The positive part of the equation is that with EVMs, the “chain of custody” from when a voter casts the ballot to when it is counted is easier to verify.
Finally, EVMs make it much faster to count the ballots and announce the results. Often there exists a tense vacuum of uncertainty before the election results are announced and in cases, this leads to speculation, conspiracy theories, and worse. So cutting down the time for which such vacuum exists is a huge societal benefit.
Pause for Thought
Having reflected on these positive aspects, I have a wish list of improvements to EVM technology that would get this closer to our ideal. My colleagues working on security of voting can comment in more technical depth on each item on this wish list. First, the software that goes into the EVMs should be made available, if not as open source, then to a selected group of independent experts, including academic researchers specializing in this area. An overwhelmingly large market share is held by two companies and hence releasing their software would go a long way. The software should then be verified for security and reliability vulnerabilities using all the tools we have in our quite large arsenal, from formal verification through static analysis to fuzzing. Second, there should be monitoring of the EVMs when deployed, as they are being used. This can be done as an example by having paper ballots for a sample, as a checking mechanism. Paper ballots have all the disadvantages that I have noted above, but have their role in a checking mechanism. Finally, on the policy side, it would be desirable to have a federal agency overseeing the security and the reliability of EVMs. Since election administration is a local level activity in the US, we currently do not have any such federal-level body. While keeping the local autonomy intact, it would be feasible to just have the monitoring of the EVMs, dare I say certification, be done through a federal body.
To Sum
In summary, EVMs have become an essential ingredient for a functioning democracy. This is not fancy, glitzy technology and hence not headline grabbing. But this is a good example where technology has quietly made a profound difference to our broad society. With some technology improvements and more policy improvements, we can make this pillar of our democracy even stronger.
Distant Whispers from an Academic Engineer's World 