When the SC Says No for Software Audit Review of EVMs & VVPAT at Present
Moneylife Digital Team 09 April 2019
The Supreme Court (SC) on Monday decided to increase voter-verified paper audit trail (VVPAT) from one electronic voting machine (EVM) per assembly segment to five randomly selected EVMs to ensure the greatest degree of accuracy and satisfaction in the election process. According to the apex Court's direction, the VVPAT slips of five EVMs in every place will be subjected to physical counting.
However, while deciding on the bunch of petitions, the SC closed one petition, filed by Sunil Ahya that was seeking software audit or review of the source code of EVMs and VVPATs.
The court's direction came on a plea by 21 leaders from the Opposition parties and others who wanted the VVPAT trail to be increased to 50% of EVMs per assembly segment. 
Mumbai-based Mr Ahya, who is an activist and manufacturer of micro controller based electronic products, was one of the petitioners in this case, who was seeking software audit of EVMs and VVPATs. 
The Supreme Court bench headed by Chief Justice Ranjan Gogoi, said, “We express our reluctance to go into the issues regarding the integrity of the EVMs, which have been raised at a belated stage. The petition was filed in the month of December 2018 raising various technical issues, which are not possible to be gone into at this stage. With the aforesaid observations, the writ petition shall stand closed.”
According to Mr Ahya the Election Commission (EC) in response to an application filed under right to information (RTI) stated that they have no information on software audit or source code review of EVMs. “Now they are informing that a technical expert committee is conducting that software audit. Either of statements can be true but both the statements cannot be true at the same time. In addition, the EC in its reply to the petition has not disclosed standards under which the audit has been conducted.”
“The EC on its website stated that EVMs have been created by Electronic Corporation of India Ltd (ECIL) and Bharat Electronics Ltd (BEL). The question therefore arises can the creator of EVM conduct an audit by itself because auditing body has always got be an independent body. The EC has completely ignored my prayer for an independent software audit review on all EVMs and VVPATs," he added.
In the public interest litigation (PIL), Mr Ahya had asked for independent software audit review of the EVMs in accordance with international practice. "The reason why an independent audit is vital is that, any process including an election process, right from its inception to final declaration of result would have many stages, links and tiers. An audit process identifies the weakest link in the whole chain and examines the assumptions to the contrary i.e. it examines the links, which otherwise would appear to be very secure," he says.
Source code is a human readable set of written statements which instruct the hardware of an electronic machine on how to function. An independent software audit review is a type of review in which one or more auditors, who are not members of the software development organisation, conduct it.
In India, the EVMs are developed, manufactured and managed by ECIL and BEL, while employees of an unnamed micro-controller manufacturer burns the software machine code onto OTP chip before it gets installed into EVM.
According to Mr Ahya, every single processor-based electronic device, including EVMs, runs through ‘software products’. During 16 March 2017 to August 2018, the EC had published three papers, including one press note on EVMs.
"From a detailed perusal of all these documents, it is prima facie evident that, the ECI does not carry out independent software audit review of various ‘software products’ of EVMs particularly the ‘source code’ which is the brain on which an entire EVM functions. It does not do so, both, before the elections as well as when these are actually deployed for voting on election day," Mr Ahya says.
Amidst growing concerns and complaints on the functioning on EVMs and, therefore, to have fullest transparency in the system and to restore the confidence of the voters, ECI introduced VVPATs as an add-on to the existing EVMs. These VVPATs provide a visible feedback to the voters so as to verify that their vote has been cast correctly. The full implementation of VVPATs is said to be, all set to be achieved by the year 2019.
Although, Mr Ahya, the petitioner, says, introduction of VVPAT as an add-on to the EVMs, is indeed, a welcome move and a step in the right direction on the road to achieve fullest transparency in the voting system and to restore the confidence of the voters, nevertheless, the concerns raised in respect of EVMs remains all the same despite introduction of the VVPAT. The VVPAT paper slips are to be printed on a thermal paper, which is susceptible to fading, he added.
In its status paper on EVMs, the EC has stated that it had introduced an EVM Tracking Software (ETS) as a modern inventory management system whereby the identity and physical presence of all EVMs and VVPATs is tracked on real time basis by the Commission and any movement of these machines ordered by it has to mandatorily be through this system. 
Mr Ahya, based on the statement from the ECI, contended that the source code of software used in EVM, VVPAT and ETS play a very important role in the scheme of conduct of elections. He says, "...if the source code of EVM, VVPAT and ETS were to be subverted in concert, then the process of randomization process would no longer maintain its randomness, rather it will become deterministic and systematic. This would be able to achieve a pre-determined outcome of the election process so as to achieve a pre-determined subverted outcome."
Thus, he contended that "in view of the above, the introduction of VVPATs may merely remain as output devices (printers) for the voters to satisfy themselves that their votes have been cast correctly, however, a concerted subversion of source codes of EVM, VVPAT and ETS may yet subvert the election results."
"Therefore, the audit of every source code whether in EVM, VVPAT or ETS needs to be undertaken and hash function outputs be registered so that any person is able to verify hash function when the machine is deployed for election use," Mr Ahya says.
On his next course of action, the Mumbai-based activist says his petition is closed for the moment in view of the general elections and he intends to reopen the petition at an appropriate time. 
Free Helpline
Legal Credit