Hari Prasad, the managing director of an Indian research and development firm and co-author of a technical paper detailing security vulnerabilities in India's electronic voting machines, has been arrested for allegedly stealing the voting machine that he and colleagues studied. According to the home page of Verifiability, Transparency and Accountability in Indian Elections (VeTA), of which Prasad is technical coordinator, the machine was provided by a local official for research purposes.
The Times of India reported that Prasad was arrested yesterday morning and "has been remanded has been remanded to police custody till August 26." (I don't advise that you follow the Indian Express link in Google News, as it ironically triggers a Trojan horse warning for me.)
Maybe they should have charged Prasad with stealing the emperor's clothes, too?
The electronic voting machines used in India are very different from the highly programmable and expensive Direct Recording Electronic (DRE) voting machines used in much of the United States -- but, like the DREs used in many states, they don't provide any paper record of individual votes. The Prasad et al. paper (here's a redundant link) notes that Indian officials have characterized the Indian EVMs as "infallib[le]," "fully tamper-proof," and "perfect." Not so much. The paper describes a variety of inventive ways to tamper with the machines. Prasad et al. essentially found that the machine wasn't more tamper-resistant than more complicated equipment, but rather susceptible to different kinds of attacks. To quote from their conclusion:
Despite elaborate safeguards, India's EVMs are vulnerable to serious attacks. Dishonest insiders or other criminals with physical access to the machines at any time before ballots are counted can insert malicious hardware that can steal votes for the lifetime of the machines. Attackers with physical access between voting and counting can arbitrarily change vote totals and can learn which candidate each voter selected.
These problems are deep-rooted. The design of India’s EVMs relies entirely on the physical security of the machines and the integrity of election insiders. This seems to negate many of the security benefits of using electronic voting in the first place. The technology’s promise was that attacks on the ballot box and dishonesty in the counting process would be more difficult. Yet we find that such attacks remain possible, while being more difficult to detect.
In photographs included in the paper, the machine's identifying marks are covered in tape to protect the anonymity of the source. According to a press report, the serial number was visible in a television interview, and was used to trace the machine to Mumbai. According to the Indian Express story (again, not linked for your protection), police have said that Prasad claims not to remember the name of the local official who provided the machine.
Indian election officials apparently have attempted to protect the security of the voting machines -- or, at any rate, their reputation -- by limiting access to them. But with more than one million machines in use, security through obscurity is hopeless. Prasad's arrest seems likely to draw further attention to the machines' security failings.
Updates from the perspective of Prasad's colleagues at VeTA should be available via VeTA's Indian EVM home page. So far the independent news stories I've found have been consistent with the information provided by VeTA.
The Statesman News Service reports that Prasad sent a text that reads in part:
I am writing from my mobile en route to Mumbai. It is time now for more technical people to pitch in and take up the cause in case my detention is for long.... I still believe whatever I have done is correct and in the national interest and am also thankful to the official who made available the EVM to us for a brief period. Hope I can communicate few more hours... I love my country.
UPDATES: I neglected to link to the remarks of J. Alex Halderman, computer scientist at the University of Michigan and one of Prasad's co-authors, posted very early this morning.
In comments, under the bodhi tree links to an update by the Mumbai Mirror.