EVM: Safeguarding Democracy1
Anupam Saraph2, Ph.D.
Lok Sabha 2009 .........................................................................................................2
Designing Receipts ....................................................................................................6
EVMs are a channel for the people to express their interests in a democracy. They
safeguard democracy if they enable and protect the expression and they further
democracy if they allow increasing involvement or expression of people’s interests.
This paper outlines three safeguards that help increase the involvement and
expression of interests of the people: Voting Receipts, or the provision of receipts to
voters, Open Audits, or the ability to allow anyone to audit an election, and
Ubiquitous EVMs, or the ability to take EVM’s to voters. It outlines how each of these
safeguards democracy and helps increase the involvement or expression of the
interests of the voters.
The safeguards suggested here are neither a perfect nor a complete list. They are
expected to serve as a starting point for safeguarding democracy.
India is considered the world’s largest democracy because the most number of people
in the world are expected to cast their votes during the periodic polling processes for
various public offices. Elections happen under the Representation of Peoples Act
1951, one of the 2000+Acts that have been ratified by the Parliament to uphold the
Promise of the Constitution of India3 constituting itself as a sovereign democratic
republic. The Representation of Peoples Act is considered as the legal instrument to
operationalise democracy, the rule of the people of India.
Traditionally democracy has been understood as the rule of the people, by the people
and for the people. Last month, in January 2010, the US department of State ran a
competition4 on twitter.com to have people across the world define democracy. The
Presented at the International Conference on EVMs, convened by The Centre For
National Renaissance Chennai on February 13th 2010.
Anupam Saraph is a democracy activist. He is also an advisor on strategy,
innovation, systems design, scenario development and information systems. He is also
recognized for contributions as an independent Board Member, coach and as a CxO.
The constitution itself was adopted on the 26th of November 1949 to come into
effect from the 26th of January 1950.
Anupam Saraph Page 1 2/12/10
Chinese winner of the competition defined democracy as a set of game rules that, in
their gradual process towards perfection, independent individuals and organizations in
a civil society seek to maximize their interests using transparent and nonviolent
This definition accepts the changing nature of democracy and puts a purpose to its
existence: the maximization if the interests of individuals and organizations.
Importantly it says a democracy brings about the changes in the rules that maximize
interests in a nonviolent and transparent manner.
Lok Sabha 2009
Elections to the 15th Lok Sabha, the Lower House of the Indian Parliament, were
conducted in 5 phases across the country (See Figure 1). This is perhaps the first
election in India that had a change of the Chief Election Commissioner during the
Like the previous elections to the Lok Sabha held in 2004, the elections in 2009 were
conducted using EVM’s manufactured in India by Electronics Corporation of India
Limited (ECIL), a Public Sector Company from Hyderabad, and Bharat Electronics
Limited (BEL), a Public Sector company from Bangalore.
Once candidates began to register, the Election Commission of India provided list of
candidates contesting the elections on its web site6. As one would expect the version
of this file downloaded on the 16th of April7 and 24th of April8 had various details of
candidates but no information on votes polled. The version of this file downloaded on
the 6th of May9, 7th of May10 and 11th of May11 10 full days before polling ended,
however, had coded the candidate name12, party name and votes polled13.
Mr Naveen Chawla took over as the Chief Election Commissioner from Mr. N
Gopalaswamy on April 20th 2009. Phase I of the Lok Sabha Polls happened under Mr.
Gopalswamy;s tenure while the rest under Mr. Chawla’s.
http://www.scribd.com/doc/15676183/CandidateAC.xls Version of CandidateAC
file downloaded on the 16th of April 2009
http://www.scribd.com/doc/15676724/CandidateAC1.xls Version of CandidateAC
file downloaded on the 24th of April 2009
http://www.scribd.com/doc/15676840/CandidateAC2.xls Version of CandidateAC
file downloaded on the 6th of May 2009
http://www.scribd.com/doc/15676045/CandidateAC4.xls Version of CandidateAC
file downloaded on the 7th of May 2009
http://www.scribd.com/doc/15676489/CandidateAC5.xls Version of CandidateAC
file downloaded on the 11th of May 2009
The coding is reported to have the sequence with which the candidate names
appeared on EVM’s in their constituencies.
The version of the CandidateAC file downloaded on and after the 15th of May 2009
from the ECI website (archived at
Anupam Saraph Page 2 2/12/10
Figure 1 The Schedule of the Lok Sabha Polls in 2009
The results declared on the 16th May 2009 surprised everyone across the board. The
combination of the unexplained data on the Election Commission’s website long
before completion of polls, the absence of result data on the ECI website after the
“results” and the unexpected poll results raised serious questions about the ability of
the EVM to capture, store and retrieve with fidelity the votes cast by the people of
Beginning June 2009 every Political Party was raising concerns about EVM’s and
demonstrating the tamper-ability of the EVM across India. The Election Commission
of India responded defensively with support from the two manufacturers of the
do not have the votes polled information at all! After various media raised the issue
with the ECI on the 15th of July the links to download Candidate Information
disappeared from the ECI website To date, despite several requests as well as in-
camera meetings at the ECI, the Election Commission of India has failed to clarify the
votes polled information before the polling was over, coding of this data, the strange
coincidences in its correlating with the EVM’s and exit the correlation with exit poll
Anupam Saraph Page 3 2/12/10
machines and the Technical Committee of the ECI. They argued that EVM’s were
tamper-proof15 while all technologists have continued to maintain that tamper-proof
technology is an oxymoron. Strangely there is no independent committee or body
constituted by the Government to evaluate the EVM’s, initiate reforms or safeguard
Elections in India are an expensive affair. The stakeholders cannot afford multiple
elections as also the failure to yield expected results. The Lok Sabha Polls cost more
than 10,000 crores (See Figure). It is evident that serious measures to safeguard the
voting process and democracy are needed in India. The lack of safeguards for EVMs
or poorly designed safeguards can make the process of polling even more expensive.
Figure 2 Election expense projections by the Indian media
Transactions in day-to-day commerce and governance require receipts in order to
ensure the transaction is valid and trusted (See Figure). Without receipts, no train
booking, air-travel, subscription, bank transaction or even a cinema show booking can
happen. A receipt serves the purpose of documenting the transaction between the
participating parties. It serves the purpose of reinforcing trust between the parties and
in the transaction.
The Election Commission of India does not issue any receipt of the vote deposited in
their custody by those enfranchised. While the light on the EVM ballot unit may
suggest a vote has been deposited, there is absolutely no means for the parties to
verify that the vote has been deposited to the account of the person or party whom it
was meant. There is absolutely no way for the voter, and presumably the ECI, to
check back later to see that the vote still remains credited to her candidate or party.
There is absolutely no way for the voter, and presumably the ECI, to know if the vote
Anupam Saraph Page 4 2/12/10
deposited to the credit of the voters candidate or party was counted. There is no way
for the transacting parties and the candidates to confirm that the votes received by a
candidate came from a legitimate voter and were meant for that candidate.
Figure 3 Receipts like these are the basis on which transactions are documented
Like the commercial and government transactions, the transaction of voting too needs
to generate a receipt for the voters.
A receipt is a confirmation, a proof of counting. It reinforces trust between the parties
and in the transaction. It reinforces the value of the vote. It gives every voter the
feeling of mattering. It communicates to the candidate a clear expression of the
interests of the people.
The opponents of receipts have argued that they open up vote commerce: exchange of
money for votes. Others have argued that voting process without receipts is also open
to proxy by commerce.
In the world of business proxy voting is both common and legitimate as is the use of
this system by lobbyists and interest groups to take over companies or change their
directions. The compulsions of the voter or the proxy holder may be diverse, but the
common equation is the value of the vote. A proxy holder looks for controlling return
on investment- the voter for an advanced dividend for giving up the right to choosing
Proxy is sustained as long at it results in the company can continue to grow and yield
return-on-investment to the proxy owner as well as serve a better dividend today than
the better future dividend from the better governance as a result of a different choice.
As far as the latter is concerned, it is self-fulfilling to prefer proxy. Dividend
payments upfront result in the exclusion of future dividends for the voter group that
Anupam Saraph Page 5 2/12/10
has given up its right to a future dividend. Therefore the choice of upfront dividends
seems always better than otherwise till the upfront dividend fails to yield comparable
value to future dividends to the voters.
A nation elects its government for the dividends its citizens may receive from the
management by the new "board". If the use of proxy serves to be more beneficial to
the voters than the management by a government, it may well be the lesser evil to
voting without receipts.
Well-designed Voting Receipts would be two-part print-outs of the EVM. Part I
would be dropped into a ballot box by the voter after confirming it documents the
correct vote. Part II would stay with the voter as proof of the transaction.
Each vote would be identified by a unique Vote Number printed on both Part I and
Part II. This number would be generated by the EVM through an encryption
algorithm using the Voters ID, the Polling Officers ID and the EVM ID. Each Vote
No would be associated with a Vote. Any Vote Number would be verifiable as being
valid or for the vote it stores by logging in at https://eci.gov.in/verifyvote. This
verification site will report invalid for invalid Vote Numbers and the number of the
Candidate for a valid vote. It will not be able to yield the identity of the voter.
Figure 4 Sample design for a two part receipt to be issued against a vote cast by a
The voter would also be able to log-in to the https://eci.gov.in/myvote with the voterid
and date-of-birth (that they can reset to another password) to check details of their
vote as they appear on the Part II of the receipt with them.
Anupam Saraph Page 6 2/12/10
Part I of the receipt confirms the vote by printing the Candidate Number and details
(name and party) as well as the location where the voter cast the vote.
Part II of the receipt provides everything on Part I (except the location map), an
optional picture of the person who cast the vote and a reminder of how the vote may
be verified anytime.
The Candidate Number is a 16 digit number generated through an algorithm that uses
the Candidates Voter ID, the District Election Officer’s Voter ID to generate a unique
number that can be verified to be genuine. Each Candidate Number will be
translatable back to Candidate Name and Political Affiliation.
All EVM’s will upload to an encrypted database Vote Numbers and associated
Candidate Number as well as the Voters ID. This database will provide information
through secure access to at https://eci.gov.in/verifyvote and https://eci.gov.in/myvote.
The important part of a legitimate transaction process is the ability to certify that all
transactions were fair and genuine. In finance it is accepted best practice to have
third-party audits to certify that transactions are according to law and genuine.
An open-audit framework would be an important safeguard for the voting process to
reinforce confidence of the voters and candidates in the outcome. Not only does the
voter need to know she counted, but the candidate also needs to know the votes
received by all candidates were indeed a mandate of the people.
Designing a process that would allow anyone concerned with the voting process to
track one or many transactions, while respecting the privacy of each voter, would be
essential part of increasing trust and thereby participation. Thus while the process
would enable anyone to check the legitimacy of each vote or of all the votes received
by a candidate, it would not reveal the identity of the voter who cast the vote.
As a first step to an Open Audit the Bar codes of Part I Receipts, dropped by voters in
the polling box at the booth, will be read into an encrypted database that will register
the Vote No and the associated Candidate No. This process will be carried out by an
agency independent of the one counting votes stored in the EVM. This will serve as a
double entry process.
A Poll Audit software program (https://eci.gov.in/AuditTheElection) can compare the
Candidate No registered against each Vote Number in the Receipt with the EVM and
generate a report of invalid Vote Numbers, invalid Candidate Numbers, Vote
Numbers in the EVM Database but not in the Receipt Database, Vote Numbers in the
Receipt Database but not in the EVM Database and discrepancies the Candidate
Number registered in the two databases for each Polling centre. In the event there are
no discrepancies, it can certify the Votes as valid.
Anyone would be able to access the Poll Audit software and ask for reports of
illegitimate Vote Numbers, illegitimate Voter IDs by each Polling Centre or by each
legitimate Polling Officer ID. The Open Audit system would enable a download of
each legitimate vote associated with each valid Candidate ID.
Anupam Saraph Page 7 2/12/10
Figure 5 Elements of information that needs to be publicly available as a part of
an open-audit architecture
The voting process in 2009 deployed 1.025 million EVM’s. Each EVM was shared
with between 1 to 3,840 votes (the maximum capacity of each machine). As the
machine can work at most 5 votes per minute (300 votes per hour), it can register at
most 2,400 votes in the 8-hour polling period16.
Given the voters time preference to vote, procedure of activating the EVM and the
time required by each voter to recognize the button corresponding to their choice,
understand the process and vote, in practice the EVM works at about 1 vote per 1-4
minutes. This means the EVM can cater to at most 15-60 votes per hour or 120 to 480
votes in the 8-hour period. This translates to 123 to 492 million votes.
Given that 417,156,894 voter cast their vote in the 2009 elections this translates to an
average of 407 votes per EVM. This suggests that the deployment of EVM’s is one of
the key reasons for a Voting Divide. A large chunk of the 42% of eligible voters are
not able to cast their vote.
With about 40 million Indians becoming eligible to vote every year would mean that
200 million new voters have to vote in the same time. The Voting Divide will only
There are over 471 million cell phone subscribers in India. Remarkably more than the
people who cast votes in the 2009 Lok Sabha Elections. Cell phones now cost under
1,000 Indian rupees and service providers offer free life-time connectivity with 1
paisa per second plans. This has revolutionized the Indian communications. Both
The 2009 Lok Sabha Polls took place between 8 AM and 4 PM.
Anupam Saraph Page 8 2/12/10
social and business practices have adapted to this unprecedented and rapidly
expanding access to hand-held compute power.
The cell phones offer the opportunity to become the ubiquitous EVM in the hands of
each voter. With the freedom to vote from anywhere, each voter can pre-register a
handset and cell number to serve as his or her EVM. Both Service Providers and
mobile phone manufacturers can tap into this opportunity and provide the required
interface to capture votes into a national database. API’s to enable generate Vote
Numbers and Receipts can be provided by the ECI on its servers for anyone to design
EVM’s that capture votes and upload to their database during the voting period.
Such Service Providers will be required to generate a mechanism to capture Part I of
the voting receipt in their database and make it accessible to third party Open Audit in
the same way as outlined above. Each Service Provider will guarantee to its
subscriber the Terms of Privacy and Security.
There are over 45,000 ATMs in India. These can be back-up devices along with
EVM’s for those who may not want to cast votes through their mobile. With multiple
channels available to cast votes it becomes increasingly difficult to tamper the EVM.
Many alternate devices now provide a way to deposit a vote into the account of the
candidate in the vote bank, the ECI.
It is both urgent and important to bridge the growing Voting Divide.
Voting is a game of expression of interests where, in its gradual process towards
perfection, independent individuals and organizations in a democracy seek to
maximize their involvement using transparent and nonviolent means.
In a democracy it is important to maximize the involvement of people expressing their
interests. The safeguards to EVM’s and the voting process recommended here are by
no means the complete and final. They form the starting point for India to take the
next step to securing and increasing the channels Indians have to express their
Several other safeguards should also be developed in the future. Some possible future
safeguards may include voting windows, or week to month long periods when voting
may continue to allow anyone to vote multiple times allowing the vote at the close of
the window to count. They may also include voting forever, or transfer of votes to the
current candidate of choice like the transfer of capital to the stock of choice allowing
the “market” capitalization of the candidate to change anytime. Yet another may
include vote anyone allowing people who do not offer themselves as candidates to be
elected and make the election process flatter and level playing. Further even vote for
any issue may extend the process to allow people to vote for or even suggest various
policies or decisions.
All of these safeguards enable maximizing peoples involvement in expression of their
interests in a democracy.
Anupam Saraph Page 9 2/12/10