VVPATs introduce vulnerability into the voting process: Former IAS officer Kannan Gopinathan

Kannan Gopinathan is a former officer of the Indian Administrative Services. In late August, about seven years after he had joined the IAS, Gopinathan resigned from the services. He told the media that his resignation was related the communications blockade that the Indian government enforced in Kashmir, after it revoked Jammu and Kashmir’s special status, enshrined in Article 370 of the Constitution. “If you ask me what you were doing, when one of the world’s largest democracies announced a ban on the entire state, and even violated the fundamental rights of the people, I should at least be able to reply that I resigned my job,” Gopinathan told the Indian Express. “There has been a lack of response to it,” he told The Hindu. “We seem to be perfectly fine with it.”

When he resigned, Gopinathan was serving as a secretary in Dadra and Nagar Haveli, a union territory. During the 2019 parliamentary elections, he had served as the returning officer—an election officer in charge of overseeing results—in the union territory. In September, Gopinathan posted on Twitter about possible vulnerabilities in the voting system employed during the election, which consists of electronic-voting machines and a voter-verifiable paper audit trails. The introduction of VVPATs into the voting process has “created a hole in the EVM armor & made the process amenable to hacking,” he posted. He based his hypothesis on information available publicly and on the Election Commission of India website. Sreerag PS, an independent journalist, interviewed Gopinathan about his conclusions, and about events that have unfolded since the bureaucrat resigned his post.

Sreerag PS: You wrote on Twitter that there are loopholes in the electoral process. Could you explain these?
Kannan Gopinathan: I have specifically raised a concern that the introduction of VVPATs has added certain vulnerabilities to an otherwise foolproof election process. With the introduction of VVPATs, two things have happened. One is that the VVPATs come in between the ballot unit [which voters use to cast their vote] and the control unit [which electronically records the vote]. Earlier, the ballot unit used to directly talk to the control unit, now the ballot unit talks to the VVPAT, and the VVPAT talks to the control unit.

The original concern at the time of the introduction of VVPATs was that [the voter] does not know when he is pressing the ballot unit, what exactly is going to the control unit—whether he is pressing candidate number one or not. We introduced the VVPAT to show that there could be a paper trail in between, and that with the paper trail you can actually verify whatever is given in the ballot unit is actually what is printed on the VVPAT. But this still does not solve the original question of what is getting registered in the control unit, because now you know what is going from ballot unit to the VVPAT, but you don’t know what is going from the VVPAT to the control unit. The introduction of VVPAT has not solved that original question—that is my point.

The original question would have been solved provided we had tallied all the paper-trail [slips] with the control-unit count. Just like the voter is verifying the input side, similarly, I think every vote needs to be checked, whether what is there in the VVPAT is what with the control unit, otherwise the original question will remain.

Number two: earlier, the [control-unit] machine did not have any information about which candidate is at which number. All that the machine knew before the introduction of VVPAT was that [there is a list with] candidate numbers one, two, three—[it would register votes as] candidate number one in the ballot unit, and candidate number one in the control unit. We never electronically loaded anything on to the control unit to say that candidate one could be the Congress, two is BJP, or something like that.

But now with the introduction of VVPAT, we are adding a process called symbol-loading on to the VVPAT—we are actually loading all the serial numbers, names, and the symbols of the candidate in that sequence to the VVPAT. So, if you just see the machine as an abstract, now the machine knows which candidate is at which number—which was not the case earlier.

SPS: If the control unit is not directly connected with the ballot unit, are there chances of registering votes inaccurately?
KG: Earlier, there was no electronic access. The EVM security was also to do with the physical security, that nobody could access it, nobody could plug in something on to the VVPAT or do something. People used to make allegations that [only] through some electromagnetic waves it can be done. But now what happens is after the candidate sequence is done—that is, after Form 7A [the list of contesting candidates on the day of the poll] is published—the engineers come and download these symbols into their laptop, and from their laptop to their symbol-loading [system], and then from that to the VVPAT, because that is only way that VVPAT can know who are the candidates in that particular constituency.

Now two things happen here—one is that already these EVMs are allocated to a constituency when this is happening, and number two, already the candidate sequence is also known. So, the randomisation is no more effective, because already constituency is decided, so irrespective of which booth it [collects] votes in, the votes will be going to the particular constituency only. [Randomisation is a computerised process where in serial numbers of EVMs under the jurisdiction of a district election officer are listed, and EVMs for a given constituency in that district are then randomly selected.]

The second key aspect is that now the candidate sequence is known. Earlier, we used to say, what is a way for an engineer or someone to do a program on the EVM? For the district administration, the security of the EVM starts only when it comes to us. Of course, during the transit also there is security, but the strongroom and the concepts [of such security] start [at the district level].

So the question was, could it happen in ECIL or BEL? [The Electronics Corporation of India Limited and Bharat Electronics Limited, respectively. Both are state-owned firms. Employees of these firms upload the candidate sequence into the VVPAT.] The key answer to that was, even if they do anything there, they never knew the candidate sequence. Even if they [create] some program which can, for example, say that every vote should go to candidate number three, there was no way one could know who will be candidate number three. That would only come after the Form 7A is published. That is one of the key security aspects. I have always defended the EVM—I was very clear that if somebody is doing programming earlier, then he wouldn’t know whom he is favouring.

In the earlier process, we were completely worried about the control unit, which was the receiving end. But once with the introduction of VVPAT, more advanced [verification] actually is on the input side, not in the receiving side. The VVPAT has a processor, a printer and a memory—we can upload pictures on to it. Functionally, it has all the components of a mini-computer or a micro-controller based [equipment]. If you are loading something to the VVPAT after the candidate sequence is known, that exposes certain vulnerabilities. Theoretically, some malware can be put into the VVPAT, which says that the VVPAT should print whatever is [selected by the voter] in the ballot unit, but it can send something else to the control unit, because it now already knows who is at what sequence [number].

SPS: Can this malware be caught?
KG: One of the checks here is of the mock poll—there are two mock-polls after commissioning and the symbol-loading. The first one is five percent random [polling] at after the symbol-loading itself. You do thousand votes there. That is actually one crucial check because it is randomly selected and this is being done at a mass scale. Then again the question there is, if at all it is caught also, the protocol is to remove that EVM—we don’t automatically start further investigations into why it happened. So, if I am to [manipulate votes in] two booths or three booths—let’s say three thousand votes is all that I am targeting—then there is a lesser chance of it being caught.

The second thing is the poll-day mock poll, [when 50 votes are polled] in the presence of polling agents of different parties to check. This was earlier a very good process. But this becomes irrelevant because [theoretically] the programme can be so written that the first hundred votes show correctly, and after hundred votes you start whatever manipulation needs to be done. So, how do we even catch it now?

The other option is [for this] to be caught during the counting, when we will be verifying the VVPAT paper ballots with the control-unit counts. Now, again, we are doing only a very limited number there. So, technically, I am not saying that this can be done at a mass scale. Let’s say there are discrepancies even there, so the protocol is still just that you go with whatever is the VVPAT count. It does not trigger any further investigations again, on the both the sides. Even if there are only two polling booths that they want to [manipulate], then there is actually sufficient scope or vulnerability in the system that can be used. As of now, the process does not ensure that there is absolutely zero chance of manipulation. Even if there is only one booth that is manipulated, we cannot say we will catch that hundred percent.

SPS: You believe it is solely the introduction of the VVPAT that makes the whole electoral process vulnerable?
KG: Yes.

SPS: The key issue that led to the introduction of VVPAT was to bring transparency to the electoral process. Without a paper trail, the voter cannot verify the vote registered.
KG: My point is that VVPAT is not solving that issue, because you still don’t know what is going to the control unit. It’s like saying that you did not know what is going from A to B, so you introduced C in between. Now, you know what is going from A to C, but you don’t know what is going from C to B, and our counting is relied on C only. Earlier also we didn’t know what is going to B, and now also we don’t know what is going to B. However, the issue would have been solved if we had gone for a hundred-percent VVPAT-verified count.

SPS: During your tenure as a returning officer, did you communicate these loopholes in the electoral process to the Election Commission of India? What was the response that you got from the ECI officials?
KG: I have clearly mentioned in the tweet that I had raised this matter during the returning-officers training in Delhi, conducted by the ECI. During the training itself, when we were told about the VVPAT matter and the symbol-loading matter, I had raised this loophole. At that point, it was not answered. They said they will get back—that was it.

SPS: In recent years, we have seen more and more nations return to the paper ballot. Do you think that, compared to tampering of EVMs, which is difficult to identify, the transparency of paper ballots allows remedial measures to be taken if any booth capturing or hijacking is suspected?
KG: As of now I think, we have a process, and if there is a loophole, we should be addressing it. Only if we cannot address it, then we can proceed to other drastic alternatives. There are many reasons we have come to EVM, but I would suggest that if there is even one percentage of doubt then we should think about alternatives. [We should not that think that] statistically there is a one-percent chance of an error, and we should go ahead with it. I would not suggest that because even one vote is critical.

SPS: Section 49 MA of the Conduct of Elections (Rules) allows a complainant to be jailed if they cannot prove a mismatch between their vote and the VVPAT symbol. Do you think it should be repealed? Do you have any alternatives for voter complaints?
KG: I only want to raise this particular concern that is to be addressed, nothing else. When I worked as a returning officer, I felt that there is a chance that this loophole could be utilised for different purposes. That almost all of the VVPAT has tallied with the EVM says that it wouldn’t have happened before. But that is not an affirmation that it cannot happen. I think we have to be very thorough with our process because we are dealing with elections to the largest democracy in the world. As a principle, no citizen who is raising a question should be penalised, not only on this issue but on any issue, because it is the citizens’ duty to raise questions.

SPS: You had resigned from the IAS citing the government’s clampdown in Kashmir. It has been over fifty days since the announcement regarding Article 370. How do you see the present situation in Kashmir?
KG: I resigned not just because of the clampdown, it was also because of the lack of response from the rest of the country on what was happening there. I remember at that point of time, those fifteen-twenty days were really frustrating because even the media was showing that everybody in Kashmir was celebrating. We know what is the reality. It has been more than fifty days now, and we still are unable to restore the basic mobile connectivity or broadband connectivity or anything there. Their politically elected leaders and civil leaders are all under detention or house arrest, and that is because the rest of the country seems to be okay with it. I just wanted to say that at least I am not okay [with it] and that there is a need for others also to be concerned about something that is happening in our part of our country. We just cannot ignore it.

SPS: In July, you had received a show-cause notice from the union home ministry.
KG: If I am not wrong, The Caravan had carried a story regarding the election when the notice was issued to administrator. [In mid April, The Caravan reported that about two weeks before the union territories of Dadra and Nagar Haveli and Daman and Diu were scheduled to go to polls, the EC issued a notice to their administrator, Praful Khoda Patel. The notice reprimanded Patel for having issued a “coercive” request to Gopinathan during the election period, when the latter was serving as a returning officer and not under Patel. Gopinathan had lodged a complaint with Pooja Jain, the chief election officer for Dadra and Nagar Haveli.]

I was pretty sure that after the election is over, there would be something by which the administration would like to [show] that this is not acceptable. I considered it as a sort of a small “showing your place” kind of a show-cause notice. The matters mentioned in it were also very flimsy and frivolous: [it said that] despite directions, I did not apply for the prime minister’s excellence award, or I did not submit a tour report after I visited Kerala [in 2018] for flood relief, which I had done in my individual capacity. [The notice referred to] a project that was to be completed in July 2019. The notice says I did not complete it in May 2018, one year before its scheduled completion. I had replied to that, and actually after the reply, I was given additional responsibilities—chairman and managing director of two smart cities, the secretary of urban development, the secretary of town and country planning, all these were given after that.

It is very simple: during the election, you raise a complaint against the [equivalent of the] chief minister to the Election Commission. Of course, after the election, the chief minister or the administration transfer you, or give you a show-cause for something. When you take a stand, that is expected, that it will come. They themselves were not very serious which can be seen from the fact that so many additional responsibilities were given.

If you will allow me to add: the news of the show-cause notice was carried by IANS [the Indo Asian News Service] without my response. They did not even reach out to me and sort of [suggested that] that this is why I resigned. When a news-wire agency like that covers it without taking the response from the person whom they are covering, then what happens is in all the regional languages, all those media who are subscribing to that news agency, they will automatically pick it up and run these stories. That is highly unfair. It is a basic thing in journalism to seek a response.

It is a very classic case, where you assign motives so that we don’t have to concentrate on the issues that are raised. We need to get out of this, if at all if we need to get into more fruitful discussions and disagreements.

This interview has been edited and condensed.