"James Boyle is William Neal Reynolds Professor of Law and co-founder of the Center for the Study of the Public Domain at Duke Law School. Professor Boyle is recognized for his exceptional scholarship on the "second enclosure movement" -- the worldwide expansion of intellectual property rights -- and its threat to the rich public domain of cultural and scientific materials that the Internet might otherwise make available. An original board member of Creative Commons and co-founder of Science Commons, Professor Boyle has worked for over 20 years as both an academic and institution builder to celebrate and protect the values of cultural and scientific openness.
When Pamela Jones created Groklaw in 2003, she envisioned a new kind of participatory journalism and distributed discovery -- a place where programmers and engineers could educate lawyers on technology relevant to legal cases of significance to the Free and Open Source community, and where technologists could learn about how the legal system works. Groklaw quickly became an essential resource for understanding such important legal debates as the SCO-Linux lawsuits, the European Union antitrust case against Microsoft, and whether software should qualify for patent protection."
Congratulations to both and to the other award winners this year, Steven Aftergood of Secrecy News and Hari Krishna Prasad Vemur, a security researcher in India who revealed serious security flaws in India's paperless electronic voting machines; enduring jail time, repeated interrogations, and ongoing political harassment from a political establishment more focussed on covering up the problems than doing anything to address them.
FLASH: 4:47 a.m. EDT August 28 — Indian e-voting researcher Hari Prasad was released on bail an hour ago, after seven days in police custody. Magistrate D. H. Sharma reportedly praised Hari and made strong comments against the police, saying Hari has done service to his country.
Ed Felten says it's time for India to face its voting problems.
The unjustified arrest of Indian e-voting researcher Hari Prasad, while an ordeal for Prasad and his family, and an embarrassment to the Indian authorities, has at least helped to focus attention on India’s risky electronic voting machines (EVMs).
Sadly, the Election Commission of India, which oversees the country’s elections, is still sticking to its position that the machines are “perfect” and “fully tamperproof”, despite evidence to the contrary including convincing peer-reviewed research by Prasad and colleagues, not to mention the common-sense fact that no affordable electronic device can ever hope to be perfect or tamperproof. The Election Commission can no longer plausibly deny that EVM vulnerabilities exist. The time has come for India to have an honest, public conversation about how it votes.
The starting point for this discussion must be to recognize the vulnerabilities of EVMs. Like paper ballots, the ballots stored in an EVM are subject to tampering during and after the election, unless they are monitored carefully. But EVMs, unlike paper ballots, are also subject to tampering before the election, perhaps months or years in advance. Indeed, for many EVMs these pre-election vulnerabilities are the most serious problem.
In May this year, Hari Prasad, along with Alex Haldermann and Ron Gronggrijp, demonstrated the vulnerability of Indian evoting machines to fraud. On Saturday Prasad was arrested, charged with the theft of an electronic voting machine.
On 12 August a group of prestigious evoting experts wrote to the Chief Election Commissioner of India explaining that "that India’s EVMs do not today provide security, verifiability, or transparency adequate for
confidence in election results." The Indian Election Commission has previously consulted Hari Prasad on how to improve the security of the voting machines. The Commission now stands accused, however, of arranging Prasad's arrest.
"The Election Commission of India should have given researchers access to the voting machines in the first place. Rather than attempting to persecute Prasad and the anonymous source, the government should be focusing its attention and resources on the real problem: electronic voting machines with no mechanism for accountability."
About four months ago, Ed Felten blogged about a research paper in which Hari Prasad, Rop Gonggrijp, and I detailed serious security flaws in India's electronic voting machines. Indian election authorities have repeatedly claimed that the machines are "tamperproof," but we demonstrated important vulnerabilities by studying a machine provided by an anonymous source.
The story took a disturbing turn a little over 24 hours ago, when my coauthor Hari Prasad was arrested by Indian authorities demanding to know the identity of that source.
At 5:30 Saturday morning, about ten police officers arrived at Hari's home in Hyderabad. They questioned him about where he got the machine we studied, and at around 8 a.m. they placed him under arrest and proceeded to drive him to Mumbai, a 14 hour journey.
The police did not state a specific charge at the time of the arrest, but it appears to be a politically motivated attempt to uncover our anonymous source. The arresting officers told Hari that they were under "pressure [from] the top," and that he would be left alone if he would reveal the source's identity.
Hari was allowed to use his cell phone for a time, and I spoke with him as he was being driven by the police to Mumbai:
[...]
If any good has come from this, it's that there has been an outpouring of support for Hari. He has received positive messages from people all over India.
Unfortunately, the entire issue distracts from the primary problem: India's electronic voting machines have fundamental security flaws, and do not provide the transparency necessary for voters to have confidence in elections. To fix these problems, the Election Commission will need help from India's technical community. Arresting and interrogating a key member of that community is enormously counterproductive."
After the shambles last week of many people being turned away from the polls we have the inevitable call for electronic and internet voting. We know however that the electronic voting systems currently deployed are seriously insecure. Hari K. Prasad, J. Alex Halderman, Rop Gonggrijp have reinforced this with a study of India's evoting machines which they demonstrate are vulnerable to fraud.
"Says Gonggrijp: "Never mind what election officials say, this research once again shows that the longstanding scientific consensus holds true—DRE voting machines are fundamentally vulnerable. Such machines have already been abandoned in Ireland, the Netherlands, Germany, Florida and many other places. India should follow suit."
Gonggrijp continues: "In order to have any transparency in elections, you need to have votes on paper. Computers can be programmed to count votes honestly, but since nobody can watch them, they might just as easily be programmed to count dishonestly. How is the voter supposed to tell the difference?""
"I've studied electronic voting machines for years, but I've never had such a strong sense that actual fraud might be taking place. There have been dozens of reports from around India that politicians have been approached by engineers offering to manipulate the machines to steal votes. My Indian coauthor, Hari Prasad, was himself approached by a prominent party and asked to help them with such manipulations! It's just too easy, thanks to the simple design of the machines and the lack of adequate safeguards, and there are probably a million people in India with the necessary electronics skills.
Many people believe that using a simple design makes these machines safer than the complex machines used in the U.S. (which sometimes contain almost a million lines of code), but simple machines are much easier to attack via hardware, and simplifying too much means giving up standard security techniques like strong cryptography. Essentially, you're left with a system that depends entirely on the physical security of the machines, just like paper ballots depend on the security of the ballot box, but with much less transparency than paper voting. What India and other democracies need is a system that's both secure *and* transparent, so that voters can have well-founded confidence their votes count."
"The independent Electoral Commission of India, which is generally well respected, has dealt poorly with previous questions about EVM security. The chair of the Electoral Commission has called the machines "infallible" and "perfect" and has rejected any suggestion that security improvements are even possible. I hope the new study will cause the EC to take a more realistic approach to EVM security.
The researchers got their hands on a real Indian EVM which they were able to examine and analyze. They were unable to extract the software running in the machine (because that would have required rendering the machine unusable for elections, which they had agreed not to do) so their analysis focused on the hardware. They were able to identify several attacks that manipulated the hardware, either by replacing components or by clamping something on to a chip on the motherboard to modify votes. They implemented demonstration attacks, actually building proof-of-concept substitute hardware and vote-manipulation devices.
Perhaps the most interesting aspect of India's EVMs is how simple they are. Simplicity is a virtue in security as in engineering generally, and researchers (including me) who have studied US voting machines have advocated simplifying their design. India's EVMs show that while simplicity is good, it's not enough. Unless there is some way to audit or verify the votes, even a simple system is subject to manipulation."
Update: Check out also ORG's briefing on why evoting systems are difficult to secure.
