‘The technology can help migrants and seasonal workers exercise their fundamental right to vote’.
New Delhi: The Election Commission had last month organised a series of webinars in collaboration with the Tamil Nadu e-Governance Agency (“TNeGA”) discussing different aspects of the potential of using blockchain technology for remote voting in India. This step would particularly favour internal migrants and seasonal workers, who make up approximately 51 million of the population (Census 2011) in exercising their fundamental right to vote. The technology that now has a long way to go before being tangible, has already created a divide in opinion between those backing it and those who aren’t.
Blockchain is a model whereby one can create and verify a set of time-stamped immutable records without any intermediary, and gives trust to all the parties involved in it. This network has no central authority and thus no one has the incentive to manipulate the truth. Here, in a sense, the system is owned by everybody and, conversely, no one owns the system. Blockchain ledgers have been used historically as support mechanisms for cryptocurrencies like Bitcoin and Ethereum.
Jayavaradhan Sambedu, Co-Founder & CTO of Curl Analytics, who has himself moderated a couple of segments of the webinar on “Remote Voting using Blockchain”, spoke to The Sunday Guardian and explained how the Election Commission is thinking about using blockchain. He said, “In principle, to aid in remote voting, an election system needs to address the following: simplicity, security, authentication, authorisation, auditability and deter coercion. Blockchain is being viewed as a technology that can aid aspects of implementation of a few of the above principles. This technology itself has nothing to do with the actual vote casting process, which will still be through EVMs. In remote voting, Blockchain can be used in Electoral Roll Management, to ensure the records are maintained transparently. A voter can walk to a polling station, verify against an Electoral Roll, authenticate via Aadhaar and then move to the private enclosure, where he can securely cast his vote on the EVMs. These are two separate systems. This will ensure a bonafide individual can cast his vote in a remote polling station.”
In the 2018 midterm elections, West Virginia became the first state in the U.S. to allow select voters to cast their ballot on a mobile phone via a proprietary application called “Voatz.” Recently, a team of MIT engineers in a research found a troubling string of vulnerabilities in it. After reverse-engineering Voatz’s Android app, the researchers concluded that an intruder who infiltrated a voter’s phone could monitor, suppress, and modify votes almost at will. Ronald Rivest, a cryptographer and an Institute Professor at MIT, had recently said at the RSA Security Conference, held in San Francisco, that blockchain is not the right technology for voting, although it can find proper application in a number of other areas.
Speaking to The Sunday Guardian, Jayavardhan Sambedu said: “Blockchain has been in play for more than a decade now and it relies on strong foundations of cryptography, digital signatures, distributed consensus and is resistant to tampering. All transaction details on the blockchain network are scrambled, using a technique called ‘hashing’. These are unidirectional and are extremely complex to reverse engineer, when designed correctly. There are many real-world applications, that rely on Blockchain & Distributed Ledgers.”
Adding to the same, Gokul Alex, Chief Innovation Officer at EPIC Knowledge Society, who was one of the speakers at the webinar, told this correspondent about network effects of the blockchain i.e. larger the blockchain, stronger is the defence mechanism. There has also been concern around the possible chances of advanced hackers barging and putting their IP even after the whitelisted IP system is inculcated. Speaking on this, Alex said, “Barging into IP happens in centralised networks. In a decentralised network, we create a network and it will verify the members. We don’t need IP whitelisting; it could be a network where people would join based on proof of their identity.” He also said that even Distributed Denial of Service Attacks can be prevented by creating multiple layer-based encryptions.
Jayavardhan Sambedu said that whitelisting is the basic way in which systems are generally secured. It prevents any other IPs from accessing apart from the ones that the server has allowed. However, there are many other aspects that would be taken into account during the design of an election system. Specifically, cyber security aspects of any critical system would be done using a CARTA (Continuous Adaptive Risk & Trust Assessment) model and based on evaluation of threats, elements of the systems would be built or reinforced.
The Election Commission is also exploring the concerns around data management as in the blockchain system, once a data is put, it remains permanently there. Besides, the maintenance of the audit trail is also being discussed at length. Underpinning all the concerns are security aspects of the system. Sanjay Bahl, who is the Director-General of CERT, said in the same webinar that the aspects of confidentiality, integrity and availability would need to be robust for such a system. Broadly, we could classify the threats for such a critical system could be from nation states, hacktivists, cyber criminals, terrorist groups, political actors and thrill seekers and for each such category, based on their intent, the system needs to take into account security aspects and should be designed to ward off such threats.
Speaking to The Sunday Guardian, Nappinai N.S., an advocate in Supreme Court and founder of Cyber Saathi and who was also one of the speakers at the webinar, said: “The very first prominent usage of the blockchain was in Bitcoin which ensured transparency in transfer of money, but not in the disclosure of the identity of the person. It was able to keep anonymous the identity of people and the choices they have made. Taking the same use case for election, we can ensure transparency in the actual voting process without compromising with the privacy which goes hand-in-hand with the mode of voting which each individual does.”
Nappinai N.S. said, “We have to evaluate whether this is the best alternative to existing methodology and what value addition the blockchain will bring which is not available with the existing process. In the Public Permissioned Blockchain which remote voting should utilise, one has to verify again the authenticity of each vote. Here, there would be a strain on the cost factor.”
There have been different recommendations to the incorporation of blockchain in remote voting. According to Jayavardhan Sambedu: “If we harness blockchain as an underlying technology, to deter manipulation, a good threat model to ensure that even before the data goes into the blockchain it is sanitised, apply it on ‘smart contracts’ across a distributed system so that auditability is simplified and apply ‘zero-knowledge proofs’ on top, to ensure right people have access, then we would have built a utopian system. Indeed, it would be easier said than done, as there are many aspects to consider when we have to design such a utopian system.”
Gokul Alex suggested implementation of end-to-end encryption technology powered by post-quantum cryptography into voting, like WhatsApp and Telegram, which have been using end-to-end encryption, and Google Chrome, which has adopted post-quantum cryptography.
Nappinai N.S. said: “We shouldn’t envision it with 0 or 1 perspective i.e. adopting an entire process of the blockchain or nothing at all. It would be a long process because we may also have to relook the laws and regulation to see whether existing laws can be adapted for new technology usage. If EC splits the process into components and uses certain parts of it, then adaptation may be much faster. We can also put in a deterrent to ensure that people who violate any norms will know that they will face severe consequences,” she said.
