India’s electronic voting machines: standalone EVMs, paper slips, and the Supreme Court

India’s electronic voting machines (EVMs) are standalone, non-networked devices made by two public sector companies, BEL and ECIL, with a ballot unit, a control unit, and since 2013 a voter verifiable paper audit trail (VVPAT) printer.⁠^1,2 For the 2024 general election, India prepared 10.48 lakh (1.048 million) polling stations for 97 crore (970 million) registered voters; on April 26, 2024 the Supreme Court rejected petitions for 100 percent VVPAT slip counting or a return to paper ballots, and added a post-result check of EVM microcontrollers on a losing candidate’s request.⁠¹

In plain words

India holds the largest elections in the world. Since the early 2000s nearly everyone votes on a simple machine: you press a blue button next to your candidate’s name and symbol, a red light glows, and the machine beeps. There is no internet connection.

People asked a hard question: how would anyone know if a machine counted wrong? So India added a small printer beside each machine. When you vote, it prints a slip showing your choice behind a glass window for seven seconds, then drops it into a sealed box. You see the slip but cannot take it home.

After the election, officials count the paper slips from a few randomly chosen machines in each area and compare them with the machine totals. Some people want every slip counted, or a return to paper ballots. India’s Supreme Court has said no to both, but it has ordered more checks over time.

Defined terms

• EVM. In India, a control unit operated by polling staff and a ballot unit used by voters, joined by a cable.⁠³ The 2024 judgment describes the units as “standalone and non-networked”.⁠¹
• VVPAT (voter verifiable paper audit trail). A printer attached to the EVM that prints a slip with the candidate’s serial number, name, and symbol, displays it to the voter for 7 seconds, then cuts it into a sealed compartment.⁠¹
• Burnt memory / one time programmable (OTP) microcontroller. The court describes the EVM program as “key hashed and burnt into a One Time Programmable microcontroller chip at the time of manufacturing,” and the control unit’s firmware as “agnostic” to candidate names and symbols.⁠¹
• Symbol loading unit (SLU). A device used 10 to 15 days before polling to load candidate names and symbols into the VVPAT.⁠¹
• Mandatory VVPAT verification. Counting the paper slips from randomly selected polling stations and comparing them with the electronic counts.⁠^1,4
• Lakh and crore. Indian units: one lakh is 100,000; one crore is 10,000,000.

What happened

India’s EVMs date to the early 1980s, when ECIL developed the first machines; they were used in parts of the country but not nationwide.⁠³ Researchers report that second generation models arrived in 2000 and were used nationwide beginning in 2004, and a third generation design followed in 2006.⁠³ The Election Commission of India (ECI) stated in August 2009 that EVMs were “fully tamper-proof,” as the researchers quote it.⁠³

In 2010, a team including Hari K. Prasad, Rop Gonggrijp, and J. Alex Halderman published the first independent security analysis of an Indian EVM, a real machine obtained from an anonymous source, at the ACM Conference on Computer and Communications Security.⁠³

In Subramanian Swamy v. Election Commission of India (2013), the Supreme Court held that “the ‘paper trail’ is an indispensable requirement of free and fair elections” and permitted the ECI to introduce VVPATs “in gradual stages,” directing the government to fund them.⁠¹ The Conduct of Elections Rules were amended on August 14, 2013 to introduce VVPATs.⁠¹

In 2019, 21 opposition parties asked the Supreme Court to require counting VVPAT slips from at least 50 percent of EVMs.⁠⁴ The ECI’s guideline then required verification at one randomly selected polling station per assembly constituency or segment.⁠⁴ On April 8, 2019, the court increased this to five per assembly constituency or segment.⁠⁴

In 2023 and 2024, the Association for Democratic Reforms and others sought 100 percent VVPAT counting, among other relief, and some petitioners sought a return to paper ballots.⁠¹ On April 26, 2024, the court dismissed the petitions and issued two new directions.⁠¹

How it worked

India’s voting sequence, as the 2024 judgment describes it, begins when the presiding officer presses the BALLOT button on the control unit. The voter presses the blue button on the ballot unit; a red LED glows; the control unit sends a command to the VVPAT, which prints the slip and displays it “through the glass window which is illuminated for 7 seconds”; the slip is cut and falls into the compartment; a fall sensor confirms to the control unit, which then records the vote and beeps.⁠¹ The control unit records which button was pressed, not a candidate’s name, and can store up to 2,000 votes.⁠¹

The court’s account of the security design, based on the ECI’s submissions, includes: standalone, non-networked units; an “Unauthorised Access Detection Mechanism” (the court’s term) that permanently disables a machine if someone tries to access its microcontroller or memory; dynamically coded key presses with timestamps; and firmware burnt into one time programmable chips at manufacture.⁠¹ Candidate symbols are loaded into the VVPAT with symbol loading units shortly before polling, after which all machines undergo a mock poll.⁠¹

Mandatory verification follows counting. Under the ECI guideline described in the 2019 order, the Returning Officer draws lots in front of candidates or their agents to choose the polling station, and the slips are counted in a wire mesh “VVPAT Counting Booth” under supervision, with the process videographed.⁠⁴ Since 2019, five polling stations per assembly constituency or segment are drawn.⁠⁴

The 2024 judgment added two steps:⁠¹

1. Symbol loading units used on or after May 1, 2024 must be sealed, signed by candidates or their representatives, and stored with the EVMs for at least 45 days after results.
2. On a written request within seven days of results from the second or third place candidate, engineers from the manufacturers must check the burnt memory or microcontroller in 5 percent of EVMs (control unit, ballot unit, and VVPAT) per assembly constituency or segment for tampering. The candidate pays the cost, refunded if tampering is found.

Evidence: measured findings

India’s official figures, as recorded in the Supreme Court’s 2024 judgment from ECI submissions:⁠¹

The one discrepancy, at polling station 63 of Mydukur assembly constituency in Andhra Pradesh in 2019, was attributed to “failure of the presiding officer to delete the mock poll data”.⁠¹ The court noted that “it is not possible to rule out human errors” and that the EVM manual sets a protocol for such cases.⁠¹

On sample size, the 2019 order records the ECI’s position that the Indian Statistical Institute found verification of 479 randomly selected EVMs “would generate over 99% accuracy in the election results,” compared with 4,125 EVMs under the one-per-segment guideline then in force, and that counting 50 percent of slips could delay results by five to six days.⁠⁴

The 2010 security analysis found, on a 2003 second generation ECIL machine, that the system had “vulnerabilities” to “serious attacks that can alter election results and violate the secrecy of the ballot”.⁠³ The researchers demonstrated two attacks requiring physical access: a “dishonest display” replacing the control unit’s display board to show altered totals, and a “clip-on memory manipulator” that could read and change stored votes, which was “technically straightforward because the EVMs do not use even basic cryptography to protect vote data internally”.⁠³ Their analysis predates VVPATs and the M3 machines used after 2013.⁠^1,3

Failures and criticisms

India’s EVM debate has several distinct critiques.

Secrecy of design. The 2010 researchers argued that “the details of the machines’ design have been a closely guarded secret” and had “never been subjected to a rigorous independent security review,” and that simplicity made some attacks easier, such as swapping a look-alike part.⁠³ The ECI’s position, as reflected in the 2024 judgment, is that the M3 design is standalone, tamper detecting, and burnt into unalterable chips.⁠¹ This review did not find a published independent security evaluation of M3 machines to cite.

Sample size. Petitioners in 2019 argued that five machines per segment amounts to around 2 percent verification, and sought 50 percent; the court declined to modify its order.⁠^5,4 Critics argue that a fixed number of machines per segment is not tied to margins, unlike a risk-limiting audit (compare Colorado). Defenders point to the ISI analysis and the absence of mismatches across tens of millions of counted slips.⁠^4,1

What the voter actually verifies. The voter sees the slip but cannot touch it. Petitioners alleged that the VVPAT window was made translucent or tinted in 2017; the court accepted the ECI’s account that the tint preserves secrecy, that the voter “can have clear view of the slip for 7 seconds,” and that this does not violate the rules.⁠¹ Verification also depends on voters noticing errors, a limitation documented for printed records elsewhere (see Georgia).

Firmware and symbol loading. Petitioners raised the symbol loading step, in which software loads candidate data into the VVPAT before polling. The 2024 directions to seal symbol loading units and allow post-result microcontroller checks respond to that concern.⁠¹

Return to paper ballots. The court rejected this “as foible and unsound,” citing “the weakness of the ballot paper system,” the size of the electorate, and the risk of “undoing the electoral reforms”.⁠¹

Competing interpretations

The system is trustworthy and adequately checked. On this reading, India’s machines are simple, offline, and checked by paper slips that have matched electronic counts in every case but one human error across more than 4 crore slips.⁠¹ The court said its 2024 directions were issued “not because we have any doubt, but to only further strengthen the integrity of the election process”.⁠¹ The 2019 court likewise said it did not doubt the system’s fairness but sought “greater satisfaction” among parties and the electorate.⁠⁴

The system needs more independent evidence. Critics accept that paper slips help but argue that verification should scale with risk and margin, that design details should be open to independent review, and that a machine-produced paper slip is only as good as voters’ attention to it.⁠^3,5 Petitioners in 2024 expressly did not attribute “motive or malice” to the ECI; their case was about verifiability, not accusation.⁠¹

The trade-off framing. The ECI’s concern about delay (five to six days for 50 percent counting) and manpower is real,⁠⁴ as is the value of public confidence the court stressed. Where to set the sample is a policy judgment between speed, cost, and assurance, which other democracies resolve with statistical audits.

Lessons

These are interpretations drawn from the record.

1. Courts can drive verification. India’s VVPATs came from a judicial finding that a paper trail is “indispensable”.⁠¹
2. A paper trail must be counted to matter. The dispute moved from whether to have paper to how much of it to count.⁠^4,1
3. Sample design deserves transparency. Statistical justifications (ISI) were cited in court, but sampling fixed per segment is not margin-based.⁠⁴
4. Pre-election software steps need custody too. Symbol loading became a focus of new safeguards.⁠¹ See hardware.
5. Simplicity cuts both ways. Offline, minimal machines avoid network attacks but depend heavily on physical custody.⁠^3,1

Application to this framework

India’s experience connects to the My Vote Forward framework’s requirement that any official voting component pair secrecy with evidence that does not rely on trusting the device (see audits and verification). The VVPAT design shows one way to keep the voter’s check private (the slip is seen, not kept) while creating a record others can count.

It also bears on the framework’s emphasis on scale and capacity. Any future official process at a large scale would face the same tension India faces between full verification and timely results, and the framework treats that as a design question for the responsible authority, not something a website can settle (see governance).

Unresolved questions

• How many requests for post-result microcontroller checks have candidates made since April 2024, and what did the checks find? This review found no published tally.
• Would a margin-based statistical audit of VVPAT slips give stronger assurance than a fixed number of machines per segment, at acceptable delay?
• Has any independent, published security evaluation of M3 EVMs and VVPATs been conducted?
• How often do voters notice and report a wrong VVPAT slip, and what happens under Rule 49MA when they do?
• What would full design disclosure cost in security, if anything, compared with what it would add in public confidence?