Why I believe VVPATs reduce confidence in EVMs.

After a significant number of doubts were raised on electronics voting machines being used in elections in India, a new solution called  Voter Verifiable Paper Audit Trail (VVPAT) was developed. The original solution consisted of two pieces of hardware.

1. Control Unit -- This unit stays with the presiding officer in the polling booth and he can perform allowed administrative functions with. The main function that he performs during the polling is the enabling of the vote after which the voter can cast his vote.
2. Ballot Unit -- This unit is placed in the polling booth and a voter can choose a single candidate and cast his vote in his favor. This vote is then transferred to the control unit.

The main doubt that was raised was that the vote had no idea whether the vote that he cast is being transferred to the control unit or not. The VVPAT solution that was developed was seeming a simple and elegant solution. The vote that is cast by the voter is printed on a sheet of paper and it shows up in the glass windows for a small period of time thus verifying the vote that the voter had cast. The solution looks like below.

Initially, I believed that this is a good solution for the problem but more I thought about it, I came up with more problems than what it was solving. Here are some of my issues with the current solution.

1. With the new solution, the vote is not directly transmitted from the ballot unit to the control unit. Basically, your vote is going to VVPAT and it is up to the VVPAT to transfer your vote to the control unit.
2. The earlier solution had one very big safeguard. The machine had no information about candidates or parties. The only thing the machine knew is the total number of candidates and it sequentially maintained which slot got how many votes. The mapping of the slot to the candidate was a completely external method and it was only maintained on a piece of paper that was stuck on top of the ballot unit. This was ensuring that not program within the machine can favor a particular candidate.
3. The earlier solution was not using any memory that was writable. One could not add anything to the machine after it was manufactured. The current solution involving VVPATs prints candidates symbol. It is clear that there is a mechanism somewhere to upload the list of symbols and symbol to ballot position mapping in the VVPAT system. Also since the vote to control unit is transferred by VVPAT, it is not impossible to create a program that can tamper with this vote and cast a vote in favor of a candidate other than what the voter intended.
4. The current verification of votes to the paper trail is grossly insufficient.

I believe there is a simple modification to the current solution that can be deployed which will take care of some of the issues. This requires a simple modification to control unit and ballot unit and it looks like below.

The idea is very simple. We keep the existing data and control flow among BU/VVPAT/CU as it is. Apart from that, the ballow should simultaneously get transferred to CU as well. The CU should compare the ballot that it received from VVPAT and BU and if there is a mismatch, it should raise an alarm and store it as a disputed vote. If the count of disputed vote is significant the CU should raise an alert and the equipment should be changed.

I am sure there is nothing wrong with the current set of equipment that we are using. But something as important as polling in a democracy should not only be fair but also should be seen to be fair.  I think this simple modification could instill more confidence in the citizens.