Stories
Slash Boxes
Comments

SoylentNews is people

posted by chromas on Thursday November 15 2018, @12:00PM   Printer-friendly
from the ¯\_(ツ)_/¯ dept.

I Bought Used Voting Machines on eBay for $100 Apiece. What I Found Was Alarming

In 2016, I bought two voting machines online for less than $100 apiece. I didn't even have to search the dark web. I found them on eBay.

Surely, I thought, these machines would have strict guidelines for lifecycle control like other sensitive equipment, like medical devices. I was wrong. I was able to purchase a pair of direct-recording electronic voting machines and have them delivered to my home in just a few days. I did this again just a few months ago. Alarmingly, they are still available to buy online.

If getting voting machines delivered to my door was shockingly easy, getting inside them proved to be simpler still. The tamper-proof screws didn't work, all the computing equipment was still intact, and the hard drives had not been wiped. The information I found on the drives, including candidates, precincts, and the number of votes cast on the machine, were not encrypted. Worse, the "Property Of" government labels were still attached, meaning someone had sold government property filled with voter information and location data online, at a low cost, with no consequences. It would be the equivalent of buying a surplus police car with the logos still on it.

[...] I reverse-engineered the machines to understand how they could be manipulated. After removing the internal hard drive, I was able to access the file structure and operating system. Since the machines were not wiped after they were used in the 2012 presidential election, I got a great deal of insight into how the machines store the votes that were cast on them. Within hours, I was able to change the candidates' names to be that of anyone I wanted. When the machine printed out the official record for the votes that were cast, it showed that the candidate's name I invented had received the most votes on that particular machine.

This year, I bought two more machines to see if security had improved. To my dismay, I discovered that the newer model machines—those that were used in the 2016 election—are running Windows CE and have USB ports, along with other components, that make them even easier to exploit than the older ones. Our voting machines, billed as "next generation," and still in use today, are worse than they were before—dispersed, disorganized, and susceptible to manipulation.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by Lester on Thursday November 15 2018, @04:25PM (1 child)

    by Lester (6231) on Thursday November 15 2018, @04:25PM (#762217) Journal

    It would even be possible to take the entire box of ballots and feed them through a 2nd counting machine to check the results.

    They should always be verified with manual counting, or at least a significative number of machines should be checked if they have counted properly. Do you remember the voting machines of USA 2000 presidential election in Florida [wikipedia.org]? Do you check Credit Card Payments? Do you count money form a cash machine? I always do it. There are two actor and all those gadgets let an actor (the bank) speed up process (teller machine, bank software...), but the other actor (you) can verify it. With electronic voting, you drop the ballot in a vacuum. And with this machines if you don't count manually ballots, just count them again in the same machine, is not very different. Think of Volskwagen dieselgate [wikipedia.org], considering what is in stake in a election, and that someone always to tamper it. It is a good idea manipulating the circuits to move 10% votes from others candidates to me when dumping totals.

    Voting machines could be even connected to internet, so, a second after finishing elections, you could have *provisional* results, but always pending of manual counting. Never trust in machine

    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2  
  • (Score: 3, Insightful) by DannyB on Thursday November 15 2018, @06:29PM

    by DannyB (5839) Subscriber Badge on Thursday November 15 2018, @06:29PM (#762276) Journal

    You mention something that I failed to mention.

    The voting machines I talk about are NOT connected to the internet. Ever. They don't need to be.

    The results can be sent by a human over the internet or some other way.

    Another thing about passing the ballots through multiple machines to verify the count would the the idea of multiple machines from different vendors that might not be implemented the same way.

    --
    To transfer files: right-click on file, pick Copy. Unplug mouse, plug mouse into other computer. Right-click, paste.