Georgia election officials accused of destroying evidence

[ancianita]

28. At the top of the DEF CON list of easily hackable machines.

Dominion Premier/Diebold AccuVote TSx

The AccuVote TSx is an electronic voting machine manufactured by Premier Voting Solutions, later acquired by Dominion Voting Systems. ...

The AccuVote TSx is currently in Alaska, Arizona, California, Colorado, Florida, Georgia, Illinois, Indiana, Kansas, Missouri, Mississippi, Ohio, Pennsylvania, Tennessee, Texas, Utah, Wisconsin, and Wyoming.

During DEF CON, the Voting Village organized a mock election to demonstrate vulnerabilities in the AccuVote TSx. The software used in the demonstration was unmodified from the software that is still used widely. Additionally, there are older, potentially more vulnerable versions of the software still in use.

The mock election demonstration consisted of multiple elements:

● All voters used the same voter activation smart card without the card being reactivated with a device of any kind to allow the next voter to cast their ballot.

This is because the voter activation card was programmed to automatically reset itself after activating the device, therefore allowing it to be used to cast unlimited number of ballots.

● The election was programmed without using software provided by the vendor, therefore proving that a chain of custody of the election management software does not prevent new elections from being programmed.

This also indicates that third parties with no access to the election management system can create rogue election definitions which are indistinguishable from real elections.

● An attack can be distributed remotely with no physical access to the voting machine. Malware needed in this demonstration can be distributed with the ballot/election definition.

This also demonstrates the mechanism enabling a wholesale attack. Depending on how a particular county’s system is set up, there may be multiple centralized systems in the chain of the information flow to the voting machines, and compromising any of the links in the chain enables a wholesale attack.

● Paperless, unauditable systems are extremely vulnerable to this kind of attack, as the only record of a voter’s intent is in digital form.

(p 14)