Princeton prof picks up e-voting machines on the cheap

It's no secret that e-voting machines here in the US and around the world have more security holes than a slice of Lorraine Swiss, but it took a Princeton professor and $82 to discover just how bad the situation really is. Now, one would think that election officials would destroy their old terminals instead of selling them to the general public for practically nothing (the ~$5,000 devices are going for less than $20 apiece), yet that's exactly what Buncombe County, North Carolina did with 144 of its retired Sequoia AVC Advantages. First manufactured in the late 80's, the Advantages use old-school push buttons and lamps instead of the touchscreens found on more modern models -- and yet according to Princeton's Andrew Appel, they're actually more secure than those Diebold machines that fellow faculty member Ed Felten totally pwned several months back. Still, Appel and his students found numerous problems with these Sequoias that are still being used in parts of Colorado, New Jersey, Pennsylvania, and all across Louisiana: not only were they able to pick the machines' locks in under seven seconds, they discovered that the non-soldered ROM chips were easily replaceable, allowing a hacker-in-the-know to potentially swap them out with outcome-altering data. A Sequoia spokesperson claims that any tampering with the machines would set off an alarm at their headquarters, but Appel argues that this security precaution could easily be overridden with the right code. So this is just great: now we know that a determined individual could easily pick up still-in-use machines (for a song), reverse engineer them to figure out the security roadblocks, and then sneak into a church basement or gymnasium where many of these terminals gather dust for 364 days a year. This is a big problem, folks, and let's hope it doesn't take an election Enron for some serious changes and regulations to be enacted by the feds.

[Andy_J @ Feb 16th 2007 4:25PM]

ummm....
Election Enron?

Don't you mean the last 2 presidential elections where it came down to a few votes? A few votes that could have easily been corrupted as per example of this blog post? I mean, how much worse does it have to get?

[--Ed @ Feb 16th 2007 3:43PM]

LOL...Here in Florida we are going back to paper too. The whole state is scraping all the eVoting machines.

[bazald @ Feb 16th 2007 6:26PM]

Back to the good, old-fashioned butterfly ballots, eh?

[bavalova @ Feb 16th 2007 5:51PM]

As it has been said a million times before.. Voter fraud has existed as long as democracy. If someone wanted to commit fraud 50 years ago, they could have done it just the same. I'm all for showing ID at the booth and heavy supervision by the people there.. It's not full proof, but what hacker in the right mind would try something with someone looking straight at them. It doesn't matter if they could pick the lock in 3 seconds, somebody would notice.

[tim @ Feb 16th 2007 3:43PM]

Why do you hate America?

[thispaceforsale @ Feb 16th 2007 4:48PM]

Americans do a pretty good job at electing crappy officials under the current rigging system, this might actually give a competitive advantadge to more deserving candidates.

[Ryan @ Feb 16th 2007 4:48PM]

Even assuming the 'election Enron' happens, you'd never hear about it.

The government would likely decide that telling people would undermine the public's faith in democracy, so the lesser of two evils is to allow those who stole the election to steal it.

Seriously, if an election official came out as a whistleblower, he would simply be discredited and the story dumped unceremoniously by the media.

[Johnny @ Feb 16th 2007 5:44PM]

Who cares?! Wether paper or digital voting machines are secure or not the results have been decided long before the people ever get to vote so practically these are just toys to keep the sheep with an illusion of choice.

[l2k @ Feb 17th 2007 12:43AM]

Proof of citzenship, indelibly marked finger, paper ballots and pen. But people don't care, and we're getting what we deserve for that.