In 2011, the election board in Pennsylvania’s Venango County — a largely rural county in the northwest part of the state — asked David A. Eckhardt, a computer science professor at Carnegie Mellon University, to examine its voting systems. In municipal and state primaries that year, a few voters had reported problems with machines ‘‘flipping’’ votes; that is, when these voters touched the screen to choose a candidate, the screen showed a different candidate selected. Errors like this are especially troubling in counties like Venango, which uses touch-screen voting machines that have no backup paper trail; once a voter casts a digital ballot, if the machine misrecords the vote because of error or maliciousness, there’s little chance the mistake will be detected. Eckhardt and his colleagues concluded that the problem with the machines, made by Election Systems & Software (ES&S), was likely a simple calibration error. But the experts were alarmed by something else they discovered. Examining the election-management computer at the county’s office — the machine used to tally official election results and, in many counties, to program voting machines — they found that remote-access software had been installed on it.
Remote-access software is a type of program that system administrators use to access and control computers remotely over the internet or over an organization’s internal network. Election systems are supposed to be air-gapped — disconnected from the internet and from other machines that might be connected to the internet. The presence of the software suggested this wasn’t the case with the Venango machine, which made the system vulnerable to hackers. Anyone who gained remote access to the system could use the software to take control of the machine. Logs showed the software was installed two years earlier and used multiple times, most notably for 80 minutes on November 1, 2010, the night before a federal election.
The software, it turns out, was being used not by a hacker but by an authorized county contractor working from home. Still, the arrangement meant anyone who might gain control of the contractor’s home computer could use it to access and gain control of the county’s election system.
… More than 350,000 voting machines are used in the United States today, according to an estimate by Verified Voting, a nonprofit that tracks voting equipment use and policy. The machines fall primarily into two categories — direct-recording electronic machines and optical-scan systems. With DREs, voters touch a screen or button or turn a dial to make their selections, and the ballots and votes are entirely digital; some DREs are outfitted with printers to produce a voter-verifiable paper trail. With optical-scan machines, which many states have purchased in recent years to replace their DREs, voters make their selections on a full-size paper ballot, which gets fed into an optical scanner and can be used after an election to verify the digital results. (Hybrid machines are also available which combine touch-screen voting with a scannable paper ballot.)
Full Article: The Myth of the Hacker-Proof Voting Machine – The New York Times.