October 20th, 2008
Report: NJ voting machines easily hacked
Prof. Andrew Appel at the AVC Advantage
Ten thousand New Jersey voting machines produced by Sequoia Voting Systems are highly vulnerable to tampering, according to a Princeton University report published Friday on a judge’s orders. The release is the result of a lawsuit instituted by Democratic lawmakers and Coalition for Peace Action.
Someone trying to manipulate the Nov. 4 election could install vote-stealing software on the machines in as little as eight minutes. And anyone at a polling place can easily change or eliminate votes, by either purposefully or accidentally pressing particular buttons located on the electronic, touch screen-equipped machines, the Princeton Packet reports.
”You can easily change the outcome of an election in a very low-tech way, said Professor Penny Venetis of the Rutgers University Constitutional Litigation Clinic, which has led the four-year legal challenge of the machines.
Judge Linda Feinberg ordered the report released — albeit with four sections redacted to protect Sequoia’s trade secrets– and ordered increased security at locations with the machines, AP reports.
The report was conducted by Princeton professor Andrew Appel, who offered this executive summary on his Freedom to Tinker blog:
- You can hack the AVC Advantage 9.00 by “prying just one ROM chip from its socket and pushing a new one in, or by replacement of the Z80 processor chip.” Time to complete: seven minutes. The new firmware will steal votes as programmed and cannot be practically detected. “All electronic records of the votes are under control of the firmware, which can manipulate them all simultaneously.”
- Attacker can install firmware by “viral propagation through audio-ballot cartridges” (used for blind voters). The attack can steal votes, cause machine to fail to operate, or cause the county-wide vote tally to be inaccurate.
- Design flaws allow poll workers to disenfranchise voters, not count votes or commit fraud.
- Votes can be manipulated after the polls close but before precinct counts are cumulated.
- “Sequoia’s sloppy software practices can lead to error and insecurity. …Programming errors that slip through these processes can miscount votes and permit fraud.”
- Programming errors have caused anamolies that disenfranchised voters.
- There are so many different versions of AVC Advantage that “New Jersey should not use any version of the AVC Advantage that it has not actually examined with the assistance of skilled computer-security experts.”
- “New Jersey should immediately implement the 2005 law passed by the Legislature, requiring an individual voter-verified record of each vote cast, by adopting precinct-count optical-scan voting equipment.”
