February 16, 2007

$82 Buys Voting Secrets

"For a mere $82 a computer scientist and electronic voting critic managed to purchase five $5,000 Sequoia electronic voting machines over the internet last month from a government auction site. And now he's taking them apart.

Princeton computer science professor Andrew Appel and his students have begun reverse-engineering the software embedded in the machines' ROM chips to determine if it has any security holes. But Appel says the ease with which he and his students opened the machines and removed the chips already demonstrates that the voting machines are vulnerable to unauthorized modification.

Their analysis appears to mark the first time that someone who hasn't signed a non-disclosure agreement with Sequoia Voting Systems has examined one of its machine's internals.

Appel bought the machines from election officials in Buncombe County, North Carolina, who offered them for sale at GovDeals.com, a site for government agencies to buy and sell surplus and confiscated equipment. The county sold 144 machines in lots of varying amounts. It paid $5,200 for each machine in 1997. To buy the machines, Appel had to pay $82 and only needed to provide a name, address, phone number and e-mail address.

Sequoia and other voting machine companies have long resisted calls from voting activists to make their proprietary software transparent to the public, because they say it would allow hackers to study the software and devise ways to plant malicious code in it. But Appel says his purchase of the machines shows how easy it is for hackers to obtain and study the software anyway.

"There are hundreds of counties in the country that have had these machines for 20 years," Appel says. "To assume that nobody could have ever had access to those machines to fool around with them in the last 20 years ... that's a stretch. And now it's certainly not true."

The article is here.

Posted by Randy Riddle at February 16, 2007 09:09 AM