nav search
Data Center Software Security Transformation DevOps Business Personal Tech Science Emergent Tech Bootnotes BOFH

Virginia scraps poke-to-vote machines hackers destroyed at DefCon

Three different machines fail tests, must be binned before November election

By Richard Chirgwin, 11 Sep 2017

Virginia's State Board of Elections has decided its current generation of electronic voting machines is potentially vulnerable, and wants them replaced in time for the gubernatorial election due on November 7th, 2017.

The decision was announced in the minutes of the Board's September 8th meeting: “The Department of Elections officially recommends that the State Board of Elections decertify all Direct Recording Electronic (DRE or touchscreen) voting equipment.”

In addition to the “current security environment”, the report cites the DefCon demonstration in July that showed how quickly DRE voting systems could be pwned.

With the DefCon bods showing some machines shared a single hard-coded password, Virginia directed the Virginia Information Technology Agency (VITA) to audit the machines in use in the state (the Accuvote TSX, the Patriot, and the AVC Advantage).

None passed the test. VITA told the board “each device analysed exhibited material risks to the integrity or availability of the election process”, and the lack of a paper audit trail posed a significant risk of lost votes.

Local outlet The News Leader notes that many precincts had either replaced their machines already, or are in the process of doing so.

The election board's decision will force a change-over on the 140 precincts that haven't replaced their machines, covering 190,000 of Virginia's ~8.4m population. ®

The Register - Independent news and views for the tech community. Part of Situation Publishing