In 2007, Ohio Secretary of State Jennifer Brunner ordered Project Everest, a security analysis of the electronic voting systems (both touch screen and optical scanners) used in Ohio, based on an earlier study commissioned by California Secretary of State Debra Bowen. Three different academic teams were hired, one for each of the e-voting system manufacturers of machines used in the state. In the end, the recommendation was to discontinue all of them.

The University of Pennsylvania team handled the Election Systems & Software (ES&S) systems. In the aftermath, a video was made of them describing their experience and what they found. The entertaining video, called Hacking Democracy (a nod to the HBO-produced move of the same name), is available on YouTube at https://www.youtube.com/watch?v=YR83iD01YvM

They analyzed ES&S's iVotronic touch screen, its local and large-batch optical scanners (M100 & M650), and its "Unity" EMS (election management software). The video is an occasionally-jaw-dropping sequence of revelations of Swiss cheese security. This page is a brief summary of the part of their presentation related to optical scanners, since Maine uses ES&S optical scanners.

Some of the general problems they found with all systems:

• Locks: these were simple wafer locks, pickable with a paper clip
• Keys: there were 2 keys, which were easy to make, and they were the same for every machine!
• Seals over sockets for removable media: tampering with these was supposed to leave evidence, but they could be removed with steam or WD40, andcould be bought from the manufacturer listed on the seals.
• Ports: there were many open ports, including ethernet or modem ports
• Printer port:
  • Access to the port allowed printing of whatever you'd want on the audit trail.
  • The connecting plug was easy to pull out (voters did it),
  • Pulling the plug disabled the audit trail, making tampering invisible

Some of the problems they found with the Optical Scanners:

• Both local and batch scanners: No password required for removable media, insert and uploads firmware auto
• No encryption on results on removable media, can alter with no trace
• Useless locks allow access to glass, put post-it note to block undesireds
• forge-able paper ballots -- non-read ink security, if sees anything where this is used (e.g., photocopy, which makes readable marks), notes possible counterfeit, but if you make a copy and then white out those sections, no problem. Might be noticeable, so best to replace security, but can't buy black, so make it by mixing colors of ink-jet cartridge.
• Can put malicious code on removable media, which goes to central tabulator and uploads and runs.

Presentation Slides

Below are the optical-scanner-related slides they used in their presentation, with an approximate time stamp as to where they occur in the video (Note: EMS = election management system, PEB = personal electronic ballot). Note in particular the "Quick Summary" slide in the Analysis section.