Here's a quick summary of the machines that they have reported vulnerabilities in. I've used [ed] to mark where I'm adding relevant content not present in the

Here's a quick summary of the machines that they have reported vulnerabilities in. I've used [ed] to mark where I'm adding relevant content not present in the report. In my non-professional opinion, none of these vulnerabilities seem earth-shattering, although the potential lack of paper trails makes some of the touch-screen systems very dicey. Both of the touch-screen systems have the option of a voter-verified paper trail, but it's not clear how widely those option are deployed. Diebold ExpressPoll-5000 - Use: Used to check in voters at the polling station. - Vulnerabilities: No voting-specific vulnerabilities were found; generally an insecure WinCE machine. Physical access would be needed to compromise. - Impact: Could change voter polls to selectively exclude individuals, forcing them to use provisional ballots. Could add voters to polls potentially, but not clear [ed] if this would pass a cross-reference with upstream voter registry. Dominion AVC Edge - Use: Touch-screen voting machine. Records votes electronically and [ed: has an optional voter-verified paper ballot audit system. Not clear how widely used the paper ballot system is used with this machine.] Verifies voter eligibility with a smart card distributed by poll staff. [ed: Presumably the smart card cross-referenced with the voter rolls during tally.] - Vulnerabilities: Physical vulnerabilities, including swapping out the electronic storage. [ed: Not clear if this would be detected by audits against the smart card registration or voter rolls]. - Impact: Removed or changed votes or completely synthetic votes, [ed: if not cross-referenced; or the storage could be re-written to change or spoil existing votes]. [ed: If paper option is not used, then no audit would be possible if storage is compromised]. Dominion Premier/Diebold AccuVote TSx - Use: Touch-screen voting machine. Records votes electronically and has an optional voter-verified paper ballot system. Verifies eligibility with smart card distributed by poll staff. - Vulnerabilities: Denial-of-service attacks easily available by unplugging a cable. Smart card is supposed to be reset by the machine, but a substitute smart card can be used that allows unlimited votes. [ed Not clear if this would pass a cross-reference with the voter rolls, or if the machine is equipped to allow such an audit.] Malware could be distributed for the device [ed: through unspecified channels]. Such malware would allow an adversary to compromise many machines without requiring physical access to polling stations. - Impact: Removed or changed votes or completely synthetic votes [ed: if not cross-referenced with voter rolls; or malware could be used strictly to change votes and still pass the cross-referencing with voter polls. The user-verified paper option could mitigate some of this, but the malware could theoretically spoil the user-verified ballot and produce a new non-spoiled ballot with a changed vote.] ES&S M650 - Use: Strictly for tallying of paper ballots. - Vulnerabilities: Physical security at the polling place, and network-based attacks in situations where the devices are networked (not at the polling place, but at the clerks office or similar centralized locations). Thought attempts are made on the device to prevent unauthorized software from being installed, there are known vulnerabilities that allow that to be changed, through a serial control port or by modifying the Zip disks (?!) that are used as the underlying file system. - Impact: Changing vote tallies. [ed: An audit would be possible because this machine uses a direct voter-filled-out paper trail].