Dominion

The Dominion ImageCast Precinct scanner was thoroughly hacked at the 2019 DEFCON Voting Village. Here, 2 hackers play pong on the system. Claims by election officials that their voting machines cannot be hacked are simply untrue. Computer science and security experts have stated and proven repeatedly that voting machines are computers and that all computers can be hacked. 

Here is the report on how the Dominion ImageCast Precinct scanner, and other voting machines were hacked. 

Dominion is on page 18. 

Photo credit: Henry Meng

Hackers featured: 

Nakul Bajaj & Lyell Read

 Many of the hacks that were demonstrated at DEFCON would likely work on all models of the Dominion ImageCast design, as the different versions have similar components. So the ICE is as vulnerable to these hack as other models. 

In this photo, researcher/hackers connected an Ethernet cable to a port very close to where voters scan their ballots. It took less than 5 seconds. The researchers said they could connect their cable to a very small device called a "raspberry" that would allow them to inject malicious code through the Ethernet cable. This could happen easily and unobtrusively in the amount of time that most voters vote.

Photo credit: Lulu Friesdat

Despite the fact that the Dominion ImageCast Precinct can and has been hacked, security experts consider it a reliable choice for voting because it has the ability to be audited. Most voters cast their votes using hand-marked paper ballots that are a reliable source to determine voter intent. 

Voters with disabilities mark their ballots using the assistive model, and then feed their ballots through the same scanner as other voters. This protects the privacy of voters with disabilities.

Security experts recommend full hand-count audits, or risk-limiting audits to confirm that the scanner has counted the ballots correctly.

Security experts have discovered a particularly bad feature in the Dominion ICE that makes it one of the worst choice for secure and accurate elections.

The machine combines the printer and scanner in one device. This may seem convenient, but it creates a ripe opportunity for foul play. 

After the voter casts their ballot, the ballot passes under the printer head. If the machine has been hacked, it can add or change the votes on the paper ballot. 

Election security experts have called this a "disaster." The reason why they consider these voting machines worse than the Dominion ImageCast Precinct - is that "No form of audit can confirm they functioned correctly." Quote from auditing expert Professor Philip Stark a statistician at the University of California, Berkeley.

SMART Elections has produced an investigative series on the problems with the Dominion ICE machine. There are 2 episodes, each 5 minutes long. The videos can quickly get you up to speed on the problems with the Dominion ICE machine. 

Watch Part 1

Watch Part 2

SMART Elections has also produced a quick and easy PDF that explains the major security concerns with  "hybrid" or "All-In-One voting systems, like the Dominion ICE, the ExpressVote and the ExpressVote XL. 

The document is based on the work of Professor Andrew Appel of Princeton and Professor Philip Stark at the University of California Berkeley.  

Click here to read or download the PDF.

Read the full paper here.

Four disability advocacy groups wrote to the NY State Board of Elections asking that the ICE machine not be certified. They say they have had bad experiences with Dominion voting systems. They are worried the machine will cause long lines and make their voting experience stressful. Read their letters and documents.

In the fall of 2018 security experts discovered a serious flaw in the Dominion ICE design. Due to that discovery, the NY State Board of Elections asked its security labs for an additional review. 

The state's own security lab described the risk that was discovered as "Very High." But then downplayed it and assessed the likelihood of the machine being compromised as "Very Low." 

The State Board of Elections chose not to decertify the machine, but the decision was controversial with security experts arguing, "NYSTEC’s actual recommendation is that this is a real threat." 

The ImageCast Precinct 

can handle multiple ballot styles.

Election Commissioners seem to be misrepresenting this information.

Below is correspondence from an attorney from Indivisible Scarsdale, Myra Saul, to the NY State Board of Elections.

 Jul 29, 2019

From: Myra Saul 

To: NY State Co-Chair Douglas Kellner, describing information she had received from Westchester County Election Commissioners:

 "The objection is this: because the machine takes so long to boot up on site, it is impractical to use. The example they cited was the test experience of Erie County.  They indicated that the  Erie Board of Elections programmed their Dominion machine to produce multiple ballot faces, but when it was tested as if at a polling site (after the seals were broken), it took 18 hours to boot up. Consequently, the machine would be useless in the field."   

Jul 29, 2019

 From: NY Commissioner Douglas A Kellner 

 To: Myra Saul 

 "I am perplexed by your email because Erie County does not use Dominion equipment. Erie is one of ten counties that use ES&S DS-200 to scan their ballots." 

Read the letter.

Read the letter.

Read the letter.

Read the letter.

The price quoted for the ICE in NY Counties is $14,000. Professor Appel says that standard optical scanners and ballot-marking devices can be purchased for $4,000 - $5,000. Prices may vary state to state, and Professor Appel works in New Jersey, where some of his research is centered. However, there is no debate that the ICE is far more expensive than the ImageCast Precinct. 

The NY State Board of Elections has established a special audit that is required only for the ICE machine. (p. 24/25)

Because of the serious risk that the machine could change the votes on paper ballots, each county that uses the ICE machine must check the printer function of at least one Dominion ICE machine after the election. 

The need for the audit indicates that there is a real danger the machine could change votes. However, as designed, the audit is not sufficient to detect fraud or mistakes, and so it gives a false sense of security.

Here is a photo of a sample audit run by the State Board of Elections at a demo.