RISE TO THE MOMENT OF TRUTH
THURSDAY, OCTOBER 19, 2023
News
Black box voting: Confessions of an elections hacker (Part 1)
Andrea Tice | 10.15.22
Clay Parikh spent nine years hacking elections.
As a hacker, he worked in an election testing lab, dealing with many voting systems, including the ES&S system used in Alabama. As a certified ethical hacker, Parikh's job was not only to think like a criminal but to act like one, too.
"This has been my total career path since retiring from the military," said Parikh. "This is what I do. I know systems; I don't care if it's a cell phone, a laptop, an Xbox or a Roomba. In the group I was in when we played 'bad guy,' we hacked a Roomba just to prove the point that we could do it and control it remotely. That's just good guys doing it - believe me, the bad guys have a lot less reign."
Parikh calls points of entry for hackers "exploitables." He says the average person has no way of knowing where these exploitables are or how to find them; such scrutiny requires a trained computer science expert.
As a successful hacker with a master's degree in cybersecurity, Parikh, who has been subcontracted within major government agencies, knows there is a difference between saying something is secure and it actually being secure.
"There is a saying in the Department of Defense," Parikh explained. "Don't ask if you have been hacked; assume that you have and try to find out how."
That is why Parikh has teamed up with the group Focus on America (FOA) to legally gain access to the ES&S 200 tabulators in Alabama to test the claims of "safe and secure" voting systems. Parikh and FOA want to provide a third-party analysis for voters showing whether this election system is as unhackable as election officials are publicly maintaining.
Following the May primaries of 2022, FOA filed a lawsuit against Secretary of State John Merrill and the Alabama Election Committee to achieve more election transparency, safeguards and accountability. The lawsuit seeks to halt the use of ES&S tabulators until the system has practical checks and balances applied through a hand recount of ballots and access to the machine for forensic analysis.
Exploitable #1: Ballot reading
"We showed the judge a video of photocopied ballots accepted and counted by an electronic voting machine," said FOA's Rebecca Rodgers. "How is that acceptable?
"How can you sit in court and watch a video of fake ballots going through a machine that was used in our primary election and not question it? How can you listen to experts like [Parikh] say that even though the machines are not connected to the internet, they can still be hacked? How can you listen to that and not make a decision to protect the citizens of Alabama?
"This is not about Democrat or Republican parties; this is about voter rights. This is a big deal."
Jason Slye was one of two people who ran the counterfeit ballots through the ES&S machines during a time of public testing done ahead of the primaries. Slye was in Baldwin County at the time.
"[The tabulators] can't distinguish between counterfeit and real ballots," Slye said. "My friend Angela made the best analogy to what this reality indicates. Consider that when a person puts a fake dollar bill into a vending machine, that person gets it spit right back out. The vending machine electronics can distinguish the difference. So what that means now is our ballot tabulators for processing people's votes are less secure than the average snack vending machine. You wouldn't get on your home computer with the security level that it is on these systems."
Angela Shepherd did fake ballot testing in Lee County in conjunction with what Slye did at his precinct. Both sets of photocopied ballots from Shepherd and Slye were not only accepted into the ES&S 200 tabulator but counted as part of the vote total.
Parikh says this event alone demands a complete evaluation of the systems, especially in light of documented contract claims from ES&S.
"One [fake] ballot going through means it's totally misconfigured," Parikh said. "ES&S claims in their technical documentation that it has to have a certain type of ink, paper, or it won't run through. Got to look at the configuration and figure out why this happened."
Slye pointed out that his concern is the exploitation of absentee ballots and noted a case in New Jersey where criminals were paid to hijack absentee ballots in the mail to sway tight elections in that state.
Exploitable #2: Built-in Potential Wifi connectivity
Parikh reviewed a publicly available purchase order from the office of the Secretary of State to ES&S and found a descriptor for wifi and internet connectivity relating to computers in each county that hold all of the election data.
"I saw the purchase order," Parikh added. "It stood right out. It even jumped out at our lawyer when she looked at the purchase order. The internet capability is right there within the machines."
State leadership presents the ES&S tabulators as safe because they are not connected to the internet when used to count votes. However, the ES&S tabulator vote totals go into the probate judge's computer for transmission to the Secretary of State's office at the end of an election. As a reminder, cybersecurity specialists say that if it a device has internet connectivity, it's hackable.
"The [connectivity component] has to be physically removed [from the electronic board] in order to be fully disabled," explained Parikh. "You can say it's disabled in one spot, and it can still run. The only way to stop it is to remove it. And there is no proof that [the Secretary of State's office has] done that."
Exploitable #3: Physical hacking
No group of voters or taxpayers is ever given access to the machines to conduct counter-checking because the equipment is off-limits to the public. The leased machines are held in storage, which immediately waves red flags to Parikh.
"For 67 counties in Alabama to rely solely on their physical security to protect the election systems - as a hacker, if I had access to the physical system, I would have been able to hack it within five minutes," Parikh claimed.
Parikh explains that malware can be inserted into these tabulators while in storage or during program updates conducted by ES&S technicians.
Neither the Secretary of State nor probate judges have access to the machines' coding or electronic components, and they likely don't have the technical knowledge to know if it has been compromised.
"The ES&S 200 is designed so that the normal things to bypass it cannot be done, but anyone who is halfway skilled at hacking can get past the system easily," Parikh said. "I wanted to do that in the voting systems test lab, but they would not allow me to do that. I was prohibited from messing with the configuration of the system.
"Here's the thing, I can hack that tabulator before it comes out of storage and sealed right before the election. I can put malware there in the ES&S, and it can hack the votes before they ever get printed out. I can change the counts before they ever hit the tapes and show up on the USB stick. The only way to ever catch this is to look at the actual printed ballots cast in a precinct and compare that to each image created by the tabulator system used in that precinct."
1819 News contacted probate judges' offices and the Secretary of State's office to ask if voters could request a hand counting of ballots to compare totals with the machine readout. The Director of External Affairs, Cameron Mixon, wrote that "there is no legal mechanism for an audit outside of the pilot audit program in a limited number of counties."
Counting the paper ballots, either within a precinct or a county, is the simplest and fastest way to confirm that no hacking occurred. Yet there appears to be no mechanism to call for this basic accountability; it seems that it would require ongoing legal and legislative action by voters or else county leadership and a probate judge implementing extra measures outside of secretary of state procedures.
Parikh also mentioned updating the drivers and programs of these tabulators before each election is farmed out to ES&S employees in Nebraska. He says Alabama voters need to know that those they voted into office to perform the duties of state elections and vote security are essentially deferring this responsibility to companies and persons outside of the state.
"Alabama has deferred all of its election authority to these third-party companies," said Slye. "Everything intertwines together. You cannot dismiss this Marxist, liberal, communist push in America and to think these organizations and media outlets are not hiring activists to do certain jobs. If you deny that, then you have just buried your head in the sand. So that is my concern, that we are giving control of our elections and the programming of these machines to a third party. In the leasing contract, it says no one is allowed to physically access the machines, can't open it up and look. So ES&S is programming the election, but we cannot see the computer coding due to proprietary rights. The citizens of Alabama pay for all this equipment but cannot even look at it. That is a big issue."
Part two is coming tomorrow
To connect with the author of this story, or to comment, email andrea.tice@1819news.com.
Don't miss out! Subscribe to our newsletter and get our top stories every weekday morning.
No comments:
Post a Comment