Someone armed with a smartphone, a palm pilot — even a personal electronic ballot purchased online, like the ones used by S.C. poll workers — could sign in to vote at a polling site and load a bit of malicious code onto one of the state's touchscreen voting machines without anyone noticing.
A voter carrying their own personal electronic ballot might stand out in the line to cast a ballot, said Buell, a computer science professor at Clemson University who consults on election technology.
But, he added, "If it's a day when it would not be unusual to be wearing a trench coat, someone could get it in, slot it and insert malware into the machine."
Buell is not the only one worried that South Carolina's aging voting machines are vulnerable to outside interference in an election. Last week, a federal court in Georgia ruled against an effort to force the Peach State to switch to paper ballots in time for the Nov. 6 election.
U.S. District Judge Amy Totenberg decided it would be too disruptive for the state to change its whole election system only seven weeks out from Election Day. But she did tell state election officials "further delay is not tolerable in their confronting and tackling the challenges before the state's election balloting system," according to the Associated Press.
Georgia uses a different touchscreen voting system than South Carolina. But the neighbors are two of only five states whose voting systems do not include a paper component to audit vote totals.
A similar suit, brought by the nonprofit group Protect Democracy, is making its way through South Carolina's court system. That suit alleges the South Carolinians' right to vote is being violated by the vulnerability of the state's 14-year-old voting machines to hacking attempts, like the one described by Clemson's Buell.
The group's complaint cites a 2007 study by researchers at Penn State University and the University of Pennsylvania citing numerous vulnerabilities in the iVotronic system, which South Carolina uses.
State officials stress South Carolina's voting machines are not connected to the internet and, as a result, can't be hacked remotely. But the 2007 study showed how a malicious user with access to one machine could spread an infection to other machines as poll workers connect them to the same memory card. Once an infected machine makes it back to county headquarters, it could infect the vote from an entire county.
Once it is loaded onto a voting machine, the malicious code could change the vote total, cause a machine to malfunction or prevent votes for a certain candidate from being entered. Critics say without any way to independently verify the recorded vote totals -- by using a back-up, paper-trail system -- such a hack could go completely unnoticed.
"They are more vulnerable than a modern machine should be," said Larry Schwartztol, attorney pressing the S.C. lawsuit. "There's no way to know, and no way to undo the damage once it happens."
Schwartztol said the S.C. suit doesn't seek to force the state to use paper ballots this November. But it does want the current S.C. voting machines replaced with machines that either scan votes recorded on paper ballots or that print out a voter's digital selections, giving officials a record with which to verify the results.
That would be Buell's preference, arguing his own study of election data has found enough apparent instances of misrecorded vote totals in one precinct or another that he questions the current system's reliability.
"They would say, 'It's human error,' " Buell said. "But if the system is so complicated, it can't be used by the people who are supposed to be using it, then I'd say the system's at fault."
S.C. Election Commission spokesman Chris Whitmire wouldn't comment on the pending lawsuit against the state or measures that election officials are taking to prevent election interference. But, he added, election officials are taking the issue seriously.
In August, for instance, election officials from across the state met with the FBI and federal Department of Homeland Security to prepare possible responses to cyberattacks.
Whitmire noted the state's 13,000 voting machines are tested regularly to ensure they work correctly and are secured to avoid any tampering when they are not in a polling place. The state also takes efforts to keep the vote count is accurate, he added.
Votes are totaled and posted at each precinct before they are sent to be counted at a county election office. Also, each county's results are audited twice before the final vote tallies are certified.
The Election Commission estimates it could cost as much as $50 million to replace the state's current iVotronic voting machines. Only about $15 million currently is set aside to buy new voting machines for the whole state.
Even if they can imagine ways the state's voting machines could be compromised, Whitmire says voters should be confident in the current system's reliability.
"You can theorize around any system," Whitmire said. "If you think about a ballot box, there are ways to tamper with that ... You have to make sure there are no ballots in there already, that nobody is taking ballots out.
"Security is not a new concept in elections."
©2018 The State (Columbia, S.C.) Distributed by Tribune Content Agency, LLC.
