The nation’s top voting machine maker has admitted in a letter to a federal lawmaker that the company installed remote-access software on election-management systems it sold over a period of six years, raising questions about the security of those systems and the integrity of elections that were conducted with them, Motherboard reports.
In a letter sent to Sen. Ron Wyden, an Oregon Democrat, in April and obtained recently by Motherboard, the firm—Election Systems and Software—acknowledged that it had “provided pcAnywhere remote connection software … to a small number of customers between 2000 and 2006,” which was installed on the election-management system ES&S sold them.
The statement contradicts what the company told The New York Times in February. At that time, a spokesperson said ES&S had never installed pcAnywhere on any election system it sold.
Even if ES&S and its customers configured their remote connections to ES&S in a secure manner, the recent US indictments against Russian state hackers who tried to interfere in the 2016 presidential elections show that they targeted companies in the US that make software for the administration of elections. An attacker would only have had to hack ES&S and then use its network to slip into a county’s election-management system when the two systems made a remote connection.
In its letter to Wyden, ES&S defended its installation of the software, saying that during the time it installed the software on customer machines prior to 2006, this was “considered an accepted practice by numerous technology companies, including other voting system manufacturers.”
In 2006, the same period when ES&S says it was still installing the pcAnywhere software on election systems, hackers stole the source code for the software, though the public didn’t learn of this until years later in 2012 when a hacker posted some of the source code online, forcing Symantec, the distributor of pcAnywhere, to admit that it had been stolen years earlier. Source code is invaluable to hackers because it allows them to examine the code to find security flaws they can exploit.
ES&S is the top voting machine maker in the country, a position it also held in the years 2000-2006 when it was installing pcAnywhere on its systems. The company’s machines were used statewide in a number of states, and at least 60% of ballots cast in the US in 2006 were tabulated on ES&S election-management systems.
