News Internet & Security Voting Machines on eBay Could Pose Security Risk Election collectibles or dangerous objects? by Tech News Reporter Sascha Brodsky is a freelance journalist based in New York City. His writing has appeared in The Atlantic, the Guardian, the Los Angeles Times and many other publications. our editorial process Sascha Brodsky Published October 27, 2020 11:04AM EDT Internet & Security Phones Internet & Security Computers Smart & Connected Life Home Theater Software & Apps Social Media Streaming Gaming View More Tweet Share Email Key Takeaways Used voting machines are widely available on eBay and some security researchers say they could pose a hacking risk.The machines range in price from less than $100 up to the thousands for a vintage collectible.The voting machines can also be used by researchers to make them more secure. erhui1979 / Getty Images Used voting machines frequently go up for auction on eBay and some experts say they could be useful for people looking for ways to hack into next month’s elections. The machines on auction range in price from less than $100 to thousands of dollars. They are marketed in the "collectibles" section of eBay and no law prohibits their sale. However, unscrupulous purchasers might find them useful for changing election results, observers say. "Obviously, having direct access to these machines allows their vulnerabilities to be discovered and exploits developed," Aaron Birnbaum, Chief Security Officer of cyber security firm Seron Security, said in an email interview. "Being able to take these machines apart and understand exactly how they function is advantageous to someone wanting to affect the results." A Wide Range for Sale The voting machines on sale vary, but yesterday they included the ES&S AutoMark A200 for $450 and the Voter Access Card Encoder for AccuVote for $149. A Coyle voting machine from 1961 was listed at a Buy it Now price of $1,700. It was "developed by Martin A. Coyle and introduced in Butler and Greene Counties, Ohio, in 1961." Dan Lopresti, a professor of computer science and engineering at Lehigh University, is an expert on the security of voting systems and he’s bought several used voting machines on eBay and other places. "Computer security researchers have been studying machines obtained this way for years," he said in an email interview. "It's possible to get a lot of information by studying a machine like this, although typically the observations are somewhat indirect because we don't have access to the source code and because the voting machine itself is just one component in the election system." Lopresti says that access to used voting machines is a spur to researchers to make them more secure. "It’s better to assume your adversary has access and design measures to protect against that, rather than assume you can completely secure a system like this from all public access," he said. "Although obviously, it's important for municipalities to protect the machines they plan to use in an upcoming election." "What makes these machines even more vulnerable is the fact that voting technology has not progressed very rapidly." Security researcher Roger Johnston says he’s headed up a team that used second-hand voting machines to quickly learn how to hack into them. "It certainly made finding the vulnerabilities quick and easy," he said in an email interview. "I have to say, however, having done vulnerability assessments for several election jurisdictions and observing others, that it is usually going to be easy enough to steal voting machines for practice because of the typically weak physical security and security culture." Hacking for Good The availability of used voting machines can enhance security, some experts say. Being able to examine them lets researchers search for bugs and vulnerabilities. "That doesn’t mean a person or organization should be able to buy tens or hundreds; we don’t want these to fall into the wrong hands at scale," Marcus Fowler, Director of Strategic Threat at the internet security firm Darktrace, and a former department chief at the CIA, said in an email interview. "Ultimately, it’s important for the industry to provide a balance between confidentiality and openness to security improvements." Scott McIntyre / Bloomberg / Getty Images The older voting machines often for sale on eBay are technologically not very different from those currently in use at polling places around the country, Veronica Miller, Cybersecurity Expert at VPN overview, said in an email interview. "What makes these machines even more vulnerable is the fact that voting technology has not progressed very rapidly," she added. "It’s better to assume your adversary has access and design measures to protect against that..." The information secure experts worry about most in used machines is the code that’s written in preparation for elections, Fowler said. "These are switched up each year, but enough similarities remain from previous years which may give motivated hackers a head-start in learning the current year’s code," he added. "Code errors would allow attackers to identify vulnerabilities—this is where traditional voting machines and our future need to vet voting apps have shared lessons." As next week’s presidential election heats up, concerns remain that some voting machines could be hacked. Those machines on eBay could make a great collectible or pose a risk to democracy.