Case 1:17-cv-02989-AT Document 579 Filed 08/15/19 Page 23 of 153 24-28.) As Dr. Halderman19 testified, the DREs use “a Windows CE operating system that is notoriously insecure. It doesn’t have a security subsystem, for example.” (Tr., Doc. 307 at 137.) The operating system software on Georgia’s DRE machines has not been updated since at least 2005 to address any of the security flaws discovered in the software over the last 13 plus years. (Halderman Decl., Doc. 260-2 ¶¶ 27-28.) In 2006 Harri Hursti,20 a nationally recognized cyber expert and “ethical hacker,” discovered a serious vulnerability in the AccuVote TSX – the same model of DRE machines used in Georgia. The State Defendants’ own retained expert described this vulnerability in the AccuVote DREs as “one of the most severe security flaws ever discovered in a voting system,” up to that time. (Shamos Dep. at 115.) Hursti’s 2006 security alert report demonstrated numerous vulnerabilities with the AccuVote TSX, the most critical security issue being that the machine’s operating software enables “a malicious person to compromise the equipment even years before actually using the exploit, possibly leaving the voting terminal incurably compromised.... [The] defects compromise the underlying platform and therefore cast a serious question over the integrity of the vote. These exploits can be used to affect the trustworthiness of the system or to selectively disenfranchise groups of voters through denial of service.” Harri Dr. Halderman’s extensive qualifications as Professor of Computer Science and Engineering and Director of the University of Michigan Center for Computer Security and Society have been previously described. 20 Mr. Hursti has performed several cybersecurity examinations of electronic voting machines of the type used in Georgia. 19 23