Case 1:17-cv-02989-AT Document 579 Filed 08/15/19 Page 24 of 153 Hursti, Diebold TSX Evaluation, Security Alert: May 11, 2006, Critical Security Issues with Diebold TSX, Executive Summary at 2.21 After Hursti’s security alert was issued, Diebold was forced to create a security patch for the vulnerable TSX software. There is no evidence that Georgia ever implemented the software patch or made any upgrades to protect the integrity of its DRE machines. (Shamos Dep. 116-17.) Georgia’s AccuVote DRE machines use software from at least 2005, which predates the version of the software released by Diebold after the Hursti discovery in 2006 and the updated BallotStation software on the same model Diebold Accuvote TSX machines that were decertified in California in 2006-07 as discussed below. (See Halderman Decl., August 2018, Doc. 260-2 ¶ 25.) Michael Barnes, Director of the Center for Election Systems at the Secretary of State’s office, testified that the internal memory of the DRE voting machines themselves has never been tested or inspected by the State. (Tr., Doc. 570 at 77.) As Hursti’s report explains in greater detail: “Unlike the desktop versions of Windows, the embedded versions of Windows CE 3.x and 4.x versions used in the Diebold system (which are both noncurrent versions) have very limited security features against a user with access below the application level. Because of the lesser security available in Windows CE, access to the standard Windows Explorer application grants users access to replace and modify files almost without restriction. This enables a hostile attacker to severely alter the system functionality and/or add new software (and hidden processes) to the system. In addition to altering individual files, the TSx and TS6 systems also present opportunities to change the Operating System itself. This provides possibilities for hiding the attack and/or altering the application's behavior without any changes to the application itself. A major contributor to this is the ability to change the Operating System functions and libraries any application software relies on at a deep level.” (Id. at 3-4.) 21 24