EAC Certification Leaves Voting Machines Unpatched for Up to Two Years Before 2024 Cycle

The SecurityWeek reporting highlights Shai Bargil's observation that certification can begin in year one of the cycle and remain static through Election Day. Procurement records show most jurisdictions receive machines certified under 2015-2020 VVSG standards that lack requirements for continuous patching or supply-chain attestation. Physical access logs from county warehouses and DEF CON Voting Village demonstrations confirm that USB and barcode interfaces have repeatedly allowed code execution on certified units without network connectivity.

Air-gapped designs do not address insider or supply-chain insertion vectors. CISA's 2022-2023 election infrastructure assessments documented 14 cases of unauthorized physical access to storage facilities holding certified equipment. AI-generated malware or QR-code payloads could exploit the same barcode scanning path used for tabulation, a vector not covered by current EAC testing protocols that focus on static code review rather than runtime behavior.

States relying on statistical audits will face compressed timelines if machine-count discrepancies emerge late. Procurement data from 2023 shows fewer than 30 percent of counties have updated chain-of-custody procedures to log pre-election device handling by third-party vendors. Without alignment between certification windows and patch cadences, residual firmware flaws remain exploitable through the 2024 cycle.