A hacker bought a voting machine on eBay. Michigan officials are now investigating

Harri Hursti has bought about 200 used voting machines without incident, but the one he purchased on eBay last month is now the subject of a state investigation, with Michigan officials determined to find out how the device ended up for sale online.

"We are actively working with law enforcement to investigate allegations of an illegal attempt to sell a voter assist terminal acquired in Michigan," Secretary of State Jocelyn Benson, who is up for reelection in November, announced in a statement last week.

And, in an additional tweet, Benson noted that the voting machine was originally from Wexford County and clarified that it was not used to tabulate ballots. (The Dominion-made apparatuses are built to function as voting machines or ballot printing devices. In Michigan, they were used to print voter ballots.)

The U.S. Election Assistance Commission says voting machines should be meticulously inventoried and kept under lock and key "in a tamper-proof location, preferably within the election office."

Hursti is a cybersecurity expert who is often contracted by state-level election officials to test vulnerabilities in voting machines. That's why he bought the Dominion ImageCast X machine as soon as he saw it online, he told NPR during a phone interview.

"I've never taken a look inside one of those," he said, with some excitement.

He forked over $1,200 then, in an effort to clarify any lingering questions about the ImageCast X's provenance, he sent an email to Michigan's secretary of state office alerting them of the deal. It's something he does whenever he buys a device online, he explained.

It's a good thing he did.

"They didn't know a device was missing until they started looking to see if there's a missing machine," Hursti said. "They really had no idea, and that is one of the biggest dangers" to election security.

As of Wednesday, the machine was still in the same unopened box it arrived in nearly two weeks ago. Hursti said he is waiting on the FBI or some other law enforcement agency to pick up the 2020 device from his home in Connecticut.

"I'm waiting to find out if it was stolen — that would make [the sale] illegal — or not. If it was not, then the machine is mine and I can get started" on his analysis, he said.

CNN has reported that the eBay seller, Ean Hutchison, who lives in Ohio, found the Dominion-made machine on a Michigan Goodwill website for just $7.99. He snapped it up then immediately put it up for sale on eBay.

Hutchison did not respond to NPR's requests for comment.

In the post on eBay, Hutchison stated that the device had been used in "the most recent Michigan elections."

Meanwhile, Michigan is one of several swing states, including Georgia and Colorado, where officials have launched investigations into possible election tampering or interference by Donald Trump supporters who hope to subvert the 2020 election. In nearly all cases, the election deniers claim they are searching for evidence of voter fraud.

For Hursti, one of the greatest threats to voting devices is not necessarily hacking, but human incompetence.

The 54-year-old is an expert in the field. He's been featured in two documentaries — Kill Chain: The Cyber War On America's Elections and the Emmy-nominated film, Hacking Democracy — that pull the curtain back on the U.S. election system. Both offer an unnerving glimpse into the weaknesses of today's election technology.

He said he's seen instances where election officials or polling place volunteers inadvertently mishandle devices or do not follow security protocols.

"They just don't have the proper training," he said.

In other cases, people simply fail to keep track of the machines. "They leave them behind someplace and just totally forget them," he said, adding that there was one instance in which an election device was left behind at a hotel for more than a year. "The hotel called and tried to tell them they left it but no one ever called back. So they sold it, which is legal for them to do."

For those not in the know, Hursti said it sounds shocking to hear that voting machines can be bought and sold for little money.

"People think it's a big deal but it happens all the time. Most of the time the seller is a government, a county, or it is electric recycling. ... And it is a good thing because hackers are a resource to make things safer."

Hackers like him, he said, are not interested in weaponizing the weaknesses they find. "The reason you pop open the machine is to learn the vulnerabilities" of each machine, in order to safeguard democracy, he added.

And there are plenty of other machines to tinker with, while he waits for the Michigan investigation to unfold.

"I bought two others last month, so I'll get started on those," he said.