Introduction

90% of the of the votes in The Netherlands are cast on the Nedap/Groenendaal ES3B voting computer. With very minor modifications, the same computer is also being used in parts of Germany and France. Use of this machine in Ireland is currently on hold after significant doubts were raised concerning its suitability for elections.

This website contains much of the raw information that was gathered during the research for the paper "Nedap/Groenendaal ES3B voting computer, a security analysis". It shows how we found out how it works, how we wrote software for it and how, when given brief access to the devices at any time before the election, we can gain complete and virtually undetectable control over election results. It also shows how we discovered that radio emanations from an unmodified ES3B can be received at several meters distance and be used to tell who votes what.

We've worked in secret for a while to make sure we actually had something to present and to be able to work without people breathing down our necks to get preliminary findings. But now that it's all in the open, reasearch into the inner working of the ES3B is not going to stop. In fact, we invite everyone to take a look, verify what we found, and hopefully even tell us things we didn't find.

The full report: Nedap/Groenendaal ES3B voting computer, a security analysis





The raw data

This is a hacker work environment. It contains much information, it is highly unordered, and information often lacks proper descriptions. It is the representation of a work in progress.

Package contents What exactly did we get? Complete with pictures and copies of the files on the ISS CD.

System description A brief high-level description on how the voting process works.

Hardware A lot of what we learned about the hardware. Includes the EPROM image for the printer control board,

Software What we learned about ISS and the ES3B software, including EPROM images, disassembly and Module memory usage.

CrossCompiler Building a development environment for the ES3B.





More information may be found by following links on the above pages. We will keep adding new information at least for the coming weeks and months.

Yours truly,

The Nedap Reverse Engineering Team