ICX BMD Critical Vulnerabilities – QR Code Manipulation and Remote Malware Install (GA)

Prof. J. Alex Halderman (Univ. of Michigan), as expert in Curling v. Raffensperger, documented through hands-on forensic testing that Georgia’s Dominion ImageCast X (ICX) BMDs contain critical vulnerabilities enabling attackers to:

1. alter ballot QR codes (the actual counted data);
2. install malicious software remotely from the EMS; and
3. subvert audit log entries. CISA was notified September 2021 but suppressed public disclosure for 22 months, finally acknowledging nine vulnerabilities in a June 2022 advisory – while Georgia conducted additional elections on the same platform.