[azernik]

In Alameda County, CA we use what look superficially to be the same machines, and have similar physical security measures - there are seals on all access points (e.g. on the cover protecting the power switch), and whenever we access one of them we save the seal's tag, log its ID, and log the ID of the replacement. At the end of the day you end up with basically a series of tags on a form that show chain of custody (the two people - always more than one - that handle the machine with a seal removed have to sign off on each change of tag).

EDIT: Note that we use these machines with an optional paper-printout add-on, and they're a non-default option mostly used to increase ballot accessibility - most people vote on paper ballots that are fed into a scanner on-site, so the scanner results can be cross-checked against the physical ballots in case of a disputed result.

[scoot]

So someone could spoil all the votes by breaking the seals?

[azernik]

Sure. And they could also spoil all the votes with an armed robbery - at many polling stations, there's no actual police presence until/unless someone calls them in.

The main intent of all the security measures is that any such tampering be obvious, and that it be clear whose votes (or at least, which precincts' votes) were compromised.

[shshhdhs]

Sure, but that doesn't address an attack that certain precincts that vote a specific party line could be compromised. If 100 attackers at 100 precincts slit some seals than that could swing a swing state

[azernik]

When you have a consistent pattern of ballot spoilage, elections are not counted as normal; at that point you'd have court cases, recounts, assorted forensic attempts to verify valid votes, etc. The system is not a rigid machine - it is a set of rules for the common case, and a set of safeguards that trigger special-case handling.

[anonbanker]

Basically, a team of 20 voters with boxcutters could spoil the results from an entire precinct.

[simooooo]

You would have to assume so...