I saw a question asking how someone could find flaws in a system that had been well tested.

The answer is that security development (as required for something like electronic voting machines) is different from normal development.  Normal testing verifies that the machine/program performs as expected under expected conditions and with expected inputs.

Better testing verifies that the machine/program performs as expected even when conditions and inputs are unexpected.

Security testing verifies correct behavior even when conditions and inputs are set by an active adversary who is trying to make the machine/program fail.

In the case of an electronic voting machine (or many other truly critical devices), you have to assume that the developer is an active adversary, unless you can personally verify the correctness of his design and development.

E.g., a paper ballot can be verified correct independent of the malicious intent of the person who laid it out or the one running the printing press.  Can electronic voting software be verified correct in the face of malicious attack, assuming that the company and developer that produced it were also malicious attackers - and also assuming that all the malicious attackers worked together in a conspiracy?

 - Carl Ellison