Facts About Our Voting Systems Every American Needs to Know
Following the facts below are the corresponding references and supporting information
1. VOLUNTARY VOTING SYSTEM GUIDELINES (VVSG) ARE THE CERTIFICATION STANDARDS FOR VOTING SYSTEMS. THE CURRENT VERSION WAS ESTABLISHED BY THE EAC IN 2005 (VVSG 1.0 / 2005) (The EAC conveniently adopted VVSG 2.0 after the election, but will not take effect until 2023)
2. NOT ONE VOTING MACHINE OR SYSTEM USED IN THE 2020 GENERAL ELECTION WAS EAC CERTIFIED BEYOND A 2005 STANDARD. NOT ONE (For reference, the iPhone had not yet been invented and AOL CD-ROMs were still being mailed when the current voting system testing guidelines were written.)
3. THE COMPANIES ACCREDITED BY THE EAC TO TEST VOTING SYSTEMS ARE CALLED “VOTING SYSTEM TEST LABORATORIES” (VSTLs) AND THERE ARE ONLY TWO: SLI COMPLIANCE AND PRO V&V
4. **VSTLs LITERALLY WORK FOR VOTING SYSTEM MANUFACTURERS** AND DO NOT WORK FOR THE EAC OR FOR THE GOVERNMENT (Manufacturers, like Dominion, hire VSTLs to test their machines for EAC certification)
5. VSTLs ARE NOT EAC CERTIFIED TO AUDIT VOTING SYSTEMS, THE EAC DOES NOT CERTIFY AUDITORS, AND THE VSTLs DON’T HAVE THE CERTIFICATIONS RECOMMENDED BY THE EAC FOR FORENSIC AUDITS (VSTLs are ONLY certified by the EAC to test new voting systems to a limited 2005 standard.)
6. THERE EXISTS A CLEAR CONFLICT OF INTEREST FOR VSTLs TO AUDIT THE SAME SYSTEMS FOR WHICH THEY ARE PAID TO TEST (See #4)
7. VOTING SYSTEMS ARE NOT TESTED FOR VULNERABILITIES TO CYBERSECURITY THREATS, HACKING, MALWARE OR FRAUD
8. THERE EXISTS NO FEDERAL LAW, GUIDELINE OR RESTRICTION WHICH PROHIBITS VOTING SYSTEMS FROM ACCESSING THE INTERNET
9. NEARLY EVERY VOTING SYSTEM IN USE TODAY HAS ONE OR MORE COMPONENTS WITHIN THE CHAIN THAT HAS THE CAPABILITY TO CONNECT TO THE INTERNET
Supporting Information:
1.
Voluntary Voting System Guidelines (VVSG) are the Federal certification testing standards for voting systems. The current version was established by the EAC in 2005 (VVSG 1.0 / 2005).
The EAC conveniently adopted VVSG 2.0 after the election, but will not take effect until 2023
“VVSG 1.0 has been in effect since 2005 and is very outdated (predates technology such as smart phones).”
https://www.eac.gov/voting-equipment/voluntary-voting-system-guidelines
Worth noting is that the EAC took nearly 16 years to update the voluntary voting system guidelines. One reason is that for a period of four years, ending in 2015, the EAC lacked the requisite number of members to form a quorum (end of Obama’s term).
https://www.eac.gov/sites/default/files/eac_assets/1/28/EAC%20Updates%20Federal%20Voting%20System%20Guidelin es-News-Release-FINAL-3-31-15-website.pdf
2.
Not one voting machine or system used in the 2020 general election was EAC certified beyond a 2005 standard. NOT ONE.
For reference, the iPhone had not yet been invented and AOL CD-ROMs were still being mailed when the current voting system testing guidelines were written.
https://www.eac.gov/voting-equipment/certified-voting-systems
A clarification update was adopted by the EAC in 2015 (VVSG 1.1), but only addressed issues related to testing VVSG 1.0, which remains the standard today.
“VVSG 1.1 has been implemented since 2015 and none of our currently registered manufacturers has submitted a system for certification under 1.1.”
https://www.eac.gov/voting-equipment/voluntary-voting-system-guidelines
3.
The companies accredited by the EAC to test voting systems are called “Voting System Test Laboratories” (VSTLs) and there are only two:
A. SLI Compliance
B. Pro V&V
https://www.eac.gov/voting-equipment/voting-system-test-laboratories-vstl
There has been some controversy regarding the accreditation status of both VSTL’s based upon the dates shown on their EAC certificates, along with the specific language limiting the term, “for a period not to exceed 2 years”.
4.
VSTLs literally work for the voting system manufacturers, like Dominion, and do not work for the EAC or for the government.
Voting system manufacturers hire VSTLs to test their machines as required for EAC certification.
“Section 231(b) of the Help America Vote Act (HAVA) of 2002 (42 U.S.C. §15371(b)) requires that the EAC provide for the accreditation and revocation of accreditation of independent, non-federal laboratories qualified to test voting systems to Federal standards.”
https://www.eac.gov/voting-equipment/voting-system-test-laboratories-vstl
Because the VSTLs literally work for the voting system manufacturer and not the EAC, they are not subject to FOIA or open records requirements; therefore, their contracts, agreements, etc. remain private and beyond reach of the public.
5.
VSTLs are not EAC certified to audit voting systems, the EAC does not certify auditors, and the VSTLs don’t have the certifications recommended by the EAC for forensic audits
VSTLs are ONLY certified by the EAC to test new voting systems to a limited 2005 standard.
“Here are some key considerations when contracting with a third party for auditing or electronic discovery services:
Ask for credentials. The collection team must be validated to ensure that the collection process is done according to authorized protocols so that all data collected is properly preserved and that no harm is done to the election system or its data. Digital forensics require specialized skillsets, and the audit team should possess certifications or applicable work experience in this specialty. Industry standard certifications are offered by organizations such as the International Association of Computer Investigative Specialists (IACIS) or the Sans Institute.”
https://www.eac.gov/election-officials/chain-custody-best-practices
6.
There is a clear conflict of interest for VSTLs to audit the same systems they are paid by the manufacturer to test
Pro V&V and SLI Compliance performed audits of the Dominion voting systems in Maricopa County despite the fact that both companies have a business relationship with Dominion testing their systems.
Pro V&V also performed an audit of the Dominion voting systems for the State of Georgia with the same conflict. Pro V&V had another conflict in Georgia as the firm tested the voting systems for state certification and also testified on behalf of Georgia Secretary of State Raffensperger in an associated court proceeding.
Pro V&V was hired by Dominion to test the voting system for EAC certification, then Pro V&V was hired by the state of Georgia to test the system for state certification, and finally was hired by the state of Georgia to audit the same system.
7.
Voting systems are not tested for vulnerabilities to cybersecurity threats, hacking, malware or the potentially nefarious actions of a poll worker.
The Voluntary Voting System Guidelines (VVSG 1.0) do not consider or contemplate nefarious threats from outside of the system. There is no penetration testing which would identify system weaknesses and shortcomings.
What’s more is the guidelines don’t require testing, analysis or prevention of a poll worker’s ability to exploit system vulnerabilities and features from the “inside” of the election such as mass adjudication or sensitivity to reject ballots. (i.e., cheat)
Also worrisome is the EAC certification is strictly limited to the software configuration as tested, which prohibits installing security patches, operating system updates, bug fixes or virus definition updates without recertification.
Most voting systems in use today are a year or more out of date, and these known vulnerabilities are often used to gain access to systems.
8.
There exists no federal law, guideline or restriction which prohibits voting systems from accessing the internet.
The Verified Voting System Guidelines that were recently adopted and will take effect in 2023 (VVSG 2.0) allow wireless hardware and capabilities but they must be disabled in the software.
Anything that is disabled by the software can be enabled by malware. Important to note is that restrictions on wireless hardware were illegally taken out of the proposed guidelines at the last minute, and only after private meetings between the EAC and the voting system manufacturers. The issue is being challenged in a pending lawsuit.
9.
Nearly every voting system in use today has one or more components with the capability to connect to the internet.