Are Our Election Management Systems Secure from Manipulation?

Questions about election processes, ballot security, voting systems and more have circulated at county commissioner meetings, social media, and community events for at least ten years. As reported by Broad + Liberty, cybersecurity and IT professional, Mark Cook, recently presented election system findings at a Keystone Townhall held in Malvern, which was sponsored by Keystone Fair Business Partners.

The audience consisted of party committee members, election poll workers, IT professionals, and others from around southeastern Pennsylvania. Cook began his presentation addressing the primary question that many in this audience had: are the election management systems, including software and voting machines, used in our elections secure from penetration and manipulation?

Demonstration

Mark Cook showed the audience a copy of the hard drive that Tina Peters procured in her role as County Clerk of Mesa County, Colorado. That county used Dominion Voting Systems software to run their elections. Dominion was purchased by Liberty Vote in 2025.

He was able to access election management system files with company preset passwords or, in some cases, where no password was required. Cook showed the ease by which the total votes from candidate A could be flipped with candidate B. The access point into these files bypassed all security measures tested in the software.

Cook also demonstrated that by simply inserting a flash drive into a laptop a pre-installed set of instructions from the software code could run without the user’s knowledge.

Finally, he showed the firewall coding that allowed incursion entry points into the election management software and direct access to where the votes are kept.

These demonstrations were done without an internet connection. The flash drive he used had a program with a built-in wireless access point that opened its own Wi-Fi network without the knowledge of the person inserting the drive into the laptop.

Many election workers simply follow instructions to insert flash drives into precinct scanners, central count scanners, or the election management computers in order to download vote totals. They may have no idea that something more could be happening in the background.

We are often told that county election systems are not connected to the internet and are air-gapped, which means that the computer or election system network is not connected, either wired or wireless, to another external network. Cook contends that without a connection to the internet, the voting systems contain vote flipping logic written into the programs. No one would ever know if the total number of votes were flipped from one candidate to another unless the race was tallied by hand. After the demonstration, the audience clearly understood that there are many ways around an air gapped network.

Election Software Certification

The software for every election system, no matter the manufacturer, is sent to one of two authorized testing labs in the country, where they are tasked with testing the integrity and security of the software. The accredited labs are Pro V&V and SLI Global Solutions.

When all tests are complete, the software is sent to the Election Assistance Commission (EAC), which is the federal authority that certifies the election system for use.

Pennsylvania has secondary certification standards for security and handicapped accessibility. The state uses whichever lab did not perform the EAC testing to complete the additional tests on the system to be certified. For example, Chester County uses the ES&S election software, which was tested by Pro V&V for the EAC certification. The Pennsylvania Secretary of State had SLI Global Solutions do the secondary testing of the system.

The Dominion software used in Mark Cook’s demonstration was certified by the EAC having undergone software testing by one of the two accredited labs. If the testing lab missed the vulnerabilities shown in this one software, then what else was overlooked in this and other systems?

There are four different election systems utilized in the Philadelphia region: Clear Ballot ClearVote, Dominion Democracy Suite, ES&S EVS, and Hart InterCivic Verity Voting. Information on all certified voting systems can be found on the PA Department of State’s website.

When reviewing the EAC testing standards for each system, a glaring issue was apparent. The testing standards used by the two accredited testing labs for all these systems are over 20 years old!

Here are the specifics for the Philadelphia region:

Bucks County: Clear Ballot ClearVote 2.3, upgraded in 2023. Testing standards were from 2005.
Chester County & Philadelphia: ES&S EVS 6.3.0.0, ElectionWare version 6.3.0.0, upgraded in 2023. Testing standards were from 2005.
Delaware County: Hart InterCivic Verity Voting, certified in 2022. Testing standards were from 2005.
Montgomery County: Dominion Democracy Suite, upgraded in 2024. Testing standards were from 2005.

The EAC voted for new software testing standards in 2021 and implemented them beginning in November 2022. However, these new standards only impact completely new systems. Patches or maintenance to previously tested systems are grandfathered under the 2005 standards.

What Now?

Members of the Keystone Fair Business Partners board of directors met privately with Mark Cook to ask for direction on securing elections. He believes that as long as counties use electronic voting systems, we have no ability to secure our elections. The only way to ensure that every vote is counted as cast is to hand tally each race. However, he provided two very clear actions that every citizen can do to help move counties in the right direction:

1. Vote in person on Election Day. Overwhelming algorithms by “swamping the vote” with more votes than expected can make it more difficult to commit fraud and more obvious if fraud takes place.
2. Attend Board of Elections and County Commissioner meetings regularly. Support elected officials trying to secure elections by expressing your concerns, bringing evidence of problems, and asking questions.

Mark Cook’s full Chester County presentation can be found here on his website.

Bottom line…

Election fraud is as old as elections themselves. Electronic systems is just the most recent method of manipulating outcomes of elections, and even those methods have changed over the last 20 years.

The only way to improve the electoral process is to use it to push change. We must vote in every election, in person if possible, because our vote is our voice. Our voice and will, reflected in society, provide us liberty, which we must never lose!