Security
Headlines
HeadlinesLatestCVEs

Headline

One Republican Now Controls a Huge Chunk of US Election Infrastructure

Former GOP operative Scott Leiendecker just bought Dominion Voting Systems, giving him ownership of voting systems used in 27 states. Election experts don’t know what to think.

Wired
#vulnerability#web#ios#mac#git#auth#dell

The news last week that Dominion Voting Systems was purchased by the founder and CEO of Knowink, a Missouri-based maker of electronic poll books, has left election integrity activists confused over what, if anything, this could mean for voters and the integrity of US elections.

The company, acquired by Scott Leiendecker, a former Republican Party operative and election director in Missouri before founding Knowink, said in a press release that he was rebranding Dominion, which has headquarters in Canada and the United States, under the name Liberty Vote “in a bold and historic move to transform and improve election integrity in America” and to distance the company from false allegations made previously by President Donald Trump and his supporters that the company had rigged the 2020 presidential election to give the win to President Joe Biden.

The Liberty release said that the rebranded company will be 100 percent American-owned, that it will have a “paper ballot focus” that leverages hand-marked paper ballots, will “prioritize facilitating third-party auditing,” and is “committed to domestic staffing and software development.” The press release provided no details, however, to explain what this means in practice.

Dominion, the second leading provider of voting machines in the US, whose systems are used in 27 states—including the entire state of Georgia—has developed its software in Canada and Belgrade, Serbia, for two decades. A search on LinkedIn shows numerous programmers and other workers in Serbia who claim to be employed by the company.

The Liberty statement does not say whether the company plans to rewrite code developed by these foreign workers—which would potentially involve rewriting hundreds of thousands of lines of code—or whether the company will move foreign developers to the US or replace them with American programmers. (Dominion has a US headquarters in Colorado.) A Liberty official, who agreed to speak on the condition that they not be named, told WIRED only that Leiendecker “is committed to 100 percent … domestic staffing and software development.” An unnamed source told CNN, however, that Liberty will continue to have a presence in Canada, where its machines are used across the country.

Philip Stark, professor of statistics at UC Berkeley and a longtime election-integrity advocate, says Liberty’s assurance about domestic-only workers is a red herring. “If the claim is that this is somehow a security measure, it isn’t. Because programmers based in the US also … may be interested in undermining or altering election integrity,” he tells WIRED.

With regard to third-party audits mentioned in the press release, a Liberty official told WIRED this means the company will conduct a “third-party, top-to-bottom, independent review of [Dominion] software and equipment in a timely manner and will work closely with federal and state certification agencies and report any vulnerabilities” to give voters assurance in the machines and the results they produce. The company didn’t say when this review would occur, but a Liberty representative told Axios it would happen ahead of next year’s midterm elections, and the company would “rebuild or retire” machines as needed.

But Stark and other election experts believe this is unrealistic and appears to be aimed just at making the company “look good” to right-wing critics. “There isn’t time between now and 2026 to design, test, and certify new voting equipment,” Stark says. Federal and state testing and certification is expensive and can take months, depending on what changes a company makes to its voting systems. And many states have legal limitations on how close to an election updates to voting systems can occur. If Liberty plans to replace foreign Dominion workers with US ones, this will likely also slow down any review and rebuilding.

What’s more, Stark, who developed procedures for risk-limiting audits used in some jurisdictions to verify the integrity of election results, says the only audits that can provide assurances about election outcomes are postelection audits of paper ballots. An audit of voting software can’t even provide assurance that a voting machine hasn’t been subverted, because the software and machine configurations can be altered after auditing and certification. A software audit can only identify existing vulnerabilities, but many of these have already been identified by third-party computer security experts who examined Dominion code in the past. And if Liberty were to rewrite any Dominion code, it would need to be audited for new vulnerabilities introduced by the recoding.

The Shrinking Voting Industry

News of the acquisition apparently caught Dominion customers off guard last week. Leiendecker reportedly held a conference call on Friday with Colorado county election clerks who were angry that they’d learned of the sale from media reports instead of the company. The election clerks reportedly grilled Leiendecker about conspiracy claims about Dominion and his plans for the company. The company’s sparse new website currently has only a brief note from Leiendecker on the homepage announcing that the company is “100% American‐owned.”

Leiendecker’s acquisition of Dominion is not a big surprise, however. Knowink and Dominion have worked together closely for a while. Dominion has used Knowink as a subcontractor when bidding for election contracts in order to offer customers a turnkey election solution that includes voting machines and poll books. And Leiendecker’s acquisition continues a long history of consolidation in the voting industry.

For the past two decades, there have only been three primary makers of voting machines in the US, the identities of which have changed frequently through mergers and acquisitions. Currently, the top three are Election Systems & Software, Dominion (now Liberty Vote), and Hart InterCivic, in that order.

Dominion was founded in 2003 in Toronto and was not a big player in the US until 2010, when it acquired two other voting firms—Premier Election Solutions (formerly Diebold Election Systems) and Sequoia Voting Systems. Premier/Diebold, like Dominion, exited the elections business after being beleaguered by security problems with its systems and lingering mistrust over the company’s close ties to the Republican Party (the former CEO had been a fundraiser for President George W. Bush). Sequoia left in large part due to financial issues. In acquiring Dominion, Leiendecker also acquires any remaining remnants of Premier/Diebold and Sequoia—equipment, software, and people—that Dominion may still possess.

With the Dominion acquisition, Leiendecker gains control of election equipment in more than half of the states. Dominion equipment is used across 26 states plus Puerto Rico. Knowink electronic poll books, which replace traditional paper poll books used to verify the eligibility of voters when they sign in at precincts, are used in 29 states plus the District of Columbia. But there are jurisdictions across 14 states, covering 20 million registered voters, that use both Dominion and Knowink systems. This gives companies that Leiendecker controls ownership of equipment that covers the entire election process in those jurisdictions—from the verification of registered voters to the casting of ballots and tabulation of results. And Georgia uses Knowink and Dominion systems statewide. Knowink poll books even interact with Dominion voting machines since a voter smart card inserted into the poll books gets encoded and then inserted into voting machines to pull up a digital ballot for the voter.

Nonetheless, some might be confused about why Leiendecker would want to acquire Dominion, since the voting machine industry has never been particularly lucrative. A 2017 study estimated it to be a $300 million-a-year business, with Dominion’s annual revenue estimated at the time to be about $100 million. Unlike IT systems that get replaced every three to five years, election systems get replaced once in a decade or longer. Voting equipment vendors often rely on long-term maintenance and election-services contracts to stay solvent while vying for new equipment contracts.

It’s not clear how much Dominion is worth today. In 2018, Dominion’s management team partnered with Staple Street Capital, a private equity firm, to acquire a controlling stake in the company. Staple estimated the company’s value at $80 million at the time. A more recent report produced by an accounting firm hired by Dominion to support its claim for damages in Fox defamation lawsuit said the company would have been worth about $741 million in December 2020 if not for Fox’s false election-rigging claims.

The Liberty official who spoke with WIRED would not disclose the price Leiendecker paid or whether other parties contributed funds. He said only that Leiendecker “is the sole owner and he privately financed” the acquisition.

Rife With Speculation

On social media, users have expressed concern about Leiendecker’s close ties to the Republican Party as a possible reason for his interest in buying Dominion, raising questions about whether he sides with conspiracy theories about Dominion and the 2020 election. Recent settlements in Dominion lawsuits against conspiracy theorists raises further questions about this, as have Leiendecker’s connection to Trump ally Ed Martin. Leiendecker didn’t respond to questions about these concerns.

Following the 2020 election in which right-wing Trump supporters accused Dominion of having ties to Venezuela—apparently confusing the company with Smartmatic, a voting machine company founded by Venezuelan engineers—and rigging the election, Dominion filed defamation lawsuits against right-wing news outlets Fox News and One America News Network for $1.6 billion for amplifying the false claims. It also filed suit against MyPillow CEO Mike Lindell, and former Trump campaign lawyers Rudy Giuliani and Sidney Powell, for $1.3 billion each.

In 2023, Fox News settled its suit for $787.5 million, and Newsmax recently settled for $67 million. But last month, Dominion reached agreements with OAN, Powell, and Giuliani for undisclosed terms. These latest settlements were a condition of Leiendecker’s acquisition of Dominion. Dominion still has pending lawsuits against Lindell and former Overstock CEO Patrick Byrne. The Liberty official who spoke with WIRED says these will be ending soon as well. “All litigation has been resolved or is in the process of being resolved,” the official wrote in an email. But Stefanie Lambert, Byrne’s attorney, wrote in an email to WIRED: “There is no settlement. Dr. Byrne is looking forward to trial.” A lawyer for Lindell did not respond to an inquiry but Lindell told Infowars this week that he will never settle with Dominion.

The settlements raise questions about whether Leiendecker simply didn’t want to be saddled with lawsuits or if he was doing right-wing defendants a favor by forcing Dominion into settlements favorable to them. Leiendecker didn’t respond to a question about the undisclosed settlement terms.

While Leiendecker hasn’t directly addressed the issue around conspiracy theorists and election manipulation publicly, his response to allegations of vote-rigging made more than a decade ago suggests he considers election integrity to be paramount, even when doing so might not be politically advantageous. Leiendecker was appointed by Missouri’s Republican secretary of state to investigate St. Louis elections administration after problems arose in the 2000 election there, according to Axios. Leiendecker was then hired by Ed Martin to be the Republican director of the St. Louis City Board of Election Commissioners from 2005 until 2009

Martin, now a staunch Trump ally and supporter of his stolen-election claims, is currently the US pardon attorney and prior to this served under the current Trump administration as the interim US attorney for DC, where he demoted prosecutors who worked on January 6 insurrection cases. But in 2005, he was chair of the St. Louis City Election Board when he hired Leiendecker. Five years after hiring Leiendecker, Martin ran unsuccessfully as a GOP candidate for a congressional seat against the Democratic incumbent and was backed by the St. Louis Tea Party. Similar to what occurred following Trump’s 2020 presidential loss, Martin alleged there were irregularities in the vote counting. A Tea Party spokeswoman called the election “stolen,” and Martin refused to concede the election. Leiendecker, instead of supporting his former boss, disputed the stolen election claim at the time, saying there were "no shenanigans” and challenged the critics to prove otherwise. St. Louis Public Radio reported that he directed this challenge at Martin.

During his time as director of the St. Louis elections board, Leiendecker was widely credited by both political parties for improving the election board’s procedures and ensuring that it processed votes more efficiently than previous boards.

Paper Chase

When it comes to future elections, Leiendecker has said in Liberty’s press release and media statements that the company is committed to providing election technology that leverages “hand-marked paper ballots” in “compliance with President Trump’s executive order.”

Trump, acting on his false vote-rigging claims, has called for all-paper elections, and his March executive order has called for all voting systems to use or produce a voter-verifiable paper ballot that voters can review to ensure machines didn’t alter their votes. Some media outlets have interpreted Leiendecker’s statements to mean he aligns with Trump’s stance to ban systems that don’t produce a paper record. The Liberty official who spoke with WIRED says Leiendecker meant only that Liberty will offer products that “enable compliance with federal and state standards”—whatever those standards may be. Current voting system standards advise states to use systems that produce a paper record but cannot require this; states decide on their own what voting systems they use. Similarly, Trump has no authority to decide what voting systems states use; the Constitution gives this authority to states alone, and the EO is currently being litigated in court.

Notably, Trump’s EO also wants states to stop using paper ballots that have bar codes or QR codes to record and tabulate votes, because the codes are not human-readable. These ballots are produced by so-called ballot-marking devices, or BMDs—voting systems that allow voters to make selections through a touchscreen tablet or other assistive device, which then prints a paper ballot showing the voter’s selections that the voter can read to verify that the machine marked their votes correctly. The ballot is then passed through an optical scanner to record and tabulate the results.

Many BMDs print ballots with a bar code or QR code on them that is encoded with the voter’s choices; it is this encoded portion that the scanner reads to record and tabulate the votes, not the human-readable portion of the ballot that the voter can verify. Ironically, like Trump, election-integrity activists (on the left and right) have long opposed the use of paper ballots with bar codes or QR codes for security reasons: Someone could theoretically program the systems to print a voter’s choices on the human-readable portion while encoding something else in the bar code or QR code that the scanner reads and tabulates. Dominion makes a BMD called the ImageCast X, most of which produce ballots with QR codes, which is used in all or parts of 15 states, according to Verified Voting, which tracks election equipment usage in the US. They are used statewide in Georgia, an important swing state that was the subject of much controversy in the 2020 election.

Many election-integrity activists want states that use these types of ballots to tabulate only from the human-readable portion of the ballot, not the QR code or bar code, or simply have voters fill out regular paper ballots by hand instead. Trump is seeking the latter.

Wired: Latest News

Why the F5 Hack Created an ‘Imminent Threat’ for Thousands of Networks