Most Election Management Systems in America are NOT certified

By Laura Scharr, team leader SC Safe Elections Group

Gateway pundit ran this recent article on election machine certification or lack thereof.  This is an issue that was brought up by many starting in November of 2020 and I personally testified about this to some of our South Carolina legislators last year in June.  This past Thursday, June 23rd I again testified to this issue in a SCGOP hearing regarding irregularities in the June 14th primary. Here are the details:

First let’s state SC law with respect to system requirements.

S.C. Code §7-13-1640 establishes the requirements for voting machines used in South Carolina. South Carolina’s requirements adhere to the minimum requirements found in HAVA, the Help America Vote Act.

S.C. Code §7-13-1620 (A) further requires that: a voting system may not be approved for use in the State unless certified by a testing laboratory (VSTLs or Voting System Testing Laboratories) accredited by the Federal Election Assistance Commission as meeting or exceeding the minimum requirements of federal voting system standards

South Carolina is 1 of 12 states that require federal certification of voting machines. “Although participation in the program is voluntary, adherence to the program’s procedural requirements is mandatory for participants.”

HAVA, the Help America Vote Act is US Code that states that all rules and regulations as to Vote System Test Laboratories or VSTLs are put in place by the Election Assistance Commission or EAC.  There are two main VSTLs Pro V&V and SLI Compliance. In order to meet its statutory requirements under HAVA §15371(b), the EAC has developed the EAC’s Voting System Test Laboratory Accreditation Program. The procedural requirements of the program are established in the Election Assistance Commission Voting System Test Laboratory Accreditation Program Manual. Even though the program manual is not statute.  Statute dictates that the manual set the rules. The procedural requirements of this Manual will supersede any prior laboratory accreditation requirements issued by the EAC.

VSTL’s are VERY important because equipment vulnerabilities allow for deployment of algorithms and scripts to intercept, alter and adjust voting tallies. They also examine the use of COTS (Commercial Off-The-Shelf) components which are a huge potential source of vulnerability.

Certification of our systems in SC

In the 2020 general election our state used our new machines/election management system ES&S version

It was certified by SLI Compliance which was issued a certificate of accreditation on 1/10/18 with an expiration of 1/10/21.  Note that our new ES&S system and election machines were put into place in time for our primaries after that test date, in 2019.

According to the vote system’s test laboratory manual version 2.0 effective May 31st 2015 manual page 38, the certificates must not exceed 2 years and must be signed by the Chair of the EAC (not the Executive Director), thus the laboratory’s certification was invalid.

The labs that certified the machines were not in compliance as they had 3 year expiration and were not signed by the Chair of the commission.

Here is a copy of the certificate for the SLI Compliance lab.

this certificate does not comply with Voting System Test Laboratory Program Manual, Version 2.0 as it doesn’t have a 2 year certification and it is not signed by the Chair of the commission.

The manual guidelines were not followed. Note that this was something that affected many states as these systems were used across the country.  Furthermore, were there any materials or even minor changes that were made from 2018 until election day in November of 2020? If so, that would require an update to the certification/inspection to ensure the system was still compliant.

System upgrade to that was then used in the June 14th primary

Our ES&S Election Management System was upgraded last year this time to version and it was primarily updated to include Windows 10.

The EMS was certified by Pro V&V, the other testing laboratory, and oddly enough that lab also was noncompliant. It had a certificate dated for the original certification of 2015 and the most recent cert has a 2021 expiration and is also signed by the Executive Director, not the Chair of the commission, so protocols and standards from the manual are not being followed.

notation on the certificate was changed to say “accreditation remains effective until revoked by a vote of the EAC.”  This was done after several people starting questioning the validity of the certification of the labs in early 2021.

Once We the People started to investigate these certifications in late 2020 suddenly a memo from Jerome Levato was issued. This memo blamed the delays and lack of certification updates on Covid. Why then? Why not prior to that when Covid was rampant?   His mea culpa memo was issued in January of 2021 and he left the agency the next month.  Note also that they changed the notation on the certificate to say “accreditation remains effective until revoked by a vote of the EAC.”  Note that the manual still requires a 2 year expiration date.

Government contracts are normally highly scrutinized for compliance

Why couldn’t a small staff of people inspect a system and get the certification? These certifications don’t require a large staff that is in close contact with each other putting people at risk. We had real estate transactions and other contracts being signed during COVID but we couldn’t get our election system certified in an important election year?  Seems very suspicious to me.

The test/certification for the was in June of 2020 and they claim it was certified 7-27-20 prior to when it was upgraded in SC last year spring/summer 2021.

As a concerned citizen, I don’t feel comfortable with this process and these explanations. These are governmental contracts which should be under far more scrutiny than your private contracts. Why are we not following the rules? Are we a society of some rules count and others don’t? Do we just change the rules when we think they aren’t in our favor anymore?  If the EAC changed the rules, why didn’t they change their manual to be consistent?  If I had a marriage certificate that wasn’t signed by the right person would my marriage be legitimate? If I bought a house and the contract wasn’t signed by the correct person would that transaction be legit? The 2-year expiration timeframe is important as these systems are considered “critical infrastructure.” If they are so critical why was this process so lax and procedures not followed? And put your thinking cap on and ask yourself why these certifications weren’t done properly by BOTH labs?  What might be the reason for that in critical election years?