Voting Machine Testing Lab Website Disintegrates
Pro V & V Website displays as beginner blog template
What is Pro V&V?
Pro V&V is one of only two labs that are accredited by the Election Assistance Commission (EAC) to test and certify U.S. voting machines for EAC certification.
Here is the Pro V&V Accreditation Certificate from the Election Assistance Commission,
Pro V&V Website Has Been Disintegrating for Months
A July 9th snapshot from the Internet Archive shows that the front page was loading as an error message on that day. Other dates show error messages as well.
2 weeks ago
A couple weeks ago we happened to be looking at the Pro V&V website and one of our researchers pointed out that only the front page was working. Every other page on the site had a missing page error message.
Last Night
I looked at the Pro V&V site again last night (https://provandv.com/) and now even the front page is jacked up. It’s showing what looks like a blog template on the front page. As though some intern decided to turn the entire Pro V&V website into their blog, but after figuring out how to set up the template, got tired and went to bed.
If a company does not have the bandwidth, or doesn’t care enough, to do basic checks that its website is up and running, do we think they have robust security protocols in place to protect their software from hackers?
Pro V&V Approved Updates to Multiple Voting Systems From Both of the 2 Major Voting Machine Vendors—Prior to the 2024 Election
Pro V&V approved 4 separate updates on voting machine software and firmware between March 2024 and September 2024. Between them, the updates covered many, possibly most, of the voting machines in use across the U.S.
March 14, 2024
Pro V&V approved an ECO (Engineer Change Order) on multiple versions of the Dominion ImageCast Precinct 2 (ImageCast Precinct is Dominion’s workhorse, the primary in-person scanner in many jurisdictions.)
April 3, 2024
Pro V&V approved an ECO (Engineer Change Order) on multiple versions of ES&S voting machines
September 10, 2024
Pro V&V approved an ECO (Engineer Change Order) on a different software version of an ES&S voting machine.
September 24, 2024
Pro V&V approved an ECO (Engineer Change Order) on multiple versions of the Dominion ICX.
Malware Can Lurk in a Software Update
Software updates are a classic mechanism to deliver malware to computer systems. For example approximately half a million Asus laptops were infected with malware through an official software update in 2018
“Researchers at cybersecurity firm Kaspersky Lab say that ASUS, one of the world’s largest computer makers, was used to unwittingly install a malicious backdoor on thousands of its customers’ computers last year after attackers compromised a server for the company’s live software update tool.”
The fact that the Pro V&V updates were so comprehensive, covering multiple versions of multiple voting machines from both of the major voting machine vendors is particularly worrisome.
De Minimis Changes Require No Extra Testing
All of the four updates we’ve listed were put through under the category “De Minimis”. This means they are considered “minimal” and no additional testing is required for the update to be installed. This increases the risk of malware coming in on these updates, since no additional tests are required with the installation.
SLI - In One Election Commissioner’s Opinion - is a “Whore”
The only lab other than Pro V&V, that is accredited by the EAC to certify U.S. voting machines. is a testing lab called SLI. SLI was described to me as a “whore” for the vendors by a well-respected election commissioner. That was his opinion. I am merely the messenger.
What does that mean exactly? Well, the voting machine vendors are the ones who actually pay for their testing, and it costs a lot. So, even though their voting machines are being evaluated, it is the vendors that are really the clients of the testing labs.
It’s as if I was trying to get certified as an EMS technician, and the fee to get certified was $10,000. Imagine that one company gives me the answers to the quiz ahead of time, and one company doesn’t. Which company am I more likely to pay $10,000 for my test? Probably the one that gives me the answers and helps me pass. So, I was told bluntly by this election commissioner, that it was his opinion that SLI was a whore for the vendors, implying that the testing at SLI is not strict.
So there are just these two testing labs that are currently allowed to approve voting machines at the federal level:
Pro V&V
SLI (aka The Whore)
These Voting Machines Are “Tested”
We are told constantly by the media to trust the voting machines because they are tested. For example, here is this headline from an October 9, 2024 AP article.
“Voting systems are targets of conspiracy theories, but get tested for accuracy and security.”
Over and over and over again. Trust us, we’re testing. Trust the machines, they’re tested. Trust us. Trust them. Or you’re crazy. Or you’re a conspiracy theorist. You’re unpatriotic. You’re undermining democracy.
Except the tests are conducted by test labs with financial conflicts of interest, that in the case of Pro V&V don’t seem to be able to even keep a basic website functioning.
Why would we trust a company that has let its website disintegrate publicly for over six months, to test complex electronic equipment that we rely on to determine who controls the treasury, the military and the policy of our entire nation?
We should not. We do not. We do not trust these voting machines. We do not trust the labs that test them. We demand that this facade of security be replaced with something meaningful: a trustworthy system that protects each vote and ensures that it is counted securely and accurately in a way that can be publicly verified.
Please Donate & Subscribe
We are making tremendous progress understanding what happened in the 2024 election, as we lay the groundwork for improved U.S. elections long term. If you find our work valuable, please subscribe and make a tax-deductible donation as well! All donations are tax-deductible.
Think for yourself, or others will think for you without thinking of you.
~ Henry David Thoreau
 | A guest post by
|
As someone who manages complex software and systems projects, you can’t test a system to prove it’s secure. You must have access to the source code, and verify an unbroken chain from the source code to the tools that build it, all the way to the images loaded onto the system. This post says what I was most afraid of - that the the states who are responsible for election security don’t have access to the source code, and don’t oversee and verify the process of who puts code into the change management system.
This is the worst case. If what I’m reading is true, we have a completely insecure election system. In this case, the testing performed is meaningless.
How can the Secretaries of State across the country let this happen?
Thank you, Lulu, for this excellent explanation.
Given the hollowing out of the federal government by Trump and Musk, perhaps some states might have the political will to institute effective testing of voting systems.
I was impressed by a 2014 report of independent testing of Dominion's Democracy Suite 4.14-A and 4.14-A.1, now hosted at Verified Voting:
https://verifiedvoting.org/wp-content/uploads/2020/08/red-team-support.pdf
As a result of an initial round of testing, Dominion corrected some, but not all, of the vulnerabilities discovered. That's the kind of "positive feedback mechanism" that we want to see with current voting systems (only, please, correct *all* of the problems). This approach to testing actively encourages independent testing that finds problems, and requires a response from the vendors that corrects those problems. Then, further testing to show that the vendor response actually fixed the problems.
Just considering my home state of NY, I have seen nothing like this in the NYS BOE tests of the currently available voting machine systems approved in NY (ClearBallot, Dominion, ES&S, and Hart InterCivic). The NYS BOE published only one high-level, completely inadequate report for each voting system tested. See:
https://elections.ny.gov/voting-systems-testing