United States

Disputed Fact Together, illusory contracts, FOIA obstruction, and denials of access create a structural environment in which grave technical weaknesses can persist indefinitely without detection or remediation. Mesa County’s case demonstrates that unauthorized software (SSMS), global SQL exposure, disabled logging, and mass deletion of audit trails can coexist with EAC/VSTL “certification” and state assurances precisely

Disputed Fact CISA’s Cyber Risk Assessment depicts U.S. election infrastructure as a highly networked, variably secured critical infrastructure ecosystem with persistent, exploitable weaknesses, while the EAC’s election system oversight is narrowly product centric, episodic, and largely detached from those systemic cyber risk realities. Unlike other critical infrastructure systems, there are no failure modes and effects

Disputed Fact The latest VVSG 2.0 standard features the following security gaps: • System boundary: focuses on the voting device and EMS, not the full enterprise and vendor environments.• Operational security: limited guidance on continuous monitoring, vulnerability management, and incident response.• Identity and access: no full RBAC requirement and constrained, fragmented MFA implementation relative to