Security Negligence

Unhardened Election Servers – Unauthorized USB Use, Video Games Installed, No NIST Hardening (GA)

Dominion, Electronic Voting System Integrity, Established Fact, Fulton County, Georgia, Security Negligence, United States /

Established Fact Cybersecurity expert Harri Hursti, providing sworn testimony in Curling v. Raffensperger, documented severe operational security failures in Georgia county election offices. EMS and tabulation servers were not hardened according to NIST benchmark guidelines; servers exhibited frequent, untracked use of USB flash drives, and unauthorized software applications – including video games – were installed […]

Unhardened Election Servers – Unauthorized USB Use, Video Games Installed, No NIST Hardening (GA) Read More »

EMS Security Event Log Configured to Auto-Overwrite – Election Day Logs Destroyed (AZ)

Arizona, Dominion, Electronic Voting System Integrity, Established Fact, Maricopa County, Security Negligence, United States /

Established Fact The EMS server’s Windows Security Event Log was configured with a maximum retention size of 20 MB and set to automatically overwrite older entries when full. As a consequence, the earliest log entry preserved at the time of forensic audit was dated February 5, 2021 – not November 3, 2020. Every access event,

EMS Security Event Log Configured to Auto-Overwrite – Election Day Logs Destroyed (AZ) Read More »

SQL Server Port 1433 Open to Any Global IP – Direct Database Modification Without Application Layer (CO)

Colorado, Dominion, Electronic Voting System Integrity, Established Fact, Mesa County, Security Negligence, United States /

Established Fact The Dominion EMS SQL Server was configured with firewall rules accepting inbound connections on port 1433 from any IP address worldwide, bypassing the certified application layer entirely. The Mesa County Forensic Team demonstrated this vulnerability empirically: a non-Dominion workstation – and even an iPhone SQL client – could directly query and modify election

SQL Server Port 1433 Open to Any Global IP – Direct Database Modification Without Application Layer (CO) Read More »

Single Shared Password Across All EMS Components – Never Rotated Through 2020 Election (AZ)

Arizona, Dominion, Electronic Voting System Integrity, Established Fact, Maricopa County, Security Negligence, United States /

Established Fact The credentials (usernames and passwords) for all EMS server components – EMS workstations, adjudication workstations, HiPro scanners, and ICC workstations – were created during the Dominion software installation on August 6, 2019, and were never changed from that date through the delivery of systems for forensic audit following the 2020 election: a period

Single Shared Password Across All EMS Components – Never Rotated Through 2020 Election (AZ) Read More »

Unpatched EMS Operating System and Plaintext FIPS Decryption Keys (AZ)

Arizona, Dominion, Electronic Voting System Integrity, Established Fact, Maricopa County, Security Negligence, United States /

Established Fact The Dominion EMS server’s operating system and antivirus software were not patched or updated after August 6, 2019 – the date of initial installation – leaving the system exposed to all known exploits disclosed during the subsequent 14 months before the November 2020 election, including the entire pre-election deployment period. More critically, Dominion

Unpatched EMS Operating System and Plaintext FIPS Decryption Keys (AZ) Read More »

Exploitation of Dominion Democracy Suite 5.5 Deployed with Open SQL Server Port 1433 – Direct Database Modification Possible from Any Internet-Connected Device (PA)

Disputed Fact, Dominion, Electronic Voting System Integrity, Pennsylvania, Security Negligence, United States /

Disputed Fact [Disputed Fact – As to whether vulnerability was exploited] Forensic analysis of Dominion’s Democracy Suite in multiple jurisdictions established that SQL Server port 1433 was configured to accept connections from any IP address worldwide. Port 1433 is the standard network port for Microsoft SQL Server – the database engine underlying the Democracy Suite.

Exploitation of Dominion Democracy Suite 5.5 Deployed with Open SQL Server Port 1433 – Direct Database Modification Possible from Any Internet-Connected Device (PA) Read More »

Dominion Democracy Suite 5.5 Deployed with Open SQL Server Port 1433 – Direct Database Modification Possible from Any Internet-Connected Device (PA)

Dominion, Electronic Voting System Integrity, Established Fact, Pennsylvania, Security Negligence, United States /

Established Fact [Established Fact – As to SQL port configuration and demonstrated vulnerability] Forensic analysis of Dominion’s Democracy Suite in multiple jurisdictions established that SQL Server port 1433 was configured to accept connections from any IP address worldwide. Port 1433 is the standard network port for Microsoft SQL Server – the database engine underlying the

Dominion Democracy Suite 5.5 Deployed with Open SQL Server Port 1433 – Direct Database Modification Possible from Any Internet-Connected Device (PA) Read More »

Halderman Expert Findings – QR Code Manipulation and Remote Malware Installation Possible on Certified BMDs (GA)

Dominion, Electronic Voting System Integrity, Established Fact, Georgia, Security Negligence, United States /

Established Fact Prof. J. Alex Halderman (Univ. of Michigan), serving as plaintiff’s expert in Curling v. Raffensperger, documented through hands-on forensic testing of the EAC-certified ICX BMD system that: (1) attackers can alter ballot QR codes (the operative data the tabulation system counts, not the human-readable text); (2) malicious software can be installed remotely from

Halderman Expert Findings – QR Code Manipulation and Remote Malware Installation Possible on Certified BMDs (GA) Read More »

Encryption Keys Stored in Plaintext Within Election Database – FIPS 140-2 Violation (GA)

Dominion, Electronic Voting System Integrity, Established Fact, Georgia, Security Negligence, United States /

Established Fact The EOG Report and independent forensic analysis confirmed that Dominion stored master cryptographic encryption keys unprotected and in plain text within the same database used to store election data and produce contest results – in direct violation of FIPS 140-2, which requires cryptographic keys to be protected within a cryptographic module from unauthorized

Encryption Keys Stored in Plaintext Within Election Database – FIPS 140-2 Violation (GA) Read More »

iButton Authentication Hardware Retained by Vendor – County Had No Independent System Access (AZ)

Arizona, Dominion, Electronic Voting System Integrity, Established Fact, Maricopa County, Security Negligence, United States /

Established Fact The Cyber Ninjas audit confirmed as an established fact that Maricopa County did not possess the administrative iButtons required to independently access, configure, or validate its Dominion tabulation systems. Only Dominion Voting Systems held these tokens. The Senate cover letter stated: “No private company should be trusted with the keys to our democracy.

iButton Authentication Hardware Retained by Vendor – County Had No Independent System Access (AZ) Read More »