Dominion Software Installed on 30,000+ BMDs Without EAC Certification; Encryption Keys Stored in Plain Text in Violation of FIPS 140-2 (GA)

In the weeks immediately preceding the 2020 election, the Georgia Secretary of State authorized Dominion to install software updates across more than 30,000 BMDs statewide without completing the EAC recertification process that such modifications require. Pre-election installation of software updates on certified systems without re-certification is a categorical violation of federal certification standards – it means that on Election Day, every BMD in Georgia was running software that had not been certified by an accredited lab as meeting HAVA’s functional and security requirements. Additionally, forensic examination of the Dominion Democracy Suite databases established that cryptographic encryption keys were stored in plain text within the election database – in direct violation of FIPS 140-2 federal standards for cryptographic module security. FIPS 140-2 is specifically incorporated into HAVA’s security requirements. Plaintext storage of encryption keys means that any party with database access – including through the open SQL Server port 1433 documented in multiple jurisdictions – could read, copy, or misuse the keys that secure the election’s cryptographic integrity. Expert testimony accepted by the federal district court in Curling v. Raffensperger found the system capable of altering individual votes and election outcomes without detection.