Post-Certification Software Alterations – 45 EXEs and 1,053 DLLs Modified (AZ)

Forensic cybersecurity analyst Ben Cotton (CyFIR), retained by the Arizona Senate audit, documented that after the Dominion software installation 45 .exe packages and 1,053 .dll files were modified, and 4 .exe files and 377 .dll files were newly created on the EMS system. Cotton stated: “The machine behavior settings (MBS) and the database versions that existed on the tabulators…could not have been produced by the DVS version 5.5B. Any representation that this is the same golden image that the EAC approved is false.” The county simultaneously defended its unpatched OS by claiming updates would void certification – a logically contradictory position, since the software modifications already voided it by the county’s own standard.