ESS Concealed pcAnywhere Remote-Access Software Installation – Installed During Period of Source Code Theft (PA)

Election Systems & Software (ESS), which operates the largest installed base of voting machines in the United States, admitted in a 2018 letter to Senator Ron Wyden that between 2000 and 2006, it installed pcAnywhere remote-access software on election management systems sold to customers – directly contradicting prior public representations. Critically, Symantec’s pcAnywhere source code was stolen by hackers in 2006 and publicly disclosed as compromised in 2012, meaning that any ESS system with pcAnywhere installed during this window was potentially accessible to anyone possessing the stolen source code – including sophisticated foreign state actors. ESS refused to disclose to Congress which specific states and counties received systems with the software installed and refused to seek Colorado certification when that state required vulnerability testing results be made public. Pennsylvania deployed ESS systems in multiple counties, and ESS refused to identify which Pennsylvania jurisdictions received affected systems, preventing state-level security assessment.