EAC Certification Does Not Require Disclosure of Foreign Ownership, Supply Chain Provenance, or Remote Access Capabilities (US)

The EAC’s certification program, as documented by the Brennan Center’s November 2019 report, certifies voting systems against technical performance standards but does not require vendors to disclose:

1. foreign connections or ownership structures;
2. supply chain provenance of components; or
3. embedded remote-access capabilities.

This structural gap enabled ESS and Dominion to pass through the federal certification pipeline while deploying systems with Chinese-manufactured components (documented at 48% for Dominion ICX), Serbian data center operations partnered with Huawei, and embedded cellular modems – none of which were disclosed to or reviewed by the EAC as part of the certification process.