Unauthenticated RDP and VNC Remote Access Protocols Enabled on Certified EMS Workstations (PA)

Forensic imaging of the Dominion Democracy Suite 5.5 server in Fulton County, PA discovered that VNC (Virtual Network Computing) and RDP (Remote Desktop Protocol) protocols were actively enabled on secured election management workstations – creating open remote-access channels that permitted outward data routing to foreign IP addresses without authentication requirement. These misconfigurations nullified any defense relying on a physical or logical air gap. The Pennsylvania Department of State’s subsequent decertification of Fulton County’s Dominion machines – issued not because of the substantive security vulnerabilities found, but purportedly because Fulton County had used an independent third-party consultant to find them – is itself documented as a potentially retaliatory act. Fulton County filed suit, characterizing the decertification as unlawful retaliation for exercising its audit rights.