They may have changed their name from Dominion to Liberty Vote, but that doesn’t prevent Liberty Vote from inheriting a significant number of security concerns with their purchase of Dominion. One of these concerns pertains to a critical privacy flaw that has been identified in Dominion Voting Systems’ ImageCast Precinct (ICP) and ImageCast Evolution (ICE) tabulators. The vulnerability stems from the method used to generate record IDs for scanned ballots. While documentation for the Democracy Suite EMS claims that exported cast-vote records (CVRs) do not compromise voter privacy, the current implementation allows attackers to determine the exact order in which ballots were cast.
By combining predictable record ID sequences with publicly available information—such as social media posts, surveillance footage, scanner logs, or public counters—malicious actors can deanonymize ballots and link specific votes to identifiable individuals. This flaw likely affects all current versions of the ICP and ICE devices, though the ICC tabulator and ICX DRE appear to be unaffected. Solutions involve a rigorous data sanitization process for existing records and a future software update to implement cryptographically secure random number generation.
August 23, 2022
Letter Notifying Dominion CEO of Privacy Flaws
Professor J. Alex Halderman issued a formal disclosure letter to Dominion Voting Systems regarding a significant privacy vulnerability in their ICP and ICE tabulators.
Download Letter
Overview of the Privacy Flaw
The vulnerability centers on how Dominion tabulators assign record ID numbers to scanned ballots. These IDs, in conjunction with tabulator and batch IDs, are used to uniquely identify ballots within the Democracy Suite EMS. These IDs are routinely exposed to the public through:
- Exported Cast-Vote Records (CVRs).
- Ballot image filenames.
- Public records requests (FOIA).
Potential Exploitation Scenarios
The flaw is particularly dangerous because it can be exploited using purely public information without requiring physical access to voting equipment or a breach of security controls.
- Public Counter Observation. Many jurisdictions display a “public counter” on the tabulator screen. If a person observes the counter value when a specific voter inserts their ballot, they can determine that voter’s position in the batch. For example, if the screen displays “BALLOTS CAST: 72” as a ballot is processed, that ballot is the 72nd in the sequence. An attacker can then use the record ID flaw to find that specific entry in public CVRs or ballot images.
- Social Media Disclosures. Voters often share their polling experiences online. Public posts that include the polling place and the “voter number” (assigned at the precinct) provide sufficient data to link a specific individual to their CVR or ballot image in localities using ICP or ICE machines.
- Surveillance Footage. In some jurisdictions, polling place surveillance footage is treated as a public record. By comparing the time a voter is seen on camera at the scanner with the record ID sequence (or scanner logs), an attacker can associate every ballot in a batch with the person who cast it.
- Scanner Log Files and Media Timestamps. Some jurisdictions publish scanner log files that record the exact time a ballot is accepted. When combined with the record ID vulnerability, this allows for the “time-of-casting” to be determined for every CVR. This can be used to deanonymize high-profile individuals (e.g., political figures) whose voting is often captured by journalists via timestamped photography or video.
Recommended Remediation and Solutions
To maintain transparency while protecting voter privacy, a two-tiered approach is recommended: immediate data sanitization and long-term software replacement.
Immediate Data Sanitization Process
Jurisdictions releasing CVRs or ballot images from past or upcoming elections should follow these steps to remove the vulnerability:
- Encryption: Securely encrypt each record ID using a unique key for every election, tabulator, and batch. This creates a unique, cryptographically strong permutation for each batch.
- Replacement: Replace all original record IDs in CVRs and filenames with these encrypted values.
- Metadata Removal and Sorting: Delete unnecessary metadata (such as image file creation times) and sort the CVR entries/image files to eliminate any residual sequence information.
Long-Term Software Updates
For future elections, the ICP and ICE software should be updated to replace the linear congruential generator with a secure alternative for record ID generation.
Disclosure Timeline
Following the discovery of this flaw, the following notification plan was established:
- Dominion Voting Systems: Notified August 23, 2022.
- Federal Agencies: To be informed prior to public disclosure.
- Individual Jurisdictions: Targeted outreach to localities known to have published exploitable data.
- Public Disclosure: Scheduled for 30 days after the initial disclosure to Dominion.
Conclusion
The security vulnerabilities inherent in Dominion electronic voting systems were not limited to the ability to manipulate election results. They also include the risk of infringing upon the rights of our citizens to have a secret ballot.