Election Crime Bureau

Made possible by the Lindell Offense Fund
Donate

Physical Configuration Audits: Critical Infrastructure Basics

When you board an airliner, you trust that the aircraft matches the design the FAA approved. When a utility runs a substation, regulators expect it to know exactly which software is on every critical device. Nuclear plants must show that what is physically installed matches their licensing basis. These checks are routine because the systems are critical.

Since January 2017, America’s election infrastructure has also been designated critical infrastructure [1]. Yet one of the most basic verification tools used in other critical sectors, the physical configuration audit, is almost never applied to voting equipment after it leaves the test lab. This post explains what a physical configuration audit is, how other sectors use it, why it matters for voting systems, and how local election officials can ask CISA to perform one.

What is a PCA?

A physical configuration audit (PCA) answers a simple question: is the item in front of you the item that was approved?

The Department of Defense’s configuration management handbook, MIL-HDBK-61A, says the PCA “is used to examine the actual configuration of the CI [configuration item] which is representative of the product configuration in order to verify that the related design documentation matches the design of the deliverable CI” [2]. Its companion, the functional configuration audit (FCA), verifies that the item performs as specified [2]. In short, the FCA asks whether it works, and the PCA asks what it is.

What a PCA Does

In elections, the PCA is part of federal certification testing. The EAC Office of Inspector General describes it this way: “The PCA compares the voting system components submitted for testing with the manufacturer’s technical documentation and establishes a baseline identifying the hardware and software that comprise the system under test” [3]. One recent test plan shows how detailed the process can be. Pro V&V’s VVSG 2.0 plan for ES&S EVS 7.0.0.0 calls for an initial PCA to baseline the system and a final PCA “to verify final software and hardware configurations.” It also includes a physical examination for wireless technology that “may include taking off covers and disassembling devices” [4].

The gap is what happens next. The lab PCA verifies the units submitted for testing. No routine federal process verifies that the thousands of units later manufactured, shipped, serviced, and deployed to precincts still match that baseline.

How Other Critical Systems Use PCA's

As an aerospace engineer, I have seen first-hand that configuration control is basic discipline in safety-critical work, not an extra step. Here is how several regulated sectors apply it:

  • Under MIL-HDBK-61A, the PCA establishes the product baseline. It is also used “to validate many of the supporting processes that the contractor uses in the production of the CI” [2]. Air Force guidance states that “the final Product Baseline must be established at Physical Configuration Audit (PCA)” [5].
  • FAA conformity inspection is required during type certification so that “the prototype article(s) used for certification evaluation and test match the type design presented for approval,” and so that production articles “continue to conform to the type design” [6]. An aircraft conforms only when its configuration and installed articles “are consistent with the drawings, specifications, and other data that are part of the TC [type certificate]” [7].
  • Nuclear power. The NRC defines configuration management as the process that ensures a licensee “maintains the plant’s physical and functional characteristics in conformance with its design and licensing basis,” including through maintenance and modification [8].
  • Electric grid. NERC Reliability Standard CIP-010 requires a documented baseline covering firmware, installed software, network-accessible ports, and security patches. It requires checking for changes “at least once every 35 calendar days” and investigating unauthorized changes. Before applying a change, the utility must verify the identity of the software source and the integrity of the software it supplies [9].

In each of these sectors, verification continues after initial approval and covers fielded equipment, not only the prototype. Elections are the exception.

Why It Matters for Election Systems

A voting system’s certificate covers a specific configuration. If the units in the field differ from that configuration in hardware, firmware, communications components, or manufacturing source, no one can claim they are certified without checking. Recent examples from both major vendors show why that check is needed.

Dominion: Same Model, Different Unit

The certified baseline for Dominion’s ImageCast Precinct 2 tabulator (ICP2, model PCOS-330A) is the unit documented in the 2019 EMC/EMI test report prepared by TÜV SÜD Canada for the federal test lab Pro V&V. That unit bears serial number FAL18480532 and a “Made in USA” label [10]. Compare it with an ICP2 photographed in Irving Township, Barry County, Michigan:

The model number, power rating, and FCC text are the same. The serial number prefix (VAL instead of FAL), the “-004” configuration suffix, and the origin label (“Made in Taiwan” instead of “Made in USA”) are different. This is not the only case:

  • Other Michigan units. I personally observed three more VAL-series ICP2 units labeled “Made in Taiwan” during October 2026 logic and accuracy testing in Wayne County. A unit photographed in Saugatuck, Allegan County, carries a “-005” suffix [11].
  • Undocumented configuration. EAC Engineering Change Order 100843 (April 2022) defines ICP2 Production Configuration 4, which removed an Ethernet port and its supporting chip from the motherboard [12]. I have found no public change order that defines a Configuration 5.
  • Manufacturing source. Michigan’s state contract says its tabulators “will be newly manufactured by Flextronics in their Plano, Texas manufacturing facility” [13]. The facility producing the VAL-series units has not been publicly identified.
  • Supply chain. In April 2026, the Michigan Department of State told Rep. Rachelle Smit that it “could not guarantee that the state’s election equipment does not include materials from companies of concern” [14].
  • Certification controls. On October 22, 2026, the EAC Inspector General confirmed that the Certificate of Conformance for Dominion’s Democracy Suite 5.20 “erroneously listed a scanner that had not been tested.” The OIG called this a breakdown in the controls meant to ensure that certified configurations reflect the components actually tested. It found no evidence the scanner was sold as part of the certified system, and its broader review of PCAs performed by Pro V&V is ongoing [3].

ES&S: Modems and Verification Questions

  • Modem configuration not certified. The EAC certified the ES&S DS200 scanner without modem capability. ES&S withdrew the modem and network components from testing in 2011. In March 2020, the EAC ordered the company to correct marketing materials that suggested the modem-equipped version was certified, warning that failure to comply could lead to decertification [15]. ES&S itself says that in “a few states” modems are used in its poll-place tabulators [16].
  • Global supply chain. ES&S states that “some components may be sourced from China-based manufacturers” and that final hardware configuration is performed in the USA [17].
  • Hash verification concerns. A federal complaint filed in Pennsylvania cites Texas examiner records. It alleges that examiners found weaknesses in ES&S’s hash-verification process, including a plain-text verification script, the ability of the system to verify itself, and five files exempt from verification [18]. These are allegations in pending litigation, not court findings. Still, they illustrate why independent hash verification of fielded units is a core PCA task.

How Local Officials Can Request a PCA

CISA’s election services are free, voluntary, and provided at the request of state and local officials [20]. CISA’s 2026 plan does not list a PCA by name. However, federal law authorizes CISA to provide technical assistance and incident response capabilities to non-federal entities on request [21], and CISA has previously examined election software directly at the request of system owners [22]. The EAC’s Testing and Certification Program Manual also provides for reviews of fielded systems, on invitation from a state or local election authority, to confirm they match the certified configuration [23].

  1. Identify the units to be audited, seal them, and defer non-emergency vendor access until the audit is complete. Check your state’s equipment-custody and record-retention rules first.
  2. Photograph labels, serial numbers, configuration suffixes, and seals, and preserve logs and chain-of-custody records.
  3. Request in writing. Send the request to your CISA central office  [email protected]) [24]. 
  4. Coordinate with the state. Notify your state election office. In some states it must approve changes to equipment; in Michigan, for example, changes to an approved system go to the Board of State Canvassers [25].
  5. Audit and report. Ask for a written report of findings delivered to your office, with a public version.

Template for Clerk PCA Requests

This template works for county, city, or township clerks. Replace the bracketed text, and remove items that do not apply.

Download Template

The Bottom Line

Every other critical sector verifies that what is fielded matches what was approved, and it keeps verifying. Elections should meet the same standard. A physical configuration audit does not assume wrongdoing. It replaces assumptions with documented facts, which is exactly what voters, canvassers, and election officials need.

References

  1. CISA, 2026 Election Infrastructure Security Plan (Sept. 2026). https://www.cisa.gov/sites/default/files/2026-09/2026-CISA-Election-Security-Plan-FINAL-508c.pdf
  2. S. Department of Defense, MIL-HDBK-61A, Configuration Management Guidance, §§ 6.2.2.1–6.2.2.2. https://swehb.nasa.gov/download/attachments/16450060/MIL-HDBK-61.PDF?api=v2
  3. EAC Office of Inspector General, Interim Report: Review of Physical Configuration Audits Supporting EAC Voting System Certifications, P26HQ0007-27-01 (Oct. 22, 2026). https://www.oversight.gov/sites/default/files/documents/reports/2026-10/P26HQ0007-27-01_Interim_PCA_Review_Report.pdf
  4. Pro V&V, EAC VVSG 2.0 Certification Test Plan, ES&S EVS 7.0.0.0 (2026). https://www.eac.gov/sites/default/files/2026-08/EVS%207000%20XL%20Test%20Plan%2001-01-ESS-2025-01%20Rev%2003_0.pdf
  5. S. Air Force, SMCI 62-109. https://static.e-publishing.af.mil/production/1/smc/publication/smci62-109/smci_62-109.pdf
  6. FAA, Advisory Circular 20-169. https://www.faa.gov/documentLibrary/media/Advisory_Circular/AC_20-169.pdf
  7. FAA, Order 8130.2G, Airworthiness Certification of Aircraft. https://www.faa.gov/documentlibrary/media/order/8130.2g.pdf
  8. NRC, Design Control: A Quick Reference Guide for NRC Inspectors. https://www.nrc.gov/docs/ML0926/ML092650379.pdf
  9. NERC, Reliability Standard CIP-010-3. https://www.nerc.com/pa/stand/reliability%20standards/cip-010-3.pdf
  10. TÜV SÜD Canada for Pro V&V, EMC/EMI Test Report 7169006118E-000, ICP2 V1, Figure 3 (June 17, 2019).
  11. Patrick Colbeck, Election Crime Bureau, Request for Investigation — Country of Origin for Electronic Voting Systems, referral to the U.S. Department of Justice (Oct. 6, 2026).
  12. EAC, ECO Analysis Form 100843 (Apr. 18, 2022). https://www.eac.gov/sites/default/files/eocdocuments/ECO%20Analysis%20Form%20100843.pdf
  13. State of Michigan Contract No. 071B7700117, Dominion Voting Systems. https://www.michigan.gov/dtmb/-/media/Project/Websites/dtmb/Procurement/Contracts/MiDEAL-Media/008/7700117.pdf
  14. Michigan House Republicans, “Rep. Smit leads House passage of plan cracking down on foreign parts in state election equipment” (Apr. 14, 2026). https://gophouse.org/posts/rep-smit-leads-house-passage-of-plan-cracking-down-on-foreign-parts-in-state-election-equipment
  15. Politico, “Election commission orders top voting machine vendor to correct misleading claims” (Aug. 13, 2020). https://www.politico.com/news/2020/08/13/election-voting-machine-misleading-claims-394891
  16. ES&S, Voter Resources. https://www.essvote.com/voter-resources/
  17. ES&S, Supply Chain and Manufacturing FAQs. https://www.essvote.com/faqs/supply-chain-manufacturing-faq/
  18. Amended Complaint, Election Truth Alliance v. Schmidt, No. 1:25-cv-00329 (W.D. Pa.), ¶¶ 58–70, 88–93. https://storage.courtlistener.com/recap/gov.uscourts.pawd.324751/gov.uscourts.pawd.324751.71.0.pdf
  19. TIPP Insights, “Georgia Election Vendors Seek To Win Over Committee Members, Take Two.” https://tippinsights.com/georgia-election-vendors-seek-to-win-over-committee-members-take-two/
  20. CISA, Election Security Services. https://www.cisa.gov/topics/election-security/election-security-services
  21. 6 U.S.C. § 659(c)(6), (f). https://uscode.house.gov/view.xhtml?req=(title:6%20section:659%20edition:prelim)
  22. CISA, CISA Election Report. https://www.cisa.gov/resources-tools/resources/cisa-election-report
  23. EAC, Testing and Certification Program Manual, Version 3.0, §§ 8.5–8.6. https://www.eac.gov/sites/default/files/TestingCertification/Testing_and_Certification_Program_Manual_Version_3_020421.pdf
  24. CISA, Region 5. https://www.cisa.gov/about/regions/region-5
  25. MCL 168.795a. https://legislature.mi.gov/documents/mcl/pdf/MCL-168-795A.pdf
More Evidence