Single Shared Credential Across All EMS Components – Never Rotated Through 2020 Election (AZ)

During the Cyber Ninjas audit of Maricopa County’s 2020 election, IT subcontractor Ben Cotton testified before the Arizona Senate on July 15, 2021, that Maricopa County lacked the administrative iButton hardware tokens required for multi-factor authentication into Dominion’s tabulation system at the technician/configuration level. Cotton testified that “only the contract Dominion employees, contracted by Maricopa county, have access to configure those ICPs and to get access to the configuration or technician aspects of those ICPs,” and confirmed that the county could not independently validate that the systems were in their certified configuration. Arizona Senate member Warren Petersen summarized: “It appears that only Dominion has that” to which Cotton responded, “Correct.” While the county possessed software-level admin passwords, the iButton hardware tokens needed for the second authentication factor to access configuration-level functions were held exclusively by Dominion-contracted technicians, meaning independent county-level validation of the certified configuration required vendor participation.