Across all three Privatized Election Operations subtopics—illusory contracts, privileged access, and operational control—the findings show that core election functions in 2020 were effectively outsourced to private vendors and NGOs whose actions and records largely fell outside traditional public‑law constraints, transparency, and security vetting.
Collectively, these findings depict a shadow governance layer over U.S. elections: private, often ideologically aligned entities used contracts, data pipelines, and embedded staff to control who could see systems, who could change them, and how election‑night operations were run, while public institutions retained only nominal authority. From a national security perspective, that architecture is dangerous because it creates an attractive, under‑regulated target for foreign intelligence services, transnational criminal networks, and hostile oligarchs: by compromising or covertly financing the vendor/NGO layer, they can influence or disrupt election outcomes without ever breaching hardened government systems. It also means Congress, ODNI, DHS, and DoJ cannot reliably reconstruct or assess what occurred in contested elections, because key technical and operational records reside in private hands outside the reach of standard transparency and oversight mechanisms.
MOST SIGNIFICANT FINDINGS
1 | Vendor License Terms and Grant Clawbacks Replaced Public Oversight with Private Veto Power Dominion Voting Systems and its Michigan reseller ElectionSource embedded audit-blocking language in software licenses covering publicly purchased election equipment, expressly prohibiting independent forensic review and threatening “immediate legal action” against any clerk who authorized it. Wisconsin Elections Commission Administrator Meagan Wolfe publicly asserted a private contract prevented her from complying with a legislative subpoena — invoking non-disclosure provisions against statutory oversight authority. CTCL grant agreements in Fulton County ($6.3M), DeKalb County (~$9.3M), Detroit ($3.5–$7.4M), Philadelphia, and the five Wisconsin “Zuckerberg 5” cities ($6.3M combined) contained clawback clauses giving the private funder unilateral authority to demand full return of disbursed funds if jurisdictions deviated from CTCL’s operational plans. The public money was spent, the public duty was fixed by statute, the public record existed — yet private paper was invoked to defeat every oversight mechanism designed to verify it. |
2 | Private Operatives Held the Physical Keys, Hardware Tokens, and Hidden Wi-Fi in the Count Room In Green Bay, Wisconsin, Michael Spitzer-Rubenstein of the CTCL-funded National Vote at Home Institute held the physical keys to the central counting facility, directed creation of three Wi-Fi networks at the Grand Hyatt counting venue — including one hidden, non-public network to which ESS voting machines were connected — and made sovereign legal determinations about whether late ballots would count. In Maricopa County, only Dominion contract employees held the administrative iButton hardware tokens required to configure or validate the county’s own tabulators; the county lacked its own administrative access. A single shared technician-level credential was used across every component of the Dominion Election Management System in Maricopa and was never rotated through the 2020 election. In both jurisdictions, the people holding the only keys capable of configuring or controlling the election infrastructure did not work for the public. |
3 | Private Voter-Roll Access — 25,000 Unvetted Partners, Real-Time API, Deputized Partisan Registrars The Michigan Department of State executed API contracts giving Rock the Vote and approximately 25,000 partner organizations direct remote access to the Qualified Voter File — containing partial Social Security and driver’s license numbers — without NIST-compliant vetting of partners or individual conflict-of-interest review. Wisconsin’s WisVote statewide voter database, priced at $12,500 per daily snapshot for public requestors, was connected by real-time API to CTCL partners at no charge; the WEC Administrator falsely denied any such API existed. In Georgia, Eligible-But-Unregistered voter data was routed through ERIC to the Chan-Zuckerberg-funded Center for Election Innovation and Research for targeted partisan mailings, and 255 ACLU of Georgia attorneys were deputized as Fulton County registrars with access to the E-Net voter-registration system on Election Day without statutory authorization. |
4 | Uncredentialed Private Contractors Ran Tabulator Programming, Poll-Worker Hiring, and Ballot Processing In Fulton County, The Elections Group — operating without any executed memorandum of understanding with the statutory election superintendent — held daily access to absentee-ballot request data, drop-box planning, tabulator programming, Logic and Accuracy testing, and the signature-verification server; Elections Group staff were issued county government email accounts. In Detroit, former 36-year State Elections Director Chris Thomas was retained as a private consultant with no current governmental title and given operational control of the city’s 2020 count. In Michigan, ElectionSource simultaneously held EMS project-file access across at least 22 counties and functioned as de facto system administrator during the 2020 cycle. Runbeck Election Services processed absentee ballots for all 159 Georgia counties and produced an estimated 3.6 million ballot packets for Maricopa County — none of these private actors subject to FOIA or state open-records law. |
5 | “Delivered Just the Margin Needed at 3:00 a.m.” — Private Contractor Email During Active Count At 4:07 a.m. on November 4, 2020 — during an active vote count in Milwaukee — a private Elections Group contractor emailed Milwaukee election official Claire Woodall-Vogg writing that she “delivered just the margin needed at 3:00 a.m.” The Elections Group operative was embedded via CTCL funding, had no executed agreement with Milwaukee, and was controlling the network linking all tabulation machines in the counting facility. No comparable email exists in the public governmental record for any 2020 election jurisdiction. The Center for Internet Security’s Albert sensor MOAs in Michigan granted a federally affiliated private NGO the right to inspect election-network traffic “in a decrypted state” on networks where users were told they had “no reasonable expectation of privacy” — placing the most sensitive tabulation traffic in private repositories outside FOIA and state audit reach. |
WHY SUBSTANTIVE RESOLUTION IS ESSENTIAL
Election systems were designated critical infrastructure by DHS in January 2017 on the premise that the people controlling administrative credentials, physical access, and operational decisions are public officials answerable to the public. The Privatized Election Operations findings document the systematic displacement of that premise in the jurisdictions that decided the 2020 presidential result. Private vendors held the only tokens capable of configuring the tabulators. Donor-funded NGOs held the keys to the counting rooms. Private API contracts opened voter rolls to thousands of unvetted organizations. Private contractors programmed the machines, processed the ballots, and ran election-night operations — none subject to FOIA, open-records law, or legislative subpoena. Every future adversary now knows: the public layer of the election is a front end for a private back end that the public cannot see, govern, or remove.
NATIONAL SECURITY IMPLICATION: An adversary seeking to influence a U.S. federal election does not need to breach hardened government systems if vendors, NGO operatives, and private contractors already hold the administrative credentials, the keys to the counting room, and real-time access to the voter rolls. The Privatized Election Operations record demonstrates that this architecture existed in 2020 across every decisive jurisdiction. It creates an under-regulated attack surface invisible to standard federal oversight — and a documented playbook for any future actor willing to use it. |
Supporting Evidence
