Federal review says Dominion software flaws haven’t been exploited in elections

“The existence of a vulnerability in election technology is not evidence that the vulnerability has been exploited or that the results of an election have been impacted,” the new Rumor Control posting reads.

“We are working closely with election officials to help them address these vulnerabilities and ensure the continued security and resilience of US election infrastructure,” CISA Executive Director Brandon Wales said in a statement to CNN. “Of note, states’ standard election security procedures would detect exploitation of these vulnerabilities and in many cases would prevent attempts entirely. This makes it very unlikely that these vulnerabilities could affect an election.”

The CISA analysis is of a security assessment of Dominion Voting Systems’ ballot-marking devices done by a University of Michigan computer scientist at the behest of plaintiffs in a long-running lawsuit against Georgia’s Secretary of State.

The computer scientist, J. Alex Halderman, was given physical access over several weeks to the Dominion ballot-marking devices, which print out a ballot after voters make their choice on a touch screen.

Halderman’s report is still under seal with the court.

But according to Halderman and people who have seen the report, it claims to demonstrate how the software flaws could be used to alter QR codes printed by the ballot-marking devices, so those codes do not match the vote recorded by the voter. Postelection audits, which compare paper trails with votes recorded on machines, could catch the discrepancy.

The nature of computing means all software has vulnerabilities if you look closely enough, and software used in elections is no different. But election experts say physical access controls and other layers of defense, along with postelection audits, help mitigate the threat of votes being manipulated via cyberattacks.

The CISA warning notes most jurisdictions using the machines tested already have adapted the mitigations recommended by the agency. Dominion has provided updates to machines to address the vulnerability, one person briefed on the matter said.

CNN has reached out to Dominion for comment.

Separately, the Georgia’s Secretary of State’s office released a statement Friday on a review of the state’s election systems conducted by Mitre Corp., a federally funded nonprofit. While the Mitre report has not been made public, Gabriel Sterling, Georgia’s deputy Secretary of State, said in a statement Friday the report showed “existing procedural safeguards make it extremely unlikely for any bad actor to actually exploit any vulnerabilities.”