Within Days of Release of Report Declaring Dominion ICX Machines Critically Insecure, SOS and Disinterested Committee Gives Greenlight to Use Them in New Mexico

On June 22nd, New Mexico’s Voting System Certification Committee (VSCC) recommended that equipment from controversial vendor, Dominion Voting Systems (“Dominion”), be recommended for use in the upcoming elections. While Dominion’s reputation with the national public is already extremely poor, one particular piece of equipment recommended for purchase is considered a major national security risk. Specifically, the Dominion ICX Ballot Marking Device, which was excoriated in a recently unsealed report from IT expert Professor Alex Halderman.

The VSCC meeting took place within days of Halderman’s scathing report in which he declared the Dominion ICX “suffers from critical vulnerabilities that can be exploited to subvert all of its security mechanisms…these vulnerabilities provide multiple routes by which attackers can install malicious software on [the machine], either with temporary physical access or remotely from election management systems.”

The members of the VSCC include Raja Sambandam, chair and IT representative; Amanda Lopez Askin, Dona Ana County Clerk; Cara Cook, Eddy County Clerk; Peggy Carabajal, Former Valencia County Clerk; and John Blair, Santa Fe City Manager. Representing Dominion were Robert Giles, Vice President of Certification and Compliance, Steven Bennett, Regional Sales Manager, Cisco Padilla Customer Service Manager for State of New Mexico, and Chis Estes, the New Mexico Tech lead.

Maggie Toulouse Oliver, New Mexico Secretary of State and Mandy Vigil, Bureau of Elections Director were present and orchestrated the meeting. Oliver opened the meeting as though recommendation by the VSCC was a foregone conclusion.

Oliver acknowledged there had been many comments sent from the public and said she hoped the committee took the time to review them. The SOS website reports that there were 631 comments submitted to the committee. We reviewed the comments and found none were in favor of the recommended system.

One New Mexican stated, “I am writing to express my great concern regarding the certification of a Dominion modification in New Mexico. We have all witnessed the overwhelming loss of confidence in this company, its leadership & security. These machines have huge design flaws…and we as citizens will never have confidence in the security of our votes until they are retired.”

Another said, “Please stop using electronic voting in New Mexico and return to hand counting. Please do not renew or return to using Dominion or any other electronic voting system. Save our state money and resources by utilizing people and implement methods that enforce the honesty of one person, one vote and do not allow for electronic manipulation.”

The fact that there was significant opposition for the new system was not mentioned by the committee, the SOS, or the vendor. Neither did the participants address any of the specific objections from the public to the new system or the contents of the Halderman report discussing the Dominion ICX machine which is proposed as part of the new system.

The committee did not ask many questions during the presentation, nor did the committee member who was an IT expert.

Dominion has often been criticized for using outdated software in their equipment, and the new proposed system for New Mexico is no better.

The vendor stated that Dominion updated the election system to Windows Server 2019 and SQL Server 2019 even though there are recent and more secure versions available. Windows 2019 and SQL 2019 have many known security issues. In fact, Microsoft has announced that these issues will not be fixed and that they are no longer supporting these versions of the software as of May 11, 2021.

Microsoft has advised all users still using the 2019 versions to migrate to the 2022 versions of Windows and SQL to prevent exposure to known and serious issues of the 2019 versions. Live demonstrations have been performed showing the ease of switching thousands of votes in seconds on election management systems that feature Windows SQL using nothing more than a USB drive and an open port.

There was also an admission that the controversial Rank Choice Voting (“RCV”) software will be present in all New Mexico election management systems —including jurisdictions that do not have RCV style elections. The Dominion representative stated “So, any jurisdiction in the state that so chooses to use the rank choice voting, it’s available in their county system.” RCV has been criticized for being confusing to voters and providing a path to victory for unpopular candidates who couldn’t otherwise win. The RCV software also fractionalizes votes and applies an algorithm to the votes cast – a scenario the public fears is happening in all our elections.

The committee did not question whether rank choice voting can be activated without the knowledge of the election officials or the public. Nor did the committee ask about the cost of installing this software statewide when RCV elections only take place in Las Cruces and Santa Fe.

The vendor stated, “we work with Dell and all the computers this year going forward, all Dell computer components have no Bluetooth or Wi-Fi cards. So, there is no connectivity.” The qualification of “this year going forward,” implies existing equipment which will remain in use may have Bluetooth and Wifi cards installed as many of members of the public expressed concern about.

The vendor’s assurance about Bluetooth and Wi-Fi cards is a red herring as most of the Dominion equipment is fitted with open USB ports which can easily be used to install a WiFi adapter, providing the equipment with internet connectivity. Additionally, the Otero County Audit discovered that the election management computers were fitted with Intel Active Management Technology – which provides persistent out‐of-band connectivity without WiFi or Bluetooth.

Connectivity in the system is clearly present, as the Dominion representative stated later in the meeting that the high-speed scanners used to process absentee ballots are hooked to the election computer for adjudication with a modem between the two.

The meeting was attended by several citizens that were interested in the process and learning more about the proposed Dominion system, but the floor was never opened to comment or questions from the public. Ms. Vigil did provide a business card to be contacted later but refused to answer questions after the meeting.

Pablo Martinez, who attended the open meeting, said, “The most disturbing part of the whole meeting was the lack of engagement by the committee. These members have been described by the Secretary of State as “experts” in the past but their lack of important security questions or just questions in general leave one to wonder what is going on. It’s like the vendors selling the equipment have taken the place of the election officials and the committee. The massive public input was completely ignored.”

Robert Kwasny, considered one of the top pioneering “Grand Uncles” of Personal and Mid-level Computing, with 47 years of high tech experience, approached Raja Sambandam after the committee meeting. Kwasny was extremely concerned about the security of the proposed system but was ignored.           More on this story will be reported in the near future.