Halderman v. Raffensperger, Dominion & MITRE

Please Follow us on Gab, Minds, Telegram, Rumble, Gab TV, GETTR, Truth Social, Twitter

Two reports offering dueling assessments about Georgia’s voting machines have finally been released to the public this week by Federal Judge Amy Totenberg, the sister of Nina Totenberg, the national legal correspondent at National Public Radio. 

Both reports were ordered under seal in the lawsuit Curling v. Raffensperger well before the 2020 election that brought forth the question to compel Georgia to use hand-marked paper ballots instead of electronic ballot-marking devices (BMDs).

One report was prepared by MITRE, a corporation that runs a project called the National Election Security Lab. MITRE was commissioned by Dominion to write this report. MITRE’s board is filled with left-leaning figures. MITRE’s report claims the Dominion machines secure and was touted by Georgia Secretary of State Brad Raffensperger on June 14 after it was released to the public. 

“The MITRE report confirms that Georgia’s election infrastructure is secured by the toughest safeguards. For years, election deniers have created a cottage industry of ever-shifting claims about conspiracies to change votes, steal elections, and undermine voter confidence. This report says it all: voting machines do not flip votes. Cast ballots are counted as the voter intended. Georgia elections are secure,” stated Raffensperger in the Secretary of State’s released statement.

Raffensperger’s conclusion are hardly the case according to 24 leading cybersecurity and election security experts. 

The second released report was written by University of Michigan professor J. Alex Halderman. His report alleges the machines have "critical vulnerabilities that can be exploited to subvert all of its security mechanisms, including: user authentication, data integrity protection, access control, privilege separation, audit logs, protective counters, hash validation, and external firmware validation."

The MITRE report, again - commissioned by Dominion - was a response to Halderman's report, which said it demonstrated "multiple routes by which attackers can install malicious software on Georgia’s BMDs, either with temporary physical access or remotely from election management systems."

Halderman report laid out specific vulnerabilities and "proof-of-concept" attack scenarios that can be found on pages 4-6. The report outlines attacks that, it asserts, would include altering the QR codes on printed ballots without the knowledge of voters, using malicious hardware on printers, or remotely installing vote-stealing malware on BMDs.

Halderman concluded the BMDs are "not sufficiently secured against technical compromise to withstand vote-altering attacks" and "can be compromised to the same extent" as Georgia's old voting system (the original lawsuit was launched against the old system and pivoted to the new Dominion system when it was put into place in 2019.”

The MITRE report challenged Halderman’s report and claimed that MITRE’s researchers assessed Halderman’s proposed attacks. MITRE claimed  that all of Halderman’s six such attacks require "access and/or opportunity that remains unavailable in the operational environment."

Five of Alderman’s attack scenarios were eemed "non-scalable" by MITRE - essentially meaning that if they were achieved they would only affect "a statistically insignificant number of votes on a single device at a time."

The sixth was considered scalable but "infeasible due to access controls in place in operational election environments, access required to Dominion election software, and access required to Dominion election hardware."

MITRE’s conclusion asserted that risk-limiting audits - such as was performed through a hand-count process on Georgia's 2020 election results - would detect five of the attacks proposed by Halderman.

The day after the reports were released, Halderman contended on Twitter that MITRE's "analysis is wrong, because it fails to account for how elections are operated in the real world."

Halderman and colleagues have claimed that Raffensperger’s assessment is “wrong” and that MITRE’s analysis is “dangerous.”

"It is entirely predicated on a false assumption: MITRE says it 'assumes strict and effective controlled access to Dominion election hardware and software,'" Halderman wrote, further calling that "wishful thinking."

Gabriel Sterling, one of Georgia's top election officials, meanwhile wrote the MITRE report "completely debunks election deniers'... claims of voting machine hacks."

Halderman responded to that tweet also, pointing to the reported breach of Georgia's voting systems in Coffee County in 2021, and saying "y'all need to patch" - as in, apply updated software with newer security measures.

Halderman’s report argues a patch "can be at least partially mitigated through changes to the... software, and I encourage Dominion and the State of Georgia to move as quickly as possible to remedy them," though he further contends "merely patching these specific problems is unlikely to make the (voting system) substantially more secure."

A statement by Raffensperger on Wednesday, meanwhile, says of Halderman's report: "The risks outlined in the researcher's report are theoretical and imaginary. Our security measures are real and mitigate all of them."

Raffensberger and Sterling are pushing not to fine tune the Georgia election machines until 2025. 

Halderman and his colleagues claim that to be nonsense and that Georgia needs to address this issue now because the 2024 election votes will otherwise be at risk in not only Georgia, but other states where Dominion operates. 

The question is what will the public demand and how will the elected officials respond. 

Halderman is outing Raffensberger and MITRE’s analysis on Twitter. 

“Astonishingly, Georgia Secretary of State Brad Raffensperger, who has been aware of our findings for two years, just announced that the state will not get around to installing Dominion’s security patches until after the 2024 Presidential election…

That's worse than doing nothing. By broadcasting that Georgia is not going to patch, Raffensperger has given would-be adversaries a whole 18 months to develop and execute attacks that exploit the known-vulnerable machines…

Our findings are a reminder that elections face ongoing risks that call for vigilance from policymakers, technologists, and the public. Officials like Raffensperger should uphold voter confidence by improving security, not denying or ignoring real problems. Voters deserve better,” tweeted Halderman. 

As a result, 20 cybersecurity experts including Halderman have written a letter to MITRE’s CEO Jason Providakes to retract MITRE’s “dangerous report.” 

The entire letter to Providakes can be read here. 

‘NO AD’ subscription for CDM!  Sign up here and support real investigative journalism and help save the republic!‘

·        Robert F. Kennedy Jr. Describes Ties From Pre-911 To Bioweapons And Pandemic

·        Organization Forms In Cherokee County – To Move Away From GOP?