The Honorable Frank LaRose Ohio Secretary of State

180 S Civic Center Dr. Columbus, OH 43215

February 13, 2024

 

Dear Sir,

 

I represent a grass-roots organization of registered voters in Ohio who are concerned about the security and accuracy of certain voting machines in Ohio. This is a follow-up to a letter of the same subject we sent to you on December 29, 2023, but have not received a response to date.

 

Given your busy schedule, it is possible that you have not had time to respond or it’s possible that your staff has not forwarded the letter to you. In either case, I have enclosed another copy for you. In addition to yourself, we sent copies to the twelve counties in Ohio who operate Dominion ImageCast (ICX) voting machines along with copies to the respective county commissioners and state representatives and senators.

 

Although we applaud your recent efforts to push-back to the radical proposed constitutional amendment titled “Secure and Fair” elections, it is concerning that your office has been silent regarding the security and accuracy of the Dominion ICX voting machines used in Ohio, especially in light of the findings that have come out in the recent Curling v. Raffensperger case in Georgia that ended a couple of weeks ago. While the judge in that case has not yet made a ruling, the evidence brought forth that these machines cannot be trusted is overwhelming. In court, the plaintiff’s expert cyber witness demonstrated that it was possible to hack the Dominion machine and alter votes in less than a minute using a ball point pen to bypass all the security passwords.

 

The expert witness in this case was Alex Halderman who previously conducted a court-ordered forensic examination of a Dominion ICX machine in Fulton County Georgia and documented his findings in what is known as the Halderman Report. The findings of this report were so damning that they were sealed by court order for two years for fear that the vulnerabilities might be exploited by bad actors if made public. The report was eventually provided to CISA, the cybersecurity agency under the Department of Homeland Security charged with protecting our election infrastructure and prompted them to issue a security advisory in June 2022 to all Board of Elections regarding the vulnerabilities. A redacted version of the report was released to the public in June 2023.

 

In addition to the Georgia case, in late 2021, a team by cyber experts in Mesa County Colorado conducted a six-month forensic examination and found conclusive evidence that the Dominion D-Suite Election Management System (EMS) server in Mesa County Colorado contained unauthorized software causing a backdoor which allowed votes to be significantly altered.

 

The bottom-line conclusion of these reports is that the Dominion D-Suite voting system (ICX machine and EMS server) as examined, is not safe to be used in any election and should not have been certified in the first place.

 

In May 2023 we sent an email to Jeffrey Matthews, Ohio Board of Voting Machine Examiners (BVME) asking about the status of work being done to the Dominion machines in Ohio in response to the CISA security advisory. Although it was confirmed by his staff that he received the email, he chose not to respond to our inquiry. From our perspective, this was not only unprofessional, but showed a lack of respect for the taxpayers of Ohio who have a right to know that their voting machines are secure.

 

To date, we have received responses from two of the county BOEs (Adams and Wayne) to the letter we sent out in December. Basically, they said that because of the CISA security advisory, Dominion was tasked to develop a software update (Democracy Suite Version 5.17) which has been certified by the U.S. Election Assistance Commission (EAC) and planned to be implemented during the summer of 2024. We assume that this will be the case for the other BOEs as well.

 

We strongly feel that a software patch to correct the Dominion security flaws is akin to putting a band aid on a life-threatening wound. First of all, the Curling v. Raffensperger case underscores the fact that the Dominion ICX machines are riddled with vulnerabilities that are not fully addressed by the CISA security advisory. Second, the CISA advisory does not address the findings of the MESA County Colorado Reports that focuses on the Election Management System server which raises the question as to how the machine could have received Federal certification in the first place. Third, and most important, it appears that the BVME is simply relying on Dominion to fix the problem. That’s like asking the fox to guard the hen house.

 

Since the Board of Elections rely on the BVME to correct known or suspected machine deficiencies, and the BVME relies on the vendor to correct them, what is missing is an independent assessment of the Dominion machines to determine if Ohio has a similar problem as Georgia and Colorado. This is beyond the scope or capability of the BVME and urgently needs to be addressed.

 

In our previous letter to you we proposed a couple of alternatives for doing an independent cybersecurity evaluation of the Dominion machines. The first option would be for you to request the Governor to call on the adjutant general to stand up a Tiger team of volunteers from the Ohio Cyber Reserve. (OhCR). The second option would be to partner with colleges and/or universities that have strong computer science and computer engineering departments that would give graduate student volunteers the opportunity to earn credit while working on a real-world project. Perhaps the evaluation team could be a combination of both.

 

In closing, you have long assured the voters of Ohio that our voting systems are secure and can be trusted. But after experiencing a challenged presidential election in 2020 combined with a lack of confidence in the government’s response and narrative regarding Covid, we are past the point of trusting the government at face value. The registered voters of Ohio deserve to know that their voting machines are safe and accurate and need an independent assessment of the machines to confirm that is true or not.

 

Sincerely,

 

Tom Howard

Tim Stechschulte

Coalition of Concerned Voters of Ohio (CCVO)

PO Box 99, Dublin OH 43017

​