ES&S claims that its election systems are never connected to the internet, but researchers find 35 ES&S systems in 10 states have been online over the last year
some in swing states — have been internet connected for months, maybe years. l o l https://www.vice.com/... @dwightshellman : Journalism matters. A lot. Here's Exhibit A. In today's cyber threat environment, the practices uncovered by @kimzetter and @vice are deeply disturbing. https://twitter.com/... Buckle Up / @buckleup36 : BREAKING: Nearly 40 voting machine systems in 10 states discovered connected to the internet unguarded. INCLUDING THESE CRITICAL SWING STATES: Wisconsin, Michigan & Florida https://twitter.com/... @chillmage : Every election expert I have spoken to in the past decade has said connecting election machines to the internet is an unnecessary and huge risk to democracy. nice job guys! https://www.vice.com/... Matt Hodges / @hodgesmr : what could go wrong https://www.vice.com/... pic.twitter.com/6xemzHa4CU @derektmead : This is an incredible investigation from @KimZetter and the conclusion is STUNNINGLY bad. Every paragraph in this story is worse than the last, astounding negligence. This one stuck out to me: https://www.vice.com/... pic.twitter.com/4qZC1R9cQT Bryan J Carr / @learnonaut : https://www.vice.com/... pic.twitter.com/Y0NqV3SmYs @derektmead : EXPOSED: we have confirmed that dozens of critical US election systems, including in Wisconsin and Florida, were left online and vulnerable despite officials' guarantees to the contrary: https://www.vice.com/... @motherboard : At least 19 of the systems, including one in Florida's Miami-Dade County, were still connected to the internet this week, the researchers told Motherboard. http://bit.ly/2YNyyba Jason Koebler / @jason_koebler : EXCLUSIVE: Dozens of voting machines and election systems have been sitting exposed on the internet, in some cases for years: https://www.vice.com/... by @KimZetter Kim Zetter / @kimzetter : Exclusive: For yrs ES&S, top voting machine maker in US, has been saying its vote tabulators and election-management systems are not connected to the internet. That appears not to be true. Researchers say they found what appear to be 35 online. https://www.vice.com/... Colin Jones / @colinjones : NEW: The top voting machine company in the country insists that its election systems are never connected to the internet. Researchers found 35 of the systems have been connected to the internet for months and possibly years, including in some swing states. https://www.vice.com/...
Context & Ripple Effects
ES&S has a documented pattern of connectivity claims not surviving scrutiny: in 2018 it contradicted earlier statements and admitted to Sen. Wyden that some systems sold from 2000-2006 shipped with a remote access feature. The company also controls around half the US voting machine market, so any gap between its security claims and field reality scales across the country.
This report lands after years of warnings that went largely unheeded — two years after voter-registration networks were penetrated by hackers, infrastructure remained largely unchanged, and pre-midterm interviews with officials and experts flagged severe vulnerabilities at many levels. Researchers now finding 35 ES&S systems online in 10 states, including swing states like Wisconsin, Michigan and Florida, turns an abstract risk into a specific, checkable discrepancy.
First-order effects
- Election officials in the 10 affected states must audit whether their ES&S equipment is or was internet-connected, directly contradicting the vendor's assurance they may have relied on when certifying their systems.
- ES&S faces a fresh credibility problem with Congress and state buyers, compounding its earlier admission to Sen. Wyden that past systems carried remote-access features it had denied.
Second-order effects
- State procurement teams can no longer treat vendor air-gap claims as sufficient — expect contractual demands for independently verifiable network isolation, raising compliance costs for ES&S and its rivals.
- With ES&S holding roughly half the market per ProPublica's profile, scrutiny of its practices puts pressure on the entire voting-equipment oligopoly, whose other members now face the same researcher-driven testing of their claims.
Third-order effects
- If vendor self-attestation keeps failing, election security shifts structurally toward external verification — a direction later borne out when three major US voting equipment makers let researchers stress-test their hardware and software to counter conspiracy theories.
- The pattern points toward federal or state-level mandates for auditable network isolation in voting systems, moving election infrastructure from trust-based certification to evidence-based procurement.
The trend: US election infrastructure is being pushed from vendor-assured security toward independent, researcher-led verification, as repeated gaps between vendors' claims and field conditions erode self-attestation.