Election tech giant ES&S and security firm Synack partner to let security professionals, vetted by Synack, conduct penetration testing on some ES&S products
Lily Hay Newman / Wired : Tweets: @synack , @weems , @lilyhnewman , and @caseyjohnellis Tweets: @synack : “By throwing [@essvote's new model of electronic poll book] to the wolves, ES&S can learn about and fix potential security issues before malicious hackers find them.” Learn more about our testing with @essvote via @WIRED: https://wired.com/... @weems : Wow they finally got ES&S to stop threatening and allow independent security researchers to do real researchers on their election machines - congrats to @mattblaze and @VotingVillageDC and everyone else I'm forgetting https://twitter.com/... Lily Hay Newman / @lilyhnewman : “Hackers gonna hack, researchers gonna research”...an actual thing ES&S's VP of security/CISO said to me today 🤯 https://www.wired.com/... Cje / @caseyjohnellis : “While some might think this is baby steps they are steps in the right direction,” he says. “The word's gonna get out that we are serious about this. Hackers gonna hack, researchers gonna research.” https://www.wired.com/... #protect2020 #vulnerabilitydisclosure @disclose_io
Context & Ripple Effects
For years ES&S handled security scrutiny defensively: it admitted to Sen. Wyden that systems sold from 2000-2006 carried a remote-access feature after contradicting earlier statements, and in 2019 researchers documented 35 of its supposedly offline election systems found online across ten states. A ProPublica profile attributed its grip on roughly half the US market to that same insulation — little regulation, almost no oversight.
The Synack partnership is a deliberate reversal: instead of resisting outside testers, the dominant vendor now channels them through a vetted middleman, starting with its new electronic poll book. The approach proved durable — by 2023 all three major US voting equipment makers had opened their gear to some form of researcher stress-testing, explicitly to counter conspiracy theories with transparency.
First-order effects
- Synack-vetted security professionals gain a sanctioned path to probe ES&S products like the new electronic poll book — a channel that simply didn't exist when researchers reported being threatened for touching the machines.
- ES&S shifts from defending claims (systems 'never connected to the internet') to generating evidence, letting it find flaws before adversaries or journalists do.
Second-order effects
- Rival voting vendors face pressure to match the model or look secretive by comparison — pressure that materialized when three major manufacturers adopted researcher testing within three years.
- Independent researchers and groups like Voting Village gain leverage: a vendor-sanctioned route makes refusal to engage elsewhere harder to justify, raising the credibility cost of ES&S's past stonewalling.
Third-order effects
- In a sector with minimal government regulation, vendor-managed researcher access risks becoming the de facto oversight mechanism — private vetting substituting for public certification, with the vendor deciding what gets tested.
- If the pattern holds, transparency itself becomes competitive infrastructure in election tech, where a vendor's willingness to be tested is priced into state procurement decisions alongside the hardware.
The trend: US election technology vendors are trading litigation-era secrecy for brokered, vetted researcher access as their primary trust-building strategy in a lightly regulated market.