CISA says Dominion's voting machines used in at least 16 states have nine vulnerabilities that have not been exploited, and suggests mitigation measures
ATLANTA (AP) — Electronic voting machines from a leading vendor used in at least 16 states have software vulnerabilities that leave …
Context & Ripple Effects
CISA's advisory on Dominion is the first time the federal cyber agency has formally catalogued and mitigated flaws that independent researchers had been flagging for years: the [[a:946338|2019 Defcon Voting Village documented exploitable weaknesses across six machine models still in use]], and a CyberScoop report that year found the dominant election-tech vendors had failed to acknowledge or fix them.
The advisory lands on a market where replacement has been slow — only 13 of 40 states surveyed ahead of the 2018 midterms planned new purchases, and 14 states still ran paperless machines — while Dominion's chief rival ES&S had its own credibility problem after researchers found 35 supposedly offline ES&S systems had been online within a year.
First-order effects
- Election officials in at least 16 states must now weigh CISA's suggested mitigation measures against their existing contracts and upgrade budgets, since the nine vulnerabilities are confirmed present but not yet exploited.
- Dominion, which had largely escaped the public reckoning that hit rivals, now has a federal agency documenting flaws in its flagship equipment.
Second-order effects
- The advisory pressures the whole duopoly: ES&S's earlier claim that its systems are never connected to the internet was already contradicted by researchers, and both vendors now face officials demanding verified security postures before signing replacement contracts.
- States that deferred machine purchases after the 2018 survey gain a concrete federal checklist, shifting procurement debates from 'whether to replace' to 'which vendor can demonstrate mitigations.'
Third-order effects
- If federal advisories become the norm, election-technology oversight shifts from vendor self-attestation toward CISA-mediated disclosure and patching — a structural change for an industry long criticized for ignoring researcher findings.
- Persistent vulnerability disclosures across multiple election cycles strengthen the case for voter-verifiable paper records as the baseline control, regardless of which vendor supplies the hardware.
The trend: US election security is moving from researcher-led disclosure that vendors ignored toward formal federal advisories that force named vendors and state officials to act.