Election Systems Software 11208 John Galt Blvd  Omaha NE 68137 P 402 938 1437  TF 1 877 377 8683 teburt@essvote com  www essvote com August 24 2018 By Email UPS Overnight The Honorable Kamala D Harris 112 Hart Senate Office Building Washington D C 20510 The Honorable Mark R Warner 703 Hart Senate Office Building Washington D C 20510 The Honorable Susan M Collins 413 Dirksen Senate Office Building Washington D C 20510 The Honorable James Lankford 316 Hart Senate Office Building Washington D C 20510 Dear Senators Harris Collins Warner and Lankford Thank you for your letter of August 22 2018 and for the opportunity to discuss how Election Systems Software ES S is working with many stakeholders including the U S government to secure our democracy through free and fair elections Below please find our answers to your questions as well as our invitation for you to join us in a discussion on election integrity 1 Will ES S commit to allowing election agencies to arrange independent qualified good faith cybersecurity tests of ES S election systems and share results with the public Further will ES S work with agencies to conduct these tests If not why not Our answer to your question is yes ES S enlists election agencies to conduct independent qualified good-faith cybersecurity tests of ES S election systems ES S products are certified by the U S government which conducts independent testing In addition our products are tested by several third-party experts including those being arranged by the Department of Homeland Security DHS As you may know certification via the federal Election Assistance Commission EAC is an extremely thorough process that requires thousands of hours for testing of each product and often each product variant Additionally many states including California require a separate extensive testing and certification process Any assertion that our products are not thoroughly and independently tested or that we do not allow election agencies to arrange testing is erroneous ES S will continue to share significant findings with the EAC Voting System Test Labs and the State and Local Election Officials we partner with and support We will not however provide or submit any hardware software source code or other intellectual property to unvetted anonymous security researchers nor would we make public any assessments of vulnerability findings because providing or making available secure information to individuals or groups whose interests may counter the United States’ interests would be irresponsible and may in fact jeopardize the integrity of elections Maintain Voter Confidence Enhance the Voting Experience ES S tests independent tests and third-party tests are conducted under both extreme laboratory conditions as well as realistic conditions that replicate a typical polling place or elections office to take into account what kind of hacking is and isn’t possible during an actual election That way time and resources are directed to vulnerabilities that are actually capable of being exploited We believe there is real value in the ethical “white hat” hackers We agree security researchers or ethical hackers often provide significant and measurable insight into the vulnerabilities associated with technology of all kinds Whether it is hardware software personnel or facilities security researchers help technology manufacturers be more aware of the cyber threats that may affect the devices we use in our daily lives Security researchers also assist government and businesses in protecting vital information and critical infrastructure assets important to our national security and democracy 2 Will ES S commit to providing election agencies with ES S election systems at a reasonable cost before entering into a long-term contract with ES S so that they can arrange independent cybersecurity testing If not why not Our answer to your question is yes ES S makes its systems available for review at no cost before an election jurisdiction makes a financial commitment to acquire the system First we provide system review through the above-mentioned EAC federal testing program which makes available the complete test reports of our systems for public review Second each state election authority requires its own level of testing of voting systems before a jurisdiction can acquire a voting system Many of these states use independent third-party researchers academics and laboratories – all of whom we most willingly work with The results of the tests determine whether a system is allowed to be used within a jurisdiction All of this information and access ensures election agencies make informed decisions about which election equipment will help them conduct secure elections 3 Will ES S commit to providing independent qualified good faith cybersecurity researchers with ES S election systems at a reasonable cost so that the researchers can conduct cybersecurity testing and share their results with the public If not why not Our answer to your question is yes We will commit to this and as stated above ES S already uses independent qualified good-faith cybersecurity testing and researchers and shares information and coordinates with appropriate government and elections agencies to ensure we provide the best protection possible for this vital element of our nation’s infrastructure We actively meet and work with academics researchers all levels of government and other outside experts to ensure we provide the best protection possible for this vital element of our nation’s infrastructure Senators we respect your positions and share your interests in election security We are an American company that dedicates each and every day to the security of elections as well as every other aspect of this cornerstone of our nation’s democracy Independent robust and ethical testing is just one example of the steps we take—as a matter of course—to ensure election integrity It is to our benefit to do so—any compromise of our products or technology would be harmful to our business to our personal integrity and to the trusted relationships we have built over the last 40 years Elections are our sole business Our dedicated employees spend all their waking hours on research development security and ongoing support of our products and processes for our nation’s elections We support many of the bills currently in Congress and welcome optical scan precinct-based balloted voting with risk limiting audits as many experts have endorsed We completely understand that today’s environment presents risks to our democracy that are unprecedented All informed observers and participants in protecting America agree that our nation’s critical infrastructure is under attack by nation-states cybercriminals and professional and amateur hackers That’s why forums open to anonymous hackers must be viewed with caution as they may be a green light for foreign intelligence operatives who attend for purposes of corporate and international espionage We believe that exposing technology in these kinds of environments makes hacking elections easier not harder and we suspect that our adversaries are paying very close attention We strongly urge you to in your capacity as members of the Select Committee reach out to your contacts in the Intelligence Committee and make your own assessment regarding the presence of foreign adversaries in these anonymous forums We note that most defense firms and other critical infrastructure suppliers also do not display national security technology in unsecured environments This prudent approach doesn’t mean there is a lack of cybersecurity testing—to the contrary Security is at the forefront of everything we do We agree that it is only through preparation constant vigilance secure technology post-election audits and strong continuing partnerships between state and local election officials the EAC DHS law enforcement and voting system manufacturers that we will keep the elections infrastructure secure and ES S is at the forefront of that preparation vigilance expertise and coordination Thank you for the opportunity to share our approach We invite each of you as well as your security experts to a discussion to learn more about all of the protective proactive steps our customers and we have taken and continue to take to ensure the integrity of America’s democracy Yours truly Tom Burt President CEO Election Systems Software cc Ms Kathy Rogers kathy rogers@essvote com Mr Zach Lewis zach_lewis@warner senate gov Ms Darci Greenacre scheduling@collins senate gov Ms Sarah Seitz sarah_seitz@lankford senate gov Senator Kamala D Harris kamala_harrissac@harris senate gov Maintain Voter Confidence Enhance the Voting Experience