By Staff
There
is another question that deserves to be separated from the broader
arguments about Dominion, Fox and the 2020 election. Where, exactly,
are the individual components inside voting systems manufactured?
This
is not a hypothetical question.
Americans
sometimes hear that voting machines are "American made" and
reasonably assume that this means the chips, processors, memory,
firmware components and other critical electronics inside those
machines are also manufactured in the United States.
The
federal record is more complicated.
In
congressional testimony concerning election equipment, industry
representatives acknowledged that certain components used in voting
equipment are manufactured outside the United States. One witness
testified that "most of the voting equipment does use sources
from outside the country," while discussing the possibility of
reshoring more of the supply chain. The witness also distinguished
between requiring U.S. assembly and completely reshoring the
components themselves.
That
distinction matters.
A
voting system can be assembled, configured and tested in the United
States while still containing commercially available electronic
components manufactured elsewhere.
Nor
does federal "Buy American" law automatically mean that
every component inside a government purchased electronic product must
be American made. Federal acquisition rules define a "domestic
end product" using a manufacturing and domestic content test,
while also providing specific treatment for commercially available
off the shelf products. The legal definition of a U.S. made end
product and the country of origin of every individual component are
therefore not necessarily the same thing.
This
does not establish that any foreign made component in a voting
machine is compromised.
It
does establish something much narrower and more important.
"American
made voting machine" is not necessarily synonymous with "every
critical electronic component was manufactured in America."
That
creates a legitimate supply chain security question.
The
question is not whether a chip manufactured overseas is automatically
malicious. That would be an unsupported conclusion.
The
question is whether the election security system has adequate
safeguards against the possibility that a critical component,
firmware image or other piece of the supply chain could be
counterfeit, tampered with or otherwise compromised before it reaches
the United States.
The
federal government itself recognizes supply chain security as an
election security issue. The Cybersecurity and Infrastructure
Security Agency has identified risks involving election equipment
supply chains and recommended measures including identifying supply
chain risks, protecting against counterfeit or tampered components,
and maintaining the integrity of third party hardware and firmware.
That
concern also helps explain why certification cannot reasonably be
treated as synonymous with perfection.
The
Election Assistance Commission's certification program tests specific
voting system configurations against applicable federal standards
through accredited laboratories. Its Quality Monitoring Program is
designed to help ensure that the systems certified by the EAC are the
same systems sold by manufacturers and includes fielded system
reviews, anomaly reporting and manufacturing site visits.
Those
are meaningful safeguards.
But
certification primarily establishes that a particular system
configuration has undergone the prescribed testing. It does not mean
that every semiconductor inside that system has been independently
manufactured in the United States or that every possible hardware
level supply chain attack has been mathematically eliminated.
That
distinction is especially important when discussing processors, boot
components, memory and other electronics that sit beneath the voting
application itself.
A
malicious change to ordinary application software is one problem.
A
malicious modification to the underlying hardware or firmware would
be a different class of problem.
That
does not mean such a modification occurred.
There
is no evidence presented here that a foreign manufactured
semiconductor inside a Dominion system was deliberately altered to
manipulate the 2020 election.
That
claim would require evidence.
It
would require identifying the specific machine and component,
establishing the component's provenance, demonstrating the alleged
modification, showing how the modification affected the system and
then connecting that mechanism to actual votes.
Without
that chain of evidence, the allegation remains speculation.
But
the opposite claim that certification makes such questions
illegitimate is also too broad.
Government
testing laboratories can miss software defects. Certified systems can
contain coding errors. Manufacturers can issue corrections. Supply
chains can contain vulnerabilities. The EAC's own investigation of
the Williamson County, Tennessee incident demonstrates that
certification does not make software infallible.
The
appropriate conclusion is therefore neither panic nor complacency.
It
is verification.
If
critical election components are manufactured overseas, Americans
should be able to ask reasonable questions about their provenance and
security.
Where
was the component manufactured?
Who
manufactured it?
Who
supplied it?
What
firmware does it contain?
Was
the component inspected or authenticated when it entered the United
States?
Was
the production version compared with the tested version?
Were
the relevant hashes or signatures verified?
Who
had physical access to it?
And
most importantly, what independent evidence exists outside the
machine itself that would reveal an attempt to alter votes?
Those
are not conspiracy theory questions.
They
are ordinary supply chain-security questions.
But
they must remain questions until the evidence answers them.
The
same evidentiary standard that should be applied to Fox, Dominion,
election officials and government agencies must also be applied here.
A
foreign component is not proof of foreign control.
A
vulnerability is not proof of exploitation.
A
software defect is not proof of election fraud.
And
American assembly is not proof that every component originated in
America.
The
responsible position lies between those extremes.
Don't
confuse foreign manufacture with compromise. But don't confuse
American assembly with complete supply chain independence, either.
The
same principle applies to the hardware supply chain. The existence of
foreign manufactured components does not prove that an election was
compromised. But the fact that a machine is assembled and certified
in the United States does not, by itself, establish that every
component inside it was manufactured domestically or that every
possible supply chain risk has been eliminated. Those are questions
that should be answered with component level documentation and
testing, not assumptions.
Sources:
Election
system certification
Shows
the systems that have received EAC certification, the manufacturer,
testing standard, and certification date. EAC:
Certified Voting Systems
citeturn0search0
Explains
that the EAC certification program tests and certifies hardware
and software
through accredited testing laboratories. EAC:
System Certification Process
citeturn0search6
Useful
for showing that certification applies to particular
systems/configurations undergoing testing against specified federal
standards. EAC:
Voting Systems Under Test
citeturn0search8
Discusses
security controls including testing, tamper-evident seals, access
controls and audits. EAC:
Are Voting Systems Secure?
citeturn0search11
Foreign
components / supply-chain issue
This
is probably the most
important source for the point you're making.
This
is the congressional record containing testimony discussing the fact
that voting equipment can contain components manufactured outside the
United States and the distinction between U.S. assembly and
completely domestic sourcing. Congressional
Record: Election Equipment Supply Chain Hearing
I'd
be careful with the article's wording here. The source supports
foreign-sourced
components in voting equipment;
it does not
by itself establish that a particular Dominion processor came from
China or Taiwan.
Federal
“Buy American” rules
This
is the primary federal regulation explaining the definition of a
domestic end product. It says manufactured end products generally
have a U.S.-manufacturing requirement plus a domestic-content test,
while also addressing exceptions such as COTS products. FAR
25.101 — General
citeturn0search2
Particularly
useful because it explicitly distinguishes the test for the country
of origin of an end product from the origin of its components. FAR
25.001 — General
citeturn0search12
That
is the source I'd use to support the article's important distinction:
U.S.-manufactured
end product ≠ necessarily every component manufactured in the
United States.
Election
hardware supply-chain security
This
is particularly strong for your article because it explicitly says
election systems contain hardware components that are part of a
complex,
globally connected supply chain.
CISA recommends identifying supply-chain touchpoints, prioritizing
critical hardware, protecting against counterfeiting/tampering,
physically inspecting components, and continuously checking the
integrity of third-party firmware. CISA:
Supply Chain Risks to Election Infrastructure
CCISA
The
landing page for the CISA publication. CISA:
Election Infrastructure Supply Chain Risk Resources
CCISA
EAC
— Certified Voting Systems
EAC
Certified Voting Systems
EAC
— System Certification Process
EAC
System Certification Process
CISA
— Supply Chain Risks to Election Infrastructure
CISA
Supply Chain Risks
Congressional
hearing on election-equipment manufacturing/supply chain
Congressional
Hearing / Election Equipment Supply Chain
FAR
25.101
as the legal source for the distinction between a domestically
manufactured end product and the origin of individual components. FAR
25.101
