By Staff
When a South Carolina citizen registers to vote, their name, address, date of birth, and the last four digits of their Social Security number enter a digital pipeline that snakes through at least four private companies, eleven state agencies, a multistate data clearinghouse with exactly two employees, and a voting equipment manufacturer whose internal software is classified as proprietary and hidden from public view. None of those private vendors are subject to the Freedom of Information Act. Not one.
The system is called VREMS, short for Voter Registration and Election Management System. It was built in 2011 by a small Greenville technology firm called TiBA Solutions. TiBA was acquired by a larger company called NWN, which in turn sold the division to Kopis, LLC, another Greenville software house, in 2018. The same codebase, now approaching a decade and a half old, has been passed through three corporate owners like a used car with a rolled back odometer. Kopis maintains it today under a statewide contract classified, curiously, under "Customer Relationship Management Software." Voters are not customers, but the database does not know the difference.
The technical architecture is a time capsule from the Obama era. The user interface runs on ASP.NET Web Forms, a Microsoft framework that was already considered legacy when VREMS was built. The middleware layer uses Windows Communication Foundation, a complex messaging platform with a well documented history of deserialization vulnerabilities that allow remote code execution when configurations are sloppy. The backend is Microsoft SQL Server. When the state put the maintenance contract out for bid in 2017, the solicitation documents tell a revealing story: page after page, module after module, the state's response was the same five words. "No modifications required at this time." Candidate tracking, online voter registration, absentee ballot requests, the smartphone application, the electronic voter list, the Motor Voter processing pipeline, the voting system interface all of it marked for static upkeep, not active hardening.
A system that does not change is a system that does not improve. Security patches may land on the server, but architectural vulnerabilities are not fixed in maintenance mode. They are inherited.
The database lives on servers inside the South Carolina Department of Administration's State Data Center, a facility that carries SOC 1 Type 2, SOC 2, IRS Publication 1075, and PCI compliance certifications. Those credentials mean the doors are locked, the cameras are on, and someone is logging who enters the server room. They say nothing about whether the application running on those servers can be exploited through a crafted web request.
From that central database, voter data fans outward in multiple directions, each a potential point of failure.
Every election cycle, VREMS exports voter roll data to Election Systems and Software, the Omaha based company that supplies South Carolina's voting equipment under a roughly fifty one million dollar contract signed in 2019. The export feeds into ElectionWare, ES&S's proprietary election management system, which in turn loads data onto ExpressPoll electronic poll books and ExpressVote ballot marking devices deployed across all forty six counties. The interface was originally built for Unity, ES&S's older election management platform. What file format carries the data? What authentication secures the transfer? Is the export pushed over an encrypted network share or walked across on a flash drive? The public has no way to know. ES&S classifies the internal components and software of its voting system as proprietary, and county election offices are instructed to tell curious citizens exactly that.
Once the data reaches the polling place, the security perimeter collapses to whatever a temporary poll worker can be trained to do in a few hours. ExpressPoll poll books are modified Android tablets. DS200 tabulators have exposed USB ports. The DS200 stores vote data on a CompactFlash card. Every one of those devices is physically accessible to poll managers during setup and teardown. Physical access to a machine is game over in any honest threat model.
Then there is ERIC, the Electronic Registration Information Center, a nonprofit membership organization that South Carolina joined in 2018. Every sixty days, the state transmits its full voter registration file plus motor vehicle licensing data to ERIC's servers. Before transmission, a cryptographic hash is applied using software provided by IBM and Senzing, the entity resolution firm whose matching algorithms power the whole operation. The hashing is cryptographically sound on paper: HMAC-SHA2-256 with a 1024 bit secret key stored in an AES-128 encrypted secure store. But the hash protects data in transit and at rest on ERIC's infrastructure. It does nothing to secure the unhashed voter file sitting on a state server at the moment the hashing application runs. If that server is compromised, the hash is a lock on a door with no walls.
ERIC's own FAQ boasts that only two employees process all member data and generate all reports for twenty seven member states. Two people. No separation of duties. No peer review. If one of those two individuals is phished, bribed, or extorted, the entire multistate data processing pipeline is compromised. If both are unavailable, contingency access becomes an unknown variable. Two employees is not a security feature. It is a single point of failure dressed up as efficiency.
The matching software itself raises questions the public documentation does not answer. Senzing's platform uses entity centric learning, a form of artificial intelligence that improves match accuracy as more records accumulate. The company's marketing emphasizes resolving differences in how records describe the same person a DMV address providing the missing link between two voter records that would otherwise not match. Fuzzy matching of this kind requires comparing actual data fields, not just cryptographic hashes. Somewhere in ERIC's processing pipeline, voter data must exist in unhashed form long enough for the matching engine to do its work. Where that happens, for how long, and with what access controls is not disclosed.
Compounding the opacity, ERIC's FAQ acknowledges that in 2018 and 2020, individual member states voluntarily participated in third party research projects to evaluate the effectiveness of mailings sent to eligible but unregistered residents. ERIC states it acted as a secure pass through for member data used in these projects. The researchers are not named. Their institutions are not disclosed. The data handling agreements are not public. If South Carolina voter data was shared with academic researchers who stored it on university servers which are notoriously soft targets for cyberattacks that exfiltration vector is completely invisible to the citizens whose data was shared.
The 2024 South Carolina Legislative Audit Council review of the Election Commission found that the state has paid over two hundred thousand dollars in ERIC membership dues and more than three hundred thousand dollars on required mailings to unregistered residents since joining. It also found that the SEC "has not implemented all voter registration list maintenance reports that could allow the agency to determine instances of improper voting." South Carolina is paying for data it does not fully use, while nine states have left ERIC since 2022, most of them in the Southeast.
Meanwhile, eleven state agencies feed voter registration data into VREMS under the National Voter Registration Act. The Department of Motor Vehicles, the Department of Social Services, the Department of Health and Environmental Control, the Department of Health and Human Services, the Department of Disabilities and Special Needs, the Department of Mental Health, the Department of Alcohol and Other Drug Abuse Services, the Commission for the Blind, the Vocational Rehabilitation Department, Protection and Advocacy for People with Disabilities, and Armed Forces recruiting stations all transmit weekly files that land in a manual review queue inside VREMS. A human being clicks on those files. If any one of those eleven agencies is compromised and its file transfer is weaponized, the manual reviewer becomes the attack vector into the statewide voter database.
The DMV connection is especially consequential. The online voter registration portal on SCVotes.gov matches applicant data against the DMV database in real time, meaning VREMS maintains a live API connection to the motor vehicle system. And the DMV is currently in the middle of a complete IT modernization procurement, solicitation number 5400027020, seeking to replace its entire driver, vehicle, and identity management platform. Whoever wins that contract will build the new DMV to VREMS interface. If the interface specification is not locked down tight if it allows more data to flow than strictly necessary, or if authentication tokens can be stolen the new DMV system becomes a privileged pathway into voter registration data for whoever controls it.
IDEMIA, the French biometrics and identity conglomerate, is not currently in South Carolina's voter registration pipeline. The company holds a state contract for concealed weapons permit fingerprinting and application processing, worth roughly eight and a half million dollars. It bid on the DMV driver's license production contract in 2023 and lost to Canadian Banknote Secure Technologies after a contentious protest. But it could bid on the DMV modernization contract, and if it wins, IDEMIA would suddenly sit at the headwaters of the data stream that feeds both voter registration identity verification and ERIC submissions.
On the voting equipment side, South Carolina runs ES&S ExpressVote ballot marking devices, DS200 and DS450 tabulators, and ExpressPoll electronic poll books. These systems have been demonstrated to contain vulnerabilities at events like DEF CON's Voting Village. The ExpressPoll runs on a modified Android operating system. The DS200 stores votes on removable flash media. The ElectionWare management system is a Windows application that receives the voter roll export from VREMS. Every one of these components is a potential entry point.
The good news is that the State Election Commission has not been asleep. The 2025 annual report documents a Vulnerability Disclosure Program that allows external security researchers to report bugs, CrowdStrike endpoint protection deployed across SEC systems, physical security assessments conducted with the Department of Homeland Security at all forty six county offices, NIST based security posture surveys, and membership in the Multi State and Elections Infrastructure Information Sharing and Analysis Centers. CISA conducted a Risk and Vulnerability Assessment in the summer of 2023, examining both external internet facing vulnerabilities and internal insider threat scenarios. The SEC participated in Tabletop the Vote exercises and held statewide Election Security Day events. Hand count audits are now performed on a percentage of ballots after every election, and the agency is piloting risk limiting audits that use statistical sampling.
These are serious measures. But they are measures applied at the state agency level. They do not reach into the private vendor systems that form the backbone of the election infrastructure.
The fundamental structural problem remains: the companies that built, maintain, and connect South Carolina's election systems are shielded from public scrutiny. Kopis is not subject to FOIA. ES&S is not subject to FOIA. ERIC is not subject to FOIA. Senzing and IBM are not subject to FOIA. If there is a breach, if there is a vulnerability, if there is a misconfiguration that has sat in the codebase since 2011, the public has no legal mechanism to discover it unless the state chooses to disclose it voluntarily. Security researchers cannot audit the source code. Penetration test results are not published. There is no bug bounty program for VREMS. The security model is security through obscurity, and obscurity is not a strategy. It is an absence of one.
What South Carolina needs is not a single fix but a structural overhaul.
First, the legislature must extend public records law to cover private vendors that handle voter registration data and election infrastructure. If a company takes taxpayer money to build or maintain a system that determines who can vote and whether their ballot is counted, the public has a right to audit that system. Proprietary code that handles public elections is an oxymoron. The source code for VREMS should be available for independent security review under a nondisclosure agreement. The interface specifications between VREMS and ES&S ElectionWare should be public. The data handling agreements between ERIC and its third party research partners should be disclosed.
Second, the state needs an independent, ongoing penetration testing program that covers the entire election data pipeline, not just the SEC's own network. The CISA assessments are valuable but they are periodic and focused on the state agency. A dedicated red team should be probing VREMS, the ES&S interface, the NVRA agency file transfers, the DMV OVR API, and the ERIC data transmission workflow on a continuous basis. Findings should be published in redacted form so the public can assess the security posture without exposing active vulnerabilities.
Third, the ERIC relationship needs a hard reassessment. The two employee bottleneck is indefensible. The undocumented third party research data sharing is unacceptable. The fact that South Carolina is paying for list maintenance reports it does not use while nine other states have walked away should trigger a cost benefit analysis that accounts for security risk, not just membership dues. If the state stays in ERIC, it should demand that all data processing be conducted onshore with auditable access logs, that the number of personnel with data access be expanded to allow meaningful separation of duties, and that all past and future third party data sharing be disclosed in full.
Fourth, the DMV modernization contract must include binding security requirements for the voter registration interface. The RFP should specify that the interface must use mutual TLS authentication, that data transfers must be limited to the minimum fields necessary for identity verification, that all API calls must be logged and auditable, and that the interface specification must be reviewed by an independent security assessor before deployment. The vendor should be required to submit to annual penetration testing of the interface and publish the results.
Fifth, the NVRA agency data pipeline needs to be locked down. Weekly file transfers from eleven agencies with wildly varying cybersecurity postures is an accident waiting to happen. The state should implement a centralized, hardened file transfer platform with mandatory malware scanning, file type whitelisting, and automated validation before any file reaches a human reviewer. Agencies should be required to meet minimum cybersecurity standards as a condition of participating in the voter registration data pipeline.
Sixth, the voting system interface between VREMS and ES&S needs to be redesigned as a one way, air gapped export with cryptographic signing. The export file should carry a digital signature that the ES&S system verifies before import, ensuring that the voter roll data loaded onto poll books and tabulators has not been tampered with in transit. The export should be logged and the logs should be publicly auditable after each election.
Seventh, South Carolina should follow the direction of legislation already filed in the General Assembly. House Bill 3628, the Secure, Accurate, and Verifiable Elections Act, proposes requiring paper poll books instead of electronic ones, establishing chain of custody requirements for all voting system components, mandating hand counts of paper ballots, requiring public access to observe the ballot count process, and making general election day a legal holiday. Paper poll books eliminate the attack surface of networked Android tablets at polling places. Chain of custody requirements create accountability for every device that touches voter data. Hand counts provide a verification mechanism independent of proprietary software. These are not radical proposals. They are basic hygiene.
Eighth, the state should establish a voter registration data access log that is available to every registered voter. If a citizen can check their credit report to see who has accessed their financial data, they should be able to see every agency, vendor, and organization that has accessed their voter registration record, when, and for what stated purpose. Transparency is a security control. Secret data flows are inherently untrustworthy data flows.
The 2024 Legislative Audit Council review of the SEC found 4,950 registered voters with duplicate Social Security numbers and 766 voters whose name, Social Security number, and date of birth had multiple matches in the system. Those are the problems visible from the outside. The vulnerabilities that are not visible the legacy code flaws, the misconfigured middleware, the unsecured file transfers, the third party data handoffs to unnamed researchers are unknown by design. That is not a system that inspires confidence. It is a system that demands sunlight.
South Carolina's election infrastructure is not one fortress. It is a network of interconnected systems built by different vendors, maintained under different contracts, governed by different rules, and shielded from public view by the convenient fiction that proprietary software is incompatible with democratic accountability. Every interface between those systems is a potential entry point. Every vendor that cannot be audited is a potential threat. Every data flow that cannot be traced is a potential leak.
The 2026 general election is coming. The DMV modernization contract is being awarded. The ERIC relationship continues to cost money and deliver incomplete results. The VREMS codebase gets older every day. The time to act is not after a breach makes headlines. It is now, while the vulnerabilities are still hypothetical and the fixes are still possible.
Sources:
South Carolina Election Commission cybersecurity audit voter registration breach 2024 2025
State Election Commission scstatehouse.gov
2024 Annual Report scvotes.gov
South Carolina voter roll security legislation reform 2025 2026
Secure, Accurate, and Verifiable Elections Act scstatehouse.gov
Election Law Changes - SC Votes scvotes.gov
South Carolina Legislature Online - Bill Search by Bill Number scstatehouse.gov
No comments:
Post a Comment