By Howard Fischer
Capitol Media Services
PHOENIX -- Secretary of State Katie Hobbs is telling Maricopa County officials they can no longer use the election equipment that the Senate subpoenaed and turned over to Cyber Ninjas.
In a letter Thursday to county supervisors, Hobbs said security experts told her that once the county lost custody and control of the voting systems "these devices should not be reused in future elections.''
"Rather, decommissioning and replacing those devices is the safest option as no methods exists to adequately ensure those machines are safe to use in future elections,'' Hobbs wrote. "Instead, the county should acquire new machines to ensure secure and accurate elections in Maricopa County going forward.''
A spokesman for the board said the letter is being reviewed by attorneys who will advise the supervisors what to do next.
And Megan Gilbertson, spokeswoman for the county Elections Department, said her agency will not use any of the equipment that has been -- or remains for the moment -- in the hands of the Senate auditors "unless the county, state and vendor are confident that there is no malicious hardware or software installed on the devices.''
But state Elections Director Bo Dul told Capitol Media Services there is no realistic way to do that.
The cost would be substantial.
County officials say they have a three-year, $6.1 million, lease from Dominion Voting Systems for the equipment that runs until just before the 2022 election. They already have paid $2.8 million of that.
Dul said it would be one thing if the equipment had been "hacked'' through a cyber attack. At that point, she said, the drives could be wiped clean of any code that doesn't belong there and reinstall the software from scratch.
This, Dul said, is more akin to people breaking into a company and getting physical access to the equipment.
"When you lose physical custody of the equipment, it's not just the software that you're worried about,'' she explained. "Even if you wipe everything, there's still certain pieces of firmware for the equipment that it's impossible to completely wipe.''
More to the point, Dul said, there is no way to actually test for those kinds of alterations.
"We can put the machines through all sorts of state-of-the-arts forensic analysis to identify if there's been any tampering,'' she said. And that firm can check off everything on its list.
"But we don't know what we don't know,'' Dul said. "So we don't know that the list that they're testing for and checking for covers everything.''
The problem, Hobbs explained to supervisors, is it is not clear what procedures, if any, were in place once the county turned the equipment over to the Senate and Cyber Ninjas.
"Indeed, our expert observers, as well as multiple news reports, have noted troubling security lapses,'' she wrote. Nor, Hobbs said, was there any transparency.
"No election official or expert observer designed by my office was allowed to remain with the equipment for the duration of the Cyber Ninjas' processing and handling of the equipment, nor did Cyber Ninjas provide a continuously, clearly visible livestream of the area where voting equipment was stored and handled,'' the secretary wrote. "The lack of physical security and transparency means we cannot be certain who accessed the voting equipment and what might have been done to them.''
What Hobbs thinks is critical.
It is her office that is in charge of certifying equipment for use in elections. And if the county for some reason balks and decides to re-use the equipment, Hobbs said her office will consider "decertification proceedings.''
Less clear is who would be responsible for the cost of replacement equipment. County officials said they believe the Senate, having demanded access to the equipment through a subpoena, agreed to provide indemnification if there were any damage.
