Vendor-controlled elections are un-auditable

Texas uses KnowInk brand poll pads. In 2020, Wisconsin cities received over $10 million from the Center for Tech and Civic Life (CTCL) — a nonprofit funded almost entirely by Facebook founder Mark Zuckerberg and his wife Priscilla Chan — to administer their elections. Dozens of states have subscribed to ERIC, the Electronic Registration Information Center, a private nonprofit that manages voter roll data on behalf of member states. In each case, a core function of democratic governance has been handed to an outside party.

Every jurisdiction that conducts electronic voting must obtain its hardware and software from private vendors. With rare exceptions confined to small pilot programs, every one of those vendors maintains that their systems are proprietary — meaning no one outside the company is permitted to examine what is happening inside them. This claim has been used repeatedly to block independent scrutiny of tabulators, poll pads, voter roll databases, and other election-critical equipment.

My recent findings in Bexar County, Texas illustrate what this means in practice. KnowInk’s ePulse platform, which manages all Poll Pad data flow, runs on Amazon Web Services commercial cloud infrastructure — not on any county or state government server. The data generated by Texas voters on Election Day resides on servers the county does not own, does not control, and cannot compel to produce records. KnowInk’s own documentation acknowledges that poll pads “may need to be left on for a time after the polls have closed to update information with the elections office.” What moves during that update process is known only to the vendor.

A small nonprofit vendor called VotingWorks has built its system around a different model: air-gapped hardware with no remote server connections, producing paper ballots voters can verify before casting. This architectural difference matters more than any published code. A device with no network connection cannot receive remote write commands after polls close — regardless of what software it runs. VotingWorks currently represents a fraction of one percent of the national market. The architecture it demonstrates is available. It is simply not being chosen.

This creates a peculiar legal and moral situation. An election official who genuinely does not know what is happening inside a vendor’s system can plausibly claim ignorance. They pushed the buttons they were told to push. They certified what the system reported. Their hands appear clean.

This is an illusion.

An election official is a public trustee bearing personal responsibility for the integrity of the process. That responsibility cannot be subcontracted. When a county signs a vendor agreement transferring custody of election data to an offsite server in an unknown location managed by a company it cannot compel to produce records, that official has not discharged their duty — they have abandoned it. The ignorance that follows is not a defense. It is the consequence of the abdication itself.

This differs from any ordinary business arrangement. When Wells Fargo carried cargo in the nineteenth century, they accepted liability for its safe delivery even when using subcontractors. If cargo was lost, Wells Fargo paid in full. Elections have no equivalent mechanism. If votes are altered or fabricated within a vendor’s system, the outcome stands, the vendor invokes proprietary privilege, and the voters — the only parties with a genuine stake — have no avenue of recourse.

Consider a licensed pharmacist who dispenses medication from a facility he has never inspected. A patient is harmed. “I trusted the supplier” is not a defense recognized by any licensing board, because the license exists precisely to ensure that someone with verified competence stands personally accountable between the supply chain and the public. Election officials hold the same trust. Their oath of office does not say: “I will certify whatever a vendor’s system reports.” It says: “I will faithfully discharge the duties of this office.” Delegating that duty to a private contractor does not transfer the responsibility. It simply ensures that when something goes wrong, no one is accountable.

When accountability is systematically removed from vote counting, certification becomes a formality. A democracy that runs on formalities rather than verified accountability is not a democracy. It is the appearance of one.