NEWS
Wyoming citizens working with attorney Fred Harrison and election-system researcher Rick Weible are seeking the records behind a basic assurance to voters: that the equipment counting their ballots has been properly tested, maintained, and checked.
Their inquiry centers on how election programming reaches voting machines, whether security updates were installed, and whether pre-election tests covered the ballot formats voters actually use. For voters, the records would provide a way to check those safeguards and identify any problems requiring correction.
Harrison and one of his clients describe the effort as a citizens’ inquiry, not a lawsuit. Its purpose, he says, is to obtain records showing compliance with Wyoming law and allowing independent verification of the systems used to count votes. “We are not asking anyone to assume fraud,” Harrison wrote in a follow-up email to Open Range Record.
Harrison says public-records requests remain outstanding for maintenance records, testing worksheets, equipment inventories and official explanations. Weible, in an interview with The Open Range Record, described the connections he believes deserve closer scrutiny.
The materials reviewed so far identify gaps in documentation and allegations that some clerks’ offices did not follow legally required testing procedures. The county-specific questions described below remain subject to verification through complete testing records and official explanations. They do not establish that someone accessed Wyoming’s tabulators without authorization or changed election results.
The route into election equipment
Weible’s concern begins before a voter feeds a ballot into a tabulator. He described a process in which election personnel use county computers connected to the internet to download election definitions, the programming that tells election equipment which contests and candidates appear on a ballot, from an Election Systems & Software portal.
According to Weible, that programming then moves through a SYSTOR USB duplicator onto approved Delkin drives used in election equipment.
His concern is that a compromised computer or source file could introduce malicious software into that transfer process. If it reached a tabulator and bypassed its safeguards, such software could potentially interfere with vote counting and cause reported totals to differ from the votes on the paper ballots. That is the potential consequence under discussion; the materials supplied do not demonstrate that such an attack succeeded in Wyoming.
“That’s where the air gap fails,” Weible said.
An air gap keeps equipment disconnected from a network. Weible’s concern is that election-programming files downloaded on an internet-connected county computer are then copied onto USB drives and loaded into election equipment. He worries that harmful software could be transferred along with those files if the source computer or files were compromised. His account does not establish that this has happened or that the tabulators themselves have a live internet connection.
During the interview, Weible specifically rejected the suggestion that clerks could simply insert inexpensive, ordinary store-bought USB drives into the tabulators. He said the equipment recognizes particular approved Delkin drives.
ES&S described the same restriction in an August 13, 2024, letter to Wyoming Secretary of State Chuck Gray. The company said its voting equipment would not accept other Delkin or third-party USB drives. It separately explained that an election-management computer can use other drives to export results for uploading through another computer to the state reporting system.
Weible’s question concerns what gets copied onto an approved drive and which equipment handles it along the way. Establishing whether that process creates an exploitable weakness in a particular county would require examining the actual workflow, equipment, and security controls.
He favors having ES&S supply prepared drives directly to counties and keeping election computers separate from ordinary county internet-connected equipment.
Which equipment belongs inside the certified system?
Harrison and Weible also question how equipment used to prepare election materials is classified. In its August 2024 letter, ES&S said the OkiData C712 ballot-on-demand printer and Dell Latitude 3500 ballot-on-demand laptop with router were ancillary equipment outside the federally certified configuration. The company said they did not require Election Assistance Commission certification as part of the voting system.
ES&S also said it understood Wyoming had approved SYSTOR USB formatting equipment and that such equipment did not require EAC certification. Weible disputes the adequacy of that boundary. He argues that equipment used to prepare ballots or handle election programming should receive scrutiny because its output enters the voting process.
His concern about ballot-on-demand equipment is practical as well as regulatory. In the interview, he explained that printer settings, margins, and scaling can affect where ballot markings appear on the page. Testing the resulting ballots, he said, is necessary to establish that a tabulator reads them correctly.
The disagreement over certification remains unresolved in the materials supplied for this article. ES&S’s position is that the equipment is ancillary; Weible argues that its role in preparing election materials warrants inclusion and review.
Conflicting accounts of a security update
The records also raise a specific question about an update known as Engineering Change Order 1141.
The EAC approved ECO 1141 on June 8, 2022, for EVS 6.0.6.0 and EVS 6.2.0.0. Its description identifies a specific Windows vulnerability, CVE-2021-34527, known as PrintNightmare, and an update to antivirus definitions. The affected operating systems were Windows 10 and Windows Server 2016 on election-management computers.
Two ES&S communications from 2024 appear difficult to reconcile.
In a July 31 email to Gray, ES&S regional sales manager Lori Mommaerts wrote that ECO 1141 could be updated but that the company would need approval before making an update. She referred to a 2022 request for approval and said it was something the company should have followed up on.
Less than two weeks later, ES&S Vice President of Certification Timothy Hallett wrote that the company had upgraded Wyoming counties’ election-management systems to EVS 6.0.6.0 in May 2023 and that the upgrade included ECO 1141.
The correspondence leaves an unanswered question about what approval or installation work remained outstanding in July 2024, if the update had already been included in the May 2023 upgrade.
Weible has acknowledged that he does not possess county maintenance records or inspection results confirming the installation status. “We need to see records from either the counties or the SOS showing the antivirus/patches were installed,” he wrote in an email to Open Range Record.
What Weible’s five-year review adds
Weible’s reports, posted at uscase.org, examine EAC engineering change orders for 2022 through 2026. The tables identify manufacturers, affected systems, approval dates, and descriptions of changes, with separate columns recording his assessment of whether each change includes Windows or antivirus updates.
His 2026 review covers January 1 through September 23. He marks the listed entries as containing neither Windows nor antivirus updates, although the table records other changes, including replacement computers, memory components, equipment repairs, and an election-results reporting feature. His 2024 and 2025 tables similarly identify no Windows or antivirus updates among the entries reviewed.
The earlier reports contain qualifications. His 2022 table identifies ECO 1141 as including both Windows and antivirus updates. His 2023 table labels several Dominion computer replacements as partial Windows updates, citing Windows 10 Pro version 21H2, while marking their antivirus-update column “No.” Those entries help define his concern: whether approved changes keep malware protection current across the systems already in use.
The federal standards he cites address that obligation. Section 7.4.2 of the Voluntary Voting System Guidelines 1.0 requires protection against malicious software and directs vendors to document procedures for keeping that protection current. The EAC’s 2019 notice on minor software changes also describes a review process requiring testing-laboratory endorsement and written EAC approval before a proposed change is implemented through that process.
For Wyoming, the review adds a question beyond whether ECO 1141 was installed: What records show how security protection has been maintained since then? Weible’s tables are his analysis of change-order records, rather than an inspection of county machines. Determining their present condition requires installation logs, software-version information, and the applicable maintenance procedures. The 2026 report also does not cover approvals after September 23.
Testing the ballots voters use
A second major part of Harrison and Weible’s work concerns logic and accuracy testing, which is the pre-election process used to compare equipment results with a known set of test votes. Weible explained why the different ways ballots are produced matter. A conventional paper ballot has ovals that voters mark. An ExpressVote device produces a different ballot format. Ballot-on-demand equipment prints ballots locally.
In his view, a test needs to demonstrate that the equipment correctly handles each applicable format. Weible also described examining Laramie County test ballots following a deposition involving the clerk’s attorney. “There wasn’t a single standard ballot there,” he said of the material he examined.
That account supports his request for closer examination of the testing record. The interview did not identify the election year or establish whether the inspected material included every separate test or retest.
Separately, Harrison’s written response identifies Laramie County reports described as covering 2026 primary and general election testing. Weible interprets repeated vote totals in increments of 40 for the primary and 41 for the general as evidence that testing covered only one ballot format.
Harrison acknowledged that the full worksheets, machine tapes, and county explanation are still needed. The reported numerical patterns are the basis for Weible’s interpretation; they do not, by themselves, establish which physical ballot formats were included.
Other county records present questions that also require context. Harrison described a Campbell County notation stating that only one ballot style was tested, alongside a certification reporting testing involving ExpressVote, ballot-on-demand and printer-produced ballots. He said the available material does not establish whether the notation concerns an entire county test, one machine, or one location.
For Fremont County, Harrison identified a test record showing 16 undervotes on each of two systems. He said the expected-results worksheet is needed to determine whether those were intentional test conditions or unexpected results.
The records still needed
Harrison says his office represents Wyoming citizens pursuing election-integrity and election-record preservation issues. He clarified that his initial notice asked officials to preserve testing materials, system logs, chain-of-custody records, vendor communications, and other election records. It did not ask officials to produce copies of those records.
Separate requests for records have since been made to several counties, the Secretary of State, and the Attorney General. His office is communicating with county clerks and their legal representatives. “We want the article to stay tied to records we can document,” Harrison wrote.
The records sought would help answer concrete questions: Which computers handle election programming? What controls protect those transfers? When were approved security updates installed? Which ballot formats were tested, and were any failed tests corrected?
ES&S’s existing correspondence supplies part of the response, including its position on ancillary equipment and its assertion that ECO 1141 was installed in 2023. County-specific maintenance and testing records remain necessary to resolve the disputed details.
Harrison argues that the records supporting public logic and accuracy tests should be readily available. He identified test decks, expected-results worksheets, machine reports, retest records, ballot-style records, maintenance records and certifications as materials citizens should be able to examine without first filing records requests.
“Public Logic and Accuracy testing should produce public proof,” he wrote. Harrison’s client, likewise, urged county clerks to help answer the questions and correct any problems the review establishes. He said voters should not have to shoulder the expense of pursuing answers that officials could provide voluntarily.
Harrison said voluntary disclosure by clerks and state officials could resolve many of the outstanding questions. “If the systems were properly tested, maintained, and certified, the records should show it."