BREAKING EXCLUSIVE: CAN ANY STATES USING KNOWINK SOFTWARE APPLICATIONS BE CONFIDENT IN SAFE AND SECURE ELECTIONS?

Cross Posted from JoeHoft.com:

January 17, 2024 by Joe Hoft

IS BPRO/KNOWINK TOTAL VOTE SYSTEM CAPABLE OF HANDLING THE 2024 ELECTION?

In early 2023, multiple articles were published raising serious questions about an election software used in at least 35 states called TotalVote. TotalVote is an all-inclusive software which handles almost all aspects of an election including campaign finance reporting, voter registration, processing election results, and election night reporting. TotalVote was developed by a company called BPro, from Pierre, South Dakota, which was purchased by KNOWiNK in 2020. TotalVote is centralized and hosted on the Microsoft Azure cloud – raising questions about cybersecurity, and TotalVote is uncertified, yet is handling parts of the election that must be performed on certified software.

BPro/KNOWiNK software has been proven to have allowed backdated voter registrations in Hawaii, unnatural injections of voter registrations in every county in New Mexico, and the KNOWiNK claims in its product information that election workers can override election results.

TotalVote got its start when former Secretaries of State of South Dakota “gifted” it to states all over the country in exchange for sole source contracts with the developer.   Pennsylvania signed a contract with BPro in 2020, New Mexico in 2015, Hawaii in 2014, Arizona in 2017 and Washington State in 2018.   KNOWiNK assumed all these contracts in December of 2020, when it purchased BPro. Then KNOWiNK added Oregon in 2021.

Evidence suggests that all is not well at KNOWiNK, as recent project status reports have shown KNOWiNK is failing to comply with the terms of the contracts signed in Pennsylvania and Oregon.

Pennsylvania recently terminated their contract with Bpro/KNOWiNK to overhaul the outdated voter roll system, and are now forced to return to using the archaic Statewide Uniform Registry of Voters (SURE) voter roll system for the 2024 election cycle.

From a recent Epoch Times article:

“The Pennsylvania State Department terminated the contract on Dec. 4, stating in a letter sent to members of the Pennsylvania County Board of Elections that KNOWiNK would not adequately address “identified deficiencies” in the new SUREVote system meant to replace the current software. Jonathan Marks, Pennsylvania’s deputy secretary for elections and commissions, sent the letter. Questions about the progress of improving the SURE system have routinely come up in Senate hearings and in the halls of the state capitol. The letter verified the work was behind schedule. It described how over the course of nine months the State Department worked with KNOWiNK, trying to correct the course of the project, “including procuring expert mediation and project management services, bringing on the expertise of a chief modernization officer, and collaborating with our vendor to address Pennsylvania’s contractual project standards,” the letter reads.”

In Oregon, KNOWiNK has a $10 million contract to overhaul the Statewide Voter Registration and Election Management systems. This project is called Oregon Registered Voter Information System (ORVIS).

The Oregon State Legislature requires oversight on state issued contracts over $5 million dollars, and they contracted with Gartner, Inc. to oversee the project.  Gartner, Inc. is a giant technology, consulting and research firm with over 100 offices worldwide which reported over $5 billion in annual revenue in 2022.

Per the original Oregon contract, ORVIS kick off was July of 2021 and was scheduled to “go live” in October of 2023.

Publicly available documents from the Oregon Secretary of State chronologically document the details of the project.  Just four months after the project kicked off, Gartner identified leadership issues and the lack of a finalized project management plan.   A June 2022 Executive Steering Committee meeting documented the need for a schedule change, and delayed the Minimum Viable Product (MVP) date from February 2023 to July of 2023.

A July 2023 KNOWiNK weekly status report listed all areas of the project on time and in the green zone, contrary to the owner’s assessment from the same month  that shows multiple areas of the project in the red zone – either behind schedule or over budget, including a lapsed Minimum Viable Product date.

From the September 2023 Gartner assessment:

“Platform Stability – The State still had concerns about items related to Operations & Maintenance, Security, Disaster Recovery. The Oregon Votes solution is being built on a re-platformed version of an older BPro solution, and Oregon will be one of the first customers to use this solution. Although this solution is built on previously deployed and tested software, there is considerable risk that this new product will not be as optimized due to the fact it hasn’t been previously deployed, and battle tested.”

County Availability: The excitement of the previous clerks conference has been replaced with concern for quality, completeness.

Regression Testing: This continues to be a problem. Every time a new release is uploaded something in the previous release(s) breaks. It is unclear if this is due to insufficient testing or if there are issues with the Core Functionality. In any case this must be corrected.” 

Most of the project markers, by this time, had been moved into the medium to high risk zones per Gartner’s independent assessment of the project.

By November 2023, the MVP date had been moved back to early 2024 and the Go Live date had been pushed back a year to 2025.  KNOWiNK, now two years behind schedule and nearly $1 Million dollars over budget, forced the State of Oregon to revert to using its highly unreliable and out of date voter registration system for the 2024 elections.

“The Oregon Centralized Voter Registration System (OCVR) is a critical application used by County and state elections employees to manage election and voter records. OCVR is now over 15 years old and needs significant enhancements or replacement. County Elections offices have minimal tools to improve the voter experience and can’t keep voters updated on the status of their voter registration and completed ballots. OCVR has significant challenges in communicating with third-party systems that are critical to the election process, such as tabulators and scanners.”  September 1, 2023 Gartner Report

 “Secretary Griffin-Valade provided direction – OCVR will be the record of reference for 2024 – ORVIS development will continue in 2024 with some counties participating in a pilot project and a full launce after the 2024 elections. We have intentionally been reluctant to complete a full data refresh until this new platform can be validated by our Security Team.” November 9, 2023 ORVIS Executive Steering Committee

 The following alarming statement is from the October 2023 Gartner Quality Assurance Report:

“Most Counties in Oregon lack confidence in the new system based on testing / training sessions conducted in August 2023 – Concerns from the State over the ability to validate the Security configuration of the new system as its being hosted and maintained by KNOWiNK.  The security concerns are related to the Microsoft Azure platform hosting the data in the cloud.” (emphasis added)

The missed implementation dates were caused by

“a deterioration of the relationship between the State and KNOWiNK degraded project productivity to the point where the February 2024 Go-Live date was highly unlikely. The deteriorated relationship was due to the State’s frustration with KNOWiNK’s previously missed Go-Live dates, and KNOWiNK’s frustration was due to the State’s pace at making critical decisions required to move the project forward.”

Gartner requires a reset of the broken relationship to complete the project.  Gartner also lists security as a primary issue.

“Infrastructure and Security Validation – Although KNOWiNK has agreed to provide the State with read only access to enable the State to validate the infrastructure and security profile of the solution, the read-only access has not yet been granted. This has been in progress for months, and a solution should be rapidly identified to ensure this milestone is achieved.  Testing is somewhat dependent on the Infrastructure and Security Validation, as this validation is a pre-requisite for allowing the Counties to test with unscrambled data.

KNOWiNK is required to provide the state with the security profile, but to date, has not complied. 

Several times in the publicly available documents, the issue of scrambled data is addressed.  “Scrambled data” means that data is being altered. Altered data on TotalVote software has been noted in several states, including in South Dakota where a voter reported that he found out he was registered to vote in a county that does not exist when he attempted to vote.  Precincts have also been displayed in the wrong county.

During an over-the-shoulder review, Gartner caught KNOWiNK switching between two instances of the system because certain functions worked in one version and not the other. 

The ORVIS system is being built off an old BPro system, and chronic problems from the “legacy system” continue to surface in the attempted implementation of the new ORVIS system. One network engineering expert summed up the project: “Oregon is buying a brand new $10 million dollar system and getting an old system with band-aids and patches on it.”

The complaints against KNOWiNK in Oregon are reminiscent of the same issues that led to KNOWiNK being fired in Pennsylvania. In a December 12, 2023 Pennsylvania Senate State Government Committee hearing, Senator Cris Dush questions Secretary of the Commonwealth Al Schmidt on why the contract with KNOWiNK was cancelled.  Secretary Schmidt explains how the vendor and the state failed to work together.  Many project deadlines were missed so the state hired a Chief Modernization Officer, and contracted Gartner to oversee project management.

Secretary Schmidt stated that it became clear, despite efforts made to get the project back on track, that the vendor was unable to fulfill the requirements. The security requirements were not going to be met that the state requires and were part of the terms of the contract.   Pennsylvania now has another request for proposal (RFP) out for bid, which means it will be years before a new system can be implemented.

The cancellation of the contract means Pennsylvania will be returning to the outdated SURE system.  The damning 2019 Pennsylvania Auditor General’s report on the SURE system revealed major security and control issues with the system.

“The Department of State must work harder to verify that registration records are accurate and up-to-date,” DePasquale said. “My audit team found too many instances of potentially bad data and sloppy recordkeeping that requires guidance from the state to help counties resolve issues throughout the year.”  “Based on data analysis that we were able to perform…. We identified tens of thousands of duplicate and inaccurate voter records, as well as nearly three thousand potentially deceased voters that had not been removed from SURE. Finally, during the conduct of our procedures, we identified potential areas of improvement related to computer security, information and technology general controls, and interface controls that we have specifically excluded from this report because of the sensitive nature of this information and due to security concerns over the Commonwealth’s critical elections infrastructure.  These conditions and our recommendations have been included in a separate confidential communication to DOS management.”

In the December 12, 2023 Pennsylvania Senate State Government Committee, Secretary Al Schmidt still refuses to give the Committee the confidential report on security recommendations for SURE, and insists areas of concern “that they agreed with” were addressed.

Known Democrat operative Molly Woon is involved in the Oregon ORVIS project, which has now been pushed to 2025.  Battleground state Pennsylvania’s tenuous situation has left them with a less than reliable voter registration system for 2024.

Former Pennsylvania State Representative Frank Ryan, CPA is quoted as saying:

“If I were chair of an audit committee, I’d ask, is there an incentive on the part of the Democratic Party to kill the changes to the SURE System until they get to the next presidential election? Because [President Joe] Biden is behind in the polls with [former President] Donald Trump in 2024. I can’t make that allegation because we don’t have enough data, but it would be a hypothesis that I would want to run down.”

States like South Dakota do not have independent cyber security contractors such as Gartner or an auditor general auditing the Total Vote System that manages the voter rolls and election night reporting via an internet connected cloud-based system.  Citizen led canvassing and voter roll analysis have revealed questionable and anomalous data which has not been addressed by the state. Like South Dakota, grassroots teams in many states that use KNOWiNK products have reported anomalous data.

With the 2024 election cycle rapidly approaching, can any of the states using KNOWiNK software applications be confident in a safe and secure election when the vendor clearly cannot meet today’s security standards in Pennsylvania and Oregon?