Dec. 19, 2019, 6:30 AM EST

By Ben Popken, Cynthia McFadden and Kevin Monahan

OMAHA, Neb. — Just off a bustling interstate near the border between Nebraska and Iowa, a 2,800-square-foot American flag flies over the squat office park that is home to Election Systems & Software LLC.

The nondescript name and building match the relative anonymity of the company, more commonly known as ES&S, which has operated in obscurity for years despite its central role in U.S. elections. Nearly half of all Americans who vote in the 2020 election will use one of its devices.

That’s starting to change. A new level of scrutiny of the election system, spurred by Russia’s interference in the 2016 election, has put ES&S in the political spotlight. The source of the nation’s voting machines has become an urgent issue because of real fears that hackers, whether foreign or domestic, might tamper with the mechanics of the voting system.

That has led to calls for ES&S and its competitors, Denver-based Dominion Voting Systems and Austin, Texas-based Hart Intercivic, to reveal details about their ownership and the origins of the parts, some of which come from China, that make up their machines.

But ES&S still faces questions about the company’s supply chain and the identities of its investors, although it has said it is entirely owned by Americans. And the results of its government penetration tests, in which authorized hackers try to break in so vulnerabilities can be identified and fixed, have yet to be revealed.

The secrecy of ES&S and its competitors has pushed politicians to seek information on security, oversight, finances and ownership. This month, a group of Democratic politicians sent the private equity firms that own the major election vendors a letter asking them to disclose a range of such information, including ownership, finances and research investments.

"The voting machine lobby, led by the biggest company, ES&S, believes they are above the law,” said Sen. Ron Wyden, D-Ore., a member of the Intelligence Committee who co-signed the letter. “They have not had anybody hold them accountable even on the most basic matters.”

ES&S Chief Executive Tom Burt dismissed criticism as inevitable and impossible to answer, but he called for greater oversight of the national election process.

“There are going to be people who have opinions from now until eternity about the security of the equipment, the bias of those companies who are producing the equipment, the bias of the election administrators who are conducting the election,” Burt said in an interview. “I can’t do anything to affect those people’s opinions.”

“What the American people need is a system that can be audited, and then those audits have to happen and be demonstrated to the American public,” Burt said. “That's what will cut through the noise.”

ES&S invited NBC News journalists into its headquarters, the first time it has done so for a national news organization. The walls were decorated with images of the Constitution and inspirational messages about quality control. In glass-walled rooms etched with the company’s patents, technicians tested machines under tight security.

Burt, a native Nebraskan, has called for federal regulations that would require voting machine companies to address some of the key questions posed to ES&S. In June, he wrote an op-ed asking Congress for more regulation, which would include requirements for paper backups of individual votes, mandatory post-election audits and more resources for the U.S. Election Assistance Commission to speed improvements.

NBC News examined publicly available online shipping records for ES&S for the past five years and found that many parts, including electronics and tablets, were made in China and the Philippines, raising concerns about technology theft or sabotage.

During the tour, Burt said the overseas facilities are “very secure.” He said the final assembly of voting machines takes place in the U.S.

Chinese manufacturers can be forced to cooperate with requests from Chinese intelligence officials to share any information about the technology and therefore pose a risk for U.S. companies, NBC News analyst Frank Figliuzzi, a former assistant director of the FBI for counterintelligence, said. That could include intellectual property, such as source code, materials or blueprints. There is also the concern of machines shipped with undetected vulnerabilities or backdoors that could allow tampering.

In a letter to NBC News, ES&S said it takes “great care” with its foreign supply chain, including conducting risk assessments and making on-site visits to suppliers to make sure that components “are trusted, tested and free of malware.” It said that all of its facilities adhere to international standards, that it manufactures in compliance with all federal guidelines and that it follows cybersecurity best practices.

The company says that its overseas manufacturing site has been successfully audited by the Election Assistance Commission and that the company conducts on-site visits of its suppliers “to ensure that components are trusted, tested and free of malware.”

“Some components (such as surface mount capacitors, resistors, inductors and fixed logic devices) may be sourced from China-based manufacturers,” the letter said, referring to basic circuitry components.

ES&S said it conducts quality assurance tests on the machines.

Questions about who owns the major voting machine manufacturers have followed the industry for years.

The issue took on greater urgency after the FBI disclosed in July 2018 that a Russian oligarch had invested in a Maryland election services firm. Officials in Maryland and North Carolina have started questioning voting machine makers about potential foreign ownership.

Because it is privately owned, ES&S is not legally obligated to reveal its ownership or any other details about its finances, although Burt did confirm that the company generated about $100 million in sales last year.

But in response to questions this year from the North Carolina State Board of Elections, ES&S disclosed which investors own more than 5 percent of the company. They include Burt, Chief Financial Officer Tom O’Brien and the Omaha-based private equity firm McCarthy Group, which owns a controlling interest. The letter identified two passive investors, Nancy McCarthy and Kenneth Stinson, who own stakes of more than 5 percent in McCarthy Group.

ES&S said McCarthy Group’s bylaws prevented it from revealing other individual investors, but it affirmed that they are all U.S. citizens or trusts or corporations owned by Americans. The company offered to pay for an independent auditor to verify that all the investors are Americans. NBC News declined, as citizenship itself wouldn’t answer other potential questions, including political affiliations or other conflicts of interest.

McCarthy Group did not respond to NBC News’ requests for comment.

Virtually no laws govern the cybersecurity aspects of voting machine technologies. But ES&S points to its voluntary efforts to improve voting machine security, most notably a new program with the Energy Department’s Idaho National Labs, the same federal facility that tests the power grid and nuclear power generators. ES&S machines underwent eight weeks of vulnerability testing and penetration by government hackers.

Chris Wlaschin, head of systems security for ES&S, said at a Homeland Security cybersecurity summit in Washington in September that the company’s machines are not prone to a remote attack over the internet. But he added that someone with enough time and access could make a machine “inoperative or unusable.”

Although Wlaschin said the company would release an executive summary of the government testing, the company recently said it has nothing for “external release.” It said recommendations from the tests would be incorporated into “future voting system releases.”

Wyden said he was concerned by the company’s foreign parts supply and was working on legislation to limit it.

“What you have found is particularly important because of the China connection,” he said.

Wyden is also eager to see the Idaho National Lab findings.

“They’re claiming that the Department of Homeland Security has been working with them. I’m going to ask for this information on the basis of your report within 10 days,” he said.

Eddie Perez, global director of technology development for the Open Source Election Technology Institute, a nonprofit election technology research group with which NBC News has partnered since 2016, said the lack of oversight is problematic.

“The way people vote is managed by a couple of entities that people don’t know a lot about, and that creates risks for the country,” he said.

When it comes down to the essentials, voting machine makers “behave based on the level of regulation they have,” Perez said.

“They have to check the boxes,” he added. “But once they’ve done that, they focus on selling their product.”

Dec. 19, 2019, 6:30 AM EST

By Ben Popken, Cynthia McFadden and Kevin Monahan

OMAHA, Neb. — Just off a bustling interstate near the border between Nebraska and Iowa, a 2,800-square-foot American flag flies over the squat office park that is home to Election Systems & Software LLC.

The nondescript name and building match the relative anonymity of the company, more commonly known as ES&S, which has operated in obscurity for years despite its central role in U.S. elections. Nearly half of all Americans who vote in the 2020 election will use one of its devices.

That’s starting to change. A new level of scrutiny of the election system, spurred by Russia’s interference in the 2016 election, has put ES&S in the political spotlight. The source of the nation’s voting machines has become an urgent issue because of real fears that hackers, whether foreign or domestic, might tamper with the mechanics of the voting system.

That has led to calls for ES&S and its competitors, Denver-based Dominion Voting Systems and Austin, Texas-based Hart Intercivic, to reveal details about their ownership and the origins of the parts, some of which come from China, that make up their machines.

But ES&S still faces questions about the company’s supply chain and the identities of its investors, although it has said it is entirely owned by Americans. And the results of its government penetration tests, in which authorized hackers try to break in so vulnerabilities can be identified and fixed, have yet to be revealed.

The secrecy of ES&S and its competitors has pushed politicians to seek information on security, oversight, finances and ownership. This month, a group of Democratic politicians sent the private equity firms that own the major election vendors a letter asking them to disclose a range of such information, including ownership, finances and research investments.

"The voting machine lobby, led by the biggest company, ES&S, believes they are above the law,” said Sen. Ron Wyden, D-Ore., a member of the Intelligence Committee who co-signed the letter. “They have not had anybody hold them accountable even on the most basic matters.”

ES&S Chief Executive Tom Burt dismissed criticism as inevitable and impossible to answer, but he called for greater oversight of the national election process.

“There are going to be people who have opinions from now until eternity about the security of the equipment, the bias of those companies who are producing the equipment, the bias of the election administrators who are conducting the election,” Burt said in an interview. “I can’t do anything to affect those people’s opinions.”

“What the American people need is a system that can be audited, and then those audits have to happen and be demonstrated to the American public,” Burt said. “That's what will cut through the noise.”

ES&S invited NBC News journalists into its headquarters, the first time it has done so for a national news organization. The walls were decorated with images of the Constitution and inspirational messages about quality control. In glass-walled rooms etched with the company’s patents, technicians tested machines under tight security.

Burt, a native Nebraskan, has called for federal regulations that would require voting machine companies to address some of the key questions posed to ES&S. In June, he wrote an op-ed asking Congress for more regulation, which would include requirements for paper backups of individual votes, mandatory post-election audits and more resources for the U.S. Election Assistance Commission to speed improvements.CEO Tom Burt talks with Cynthia McFadden of NBC News.

NBC News examined publicly available online shipping records for ES&S for the past five years and found that many parts, including electronics and tablets, were made in China and the Philippines, raising concerns about technology theft or sabotage.

During the tour, Burt said the overseas facilities are “very secure.” He said the final assembly of voting machines takes place in the U.S.

Chinese manufacturers can be forced to cooperate with requests from Chinese intelligence officials to share any information about the technology and therefore pose a risk for U.S. companies, NBC News analyst Frank Figliuzzi, a former assistant director of the FBI for counterintelligence, said. That could include intellectual property, such as source code, materials or blueprints. There is also the concern of machines shipped with undetected vulnerabilities or backdoors that could allow tampering.

In a letter to NBC News, ES&S said it takes “great care” with its foreign supply chain, including conducting risk assessments and making on-site visits to suppliers to make sure that components “are trusted, tested and free of malware.” It said that all of its facilities adhere to international standards, that it manufactures in compliance with all federal guidelines and that it follows cybersecurity best practices.

The company says that its overseas manufacturing site has been successfully audited by the Election Assistance Commission and that the company conducts on-site visits of its suppliers “to ensure that components are trusted, tested and free of malware.”

“Some components (such as surface mount capacitors, resistors, inductors and fixed logic devices) may be sourced from China-based manufacturers,” the letter said, referring to basic circuitry components.

ES&S said it conducts quality assurance tests on the machines.

Questions about who owns the major voting machine manufacturers have followed the industry for years.

The issue took on greater urgency after the FBI disclosed in July 2018 that a Russian oligarch had invested in a Maryland election services firm. Officials in Maryland and North Carolina have started questioning voting machine makers about potential foreign ownership.

Because it is privately owned, ES&S is not legally obligated to reveal its ownership or any other details about its finances, although Burt did confirm that the company generated about $100 million in sales last year.A developer and principle architect work on software.

But in response to questions this year from the North Carolina State Board of Elections, ES&S disclosed which investors own more than 5 percent of the company. They include Burt, Chief Financial Officer Tom O’Brien and the Omaha-based private equity firm McCarthy Group, which owns a controlling interest. The letter identified two passive investors, Nancy McCarthy and Kenneth Stinson, who own stakes of more than 5 percent in McCarthy Group.

ES&S said McCarthy Group’s bylaws prevented it from revealing other individual investors, but it affirmed that they are all U.S. citizens or trusts or corporations owned by Americans. The company offered to pay for an independent auditor to verify that all the investors are Americans. NBC News declined, as citizenship itself wouldn’t answer other potential questions, including political affiliations or other conflicts of interest.

McCarthy Group did not respond to NBC News’ requests for comment.

Virtually no laws govern the cybersecurity aspects of voting machine technologies. But ES&S points to its voluntary efforts to improve voting machine security, most notably a new program with the Energy Department’s Idaho National Labs, the same federal facility that tests the power grid and nuclear power generators. ES&S machines underwent eight weeks of vulnerability testing and penetration by government hackers.

Chris Wlaschin, head of systems security for ES&S, said at a Homeland Security cybersecurity summit in Washington in September that the company’s machines are not prone to a remote attack over the internet. But he added that someone with enough time and access could make a machine “inoperative or unusable.”

儘管Wlaschin表示該公司將發布政府測試的執行摘要，但該公司最近表示沒有“外部發布”的內容。它說測試的建議將被合併到“未來投票系統版本”中。

懷登說，他對公司的國外零件供應感到擔憂，並正在制定立法以限制供應。

他說：“由於與中國的聯繫，發現的東西尤其重要。”政府關係高級副總裁Kathy Rogers和系統安全副總裁Chris Wlaschin。

懷登還渴望看到愛達荷州國家實驗室的發現。

“他們聲稱國土安全部一直在與他們合作。我將在10天內根據您的報告要求提供此信息。”他說。

非營利性選舉技術研究組織開源選舉技術研究所全球技術開發總監埃迪·佩雷斯（Eddie Perez）自2016年以來一直與NBC News合作與該組織合作，他說缺乏監督是有問題的。

他說：“人們的投票方式是由人們不太了解的幾個實體管理的，這給國家帶來了風險。”

佩雷斯說，當涉及到基本要素時，投票機製造商“應根據他們所掌握的法規水平來行事”。

“他們必須選中相應的框，”他補充說。“但是一旦這樣做，他們就會專注於銷售產品。”