Voting machine flaws confirmed, but no evidence of tampering found in Puerto Rico audit

Key points

• Mojave Research identified weak and recycled passwords in Dominion-made machines seized from Puerto Rico, but found no proof these flaws were exploited to alter results.
• The Office of the Director of National Intelligence (ODNI) issued a stop-work order to Mojave Research in October 2025, ending the contract shortly after the firm reported its findings.
• Critics, including Justice Department attorney Kurt Olsen, accused the firm of being funded by George Soros, a claim Mojave CEO Jason Wareham denied under penalty of perjury.
• Security experts warn that the administration’s focus on finding 'boogeymen' distracts from necessary technical fixes, while both major parties have failed to adequately address known vulnerabilities.
• A recent CISA report revealed that federal assessors gained full network control of some state voting systems within hours, highlighting persistent risks despite claims of offline security.

Background

This follows earlier declassified documents in July 2026 that failed to substantiate claims of widespread election fraud or non-citizen voting. Previous incidents, such as a New Jersey software error and a 2020 Michigan glitch, were also weaponized by political actors to cast doubt on election integrity despite official audits confirming no impact on outcomes.

How outlets are covering it

Politico and CNN emphasize the conflict between technical findings and political motives, noting that ODNI officials accepted the report but a faction within the administration rejected it for not proving fraud. Daily Kos highlights the broader failure of both parties to address vulnerabilities, arguing that the 'Big Lie' of 2020 has created a dangerous mindset where questioning security is equated with conspiracy. While Politico and CNN focus on the specific contract termination and Soros accusations, Daily Kos points to a CISA report showing that many state systems remain 'soft targets' capable of being breached by moderately skilled adversaries, a concern ignored by both sides.

Why it matters

The incident illustrates how legitimate cybersecurity audits can be politicized, potentially undermining public trust in elections. If security flaws are dismissed as conspiracy fodder rather than addressed, the infrastructure remains vulnerable to actual threats, while the narrative of fraud continues to distract from necessary technical improvements and post-election audits.

What to watch

Liberty Vote, which acquired Dominion Voting Systems, has stated it has not received the Mojave report and does not plan changes before November. The ODNI has not released the findings publicly, and the administration continues to pursue legal threats against states regarding voter rolls, despite losing multiple federal court cases.