North Carolina Investigative Analysis

Part 1: A Political Hurricane

When Hurricane Helene barreled into North Carolina in September 2024, few people expected the scope of destruction and devastation that would soon unfold. The western part of the state is hundreds of miles from the coast, but the storm’s inland path brought a disastrous collision with mountainous terrain, causing landslides and unprecedented flooding. Communities in the western corridor of the state were deluged—underwater, without electricity, phones, or access to roads. Lives were lost, and businesses were destroyed.

As North Carolinians began to dig out from the rubble, the upcoming November election was, understandably, far from their minds. Yet with North Carolina’s record of razor-thin election results, every vote would matter in the 2024 General Election.

Leading up to November 5th, Presidential polls in North Carolina predicted a tight race between Kamala Harris and Donald Trump. RealClear Polling’s overall average (calculated with information collected through November 4, 2024, from a collection of the most reputable national polls) showed Trump with a slight edge of 1.2 points over Harris, well within the margin of error. The Tar Heel State was an effective toss-up.

Post-election analysis showed how the hurricane affected voter turnout and election logistics across North Carolina. While there were 100,000 more ballots cast in the 2024 General Election than in the 2020 contest, the state’s rapid population growth resulted in a lower overall turnout rate—73.1% in 2024 versus 75.4% in 2020. The storm caused power outages and severe damage to polling places in 13 counties, prompting election officials to employ emergency measures like alternate polling places and absentee ballots. Over half a million voters lived in impacted counties, many of which saw a lag in mail-in ballot return rates.

While western North Carolina struggled to find solid ground, a different kind of storm was building across the state.

Last Minute Change to Ballots

In early September 2024, Robert F. Kennedy, Jr. dropped out of the presidential race and endorsed Trump; RFK Jr. requested that his name be removed from North Carolina ballots, most of which had already been printed. The State Board of Elections appealed a court order that would have required them to remove RFK Jr.’s name, but North Carolina’s Supreme Court ruled in favor of removal, despite the expected delays associated with reprinting ballots.

In a dissenting opinion, Democratic Justice Allison Riggs criticized the court’s decision for the harm it would cause voters and election officials, writing that it was “egregious and unjustified.” Her rebuke stressed the impact the decision would have on election administrators, who were overworked and underpaid “in a time when such service has subjected those public servants to harassment and peril.”

Although election officials had already printed nearly three million ballots and were ready to distribute them to absentee voters by the deadline of September 6th, the state Supreme Court’s decision postponed the “send” dates to September 20th for overseas and military voters, and to September 24th for the general public. Instead of having over the 60 days guaranteed by state law to receive ballots, hurricane victims—and, indeed, all absentee voters in the state—would see that time reduced by a third.

In addition to abridged voting periods, county election officials had to contend with heavy workloads and high costs. Already-printed ballots would have to be destroyed, and more than 2,000 different ballot styles used across the state would require redesign. Per AP News, counties would have to reassemble ballot packets, ‘recode’ tabulation machines, and bear the cost of reprinting. Expenses ranged from a few thousand dollars in smaller areas to $300,000 in Wake County. The Wake County Board also hired about 50 additional workers to prepare outgoing ballots under the new, tight deadline imposed by the ballot changes

The last-minute ballot changes also meant counties had to scramble to complete their state-mandated Logic and Accuracy (L&A) checks on voting machines and tabulators. In a September 2024 article in The Carolina Journal, Jim Womack, Chairman of the North Carolina Election Integrity Team, expressed his concerns about election vulnerabilities, stating that although L&A testing is intended to ensure machines are counting ballots correctly, it is not the same as a cybersecurity check.

“It is not, and it is in no way, a confidence-builder for people like me that the machines are not going to be exploited,” said Womack. “In fact, logic and accuracy testing only proves that the machine—like a handheld calculator—can count and balance effectively.”

With less than two months before the general election, the decision to remove RFK Jr. from North Carolina ballots inundated election officials and voters with a surge of chaos and confusion. This resulted in delays that doubtless jeopardized early voting and absentee voting for displaced hurricane evacuees and military personnel stationed abroad.

A Slow-Building Storm – Long-Standing Vulnerabilities

Long before the contentious race between Trump and Harris stormed the state, North Carolina battled the headwinds of insecure voting systems. During the 2016 election, problems with poll books manufactured by VR Systems (which are no longer used in the state) led to major delays in Durham County, forcing some voters to leave without casting their votes and requiring the county to recount 94,000 ballots.

Based on then-FBI Director Robert Mueller’s report, VR Systems believed that they were the target of Russian intelligence; this report stated that Russian spies had installed malware on a company’s network that “developed software used by numerous U.S. counties to manage voter rolls.” However, VR Systems maintained that it was never hacked, citing an independent security audit that was reportedly conducted seven months after the election.

In 2019, cybersecurity researcher Chris Vickery discovered an online repository of passwords for touchscreen voting machines used in North Carolina, as well as serial numbers for machines that used modems, allowing the machines to connect to the Internet. While the State Board of Elections said the passwords were old and reported that they had been changed after their use in 2010, Vickery found that the most recent file uploaded online was from 2016. After he reported his findings, state election officials locked the repository and took it offline.

Just before the 2020 election, the Tar Heel State replaced older, vulnerable equipment with new voting machines and tabulators. According to lawsuits filed by the North Carolina NAACP, the upgraded systems were just as vulnerable as their predecessors.

On April 15, 2020, the North Carolina NAACP, represented by Free Speech for People, challenged the North Carolina State Board of Elections on the legality of Election Systems & Software’s (ES&S) ExpressVote, the new electronic voting system implemented in Mecklenburg, Buncombe, and several other North Carolina counties, which included the cities of Charlotte and Asheville. The suit alleged that ExpressVote was vulnerable to security threats, and its results were unverifiable. In North Carolina, Election Systems & Software (hereafter, ES&S) is used in 93 of the 100 counties to cast and count votes, home to over 92% of the registered voters in the state. The other seven counties use Hart InterCivic machines to conduct their elections.

ExpressVote, a ballot-marking device on which voters select their preferred candidates using a touchscreen, prints a ballot summary text card (but does not print the entire ballot) along with a barcode. Vote-counting tabulators only scan and read the data in the barcode, meaning North Carolina voters had no way to confirm that votes entered on ExpressVote were being scanned and counted. This system has been heavily criticized by voting rights and election security experts.

“The right to vote means the right to have one’s own intended choices recorded and counted, not the choices of a computer running on insecure, unreliable software,” said Courtney Hostetler, Counsel at Free Speech For People.

The NAACP and Free Speech for People asserted that ExpressVote’s barcodes could be miscoded or hacked without detection, and its security flaws risked that voters in Mecklenburg County (where Charlotte is located) and others could have their votes cancelled or have them be recorded for the wrong candidate. The complaint detailed problems that had already taken place with ExpressVote in March of 2020 during the North Carolina Democratic primary election; in this election, machines had been left in improper modes, had been used in various types of voting for which they had not been authorized, and had been responsible for improperly tabulating votes in at least one county.

Three months after the North Carolina NAACP filed its complaint, it followed up with a motion for a preliminary injunction of the ExpressVote for any future elections in North Carolina. The injunction stated that the 21 counties using the ballot-marking devices could instead opt for one of three other voting systems certified for use in the state. These other machines did not have the same issues noted in ExpressVote; they did not provide voters with human-unreadable barcodes or with ballots that could not be verified. The motion read that, absent an injunction, voters in these counties would be at substantial risk for immediate and irreparable injury to their right to vote in free elections.

The plaintiffs’ brief in support of a preliminary injunction highlighted a litany of insecurities in the ExpressVote. “These electronic voting machines are unreliable, vulnerable to hacking, programming error, and malfunction, tabulate voters’ choices based on a barcode that voters cannot read or verify, and use software that is already past its end-of-life date,” the brief read.

Within the brief, America’s foremost experts in election security provided affidavits against the ExpressVote, saying it suffers from vulnerabilities that threaten the integrity of elections. Dr. Duncan Buell, Professor of Computer Science and Engineering at the University of South Carolina, has also conducted research supporting the National Security Agency. He noted errors, vulnerabilities, and critical security failures across many software systems produced by ES&S, including the ExpressVote.

Dr. Andrew W. Appel, Professor of Computer Science at Princeton University, concurred with Dr. Buell and stated that the ExpressVote is vulnerable to cyberattacks and hacking, and that it lacks any means through which voters can reliably determine whether their selections were altered. Dr. Appel felt that the voting system was particularly susceptible to hackers’ attacks because “the ExpressVote’s vote-marking software can be replaced by fraudulent vote-stealing software that steals votes by recording different votes on the paper ballot than what the voter indicated on the touchscreen.”

While the motion for preliminary injunction and brief focused on discontinuing the use of ES&S ExpressVote for the 2020 election in North Carolina, they also underscored the deluge of voting system insecurities that North Carolina had experienced for some time, especially with ES&S equipment.

In 2013, the North Carolina legislature voted to decertify the iVotronic, a direct-recording electronic (DRE) voting machine also manufactured by ES&S. The iVotronic, like the ExpressVote, produced unverifiable ballots, which made it impossible to detect errors. According to the NC State Board of Elections, state law mandates that all 100 counties use paper ballots, producing a paper trail that can be easily audited or recounted. The iViotronic did not meet this requirement, and the legislature set its decertification deadline for December 2019.

The North Carolina State Board of Elections moved slowly in testing and certifying other voting systems. By March of 2019, six years after the decertification of the iVotronic, ES&S had decided to discontinue production of the voting system for which it was seeking state certification, the EVS 5.2.2.0. However, during the certification process, ES&S withheld this information from North Carolina election officials. Absent that information, in August of 2019, the State Board of Elections certified the ES&S EVS 5.2.2.0.

Only after receiving certification did ES&S inform the North Carolina State Board of Elections that it would not have enough supply of EVS 5.2.2.0 machines to meet the state’s needs, reportedly due to discontinued production of that machine type. They requested an administrative certification of a newer version, the EVS 5.2.4.0, which included the ExpressVote. Administrative certification allows election officials to waive new systems without rigorous testing, as long as they are not substantially altered from approved systems.

The divided State Board of Elections approved administrative certification by a vote of 3-2 in December of 2019, a few weeks before the decertification of the iVotronic, clearing the way for EVS 5.2.4.0—and the ExpressVote—to be used in the 2020 primary elections for both parties and future elections in North Carolina.

Stella Anderson, one of two Democratic board members who opposed the upgraded system, voiced concern about ES&S’s deceptive tactics. She argued that changes framed as “enhancements” were substantial modifications and should not have been approved for use in the 2020 elections without additional testing.

Between December 2019 and the Democratic Primary election in March 2020, 21 counties in North Carolina switched from using the iVotronic to the ExpressVote—effectively switching from one flawed, insecure, and unreliable ES&S voting machine to another flawed, insecure, and unreliable ES&S voting machine.

On August 19, 2020, the motion for preliminary injunction of the ExpressVote, which was filed by the North Carolina NAACP and Free Speech for People was denied by the Wake County Court; this motion was denied on the grounds that much of the alleged injury was highly speculative, and that, by law, preliminary injunctions ‘return standards to the status quo’, i.e. the effect of such an injunction would be to revert things to the way they were before the ExpressVote was implemented. In North Carolina, this would mean returning some counties to electronic voting systems that provided no paper record for auditing, which was not in compliance with state election regulations.

The court also argued that the ExpressVote had been certified by the U.S. Elections Assistance Commission in 39 states and Washington, D.C., with 90,000 units in use across various jurisdictions. To earn certification, it had to produce zero mistakes in 1.5 million marked selections. However, certification was earned in North Carolina on an earlier version of ES&S software—meaning the ExpressVote was slipped into an upgraded version that received administrative approval without testing.

Discrepancies and incorrect vote tallies were subsequently discovered during the North Carolina Democratic Primary elections held in March of 2020.

Nevertheless, Free Speech for People and the plaintiffs they represented voluntarily dismissed the lawsuit on October 4, 2021. Our team could find no other documentation showing that the ExpressVote system has been challenged, tested, or changed in North Carolina since the lawsuit was dismissed.

False Alarms

The profound security vulnerabilities in North Carolina’s election machinery require no embellishment or exaggeration to raise the alarm. Despite this, public-facing claims of malfeasance have muddied the waters further with manufactured claims and false accusations.

Prior to the 2022 North Carolina midterm elections, William Keith Senter, Chair of the Republican Party in Surry County, NC, threatened to have county elections director Michelle Huff fired if she refused to give him unauthorized access to vote-counting tabulators (ES&S brand), which by state law may only be handled by an election official.

Senter and prominent pro-Trump ally Douglas Frank met with Huff on March 28, 2022, and claimed there was a “chip in the voting machines” that pinged a cellular phone tower on Nov. 3, 2020; their claims that this chip influenced the election results. The state board elections decried this as “fabricated disinformation”, and these claims have also been deemed false by Reuters and Business Insider. In this case, there was no “chip that pinged a cell phone tower and changed election results”. As is often the case with conspiracy theories, however, Senter and Frank “got the facts wrong, but the feelings right.” There are vulnerabilities endemic to the U.S. election system, including machinery with components (like wireless modems) that can be made to connect to outside infrastructure in a manner that can compromise the integrity of people's votes. Real threats are not diminished by false alarms—in fact, quite the opposite.

A false alarm, per the National Weather Service, is when a warning is issued for an expected hazard—such as a hurricane—but that hazard never materializes, or proves to be less severe than anticipated. The danger of false alarms is that, over time, people tend to disregard the warnings that are issued. Should a real threat develop, people may incorrectly ignore a warning that could otherwise save their lives.

It’s human nature to grow numb and skeptical when the blare of warning sirens has lasted so long it becomes background noise, or when false alarms have demanded time and attention with claims of catastrophe that never materialized.

Long-standing threats to North Carolina’s election integrity may have culminated in a “perfect storm” in the 2024 General Election - potential vote manipulation that may have changed the outcome of the presidential race. And if we do not heed the warnings, all future elections in the state—and American democracy—are on the path of destruction.