Short answer: No. A voting machine vulnerability can show that a system has a weakness that should be fixed. By itself, it does not prove that anyone exploited the weakness, that votes were changed, or that an election outcome was altered.
That distinction matters because a vulnerability report answers a different question from an election-fraud claim. A security researcher may demonstrate that a system could be compromised under certain conditions. To establish that votes actually changed, investigators would still need evidence connecting the vulnerability to a real-world exploit, a specific election, affected machines or records, altered votes, and an impact large enough to matter to the certified result.
Voting Machine Vulnerability: 6 Evidence Checks
For a voting-system vulnerability to become evidence that votes were changed, the evidence would need to move through several separate steps:
- Vulnerability: A real weakness exists in hardware, software, configuration, access controls, or procedures.
- Real-world exploitability: The conditions required to use that weakness were actually available in the election environment.
- Actual exploitation: Evidence shows that someone used the weakness rather than merely having the theoretical ability to do so.
- Affected votes: Records, audits, forensic evidence, paper ballots, logs, or other evidence identify votes or tabulation data that were actually altered.
- Scale and margin: The number of affected votes is established and compared with the relevant contest margin and legal standards.
- Outcome effect: The evidence supports the conclusion that the certified result would have been different.
Skipping one of those steps can turn evidence of possibility into a claim about what actually happened. The Evidence Matters treats those as different propositions requiring different proof.
What Does a Voting Machine Vulnerability Prove?
A voting machine vulnerability can prove that a system has a weakness. Depending on the research, it may also show that an attacker with particular access, equipment, credentials, timing, or knowledge could perform a specific action. That is important security information. Election officials and vendors should evaluate credible findings, patch systems, improve procedures, and reduce exposure.
But security testing is often performed under controlled conditions designed to discover what is technically possible. Those conditions may not match the safeguards, chain-of-custody rules, access restrictions, paper records, audits, or monitoring used in an actual election.
A 2026 voting-system vulnerability FAQ published by electionline and attributed to the Center for Democracy & Technology makes this distinction directly: finding a vulnerability is different from showing that it was exploited, and both are different from showing that exploitation changed votes or determined an election outcome. Read the voting-system vulnerabilities FAQ.
What would evidence of actual exploitation look like?
The strongest evidence would connect a known weakness to specific activity. Depending on the system and allegation, that could include authenticated logs, forensic images, malware or unauthorized code found on election equipment, access records, credible witness evidence supported by technical records, unexplained discrepancies between electronic records and voter-verified paper records, or audit findings that cannot be explained by ordinary administrative or technical causes.
Even then, investigators would have to determine what the activity did. Evidence that a machine was accessed is not automatically evidence that a vote was changed. Evidence that software was modified is not automatically evidence that tabulation was affected. Each conclusion needs its own evidentiary support.
Why paper records and audits matter
Independent records can test whether an electronic system’s reported totals match evidence that exists outside the software being questioned. Voter-verifiable paper records, recounts, post-election audits, chain-of-custody documentation, and other controls can provide evidence for or against a claim that electronic records were altered.
This is why the strongest investigation does not rely on one data source. It compares electronic records with independent records and asks whether the alleged mechanism produced observable effects.
What has CISA said about election-system security?
CISA has publicly distinguished cyber activity from evidence of material election impact. After the 2024 election, CISA stated that it had no evidence of malicious activity that had a material impact on the security or integrity of election infrastructure. Read CISA’s November 6, 2024 statement.
A joint federal report concerning the 2022 federal elections similarly said the government had no evidence that detected foreign-government-affiliated activity prevented voting, changed votes, disrupted timely tabulation, or otherwise materially affected election infrastructure. Read the joint 2022 election report.
Those statements do not mean voting technology can never have vulnerabilities. They mean that evidence of vulnerabilities and evidence of actual election impact are separate questions.
Can a Voting Machine Vulnerability Prove a Past Election Was Changed?
No. A demonstration can establish that an attack is possible under the demonstrated conditions. To prove a past election was changed, evidence must connect the demonstrated technique to that election and show that it was actually used successfully.
For example, a researcher might show that physical access to a particular device can permit installation of malicious software. That finding supports better physical security and remediation. It does not by itself establish that an unauthorized person obtained the required access during an election, installed the software, avoided detection, changed recorded votes, and affected enough votes to change the result.
How should a voting-machine claim be evaluated?
Start with the narrowest claim that the evidence actually supports. Ask:
- What exact machine, software version, configuration, or procedure is involved?
- Is the reported weakness independently documented?
- What conditions are required to exploit it?
- Were those conditions present in the election being discussed?
- Is there evidence of actual exploitation?
- Is there evidence that vote records or totals changed?
- Do paper records, audits, logs, recounts, or forensic evidence confirm or contradict the allegation?
- How many votes could be shown to be affected, and how does that compare with the contest margin?
For a broader framework, see what evidence would prove election fraud changed an election outcome and our records-based review of Fulton County voting-machine claims. This framework avoids two opposite errors: dismissing a real security weakness merely because exploitation has not been proven, or treating a real weakness as proof of exploitation and an altered outcome.
A Voting Machine Vulnerability Is Evidence of Risk, Not Automatically Outcome
The evidence can support a finding that a vulnerability exists while leaving exploitation unresolved. It can support evidence of exploitation without yet establishing changed votes. And it can establish changed votes without automatically establishing that enough votes changed to alter a certified outcome.
That is why The Evidence Matters separates capability, event, effect, scale, and outcome instead of collapsing them into one claim.
For the broader standard on what would be needed to prove that election fraud changed an election result, see What Evidence Would Prove Election Fraud Changed an Election Outcome?
Fine. Now show the evidence.
How we rate claims: See the Evidence Matters Verdict System