Paper Audits Are Necessary When China-Made Parts Are Embedded in Election Machines 

Paper Audits Are Necessary When China-Made Parts Are Embedded in Election Machines 

China-made components, shared county voting systems, and an unresolved Riverside, California reconciliation question make independent paper audits a necessity—not an accusation.

By Christine Bish

Catherine Herridge’s report this week should not be dismissed as another abstract debate about election technology. The documents behind it are public, and they sharpen a question California officials have evaded for years: when election systems carry acknowledged supply-chain and cybersecurity risks, why is independent verification so often treated as a threat rather than a duty?

DHS WARNING: CHINESE PARTS IN ELECTION MACHINES, REQUIRES PAPER BALLOT AUDITS

– Letter @SecMullinDHS Summarizes Classified Records

– “Voting machines with components manufactured by foreign adversaries introduce significant security risks”

– “need for strong mitigation… pic.twitter.com/dlSBqwltGM

— Catherine Herridge (@C__Herridge) August 27, 2026

The responsible answer is not to assume that a machine changed a vote. It is also not to insist that certification makes further scrutiny illegitimate. The responsible answer is to examine the paper, reconcile the records, test the exact equipment, and publish the result.

Three questions that must not be collapsed into one

Herridge’s disclosure raises three separate questions. Keeping them separate protects both election integrity and factual accuracy:

1. Foreign manipulation. Did a foreign government successfully alter an American vote count? The released intelligence says there is no evidence that China did so.
2. Supply-chain exposure. Did major vendors use components manufactured in China or other adversary countries? DHS says the vendor testimony establishes that risk.
3. Ordinary failure. Could equipment, software, procedures or records fail without fraud? Yes. Mechanical, clerical and administrative errors require correction even when criminal intent is absent.

The 2020 congressional hearing cited by DHS made the same practical point. As one voting-system witness put it: “On rare occasions, machines falter, and humans make mistakes.” That statement does not establish that a particular county result was wrong. It explains why verification exists.²

Nothing in the records cited here establishes that a foreign actor altered a vote, that these systems miscounted an election, or that any county official acted fraudulently. The case for expanded auditing rests on risk and verifiability—not an accusation of crime.

The federal warning—precise, serious and limited

In an August 24 letter to the White House Government Transparency Task Force, Homeland Security Secretary Markwayne Mullin said voting machines containing components manufactured by foreign adversaries present “significant security risks.” Relying on 2020 congressional testimony, the letter identified Election Systems & Software, Hart InterCivic and Dominion as the three vendors then supplying more than 80 percent of U.S. voting machines, and said representatives of each had acknowledged that some parts were made in China.¹

The underlying hearing record gives that statement needed scale and context. The parts discussed included items such as displays, glass, capacitors, resistors, and a programmable logic device. The vendors said some components had no practical domestic substitute; they also told Congress they knew of no foreign-government breach or tampering of their systems. The DHS disclosure establishes a supply-chain exposure. It does not establish that China altered an American vote count.²

That distinction is not a retreat. It is the dividing line between evidence and speculation. An administration official also told Herridge there was no intelligence that China had successfully manipulated an American vote count. The National Intelligence Council assessment released with the materials said election tabulation is highly secure, large-scale alteration would likely be detected, and it had no indication that foreign adversaries attempted such attacks in the prior two federal cycles.¹

DHS nevertheless announced a concrete grant condition. For fiscal-year 2026 Homeland Security Grant Program awards, the department says states seeking access to the full award must demonstrate a post-election manual audit of at least 5 percent of ballots after each federal election. The underlying grant notice holds back 20 percent from drawdown until specified election-security conditions are met.³

That rule is prospective, applies to federal elections, and is not a retroactive judgment about any California result. It is not an order for a full recount. But it is a federal acknowledgment of a basic principle: a paper record has value only when officials use it to test the machine-produced result.

California’s ordinary safeguard is narrower: state law generally requires a public manual tally of ballots from 1 percent of precincts, supplemented so every contest is included. That process can detect tabulation error in the sampled ballots, but it is not the same as reconciling every ballot category or conducting a broad performance audit. The federal 5 percent grant condition does not invalidate California’s certified elections; it does show that Washington now expects a more substantial paper check as a condition of full funding.¹⁵

Sacramento: a citizen inquiry carried San Mateo’s warning north

California did not need Washington to explain the value of testing. Sacramento’s 2019–2020 grand-jury inquiry began when a citizen asked whether recommendations from a San Mateo County grand-jury report should also apply in Sacramento. San Mateo had examined risks to election announcements after website hijacking and employee-email breaches. Sacramento’s grand jury sent that report to its Registrar of Voters and asked whether the recommendations were applicable and being implemented.⁴

The inquiry then produced its own local finding: Sacramento County’s Department of Technology was not regularly and consistently performing vulnerability scans and penetration testing. The grand jury also said it could not determine when the last external security audit of the county’s election systems occurred or who had performed the penetration testing.⁴

The report recommended third-party penetration tests at least twice each year, additional scans after system changes, multi-factor authentication before the November 2020 general election, and a report-back on reviews by CyberDefenses and DHS. This was a general county information-technology finding; the grand jury did not identify a China-made component, a Dominion defect, a compromised tabulator, or a changed vote.⁴

Sacramento’s response partially disagreed with the first finding. The county said vulnerability scans were consistent, but acknowledged that penetration testing was not regular or consistent. It projected semiannual testing by June 2021. Multi-factor authentication for nontechnical election staff was postponed until June 2021 because of operational conflicts with the November 2020 election. The county also declined to make technical DHS and CyberDefenses reports public, arguing that publication could expose defensive strategies.⁵

In a July 21, 2021 email in The Bish Report’s records, then-Registrar Courtney Bailey-Kanelos said the DHS assessment was still outstanding and listed remote and on-site testing for August 2021—after the 2020 general election. Sacramento’s record is not proof of a breached election. It is proof that officials knew independent security work remained unfinished while the public was being asked to trust the system.⁶

A limited case study published by Great American Rebirth supplies the contemporaneous visual record. On December 15, 2020, during a tour of Sacramento County’s election facility, IT consultant Mark Cook photographed warehouse racks containing rows of Dominion-branded cartons. A close-up clearly shows the Dominion Voting logo above the stencil “MADE IN CHINA”; the case study estimated approximately 100 labeled boxes. The original files credit Cook, and the county response posted with the report confirms that all photographs were taken December 15, after certification and the recount period.¹⁰

The evidentiary boundary is as important as the image. The photographs do not show what was inside the cartons, identify a model or serial number, establish that a complete voting machine was manufactured in China, connect any box to Riverside County, or prove compromise. But they do establish something local and concrete: Dominion-branded cartons bearing a China country-of-origin marking were present in Sacramento’s election warehouse by December 2020. The county’s posted response did not directly address Photo #1 or dispute the carton markings.¹⁰

Figure 1. Dominion Voting-branded shipping cartons bearing the printed words ‘Made in China,’ photographed during a December 15, 2020 visit to Sacramento County election facilities. Photo © 2020 Mark Cook.

Figure 2. Storage racks containing Dominion Voting-branded cartons and equipment cases during the same facility visit. Photo © 2020 Mark Cook.

The county’s posted response supplied important context. It said the Dominion environment operated on two air-gapped networks; that all USB drives were labeled and recorded when used; and that only designated senior personnel had access to the server and ballot-counting room under a two-person rule. It also acknowledged that USB drives “should not have been left out” and said procedures were updated so they would be returned immediately to designated storage.¹⁰

Figure 3. A removable USB drive hand-labeled ‘BIOS’ resting on a workstation labeled ‘Ballot Programming.’ Photo © 2020 Mark Cook.

Were Sacramento, Riverside and Shasta using the same systems?

For the 2020 general election, the answer is yes in the material sense: California’s official inventory lists all three counties in the Dominion Democracy Suite 5.10A family. Sacramento and Riverside both used ImageCast Central 5.10A for central tabulation and ImageCast X 5.10A for accessible voting. Shasta used ImageCast Central 5.10A with ImageCast Evolution 5.10A devices. Similar system families do not prove identical hardware lots, component suppliers, configurations, maintenance histories or operating procedures.¹¹

Sources: California Secretary of State county inventories (2020 and 2026); Sacramento County Resolution 2017-0773; Riverside County Board item 3.37 (2019); Shasta County Board agendas (2017 and 2023).

The procurement paths also overlap. Riverside’s 2019 board record says its Dominion agreement was based on—“piggybacking” from—Sacramento County’s competitively bid agreement, with Riverside negotiating a 30 percent discount from list price. Shasta entered its own Dominion lease earlier, effective January 1, 2018, and later terminated it. By 2026, Sacramento and Riverside had moved within the Dominion family to version 5.19, while Shasta was using Hart InterCivic Verity 3.2.^12,13,14

Shasta shows why the vendor name is not the whole story

Shasta’s Board of Supervisors approved a $1,978,428 lease for Dominion Democracy Suite 5.2 on December 5, 2017, covering January 1, 2018 through December 31, 2025. The board voted to end that agreement in January 2023. In April 2023 it authorized acquisition of Hart InterCivic’s Verity system, which the Secretary of State’s 2026 inventory lists as Shasta’s current platform.^13,14

The change matters to the comparison. A photograph from Sacramento cannot establish what was inside Riverside’s units, and a 2020 system inventory cannot establish what Shasta uses today. The correct question is not merely, “Which vendor?” It is: which exact devices, components, software versions and procedures were actually deployed in the election being reviewed?

Riverside: what triggered the grand-jury investigation?

Riverside’s investigation had a broader trigger than Sacramento’s. The 2024–2025 Civil Grand Jury says it acted “in response to public concerns about election integrity” and the “ongoing interest” of county residents. In its discussion, it identified two lawsuits involving Riverside County and a private election-oversight committee that had raised concerns for years. The report does not identify one complaint or one complainant as the sole trigger.⁷

After the November 5, 2024 general election, the community group tried to reproduce Riverside’s certified result from documentation supplied by the Registrar. The group reported that the certified result contained 33,888 more ballots than it could verify. The grand jury did not conclude that those were fraudulent, illegal or nonexistent ballots. It found that the group could not independently verify the certified result even with the Registrar’s cooperation—and separately found no evidence that the office was deliberately withholding information.⁷

That is a reconciliation problem, not a fraud finding. It could reflect incomplete records, different accounting categories, clerical omissions, illegible forms, timing differences or another explanation. The report did not determine which explanation applied, and it established neither fraud nor machine failure. Those possibilities must be tested, not guessed. Mechanical and administrative errors do not need criminal motive to matter.

The same report credited the Registrar with improvements, found evidence that the office followed federal and state law, noted that the statutory 1 percent manual tally required only nine ballots to be re-adjudicated, and reported that three requested recounts did not change results. Those facts argue against declaring the 33,888 figure proof of a wrong outcome. They do not eliminate the grand jury’s finding that an outsider could not independently reproduce the certified total.⁷

The grand jury also found that the office did not provide a comprehensive trail for all ballots issued, received, returned and challenged; that some handwritten chain-of-custody records were not legible; that temporary employees lacked emergency drills; and that ballot-processing livestream cameras did not record during two emergency evacuations. Riverside disputed or qualified several of those findings, including the audit-trail and camera findings.^7,8

The grand jury’s central recommendation was straightforward: hire a third-party independent firm to conduct a performance audit of all aspects of the Registrar’s election processes by June 2, 2026. The county rejected that recommendation as “not warranted or reasonable,” citing consultant reviews, Auditor-Controller work and collaboration with DHS. It accepted or planned other improvements, including further study of electronic chain-of-custody records and expanded emergency training.⁸

Those responses matter. So does the line the county drew. A consultant’s procedural review can improve operations. Statutory compliance can establish that required steps occurred. Neither is identical to an independent performance audit designed to test whether the complete system produces a result that outsiders can reproduce from the underlying records.

The Dominion connection—and the missing answer

California’s official 2020 inventory lists Riverside County as using Dominion ImageCast Central 5.10A for central tabulation and ImageCast X 5.10A for accessibility support; the 2026 inventory lists version 5.19 components. The Mullin letter says Dominion, as a company, acknowledged using some China-made parts.^11,14,1

That does not tell us which parts—if any—were inside Riverside’s specific units. The public records reviewed for this article do not provide a part-level bill of materials for Riverside’s deployed equipment, its component countries of origin, or the replacement history for individual devices. A vendor name is not a forensic finding. A model number is not a supply-chain audit.

California has also drawn an important technical distinction. In 2022 the Secretary of State said a CISA advisory involving Dominion ImageCast X version 5.5-A did not apply wholesale to California’s certified 5.10-A system. Seven of nine findings were not present, the state said, and two overlapping issues had already been mitigated. There was no evidence the vulnerabilities had been exploited. That memorandum is a reason to reject blanket claims about every Dominion device—but not a reason to conceal the exact provenance and configuration of the units used in Riverside.⁹

What independent verification should look like

An independent review can be rigorous without becoming partisan theater. At minimum, it should include:

1. Paper reconciliation. Account for ballots, return envelopes, voter-participation records, precinct and vote-center statements, cure records, duplication logs and adjudication records.
2. A meaningful hand audit. Use a statistically sound risk-limiting audit or an expanded hand count sufficient to test the certified outcome; if the court finds a full count necessary, document every batch and variance.
3. System examination. Review logs, removable media, access records, software and firmware hashes, configurations, technician activity and any authorized network connections.
4. Supply-chain verification. Obtain the bill of materials, serial numbers, supplier records, countries of origin, maintenance history and component replacements for the equipment actually deployed.
5. A public findings report. Publish the scope, method, totals, discrepancies and conclusions while sealing only the technical details necessary to protect voter privacy and system security.

Election officials sometimes argue that public release of technical security reports can reveal defensive weaknesses. That concern can be legitimate. It is not an excuse to avoid independent examination. Courts routinely protect sensitive details while permitting experts to test evidence and report conclusions the public can understand.

The answer is verification

Herridge’s disclosure changes the debate in one important respect: the supply-chain concern can no longer be dismissed as imaginary. The federal government has now said that dominant voting-system vendors acknowledged China-made components and has tied full grant access to paper-based post-election checks. Sacramento’s 2020 photographs add a local, contemporaneous fact: Dominion-branded cartons inside the county election warehouse carried a “MADE IN CHINA” mark.¹⁰

That leaves California with a choice. Officials can continue asking the public to accept assurance as proof. Or they can permit a protected, independent review capable of confirming the certified result—or identifying the exact point at which the records fail to reconcile.

If the records reconcile, an audit strengthens confidence and closes the door on unsupported claims. If they do not, the public learns precisely what failed and what must be corrected. Neither outcome requires investigators to begin with a fraud theory. Mechanical errors do not need motive, and public trust should not depend on pretending that only intentional wrongdoing can produce a meaningful discrepancy.

Source record

Primary records reviewed for this article. The photographs are used as documentary images and retain Mark Cook’s visible copyright watermark.

9. White House Election Integrity page and Secretary Mullin letter and DHS assessments ZIP.
10. S. House Administration Committee, 2020 Election Security hearing.
11. DHS July 10, 2026 grant-condition release and FEMA FY 2026 HSGP Notice of Funding Opportunity.
12. Sacramento County Grand Jury, Election Security in Sacramento County.
13. Sacramento County response to the 2019–2020 Grand Jury.
14. Email from Sacramento County Registrar Courtney Bailey-Kanelos, July 21, 2021 (on file with the author).
15. Riverside County Civil Grand Jury, Riverside County Elections: A Pathway to Greater Voter Confidence.
16. Riverside County response to the 2024–2025 Civil Grand Jury.
17. California Secretary of State June 3, 2022 memorandum on Dominion Democracy Suite 5.10-A.
18. Great American Rebirth, Sacramento Registrar of Voters: A Limited Case Study; Photo #1: Dominion Voting cartons marked ‘Made in China’; and Sacramento Registrar Courtney Bailey-Kanelos’s response posted with the case study. Photographs credited © 2020 Mark Cook.
19. California Secretary of State, voting systems used by counties in the November 3, 2020 general election.
20. Sacramento County Board of Supervisors, November 14, 2017, executed voting-system award materials (Resolution 2017-0773); and Riverside County Board of Supervisors, June 18, 2019, item 3.37 and Dominion managed-services agreement.
21. Shasta County Board agenda, December 5, 2017, item C9; Shasta County voting-system staff report and Hart authorization, March–April 2023; and Shasta County notice of Dominion contract termination.
22. California Secretary of State, voting technologies used by counties, 2026 inventory.
23. California Secretary of State, one-percent manual tally requirements.