6-Week Vote Machine Audit Found Weaknesses, Zero Fraud

For election security researchers, the Mojave Research case is a stark warning about what happens when technical truth collides with political expectation. A small firm with no election-testing background was thrust into a federal review, found serious weaknesses but no fraud, and saw its contract vanish. The implications for vulnerability disclosure, procurement integrity, and researcher independence are profound.

The central development is that Mojave Research, a cybersecurity firm with no prior election-systems testing experience, was hired by the Office of the Director of National Intelligence in the spring of 2025 to examine a Liberty Vote voting machine—formerly Dominion Voting Systems—that the agency had acquired from Puerto Rico. According to the firm's executives, speaking publicly for the first time at the DEF CON cybersecurity conference in Las Vegas in August 2026, the six-week basement review found extensive and largely unacceptable weaknesses, but no evidence that those weaknesses were actively exploited or that votes were altered. That finding, rather than reassuring the Trump administration, appears to have triggered a political backlash: the contract was abruptly not renewed after the firm declined to endorse false claims of voter fraud, and allies of President Donald Trump spread baseless claims that Mojave was funded by liberal billionaire George Soros.

“

Mojave Research's CEO, Jason Wareham, acknowledged that the work was done in his basement in Reston, Virginia, over six weeks—an unusual setting for a review of critical election infrastructure.

This episode sits at the intersection of election security, cybersecurity research integrity, and partisan pressure. The broader context is the long-running effort by President Trump and his allies to relitigate the 2020 election through claims of unreliable voting machines. The Office of the Director of National Intelligence, rather than establishing an independent technical review process with experienced election-security specialists, reached out to a small firm with no relevant domain expertise. Mojave Research's CEO, Jason Wareham, acknowledged that the work was done in his basement in Reston, Virginia, over six weeks—an unusual setting for a review of critical election infrastructure. The specific machine under examination came from Puerto Rico and was made by Liberty Vote, previously known as Dominion Voting Systems, a company that has long been a target of election-fraud conspiracy theories.

The technical findings themselves are nuanced and significant. Mojave's chief technology officer, Manbir Gulati, described the result at DEF CON's Voting Village symposium: "We found extensive and largely unacceptable weaknesses, but we did not find evidence that those weaknesses were actively exploited or that votes were altered." That distinction matters enormously in election security. The presence of serious vulnerabilities in voting equipment is itself a legitimate and serious public-safety concern, regardless of whether it was exploited. But the absence of evidence of active exploitation directly contradicts the Trump administration's preferred narrative that the 2020 election was stolen. This placed Mojave in a politically untenable position: its technical honesty undermined a politically convenient falsehood, and the consequence was professional retaliation.

The retaliation took multiple forms, according to the executives and documents they provided to CNN. Government work was derailed, the contract was not renewed, and false claims spread through Trump-aligned circles that Mojave Research was funded by George Soros—a familiar antisemitic trope used to discredit perceived political opponents. Wareham stated that a group of "White House-adjacent" Trump allies was dissatisfied that he was unwilling to "name and shame" and declare that the election had been a landslide for Trump. This pressure campaign illustrates how independent security findings can be weaponized or suppressed when they conflict with a powerful client's worldview. For the broader cybersecurity community, the message is chilling: honest technical assessment can cost contracts, reputation, and political viability.