The “try to hack us to see if we’re vulnerable” part is 100% standard practice for security audits. It’s called penetration testing, and there is an entire industry set up around the idea of legally breaking into secure facilities, just to see if their security is working. It is healthy, because it can be a valuable tool for finding major security flaws.

The massive glaring issue is the fact that they asked the penetration testers to hide their results, and not alert the agencies involved. The entire point of a penetration test is to see if attackers can get in so that you can fix the issues they used to breach your facility. If the penetration testers aren’t sharing their results, it’s just fucking breaking and entering to tamper with voting machines. Asking the penetration testers to hide their results is like asking a surgeon to pull out a perfectly healthy organ.

At least the security company noticed this, and had the ethics to actually come forward about it.

Right, I was just about to say the same. Were it literally any other administration, except maybe for Nixon but they didn't have voting machines, this would just be normal security stuff. Unfortunately for this administration of nuts who will 100% try to cheat and probably have at least twice before, it's very alarming.

no, i want the complete specifications for critical public infrastructure to be public so there are no secrets at all

We all speculate his handler is Putin, that has become clearer and clearer... now that the Russian Federation is basically allies with US... it's definitely keep your enemies closer situation favoring Russia.

Propublica has done some really good investigative journalism on this

There have been efforts to do this in the past. DEF CON's Voting Village spent a lot of effort to get second hand voting machines and provide them for hackers to try to compromise. The voting machine companies hated it, because it often demonstrated pretty terrible security practices. Since fixing security is expensive, they often adopted a "security through obscurity" mindset and refused to have anything tested. DEF CON still has a Voting Village, though I'm not sure if they still offer up machines for direct attack. Though ya, why States are satisfied with machines which don't come with some type of standardized testing (including Red Teaming) is beyond me. The AVS WinVote's security was so atrociously bad that it was finally decertified in a lot of States.

That said, hacking individual voting machines would be of little use if your goal is to change the outcome of an election, especially Statewide races. Polling in the US is really distributed, meaning that any effective attack would need to have multiple people all working in concert. And hacking on a machine by machine basis would take time and possibly create a lot of noise (statistical anomalies and the like). Big shifts would really come from pre-election tampering with things like voter rolls and propaganda/influence campaigns. That's where CISA could (or should have) helped. Showing up now is way too little too late. It's just the Trump administration trying to build up a bullshit case of "those silly States didn't let us help them. Now look at how badly they were all HACKED!" With, of course, Democrat wins being the only "proof" of said hacks.

CISA normally does stuff like this. The shady part is them being told not to release any findings to the voting machine manufacturer.