FLASHBACK: Chinese Parts, Hidden Ownership, Growing Scrutiny: Inside America’s Biggest Maker of Voting Machines…

“The voting machine lobby, led by the biggest company, ES&S, believes they are above the law,” said Sen. Ron Wyden, D-Ore., a member of the Intelligence Committee who co-signed the letter. “They have not had anybody hold them accountable even on the most basic matters.”

ES&S Chief Executive Tom Burt dismissed criticism as inevitable and impossible to answer, but he called for greater oversight of the national election process.

“There are going to be people who have opinions from now until eternity about the security of the equipment, the bias of those companies who are producing the equipment, the bias of the election administrators who are conducting the election,” Burt said in an interview. “I can’t do anything to affect those people’s opinions.”

“What the American people need is a system that can be audited, and then those audits have to happen and be demonstrated to the American public,” Burt said. “That’s what will cut through the noise.”

Supply chain questions

ES&S invited NBC News journalists into its headquarters, the first time it has done so for a national news organization. The walls were decorated with images of the Constitution and inspirational messages about quality control. In glass-walled rooms etched with the company’s patents, technicians tested machines under tight security.

Burt, a native Nebraskan, has called for federal regulations that would require voting machine companies to address some of the key questions posed to ES&S. In June, he wrote an op-ed asking Congress for more regulation, which would include requirements for paper backups of individual votes, mandatory post-election audits and more resources for the U.S. Election Assistance Commission to speed improvements.

NBC News examined publicly available online shipping records for ES&S for the past five years and found that many parts, including electronics and tablets, were made in China and the Philippines, raising concerns about technology theft or sabotage.

During the tour, Burt said the overseas facilities are “very secure.” He said the final assembly of voting machines takes place in the U.S.

Chinese manufacturers can be forced to cooperate with requests from Chinese intelligence officials to share any information about the technology and therefore pose a risk for U.S. companies, NBC News analyst Frank Figliuzzi, a former assistant director of the FBI for counterintelligence, said. That could include intellectual property, such as source code, materials or blueprints. There is also the concern of machines shipped with undetected vulnerabilities or backdoors that could allow tampering.

In a letter to NBC News, ES&S said it takes “great care” with its foreign supply chain, including conducting risk assessments and making on-site visits to suppliers to make sure that components “are trusted, tested and free of malware.” It said that all of its facilities adhere to international standards, that it manufactures in compliance with all federal guidelines and that it follows cybersecurity best practices.

The company says that its overseas manufacturing site has been successfully audited by the Election Assistance Commission and that the company conducts on-site visits of its suppliers “to ensure that components are trusted, tested and free of malware.”

“Some components (such as surface mount capacitors, resistors, inductors and fixed logic devices) may be sourced from China-based manufacturers,” the letter said, referring to basic circuitry components.

ES&S said it conducts quality assurance tests on the machines.

Ownership questions

Questions about who owns the major voting machine manufacturers have followed the industry for years.

The issue took on greater urgency after the FBI disclosed in July 2018 that a Russian oligarch had invested in a Maryland election services firm. Officials in Maryland and North Carolina have started questioning voting machine makers about potential foreign ownership.

Because it is privately owned, ES&S is not legally obligated to reveal its ownership or any other details about its finances, although Burt did confirm that the company generated about $100 million in sales last year.

But in response to questions this year from the North Carolina State Board of Elections, ES&S disclosed which investors own more than 5 percent of the company. They include Burt, Chief Financial Officer Tom O’Brien and the Omaha-based private equity firm McCarthy Group, which owns a controlling interest. The letter identified two passive investors, Nancy McCarthy and Kenneth Stinson, who own stakes of more than 5 percent in McCarthy Group.

McCarthy Group did not respond to NBC News’ requests for comment.

Testing questions

Virtually no laws govern the cybersecurity aspects of voting machine technologies. But ES&S points to its voluntary efforts to improve voting machine security, most notably a new program with the Energy Department’s Idaho National Labs, the same federal facility that tests the power grid and nuclear power generators. ES&S machines underwent eight weeks of vulnerability testing and penetration by government hackers.

Chris Wlaschin, head of systems security for ES&S, said at a Homeland Security cybersecurity summit in Washington in September that the company’s machines are not prone to a remote attack over the internet. But he added that someone with enough time and access could make a machine “inoperative or unusable.”

Although Wlaschin said the company would release an executive summary of the government testing, the company recently said it has nothing for “external release.” It said recommendations from the tests would be incorporated into “future voting system releases.”

Wyden said he was concerned by the company’s foreign parts supply and was working on legislation to limit it.

“What you have found is particularly important because of the China connection,” he said.

Wyden is also eager to see the Idaho National Lab findings.

“They’re claiming that the Department of Homeland Security has been working with them. I’m going to ask for this information on the basis of your report within 10 days,” he said.

Eddie Perez, global director of technology development for the Open Source Election Technology Institute, a nonprofit election technology research group with which NBC News has partnered since 2016, said the lack of oversight is problematic.

“The way people vote is managed by a couple of entities that people don’t know a lot about, and that creates risks for the country,” he said.

When it comes down to the essentials, voting machine makers “behave based on the level of regulation they have,” Perez said.

“They have to check the boxes,” he added. “But once they’ve done that, they focus on selling their product.”