Privacy Office
Attn: FOIA Appeals
U.S. Department of Homeland Security
2707 Martin Luther King Jr. Avenue, SE
Mail Stop 0655
Washington, D.C. 20528-0655

RE: APPEAL OF FOIA REQUEST - CISA Case Number 2026-NPFO-00131

Dear FOIA Appeals Officer:

I am writing to appeal the final response dated December 30, 2025, regarding my Freedom of Information Act request (CISA Case Number 2026-NPFO-00131) for in-election event logs from federally certified voting systems used in the November 3, 2020 and November 5, 2024 federal general elections.

CISA's response stated that "no responsive records" were located within CISA's files. I contend that this determination reflects an inadequate search and a misunderstanding of CISA's statutory obligations and custodial relationships with respect to election infrastructure records.

GROUNDS FOR APPEAL

1. INADEQUATE SEARCH - FAILURE TO REQUEST RECORDS FROM VENDORS
   CISA's response indicates that only "files within the CISA National Risk Management Center" were searched. This is insufficient. The requested records are maintained by private voting system vendors with whom CISA maintains direct regulatory and security relationships under the agency's election infrastructure protection mandate.

   Under FOIA, agencies must make reasonable efforts to search for records in their custody or control, not merely records physically stored in agency file cabinets. CISA has established relationships with voting system vendors including Election Systems & Software (ES&S), Dominion Voting Systems, Hart InterCivic, and others through:

   • The Election Infrastructure Subsector coordinating council
   • Federally mandated security assessments and certifications
   • HAVA clearinghouse authority (52 U.S.C. § 20901 et seq.)
   • Critical infrastructure protection protocols under 6 U.S.C. § 659

   These relationships give CISA the authority and obligation to request records from vendors on behalf of public requesters, particularly when those records document the operation of federally certified systems during federal elections.

2. VVSG 2.0 MANDATES ELECTION EVENT LOG AVAILABILITY
   The Voluntary Voting System Guidelines 2.0 (VVSG 2.0), which establishes federal certification standards for voting systems, explicitly requires that election event logs be exportable and documented:

   • VVSG 2.0 Requirement 4.1-D states: "The voting devices comprising the voting system must include support for CDF specification(s) for import or export of election event log data."
   • VVSG 2.0 Requirement 4.1-E states: "Manufacturers must provide a publicly available specification for event codes used in their equipment."
   • VVSG 2.0 Requirement 4.1-F states: "Manufacturers must include a specification describing how the manufacturer has implemented a CDF specification for a particular device or function."

   These federal requirements, developed jointly by the EAC and NIST, establish that election event logs are not proprietary vendor secrets but rather federally mandated data structures that must be exportable and documented. Any voting system that received federal certification under VVSG 2.0 was required to demonstrate compliance with these logging and export requirements.

   CISA cannot claim that election event logs are unavailable when federal certification standards explicitly mandate their existence and exportability. The vendors operating federally certified systems during the 2020 and 2024 elections were required to generate these logs in compliance with VVSG standards.

3. ELECTION INFRASTRUCTURE RECORDS ARE PUBLIC RECORDS
   The requested in-election logs document the operation of voting systems during federal elections and constitute public records under federal law. While these records may be physically stored by private vendors, they are generated by federally certified systems operating under federal and state election law, making them subject to public disclosure.

   CISA cannot evade its FOIA obligations by claiming it does not possess records that it has the statutory authority to obtain from third parties who maintain those records as part of the election infrastructure ecosystem CISA is charged with protecting.

   The VVSG 2.0 requirements demonstrate that these logs were specifically designed for exchange and analysis. The Discussion section of Requirement 4.1-D references "NIST SP 1500-101 Election Event Logging Common Data Format Specification," a federal standard created specifically to enable sharing and analysis of election event logs across jurisdictions and systems.

4. PART 2 OF REQUEST SPECIFICALLY ADDRESSED EAC CLEARINGHOUSE SUBMISSIONS
   My request explicitly sought "any national-level datasets, aggregated files, clearinghouse submissions, or compiled extracts of the above timestamped in-election logs for the November 3, 2020 and November 5, 2024 general elections that the EAC received from states, vendors, or testing laboratories under its HAVA clearinghouse authority (52 U.S.C. 20901 et seq.)."

   The response does not indicate whether CISA coordinated with the Election Assistance Commission (EAC) to search for records that may have been submitted to the EAC clearinghouse and subsequently shared with CISA. Given CISA's role in election security and its coordination with the EAC on VVSG standards, a reasonable search would have included inquiries to the EAC regarding any such submissions.

   Furthermore, CISA's role in developing and implementing VVSG 2.0 requirements, including the election event logging standards, creates a direct connection between CISA and the logs generated by compliant systems.

5. STATUTORY OBLIGATION TO MAINTAIN ELECTION RECORDS
   Federal law requires the preservation of election records. The Civil Rights Act of 1960 (52 U.S.C. § 20701) mandates retention of all records relating to federal elections for 22 months. In-election event logs are unequivocally election records subject to this preservation requirement.

   While vendors may physically maintain these logs, CISA's role in certifying and overseeing voting systems through VVSG standards creates a custodial relationship that triggers FOIA obligations when records are requested.

6. CONTRADICTION BETWEEN CERTIFICATION REQUIREMENTS AND "NO RECORDS" CLAIM
   CISA's position that no responsive records exist is fundamentally incompatible with the VVSG 2.0 certification process. If voting systems used in the 2020 and 2024 federal elections were federally certified, they must have demonstrated compliance with Requirements 4.1-D, 4.1-E, and 4.1-F, which means:

   • Election event logs were generated and are exportable
   • Documentation of event codes exists and is publicly available
   • Specifications describing the CDF implementation exist

   CISA cannot simultaneously certify voting systems as compliant with federal logging standards and claim that election event logs do not exist or are unavailable. This contradiction requires resolution through an adequate search that includes vendor records.

REQUESTED RELIEF

I respectfully request that DHS:

1. Order CISA to conduct a proper search that includes:
   a. Formal requests to all federally certified voting system vendors for the in-election event logs described in my original request, as required to be exportable under VVSG 2.0 Requirement 4.1-D
   b. Coordination with the EAC to obtain any clearinghouse submissions or compiled datasets containing the requested information
   c. Search of any CISA databases, portals, or systems that may have received automated log submissions from state or local officials during the election periods specified
   d. Review of VVSG 2.0 certification files to identify which systems were certified as compliant with election event logging requirements and obtain the logs from those certified systems

2. Direct CISA to fulfill its statutory role as the federal agency responsible for election infrastructure security by exercising its authority to obtain responsive records from vendors and other custodians

3. Require CISA to provide a detailed explanation of what specific actions were taken to search for responsive records, including what offices were contacted, what databases were queried, and whether any third-party custodians were contacted

4. Upon completion of an adequate search, provide all responsive records with only legally justified redactions

CONCLUSION

The American public has a fundamental right to transparency regarding the operation of voting systems in federal elections. CISA cannot fulfill its mission to protect election infrastructure while simultaneously refusing to obtain and disclose basic operational logs that federal standards explicitly require to exist and be exportable.

The VVSG 2.0 requirements make clear that election event logs are not optional, proprietary, or secret. They are federally mandated data structures designed specifically for exchange and analysis. CISA's role in developing and enforcing these standards creates both the authority and the obligation to obtain these records when requested by the public.

A "no records" response is unacceptable when CISA has clear authority to obtain the requested records from the vendors it regulates and coordinates with. I urge DHS to reverse this determination and require CISA to conduct a search commensurate with the agency's actual authority and custodial relationships.

I am enclosing a copy of CISA's final response dated December 30, 2025. Please contact me if you require any additional information.

Respectfully submitted,

Jason Page Date: January 6, 2026

Enclosure: CISA Final Response Letter (Case Number 2026-NPFO-00131)