what, if anything, would a router show at this point in time. Do these routers use store logs that would still be accessible?
Are they trying to find some rhetorical bamboo in the switch (trying to be funny though those beliefs definitely are not in my book...)?
That said, the EMS is usually a small half-rack setup and I'd be surprised for there to be a router at all. Often it's a single machine. The vendors usually tell you to either never connect it to outside networks, or to do so only for setup and disconnect it before you start election preparation. Most, usually all, in-election connectivity to the machines is via sneakernet.
Any kind of detailed network logging becomes a big undertaking at organizational scale, so it's very unlikely that there are any kind of useful persistent traffic logs on the routers. Any such logs would have been kept on a dedicated system like a netflow collector or SIEM, the routers don't have the storage (or storage write endurance). The fact the senate didn't subpoena for such a system suggests it doesn't exist, which is unsurprising. Mass-retention of network traffic logs is a sufficiently expensive and complex thing that not a lot of organizations do it.
That was my guess on logs. Really cool to learn more!
You sound like you work in the industry. I'm sorry for that ;( Recent WaPo article on election workers was scary.
There isn't, you can actually see their EMS diagram here: https://recorder.maricopa.gov/justthefacts/pdf/Maricopa%20EM...
(Switches yes, but no routers)
https://recorder.maricopa.gov/justthefacts/pdf/Maricopa%20EM...
It shows the EMS rack and the ballot scanners in a network configuration.
Since this seems to be windows based from a video I've seen. At least the software they were using to adjudicate votes. Source: https://rumble.com/vbqj0b-dominon-voting-machines-walkthroug...
I expect the EMS rack have a network port and not a wifi port. Back when I was using windows, connecting to the internet through the network port required a setup step, for things like DHCP server for the dynamic ip. I'm curious, does windows remember the configurations it has used in the past? And does windows keep a log file of the network connections it makes, and how often are those logs rotated typically?
But you can see they use a Netgear switch, so we don't even know if it's managed but I'd guess it's not because Netgear's managed line just isn't that popular. There's probably nothing of interest that could be extracted from that switch.
Yes, as far as I know all of Dominion's management software is Windows-based. There's a potentially huge amount of forensic data available from the Windows machines but whether or not you could demonstrate internet access just depends. It's the kind of thing you could probably only prove in the positive. Windows does not keep network logs per se, just there are lots of other logs that can be used to infer certain network activity. The reality is that network traffic is so high volume and low value that it's unusual for anything to record it in much detail, it'd just eat a lot of storage and I/O to never get looked at.