Prosecutors in Los Angeles say Konnech, a small company that makes software for scheduling election workers, has illegally given its contractors in China access to sensitive data as part of a "massive data breach." A defense attorney said the prosecution was relying on dubious information from "one of the more discredited election deniers."

Now, amid the allegations, a number of localities across the U.S. are weighing whether to ditch Konnech's software with just weeks until Election Day.

Konnech has provided its PollChief software to some cities and counties across the country, including Los Angeles County.

The LA County district attorney alleges that by giving contractors in China access to sensitive data on elections workers, Konnech has violated its contract — and criminal law.

Konnech CEO Eugene Yu has been charged with conspiracy to embezzle public funds and grand theft by embezzlement of public funds.

The DA's criminal complaint does not address a motivation for the alleged criminal conspiracy, and does not allege that Yu stole money, but rather that he misappropriated government funds.

On Friday, a Los Angeles Superior Court judge ordered Yu to remain in home confinement in LA and post a bond of $500,000. Though Yu's passport was already in the custody of the LA County district attorney, prosecutor Eric Neff argued Yu should be held in custody pending trial, because he allegedly posed an "extensive flight risk" due to his "deep ties to China." Yu's defense attorney disagreed, arguing that a combination of GPS monitoring and the payment of bond was sufficient. The defense ultimately secured Yu's release. He is set to reappear in court in November, where he will enter a plea in the case.

The criminal complaint says that the third-party contractors in China who were sent the workers' data also "assisted with creating and fixing" Konnech's software.

A project manager for Konnech's $2.9 million contract with LA County said that this presented a "huge security issue," according to the complaint. But a spokesperson for the county clerk said the county is still planning to use Konnech's software in this fall's elections.

Prosecutor Neff said in court on Friday that "this is arguably the largest data breach in United States history," though he did not provide additional information about that claim.

Defense attorney Janet Levine cast doubt on the prosecutor's claim, and countered that such breaches are an unfortunate reality, noting that "the amount of data breaches in the country are astounding." In 2017, a breach of data from the credit reporting company Equifax exposed sensitive information on 147 million people — a far larger figure than what has been alleged in the case against Konnech.

NPR asked the district attorney's office about the claim. In response, a spokesperson said the DA's office is "still exploring the scope of the breach," and, "at this point, all we can say definitively is that there is significant evidence that there has been a data breach of LA election workers."

In any case, District Attorney George Gascón previously emphasized in a statement that "this investigation is concerned solely with the personal identifying information of election workers. In this case, the alleged conduct had no impact on the tabulation of votes and did not alter election results."

Last week, Yu was arrested in his home state of Michigan, and prosecutors sought to extradite him to California to face the charges.

The district attorney's office also told NPR that it launched its investigation due to a tip from Gregg Phillips, a prominent election denier associated with the controversial group True the Vote. Phillips and True the Vote also executive produced and provided the basis for the widely debunked election denial film 2000 Mules.

Phillips has said that True the Vote's examination of Konnech benefited from information provided by followers of the far-right conspiracy theory QAnon.

The district attorney's office had previously claimed that True the Vote played no role in its investigation, but now acknowledges that Phillips' report "did in fact result in us initiating our investigation," according to a spokesperson.

Yu's defense attorneys have already raised concerns about a criminal prosecution relying on any information from Phillips.

Konnech's representatives have also questioned why an alleged contract violation is being charged as a crime, when such disputes are typically handled in civil court.

"It looks and strikes me as a contracts case," said Levine, Yu's defense attorney.

'A very confusing situation'

Yu's arrest and the questions swirling around it sent a jolt of chaos through voting offices across the country that are in the midst of conducting a midterm election.

A spokesperson for the LA district attorney's office said it had received inquiries from 20 other jurisdictions that use Konnech's software regarding the charges.

NPR has confirmed at least four election jurisdictions have stopped using Konnech's software, including the city of Detroit, which has more than 500,000 registered voters.

The city clerk in Detroit, Janice Winfrey, declined an interview request from NPR, but told member station WDET in a statement that the city was terminating its contract with Konnech "out of an abundance of caution."

"Our data, which is now back under our exclusive control, was housed on servers located in Lansing, Michigan. Konnech, per its contract, only provided logistical and call center support," said Winfrey. "My staff and I are confident that the 2022 election process will run smoothly delivering, after all votes have been counted, an unimpeachable work product."

In Virginia's Loudoun County, northwest of Washington, D.C., election officials there scrambled to make a decision on whether or not to drop Konnech's services for this election, even though they didn't feel like they had all the information about the accusations.

"I have no idea [what's going on]," said Richard Keech, Loudoun's deputy elections director. "The district attorney [in LA County] doesn't seem to be talking. It is a very confusing situation. And we've gone round and round and round in circles about this because nobody has the full story."

The office has had a harder time recruiting poll workers in recent years due to increased scrutiny on elections, said Keech, so they did eventually decide to stop using Konnech software as a preventative measure.

"At this particular moment, with an election breathing down our neck, the last thing we need is for our election officers to feel like we're not doing everything we can to protect them," Keech said.

The county got its poll worker data back from Konnech, and has cobbled together a plan to manage and communicate with those workers this fall by using a few different systems.

"Election administrators are hardy, resilient folks," said Keech, noting that in 2020 Virginia lawmakers changed rules to expand ballot access just weeks before the election. "It's terrible to say it, but we're kind of accustomed to implementing systems with short or no notice."

At least two other Virginia counties, Fairfax and Prince William, have also said they have stopped using Konnech.

While four jurisdictions is a small fraction of the thousands of voting jurisdictions that make up the fabric of America's elections, it may represent a sizable chunk of Konnech's business in the U.S. The company has just roughly two dozen employees, and the about page on its website says it had 32 North American clients before the controversy.

Another client, the city of Minneapolis, said in a statement last week that it did not think any of its poll worker data was impacted, and indicated that it still planned to use Konnech software this year barring more information being uncovered.

Other election offices, like those in Hillsborough County, Fla. and Parker County, Texas, have tried to distance themselves from the controversy by clarifying publicly that they do not use Konnech's software.

A legal battle and an alleged 'smear campaign'

Both Konnech and True the Vote have traded allegations back and forth for months. In August 2022, Phillips and True the Vote accused Konnech of being part of a "red Chinese communist op run against the United States."

The following month, Konnech filed a lawsuit in federal court against True the Vote and alleged that the group illegally accessed Konnech's data and defamed Konnech with a xenophobic "smear campaign." Yu was born in China but immigrated to the U.S. in the 1980s and became a U.S. citizen in 1997, the company said. A spokesperson for Konnech gave interviews to several media outlets, including NPR, describing True the Vote's accusations as conspiracy theories and said that Yu was facing death threats as a result. The company acknowledged having done business in China as recently as 2021, and said it had employees there working on software testing and development. The company insisted, however, "Konnech has never stored customer data on servers in China."

A federal judge issued a temporary restraining order against True the Vote, requiring the group to cease using any data obtained from Konnech and to disclose information about who may have helped True the Vote access data from Konnech.

Even after Yu's arrest, the judge, Kenneth Hoyt, expressed skepticism and exasperation toward True the Vote's attorneys, according to a transcript of a court hearing obtained by NPR. He also described the defamation case as separate and distinct from the criminal case in Los Angeles.

Judge Hoyt, who was nominated to the bench by President Ronald Reagan, told True the Vote's attorneys, "I'm thinking you may be played" by the group.

"I'm confident that I have not been played," replied True the Vote's attorney, Brock Akers, who added that he thought the group's "election integrity" work was "worthy."

"I don't really have any confidence in any of these folk who claim they are doing that," said Judge Hoyt.

True the Vote's attorneys told the court that the initial source of their information about Konnech was a man named Mike Hasson. Konnech has since sought to add Hasson as a defendant in their lawsuit. NPR was unable to reach Hasson by phone or email.

Despite the federal judge's skepticism, authorities in Los Angeles appear to have taken True the Vote's information seriously, though the complaint does not reference the kind of wide-ranging conspiracy by the Chinese government that Phillips has claimed.

A spokesperson for the LA County district attorney said in a statement, "Our Public Integrity Division (PID) routinely accepts complaints from the public. Oftentimes, these complaints are made by political opponents of the accused. With that in mind, if a crime is alleged we have a responsibility to conduct an independent investigation. Greg[g] Phillips' report to PID was the first step in a thorough independent and still ongoing investigation which ultimately led to the arrest and charging of Mr. Yu."

A representative of True the Vote declined to comment.

Copyright 2022 NPR. To see more, visit https://www.npr.org.