Lawsuit pushes Georgia to dump paperless voting machines by November

The voting machines used in the latest Georgia primary are the subject of a lawsuit that calls for the state to stop using them out of fear that they can be hacked.

A group of election reform advocates is seeking an injunction that would force the state to abandon its paperless direct-recording electronic (DRE) voting machines before November. For Georgia, that would mean all of the machines, since it’s one of five states that exclusively use DREs.

Experts have argued that DRE machines are susceptible to hacking because of their lack of an accompanying paper record.

Plantiffs contend that the Georgia voters’ constitutional right to properly counted votes is in jeopardy due to the inherent flaws in DRE machines. Instead of relying on the machines in November, the suit reasons that voters could simply use paper ballots then count the votes using optical scanners the state currently uses to count mail-in and provisional ballots.

“Georgia voters are at risk of being disenfranchised by being denied the right to vote or by having their votes nullified through interference that alters the election results from what voters intended,” David Cross, an attorney with Morrison & Foerster, told CyberScoop by email.

Georgia is not alone in the challenge of dealing with DREs, as many states have started to take steps toward replacing similar machines. But a plaintiff in the suit says the state is unique because of its past security lapses.

“It’s the largest state that still has all paperless DREs. So by far, millions more people are affected by an unauditable system,”  Marilyn Marks, executive director of the Coalition for Good Governance told CyberScoop. CGG is a plaintiff on the suit.

For the time being, state officials argue that the current system is secure. Candice Broce, press secretary for Georgia Secretary of State Brian Kemp, told CyberScoop that the state’s election systems have “extensive security protocols in place” and that IT staff receive regular threat intelligence updates.

Each county, Broce said, has its own air-gapped vote tabulation and election management system as an added security measure.

Kemp, who is running for governor this year, issued a statement earlier this year affirming that Georgia’s current voting system is “accurate and safe,” after having conducted a security assessment in November.

Nevertheless, Kemp created a commission to possibly replace DREs with a system that contains a voter-verified paper trail by 2020. The reasoning he provided was to “further increase resiliency and update an aging system.”

Cross said these actions amount to “window dressing,” since Kemp is still defending DREs. Marks said she’s skeptical because of Kemp’s justification of replacing DREs.

“They are still … claiming that the system is sound and secure, and produces great results, and that there’s nothing wrong with the system,” Marks said. “They have said ‘Yeah, we need a new system because this one will be aging,’ but they have not acknowledged the security risk in the current system at all.”

Marks said that drive for using paper is important in order to instill confidence in the vote. Officials and experts have said that an adversary need not necessarily change vote counts to sow doubt; the mere risk of that happening is enough to reduce confidence.

“It is one of the key reasons why we have to go to a paper-based system that people can have confidence in. They can have total confidence in coloring in that bubble,” Marks said. “We have to have a system that has voter confidence not decreed, but voter confidence that’s earned.”

The U.S. intelligence community concluded last year that Russia actively tried to interfere with the 2016 election and officials have said it will do so again. The Department of Homeland Security warned 21 states that Russian hackers probed their election systems for vulnerabilities. While officials have repeatedly said that there’s no evidence vote totals were changed, an attorney on the suit says to take that with a grain of salt.

“It could simply mean that nobody’s found definitive proof that the election results were affected yet because it’s difficult to establish. But even if there’s been no effect on election results so far, a significant risk remains for the upcoming elections,” Cross said.

For those reasons, Cross says it’s “imperative” that some change happens before the midterm election to make the vote more secure.