A polling site in Atlanta, Georgia, on November 8, 2016. John Spink/ZUMA
Late Monday, a federal judge ruled that Georgia’s electronic voting system, which lacks any paper trail, may violate the constitutional rights of Georgia voters. But the judge declined to force the state to switch to paper ballots before the midterm elections, which are less than two months away.
A group of voters and election security experts sued the state last July in hopes of forcing it to replace its old electronic machines with a system that provides a verifiable paper trail. Security experts have warned that the state’s antiquated election system is vulnerable to hacking and manipulation. The worst-case scenario is a hack that alters the result but cannot be detected due to the lack of a paper trail.
Judge Amy Totenberg acknowledged the election system’s vulnerabilities in her ruling. “Plaintiffs shine a spotlight on the serious security flaws and vulnerabilities in the State’s DRE [Direct Recording Electronic] system—including unverifiable election results, outdated software susceptible to malware and viruses, and a central server that was already hacked multiple times,” she wrote. The state’s use of this system, she wrote, is likely to cause a “debasement or dilution” of people’s votes.
Although Totenberg declined to force the state to switch to paper ballots this year, she did find that the state’s system is in dire need of an upgrade before 2020. The case will continue in federal court to determine what is required of the state by then.
Georgia is one of just five states that use only electronic voting machines with no paper trail, a system that voting security experts believe is easy to hack in an era of cyberattacks on our election systems. Georgia’s system is also the only one in the country that is centralized—using the same software for each machine across the state, downloaded from a single source. As a consequence, Georgia appears to be at particular risk of being compromised.
The possibility of compromising Georgia’s voting system is very real. In August 2016, a security researcher named Logan Lamb began poking around the website that housed the state’s election system to check for vulnerabilities. He was shocked to find that its firewall was inoperative, granting him access to information on 6 million voters, including names, addresses, and partial Social Security numbers, as well as election officials’ passwords that could be used on Election Day to access the central server. Special Counsel Robert Mueller’s investigation revealed that Russian intelligence officials had visited the websites of several Georgia counties, as well as counties in other states, looking for vulnerabilities.
Though Georgia is traditionally a red state, its changing demographics have made it a target for Democrats in recent years. In November, there will be competitive congressional races in the state, as well as one of the nation’s most-watched governor’s races between Democrat Stacey Abrams and Republican Brian Kemp. Kemp has served as Georgia’s secretary of state since 2010, and he is not only overseeing the election but also the defendant in the lawsuit over the security of the system he administers. “I don’t think there’s anything that Georgia can do to reasonably secure the paperless touch-screen machines that are in use today,” voting security expert Alex Halderman, a computer scientist at the University of Michigan and an expert witness in the case, told the court last week.
Totenberg’s ruling is an embarrassing refutation of Kemp’s oversight of the state’s voting system, although it’s not as harmful to his gubernatorial bid as if she had ordered the state to switch to paper ballots immediately. Confronted with the failures of their systems, Totenberg wrote, state election officials had moved “in slow motion” and “buried their heads in the sand.”
Matt Bernhard, a Ph.D. student working with Halderman, laid out the risk of a hack in an article on the website Medium on Monday: “It is quite possible that Georgia’s elections have already been hacked. Because the voting machines are completely unverifiable, we have zero chance to find out. No effort has been made on the part of the state of Georgia to investigate the impact of the vulnerability or to decontaminate various state voting equipment.”
Georgia election officials protested that switching to paper ballots at the last minute would be difficult. Early voting in Georgia begins October 15, less than a month from now. While Kemp’s office claims that the elections can be conducted securely and accurately, his office has conceded the need for reform. In April, Kemp assembled a panel of lawmakers and election officials to explore replacing the current system before the 2020 elections.
