Photograph by Joe Raedle/Getty Images
Pop the hood of Georgia’s elections system and you’ll notice a lot of old, rusted parts, begging to be repaired or replaced. But if you ask Secretary of State Brian Kemp, the Republican nominee in this year’s gubernatorial contest, for a diagnosis, he’ll likely assure you that, despite a few loose screws and some oxidation on the battery, the eight-cylinder power propelling this motor has no problem carrying you from Point A to Point B—or running an election.
Kemp, who elbowed Lieutenant Governor Casey Cagle out of the race in the July 24 runoff election, is the overseer of Georgia’s elections engine, which will likely count well over 2 million votes to determine if he or his Democratic rival, Stacey Abrams, will claim the state’s top job after the November 6 general election.
Some—including the Democratic Party of Georgia—take issue with the fact that Kemp oversees the procedures that are used to elect Georgia’s public officials, calling on him to resign from his elections czar post. (Congresswoman Karen Handel stepped down when she held the job in 2010 to run for governor, but Cathy Cox held on to her position when she ran for governor in the 2006 Democratic primary.) Kemp has reportedly said he has no intention of resigning.
“The same people that are criticizing me on [elections integrity], if I resign, they’d criticize me for leaving the office, saying, ‘You’re scared and running because elections are not secure,’” Kemp said, according to WABE. “It’s just a political argument.”
One of the most controversial questions regarding the governor’s race and others on Georgia’s November ballot: How tight is Georgia’s elections system security? The question is polarizing. The answer is complicated and, in some ways, up for interpretation—and litigation. And how exactly to reform a system that Congresspeople and activist groups, such as Georgia Votes Paper and the Coalition for Good Governance, have deemed problematic is subject to a tangled debate.
Currently, Election Day for a Georgia voter looks something like this: Show up to the assigned precinct and show a photo ID to check in by signing a voter certificate; take a yellow voter ID card from a poll worker and insert it into an available voting computer; mark selections on the touchscreen and press the “cast ballot” button; eject and return the voter ID card to a poll worker; receive and proudly don an “I’m a Georgia Voter” sticker. Once the polls close, around 7 p.m., elections officials lock up the voting machines—essentially bulky laptops—and cart them and the voter cards to a “check-in center,” which will then send the election data to the respective county’s elections preparation center, where the votes are counted and tabulated.
In addition to being one of just 14 states using an electronic-only voting system, Georgia is one of only 10 states that don’t mandate post-election audits, according to the National Conference of State Legislatures, along with fellow Southern states Alabama, Louisiana, and Mississippi.
Thanks largely to Russia’s interference in the 2016 presidential election, voters—particularly those in Georgia, which Democrats in the Congressional Committee on House Administration say has among the most vulnerable elections systems in the country—have raised eyebrows about the integrity of polling machines, the safety of voter registration data, and Russia’s ability to affect the final tallies.
Russia unnerved Georgians in July, when indictments dealt by Special Counsel Robert Mueller’s investigation said that Russian military intelligence officers had paid a visit to websites with election information in U.S. states—and in Fulton and Cobb counties—“looking for election-related vulnerabilities,” as a report by The New Yorker put it.
Some elections reform advocates claim Georgia’s polling machines can be easily hacked, and that a paper ballot process—essentially just bubbling in selections, like answers on a multiple choice test—is imperative to monitoring vote counting and auditing. They also believe each Georgia county has the discretion to implement a paper-based system, should it see fit and have the necessary polling equipment.
The secretary of state’s office disagrees with both charges. Nevertheless, citizens in Morgan County, which lies about 50 miles east of Atlanta, are lobbying the county’s elections board to declare Russia’s intrusion in the presidential election an “emergency” that warrants a switch to paper ballots. Should those activists succeed in overhauling their elections system, however, Georgia’s elections board could attempt to see Morgan County punished for an election law violation, according to the secretary of state’s office.
As Buzzfeed News recently pointed out, pro-paper advocates’ crusade for change requires some walking on eggshells. Activists find it important to school registered voters on the problems Georgia’s elections systems face, although they’re reluctant to sensationalize supposed security holes, worrying these issues could convince people that their votes don’t matter and that a trip to the polls would be all for naught.
Photograph by Stephen Morton/Getty Images
On August 6, in a packed room at Manuel’s Tavern, activist groups Georgia Alliance for Social Justice and Georgia Votes Paper hosted a panel discussion spearheaded by a Georgia Tech computing professor, a cyber security researcher, and elections watchdogs involved in a federal lawsuit against the secretary of state’s office that plaintiffs and supporters hope will yield a paper-centric overhaul before the general election.
Panelist Logan Lamb, the cyber security researcher who also considers himself something of a hacker, gave attendees a play-by-play of how he was able to casually crack into a Kennesaw State University server—the college once housed Georgia’s Center for Elections Systems—and easily retrieve Georgia voters’ personal information.
When Lamb first stumbled upon KSU’s data, “It was before the presidential election, and the last thing I wanted to do was stir up a bunch of fear needlessly,” he said at Manuel’s. But what he found didn’t exactly pacify fretting voters. Lamb discovered lists of registered voters’ names, addresses, birthdays, the last four digits of social security numbers, and drivers license numbers—personal info that could be used to alter a voter’s registration information.
Lamb tipped off Merle King, then at the helm of KSU’s Center for Elections Systems, about what he was able to download, although the agency, with which the state severed ties after a number of security lapses were identified, had allegedly brushed such concerns aside, according to The New Yorker’s report. That supposed dismissal of Lamb’s security concerns preceded a mysterious wipe, in July 2017, of the Center’s entire records cache, further calling into question the integrity of the state’s voter data.
The secretary of state’s office, however, maintains that there’s no concrete evidence to suggest that hackers have breached Georgia’s elections infrastructure and impacted the results of any particular vote, and notes that the FBI “has a complete copy of KSU’s misconfigured server.” Additionally, officials say, issues of polling machine security are often conflated with those of voter rolls and tabulation processes. And as for that data wipe, Kemp initially blamed it on the “ineptitude” of KSU’s technicians, but later backtracked and said the deletion was just protocol when servers are retired, according to Politico Magazine.
Photograph by Steve Pope/Getty Images
While paper ballot supporters assert that their proposed method is the only way to ensure there’s a “voter-verifiable paper trail” following an election, the secretary of state’s office, as well as Fulton County elections commissioner Richard Barron, suggests Georgia’s currently used direct-recording electronic voting machines (DREs) are able to spit out paper copies summarizing screen touches made during polling hours. That audit, however, relies purely on a sense of trust in the voting computers’ code. As evidenced by a video report by the New York Times, an experienced computer geek could dictate the results of an election by tricking officials into downloading voting machine software infected with malware.
Lamb and Georgia Tech professor Richard DeMillo, another panelist at Manuel’s, suggest intruding in an election computer is as easy as loading a virus onto a memory card that looks just like the voter cards handed out by poll workers. Although the machines are “air-gapped”—not connected directly to an online server—“the cards are programmed from a central internet-connected server,” DeMillo says. “If that server is compromised, it can write whatever it wants on the cards. The voting computers read whatever is written on the card automatically and invisibly to the election workers. If that’s a command to install malware and erase all traces, the poll workers would never know.”
But, according to the secretary of state’s office, it’s not that simple. “Georgia’s voting machines have layers of physical and logical security to detect and prevent tampering or other malicious activity,” says Candice Broce, spokesperson for the secretary of state’s office. “Votes cast are reconciled at every precinct using voter access cards, poll books, and oaths signed by voters.” Additionally, Broce added, Kemp’s office late last year inspected Georgia’s voting machines “and found them to be secure and accurate.”
Jeh Johnson, secretary of Homeland Security under former President Barack Obama, urged America’s state leaders in August 2016 to start considering elections systems as “critical infrastructure”—think roadways, bridges, and the power grid—allowing DHS to help states out with cyber security matters. “This inflamed Kemp,” The New Yorker reported, adding that he believed such a designation would welcome undue federal government regulation, which his party so often detests. Still, he later accepted the department’s assistance and has said his office has a much stronger relationship since President Donald Trump took office.
Kemp has said he’s not overtly opposed to adopting a paper ballot program, nor does he want to keep the current, outmoded process operating as-is. He, too wants Georgians to have a voter-verifiable paper trail, so he’s currently heading the Secure, Accessible, and Fair Elections Commission (SAFE), which is helping Georgia identify and find funding for a voting system upgrade. A new system could be in place by the 2020 presidential election.
All options are on the table, his representatives have said. The aforementioned lawsuit against his office, however, is asking for something that just can’t be accomplished by November, Broce says. Georgia only has roughly 650 operable optical scanners, which are needed to count paper ballots. The secretary of state would need to buy more scanners to tally all the votes, she says, and the state’s procurement rules would likely preclude a hasty purchase and implementation process.
“There is not enough time to acquire the right inventory, train local elections officials, educate voters, and ensure the necessary safeguards to prevent chaos at the polls if a judge orders Georgia to convert to a new system virtually overnight,” Broce says.
Not so, argues Marilyn Marks, lawsuit plaintiff and the executive director of the Coalition for Good Governance. Optical scanners, Marks says, can count 30 ballots in a minute, meaning if Georgia officials started feeding paper to the machines in the afternoon of Election Day, they’d be able to count every ballot well before midnight. She added that elections commissions in myriad other states, such as Colorado, would be glad to lend their machines to help out. (To this point, Broce says that if a machine were to be borrowed, it would have to be tested for compliance and would need to be compatible with Georgia’s election management system. In response, Marks says that Colorado’s equipment is the same model as Georgia’s and that some Colorado scanners were sent to Georgia last year in Muscogee County.)
But Barron, the head of Fulton elections, says the current system used in the state’s largest county has a zero percent error rate. Paper balloting, he continues, would be “going back to the stone age” and can yield a 5 percent error rate. “The more human hands that get on it . . . the more people can manipulate it,” he says.
The plaintiffs in the suit against the secretary of state’s office cited in their litigation a handful of discrepancies found in Fulton’s past elections, such as the 6th Congressional District race that Republican Karen Handel won over Democrat Jon Ossoff in June 2017. According to court records, a few precincts reported conflicting numbers when they tallied the number of people who cast ballots, the amount of people who showed up and signed in to vote, and the official precinct head count at the end of the election.
Those discrepancies, Barron claims, might have stemmed in part from the amount of yet uncounted provisional ballots—voters of questionable eligibility, such as those who might have visited the wrong precinct, cast this type of vote, which must later be verified by elections officials—as well as hiccups with Express Polls, which poll workers use to determine who’s voting. If the Express Polls fail to sync while at the precinct, Barron says, “the number at the end of the day is going to be out of balance with the number of votes on the touchscreens.” Poll workers count voter certificates as a backup, but those numbers can have discrepancies, too.
“Sometimes, when [poll workers] get to the end of their 14-hour day and they don’t feel like going back through and counting those [voter certificates] one-by-one—especially if they have a thousand of them—they write down the simplest number they can,” he says, leading to a further review of paperwork. But technicians can reconcile the tally between Express Polls and touchscreens back at election prep centers.
In a prepared statement sent to Atlanta magazine, Kemp wrote: “The chaos of switching to a completely different voting system this close to an election would cause inconvenience, voter confusion, and potentially suppressed turnout. Georgians should know that their votes count because our voting equipment remains accurate and secure. The hysteria of some people seeking to force Georgia to switch to an all-paper ballot system is based on misinformation, and making this change would spend money to create problems that we should avoid.”
Still, many, including Barron, say the system, which uses 17-year-old voting machines, is due for an upgrade. “When your server is running off of Windows 2000, it’s not supported by Microsoft anymore,” says Barron, “so that’s one reason you’d need to upgrade to a voting system where the server is up to date with today’s technology.”
Multiple federal agencies, not to mention President Donald Trump, have endorsed some form of paper-based system to conduct elections. “It’s old fashioned, but it’s always good to have a paper backup system of voting,” the commander in chief said, according to the New York Times.
Kemp’s office said the SAFE commission is currently shopping around for a voting system that offers a voter-verifiable paper trail, Broce says, and on August 8, the state reached out to polling machine vendors to request information about potential replacement equipment. “The voter registration database (replaced in 2013) is the only component of Georgia’s election system that we will not replace at this time,” she added.
However, the secretary of state’s office told Atlanta magazine that, in the unlikely event of a power outage or other disaster on Election Day, paper provisional ballots could be utilized. Georgia’s polling machines are equipped with battery backups that last about 3-and-a-half hours. “If electricity to a polling place was lost, poll workers could power down several machines for use until the active ones’ batteries ran out of power,” Broce said. “They also keep provisional ballots on hand, if needed.”
With the general election fast approaching, the clock is ticking on the activists’ lawsuit, but much more is at stake than the results of this year’s gubernatorial election. Kemp is now in the hot seat, and his next moves and the actions of his office could determine the future of Georgia’s democratic processes.
Editor’s Note 8/22/18: We’ve updated this story to clarify a few sections after receiving comments from Secretary of State spokesperson Candice Broce. On 8/26, we updated this section to reflect comments from Marilyn Marks, the plantiff in the lawsuit against Brian Kemp.
-We reported that some were calling for Brian Kemp to recuse himself from election tabulation. The Secretary of State’s office does not tabulate votes; this is performed at the county level.
-We’ve clarified that Georgia’s voting systems are “electronic-only,” rather than “totally paperless,” as they do have the ability to print paper copies of screen touches, according to Broce. In response to Broce’s comments, Marks still maintains that Georgia cannot, in fact, print paper copies of screen touches and that “there is no paper trail as required by federal law.”
-We clarified that Russian military intelligence officers visited “websites with election information” rather than “voting websites.”
-We added a note from the Secretary of State office that the FBI has a complete copy of KSU’s server.
-We removed a reference to an 11-year-old’s hack of a simulated election reporting website at this year’s DEFCON hacking convention because it is not related to physical voting machine hacking.
-We previously added a note from Secretary of State spokesperson Candice Broce about Marilyn Marks’s suggestion of borrowing optical scanners from another state. We then added a response to Broce’s comments from Marks, who says that Colorado has excess equipment that is the same model as Georgia’s and has lent scanners to Georgia in the past.
