As the 2016 cyber-attacks on U.S. elections continue unabated this election year, most everyone agrees that Georgia’s aging, insecure voting machines must be replaced with a new system to increase public confidence.
Georgia legislators tried this spring to authorize purchase of a new system, but the flawed legislation failed. That’s a good thing. It would have made the situation worse, not better.
In the wake of this failure, Secretary of State Brian Kemp formed a blue-ribbon Commission on Secure, Accessible and Fair Elections (SAFE) to study the options for Georgia’s next voting system. In short, the Secretary set up a way for Georgia to dig itself out of its election integrity hole and leapfrog to the front of the pack nationwide. At SAFE’s first meeting, Mr. Kemp sabotaged his own commission.
The laudable goal of that meeting was to describe Georgia’s current system. Briefing slides are available online. Not apparent in the published material is a disturbing pattern of giving SAFE false and misleading information. If not corrected, the Commission’s recommendations will be as flawed as other efforts to fix the current system. Here are five egregious examples of such misinformation.
1.) SAFE was falsely told that current touchscreen voting machines are mandated by Georgia Law. The touchscreen “mandate” is an easily reversible administrative action of the five-member State Election Board. Here’s why it matters. These machines have been hacked repeatedly and at will. Most states subsequently abandoned them. Georgia law specifically authorizes the use of optical scanning of paper ballots, a more-secure alternative.
2. SAFE was not told that Georgia’s touchscreens violate the federal Help America Vote Act (HAVA). HAVA requires a paper record of votes cast so that manual recounts can be conducted. Election Director Chris Harvey told SAFE members that electronic ballot records stored in Georgia’s voting machines are the same as paper records because a paper printout can be created. This claim would require the state to trust the validity of internally stored electronic records on hacked machines. Data stored on compromised machines must be presumed to be untrustworthy.
3.) Georgia owns 1,000 paper ballot scanners — enough to conduct elections — but SAFE was misinformed about the feasibility of using them. If 3 million voters cast their ballots in November, the average load per scanner is 3,000 ballots. The entire election could be conducted quickly and efficiently in this way. Harvey’s claim that the overloaded machines would be “smoking” is unsupported by evidence. Furthermore, other states have upgraded their scanning equipment and warehoused scanners identical to Georgia’s. Election officials I have spoken with in those states are willing to loan this equipment to Georgia.
4.) SAFE was misleadingly told that scanning of paper ballots is “old fashioned” and inconsistent with Georgia’s high-tech image. Just the reverse is true. Georgia’s reputation has been severely damaged by a series of technology- and cybersecurity-related fiascos. Election officials conflated hand-marking and hand-counting of paper ballots, made up claims about the “hackability” of paper ballots, and characterized paper ballots as a “step backward.” Cybersecurity experts agree that hand-marked paper ballots are the safe, modern alternative, a position that has been endorsed by the Department of Homeland Security and Congressional committees.
5.) SAFE was misinformed about the vulnerability of Georgia’s current system to cyberattacks. Georgia’s current election system is at high risk of attack and penetration. Claims that “voting machines are not connected to the Internet” (they are) bolster a false sense of security. Impartial examinations of Georgia’s election system have debunked these claims that Georgia’s system is secure. Intelligence agencies assesses the risk of attack as high. No forensic analysis of whether votes have been changed has occurred. National media coverage of Georgia’s weaknesses is relentless. Election officials have shamefully excluded the public from legally protected observation. SAFE is being misled into believing self-serving, false assurances.
It is certain that Georgia’s voting machines will be scrapped sometime soon. SAFE recommendations will help determine public confidence in future elections. Mr. Kemp owes it to his commission and all Georgia citizens to correct this misinformation and accurately explain the cybersecurity realities of election integrity.
Richard DeMillo holds the Charlotte B. and Roger C. Warren Chair in Computer Science at Georgia Tech. He studies election security and serves on the advisory board of Verified Voting.