Can Georgia’s electronic voting machines be trusted?

When Georgia voters cast their ballots this fall, some will wonder whether the state’s outdated touchscreen voting machines are safe and accurate.

Election officials say voters have nothing to fear, but election integrity advocates say there’s good reason to worry.

Electronic voting machines could be hacked if someone got around security measures. There's no paper backup. And a state election computer exposed voting information online for months.

Even a federal judge said this week that there's a "mounting tide of evidence" the state's digital voting system is at risk.

Can Georgians trust their votes will be counted in the election for governor between Democrat Stacey Abrams and Republican Secretary of State Brian Kemp?

Skeptics say they’ve lost faith in the system and in Kemp’s ability to oversee it while running for higher office. Kemp and election officials are trying to reassure voters that the election system hasn’t been compromised, and that voting is safe and accurate.

"It's not trustworthy at all," said Dana Bowers, a voter who organized an online petition with more than 4,800 signatures calling for the state to switch to paper ballots. The State Election Board rejected the petition last week. "You can't verify your own vote, and you don't know if your vote even makes it through to be counted."

Georgia was the first state in the nation to move to electronic voting machines in 2002, when it was touted as a superior technology in the wake of problems counting Florida’s punch-card ballots with hanging chads during the 2000 presidential election.

Now Georgia is one of the last to continue to rely on them. Just four other states — Delaware, Louisiana, New Jersey and South Carolina — use electronic voting machines statewide without a verifiable paper record. As in Georgia, those states are facing fierce debates over election security as lawmakers consider whether to move to paper ballots.

Election officials acknowledge that Georgia’s voting system should be phased out and replaced with paper ballots, which can’t be hacked. But they remain certain that the state’s 27,000 direct-recording electronic voting machines will work well — for one more election at least.

“I’m very confident of where we are in the Secretary of State’s Office, and where the counties are, to get ready to vote on our secure system,” Kemp said Monday. The state is working to upgrade its “secure — but aging — voting system” in time for the 2020 presidential election, he said.

‘Not just a theoretical, paranoid notion’

The most significant threat to electronic voting comes from hackers, whether from Russia or elsewhere, who could find a way to penetrate election computers to alter results.

While attorneys for Kemp said in court filings that those fears amount to “paranoia,” election integrity advocates and computer security experts say the peril is real.

U.S. District Judge Amy Totenberg agreed, saying election officials haven't dealt with security vulnerabilities that could undermine voters' trust in elections. However, she ruled against a motion to convert the state to paper ballots immediately because of the potential for voter confusion and staffing shortages.

“It is not just a theoretical, paranoid notion at this point,” Totenberg said in court last week. “We don’t think that in other contexts, in financial frauds … in data breach cases. We don’t think it is theoretical because it hits our bank accounts, and we can see it.”

An overriding concern is that someone could find a way to contaminate Georgia’s voting machines with malware that could change or erase votes.

Though voting machines aren’t directly connected to the internet, witnesses testified last week that USB drives or CDs are used to transfer election data from internet-connected computers to election servers. Tech experts say that’s a way hackers could spread malicious code, as the Stuxnet virus did when it damaged Iran’s nuclear program.

“It’s connected to the internet in so many ways, it’s hard to keep track of,” said Richard DeMillo, a Georgia Tech computing professor. “There are so many ways to breach a secure system that any one of them would be useful to an intruder.”

There’s no evidence that Georgia’s touchscreens have been hacked during an election, but malware could be written so that it erases itself after rigging an election, leaving no trace.

Election officials say security precautions protect voting machines from tampering. For example, a USB drive is reformatted every time before it’s plugged into an election server, said Michael Barnes, the director of the Center for Elections Systems in the Secretary of State’s Office.

“Voters can have confidence in our system. Their votes will be counted accurately,” said Cathy Cox, a Democrat who oversaw Georgia’s transition to electronic voting machines as the secretary of state from 1999 to 2007. “I have great confidence in the security layers that we have in place for storing the equipment, for testing the equipment, and the checks and balances at the end of every Election Day that have proven that they work over the last 16 years.”

That’s little comfort to those who are unsure whether their votes will be recorded correctly on state election computers.

Some of them are choosing to vote by mailing absentee ballots on paper, a way to mitigate some of the digital risks posed by electronic voting machines. Georgia allows its 6.8 million registered voters to request absentee ballots.

A push for absentee ballots

Abrams is encouraging voters to vote by mail, a message she has spread on Facebook and Twitter. About 10 percent of Georgia voters typically vote on paper absentee ballots.

"I believe in trust but verify. So we have to use the paper ballots that come with absentee balloting if we want to make sure all our votes are going to get counted," Abrams said during a town hall meeting last month.

Concerns about election integrity and security increased two years ago, when a cybersecurity researcher found that an election server housed at Kennesaw State University had exposed Georgia voters' information online for months. Kemp terminated the state's contract with KSU last year and moved elections management functions in-house.

The researcher, Logan Lamb, said in a sworn court filing last month that the information included more than 6 million voters’ driver’s license numbers, birth dates, home addresses and partial Social Security numbers.

Someone with access to voters’ birth dates and driver’s license numbers could change voter registration information online, making it more difficult for them to vote, DeMillo said.

State election officials dispute Lamb’s claims. Kemp spokeswoman Candice Broce said Lamb never accessed the voter registration database, and no personally identifiable information was breached.

Further fueling distrust of Georgia elections, Abrams supporters say Kemp shouldn’t be in charge of elections as secretary of state while also running for governor.

Kemp has said he won't resign, and there's no way for him to manipulate elections, which are managed locally by Georgia's 159 county election offices.

“The secretary of state does not actually run elections in Georgia,” Broce said. “We do not tabulate votes. We do not process absentee ballot applications. We do not issue absentee ballots. We do not determine voter eligibility. … Georgians can be confident that their votes will count.”

On top of other suspicions about Georgia's voting system, a Russian agent accused of tampering with the 2016 presidential election visited election websites in Cobb and Fulton counties, according to a July indictment as part of special counsel Robert Mueller's investigation.

The agent, Anatoliy Sergeyevich Kovalev, viewed a job posting for a Cobb election technician position and visited a Fulton website containing information for candidates. He didn’t gain access to state or county election systems, according to the Secretary of State’s Office.

Georgia legislators are reviewing a new voting system for the 2020 presidential election year. All options under consideration include a paper ballot, either with bubbles filled in by a pen, or with touchscreen machines that print ballots for voters to review and cast.

Despite worries about the sanctity of Georgia’s election system, voters should feel assured that their vote will count, said David Becker, the executive director of the Center for Election Innovation and Research.

Just because there are vulnerabilities in Georgia’s election technology doesn’t mean they’re easy to exploit, he said. The more people vote, the more likely it is that interference in elections could be detected.

“Nothing would make Vladimir Putin and Russia happier than if voters lost confidence and stayed home,” Becker said. “The best way to promote election security and democracy overall is to go vote.”

— Staff writer Greg Bluestein contributed to this article.

How to vote in Georgia’s election