In the wake of Russia’s interference in U.S. elections, questions persist as to whether Russia changed vote totals and changed the outcome of the election. Former Homeland Security Secretary Jeh Johnson and the Senate intelligence committee each say there is no evidence that the Russians did so. But as technologist Matt Blaze told the New York Times, that’s “less comforting than it might sound at first glance, because we haven’t looked very hard.” And experts agree that our outdated voting technology certainly exposes voters to the risk of interference, as election security experts and election administrators have known for more than a decade. Last month, the U.S. District Court for the Northern District of Georgia recognized that the risk of election hacking is of constitutional significance—and that courts can do something about it. In Curling v. Kemp, two groups of Georgia voters contend that Georgia’s old paperless voting machines are so unreliable that they compromise the plaintiffs’ constitutional right to vote. In ruling on the voters’ motion for preliminary injunction, Judge Amy Totenberg held that the plaintiffs had demonstrated a likelihood of success on the merits—in other words, Georgia’s insecure voting system likely violated their constitutional rights. While the court declined to order relief in time for the 2018 elections, the ruling suggests that Georgia may eventually be ordered to move to a more secure voting system. (Protect Democracy, where I work, has filed an amicus brief in Curling. Protect Democracy also represents Lawfare contributors and editors Benjamin Wittes, Jack Goldsmith, Scott Anderson and Susan Hennessey on a number of separate matters.)
Until now, courts have had few opportunities to consider the constitutional dimensions of vote-counting procedures. Voting rights litigation has centered on voter-registration rules, access to the polls, and access to the ballot, rather than the mechanics of counting votes. But with a new focus on election hacking, courts are being invited to scrutinize the sufficiency of different states’ voting systems and their security from intruders. Totenberg’s ruling shows that courts are fully capable of evaluating the risks of different voting technologies—and ordering remedies when they are needed.
Georgia exclusively uses Direct Recording Electronic (DRE) voting machines that produce no paper record. These touchscreen machines record votes on a memory card, which is removed at the end of voting and used to transfer the vote totals to county servers for tabulation. Computer scientists who have studied the machines used in Georgia have identified multiple avenues through which attackers could change vote totals on the machines. In fact, the Georgia plaintiffs’ computer-science expert actually executed one such hack in a live demonstration for the court. Separately, Georgia election administrators inadvertently published sensitive voting-related information such as software applications, voter registration information, and ballot-building files on a public website. Taken together, the court found, these features of Georgia’s system exposed voters to a substantial risk of election hacking.
Full Article: Federal Court Ruling in Georgia Shows Judges Have a Role to Play in Election Security – Lawfare.