August 5, 2018

Dear Georgia Public Official:

The controversy concerning Georgia’s insecure and un-auditable voting system is escalating, gaining national attention daily. Most recently McClatchy newspapers (including the Macon Telegraph and the Columbus Ledger-Enquirer)  reported on the alarming election system security failures . This follows considerable national press over the last year about the reckless management of Georgia's unacceptable voting system.

The purpose of this letter is to offer reliable verifiable information (here and through a live event Monday ) related to Georgia’s seriously failing voting system, and  your duty as a public official to take prompt action to remedy the unsustainable situation impacting Georgia voters, your constituents. The latter portion of this letter fact-checks Secretary Kemp’s recent misinformation efforts through a letter his office directed to 159 counties’ Board of Elections. 

Immediate opportunity to hear from experts and ask questions

On Monday night, Professor Rich DeMillo , Logan Lamb (cybersecurity researcher who  gained access to the state’s election server ), along with other panelists and I will present information on Georgia’s election security and our recommendations for immediate steps that can be taken to conduct a secure election in November. Read Professor DeMillo’s opinion piece in the AJC last Sunday  where he fact-checked Secretary Kemp’s claims about the voting system .

The event is being hosted live and livestreamed from Manuel’s Tavern (Atlanta) from 6:30 to 8:30. If you cannot attend in person, please participate and ask your questions via livestream. (Details are  posted here .) 

Read sworn testimony of election system failures

On Friday,  Coalition for Good Governance , filed a  Motion for Preliminary Injunction seeking a Court order  requiring paper ballots in the November election. Read the sworn testimony in the exhibits to the motion, to see examples of the signs of failure of the system. (see page  19/369 and supporting exhibits ) Reports arrive daily of alarming problems both in the pollbooks and in the voting machines. There is simply no excuse to conduct the midterms using a flawed system when a secure solution is so easily available. 

Simple solution is being ignored

The unacceptable unsafe state of the touchscreen voting system has been long understood by experts, despite denials by Georgia officials.  Virtually all federal agencies concerned with national security are echoing the  Senate Intelligence Committee’s admonitions to ban paperless voting machines of the type Georgia uses, and use paper ballots instead. 

Georgia is fortunate to have the legal authority, equipment and knowhow to make a rapid change to use paper ballots counted by optical scan machines. Kemp merely needs the motivation to adopt an auditable, reliable voting system. The state owns approximately 1,000 ballot scanners and has plenty of scanning capacity to count paper ballots from all voters. If desired, additional Georgia-certified ballot scanners are available for trivial sums.

Georgia citizens are  petitioning Secretary Kemp and the State Election Board to adopt this simple option to use paper ballots in November. But Secretary Kemp, State Board officials, and some  local election officials refuse to even entertain dialogue about using this easily available secure option.

More details on the feasibility and simplicity of the immediate solution can be found in those  two documents presented to Georgia’s new voting system  commission . Secretary Kemp and local officials are simply not truthful when they claim to have no authority to use paper ballots. Paper ballots have been legal in Georgia since 1777, as called for in the first state constitution. That right has not been lost!

Secretary Kemp’s misinformation campaign

Secretary Kemp continues to deflect, deny and misrepresent facts when it comes to the reliability of Georgia's voting system. There is simply no question it is broken, and you know that by now if you have read the supporting documents linked in this email. But Kemp has been  falsely claiming that he has no authority to permit paper ballots, nor do local officials. Both claims are false. In fact, he has a  duty to ban the touchscreen system if it cannot be “safely and accurately used.” (Georgia statutes §21-2-379.2(c)) Obviously, the General Assembly would not mandate a voting system be used whether or not it was operable and accurate! The computer science community, voting system experts, federal authorities, and Congress are in agreement that paperless electronic voting is unsafe and unreliable. Yet, Secretary Kemp claims to have superior knowledge and insists that Georgia's system is somehow magically “safe.” 

In the face of an election security crisis, the State Election Board has met only once this year, and met only twice in 2017.  

Fact-checking SOS official communications and misrepresentations

Your county Board of Elections just received a letter from Chris Harvey, Director of the Elections Division in the Secretary of State’s office, falsely claiming the county board has no authority to adopt paper ballots. The official letter is full of misrepresentations and falsehoods, which should be of concern to local officials and voters’ legislative representatives. I address some of those misrepresentations below. They are important to consider as county commissioners and election board members consider their own duty to help safeguard their voters’ elections. I have  linked the letter here ,  and referenced many of the misstatements by annotated number referenced below and on Mr. Harvey’s letter. 

  •  FACT: Pre-election voting machine testing is ineffective at best. Georgia’s testing is considered “security theater” by professionals. Testing is in “test mode” which can, like Volkswagen’s scandal, perform well but be programmed for mischief in “election mode.” Hacking malware can easily defeat testing. A simple example would have the malware activate after testing has been completed, or after the close of the polls.  Also, the touchscreen system is so unverifiable that it doesn’t, and cannot, comply with the state’s voting system laws. Harvey’s statement below is just false.

SOS false claim [1] : “ It is our duty to provide Georgians with the opportunity to vote on a secure and reliable voting system, which we regularly test to ensure ongoing compliance with state law …” 
 
  •  FACT: Physical security of the vulnerable voting system is lax at best. Read voting systems expert Matt Bernhard’s testimony of what he has experienced and observed in Georgia with machine components inviting intrusion. (see pages 38-41 to see his sworn expert testimony.)  I was present, and can report that such experiences are frequent. Last month I was able to walk through an open loading dock door into Fulton’s voting machine warehouse with vulnerable components scattered around unsecured. Planting malware on one memory card can infect the entire county’s election. 
 
SOS false claim [2] : “Strict security mechanisms surround each component.”
 
 
  • FACT: Encryption of Georgia’s election files is weak and easily defeated. In fact encryption keys were published on KSU’s open server. See Logan Lamb’s expert witness sworn testimony that the databases he found used “poor encryption allowing third parties to extract user names and passwords for multiple databases.”  pages 129-130. 
 
SOS False claim [3,4] : “Many people are pleasantly surprised to hear that Georgia builds its encrypted ballot databases on machine that are never connected to the internet.”  
 
  • FACT: Lamb found the databases themselves on a server on the internet! (see claim [4] above.)
 
 
  • FACT: Election data handling practices could hardly be worse. For example, KSU used Twitter to announce that it had bulk updates of voter registration files for counties to download over the internet! Lamb saw Election Department videos instructing counties to log in on the internet and download sensitive election data. (page 130)
 
SOS False claim [5] : “We also deploy cybersecurity protections, secure
armed transport of election materials, and physical security for our voting machines.”
 
  • FACT: Coalition for Good Governanceis a plaintiff in a lawsuit against Sec. Kemp, Fulton County Election Board and the State Election Board to end paperless voting machines and move to paper ballots. For the short term, we recommend using the optical scan units owned by the state to count paper ballots. We have been very clear in our detailed suggestions about the deployment of optical scanners for ballot counting. 
 
SOS False claim: [6.,7.] SOS claims that plaintiffs “demand hand-counted paper ballots.” [That is simply untrue. We believe that high volume hand counts have high error rates.]  
 
 
  •  FACT: Georgia law currently clearly provides that the governing body of a county may choose to utilize optical scanners for counting ballots: 
 
§ 21-2-366. Authorization for utilization of optical scanning systems

The governing authority of any county or municipality may, at any regular meeting or at a special meeting called for the purpose, by a majority vote authorize and direct the use of optical scanning voting systems for recording and computing the vote at elections held in the county or municipality. If so authorized and directed, the governing authority shall purchase, lease, rent, or otherwise procure optical scanning voting systems conforming to the requirements of this part.

We cited this law in our  letter to Georgia county boards of commissioners . There is no law that contradicts this statute. Kemp cannot be permitted to just falsely deny that  valid laws exist because it suits his political purpose to do so.
 
SOS False claims [8],[9]  “[T]hey mistakenly cite a state law which was superseded by a newer law for the assertion that counties can unilaterally elect to stop using DRE voting equipment. Their assertion is not an accurate statement of Georgia law.” 
 
  • FACT: The Secretary of State has certified the Diebold Voting System as Georgia’s uniform voting system. His certification specifically includes Diebold’s touchscreen units, Diebold optical scanners, Diebold electronic pollbooks, and supporting components. The certification does not restrict the use of the scanners to mail ballots. The General Assembly (wisely or not) determined that there should be one “uniform voting system” –supplied by one supplier. We believe that the uniform Diebold voting system optical scanners can provide a reasonable transition step to a more modern secure system in future years.
 
SOS False Claim [10] : The implication Harvey makes, as is often cited, that using scanners would violate the uniform voting system requirement. 
 
  • FACT:  Current law (§ 21-2-383(b)) requires that touchscreens (“DREs”) be used for in-person early voting if the DREs are also used in the polling places on Election Day. Nothing requires that DREs be used in the polling places. 
 
SOS False Claim [11]: “ §21-2-381 requires early voting to be on a DRE…” 
 
  • FACT: The statute cited as authority by the SOS (§21-2-381) has nothing to do with DREs but is the process for applying for a mail ballot. This is standard operating style for the SOS office, playing fast and loose with citing law to end discussions, knowing that most citizens won’t fact check them. In order to defend DRE use, on September 22, 2017 Harvey testified to the Georgia House Committee on Science and Technology that Georgia Code section 21-2-397 mandated DRE use.  There is no code section 21-2-397. Secretary Kemp is recently on record falsely claiming as well that the statutes mandate DREs. They resort to inventing statutes that don’t exist to defend their stance for un-auditable balloting.  
 
  • FACT: Virtually every scientific and academic study conducted confirms that fully electronic DREs cannot be verified or audited to determine that the votes are recorded and counted as the voter intended. (see Bernhard testimony pages 33-38) NIST has also concurred that paperless voting machines are not auditable. In fact using ballots without a paper audit trail as Georgia does violates federal law, the Help America Vote Act.
 
 
SOS False Claim [12]: “There are some who believe that because the current DRE machines are fully electronic, there is no way to verify that voter selections match the vote count's output. This belief is not true.”   [SOS seems to wish it true, but has no facts or experts who can rebut the scientific facts.]
 
 
  • FACT:  The state’s routine testing of the voting machines is ineffective and would only detect the most crude or obvious mis-programming or malfunctions. See first bullet above. (See Bernard page 40). The “testing” that is conducted cannot be relied on to detect any intentionally planted malware.

SOS False Claim [13],[14]: “[E]lection officials test and demonstrate the accuracy of these machines through logic and accuracy testing before every single use.” “It is tested and retested.”
 
  • FACT:  The County Election Board, (the “superintendent”) has the authority adopt paper ballots if they determine that the machines are “impossible or impracticable” to use. (§ 21-2-281) This particular authority belongs to the County Election Board. 
 
SOS False Claim [15,16]  “There is a provision in Georgia law that allows  the state to move to paper ballots in the event that the machines are ‘inoperable or unsafe.’”   (Harvey attempts to imply that the counties have no independent right to make the determination for their counties, and goes on to say that if it were the case that the “office feels that the machines cannot be trusted” that  his office will invoke the statute.) 
 
Again SOS makes up statutes. A search of the law will not find any statute using the phrase “inoperable or unsafe.” Kemp assumes that we will not fact check him and permit him to make up statutory citations to fit the purpose of maintaining the flawed system. 
 
  • FACT: The state genuinely needs a totally new and modernized new paper balloting system as soon as feasible. (Our interim solution uses old equipment.) 2018 is passing with almost no work being conducted by the State Board or Kemp on this urgent need.  While Kemp named and chairs a new voting systems commission, he has only called one meeting this year while there is an urgent need for Georgia to plan for its new election infrastructure. 
 
SOS False Claim [17 ] “The Secretary of State’s commitment to constant vigilance is why we have supported a move towards a new voting system…” (In truth, Kemp has done almost nothing to develop a plan to move to a verifiable voting system.)
 
In summary, it is clear in the law that local election officials have the responsibility and authority to safeguard the elections using paper ballots when state officials refuse to act. Local governing boards (commissioners and city councils) have the authority to deploy optical scans and paper ballots. While it is certainly the duty of the Secretary of State and the State Election Board to sideline the unreliable paperless voting system, they have no interest nor inclination to do so. They are oddly incurious about the repeated warnings of scientists and federal agencies. Georgia voters be damned. They have their own political desires that are apparently best served by conducting elections on a truly dangerous and exploitable system.  Therefore the duty to act to protect the election falls to the local board official who clearly possess the authority under Georgia’s laws.

We urge you to study the current materials from the federal government, computer voting system experts, and the very real malfunctions occurring in recent elections. We encourage your questions, and look to you to protect Georgia's upcoming elections.

Marilyn Marks
704 292 9802 (mobile)