One Little-Watched Race Has Huge Implications for Election Hacking and Voter Suppression in Georgia

So much attention in the midterm elections this year has focused on the gubernatorial race in Georgia between Republican Brian Kemp and Democrat Stacey Abrams that the race for secretary of state, the office Kemp is vacating, has gone largely ignored.

It’s arguably the more important race, since this is the office that will control the state’s voter registration database and any purges made to the voter roll going forward. Equally important, it’s the office that will be responsible for programming all of the state’s currently paperless voting machines that can’t be audited, though Georgia will be looking to replace these machines with an undetermined model next year. Both of these factors could make Georgia a hotbed for voter suppression tactics and vote-counting integrity in the 2020 presidential elections, experts said.

“We’ve said all along for the last two years that this is probably the most important office we would be electing in 2018 because of the broad scope of oversight and duties that the secretary of state has in Georgia,” said Sara Henderson, executive director of Common Cause Georgia, a nonprofit, nonpartisan voting advocacy group. “There’s a lot of talk within the national media that in Georgia, the counties control their own elections. But nothing could be further from the truth. That’s how we’re set up regarding our election laws, but that is not in effect how it operates here. The secretary of state absolutely 100 percent impacts how and what the counties do.”

Georgia is one of only a few states that uses a single model of voting machines statewide — in this case, paperless direct-recording electronic machines made by the now-defunct Diebold Election Systems — and also uses a centralized model for programming those machines before each election. Instead of letting county elections offices or an independent third party program them, Kemp’s office controls this task — a job it only assumed last year in a controversial move that occurred in the middle of Kemp’s heated campaign for governor.

Kemp has so far narrowly escaped a runoff in his gubernatorial race with Abrams, after barely amassing the 50 percent of votes needed for victory (he had 50.2 percent at last count, about 59,000 more votes than Abrams; a federal judge on Monday ordered election results not be certified for several more days, responding to one of several challenges seeking time to resolve questions over the number of absentee and provisional ballots being counted). But this isn’t the case for the two candidates now vying for Kemp’s former job. The tight race for secretary of state between Republican Brad Raffensperger, a state representative and businessman, and former Democratic Rep. John Barrow, who served in the House for a decade, will go into a runoff on December 4. The tally in their race as of Friday gave Raffensperger the lead with 49.2 percent of votes to Barrow’s 48.6 percent, a difference of 24,210 votes. The candidates now face challenges with getting voters to turn up for the runoff, as such races traditionally produce lower voter turnout than regular elections.

Who wins the secretary of state’s race will determine in part whether Kemp’s controversial handling of voter purges continues.

Republican Brian Kemp, right, holds a news conference to resign as Georgia’s secretary of state with Gov. Nathan Deal, left, on Nov. 8, 2018, in Atlanta, Ga.

Kemp and his office have been accused of voter suppression through aggressive purges of the state’s voter roll. Last year, his office purged some 668,000 voters who Kemp’s staff said had died, moved, or been inactive in casting ballots for six years or more. But a recent investigation has called into question whether 340,000 voters who had been removed for allegedly moving out of state actually moved. Kemp also attempted to block the registration of 53,000 new voters this year by determining that signatures and other information on their applications weren’t an “exact match” with secondary documents on file for the voters; a lawsuit and court ruling, however, intervened to stop him.

The issue of purging inactive voters came up during the secretary of state’s race. Raffensperger said in a debate that he supports purging inactive registered voters whose only lapse is not voting in past elections, while Barrow opposes such purges.

But purging voters wasn’t the only control Kemp wielded over the midterms. As chief election official in the state, he had certain authority over election procedures and recounts, including of his own gubernatorial race. Kemp came under fire by former President Jimmy Carter and others for refusing to recuse himself from overseeing an election in which he was also a candidate for office. Carter has served as an election monitor for years in dozens of other countries. “This runs counter to the most fundamental principle of democratic elections that the electoral process be managed by an independent and impartial election authority,” Carter wrote in a letter to Kemp before the election. Kemp only resigned from his secretary of state position last Thursday, after securing the lead in his gubernatorial race.

“It’s unquestionably improper for the secretary of state to control the programming and management of the voting machines that will decide his election contest [or his replacement],” said Susan Greenhalgh, policy director at the National Election Defense Coalition, a voter integrity group. “But in Georgia, it’s much worse because there is no paper ballot, no physical evidence that provides a permanent record of voter intent that can be used to confirm the correctness of the election outcome. Voters just have to trust the secretary of state.”

“In Georgia, there is no physical evidence that provides a permanent record of voter intent.”

Georgia’s current governor, Nathan Deal, appointed attorney Robyn Crittenden as interim secretary of state until the runoff for the office in December. Crittenden, an African-American who headed the state’s Department of Human Services, told the Atlanta Journal-Constitution that she intends “to take on this role in the same way I have approached my previous work in state government with a focus on transparency and service to the people of Georgia. Georgians can rest assured that I’m going to give this job my all, and that we’re going to follow the law.”

Common Cause’s Henderson called the appointment of a neutral party as interim secretary of state a good move and said her group feels “more confident about the runoff than we did about Election Day and early voting when Kemp was overseeing that process.”

During his tenure as secretary of state, Kemp didn’t just control the programming of all machines in the state; he also vigorously fought with election integrity activists who filed a lawsuit last year seeking to rid the state of its paperless voting machines on grounds that the machines aren’t secure and can’t be audited to verify that the software hasn’t been manipulated by malicious code. Georgia has been using its paperless machines since 2002, with Kemp and Republican secretaries of states that preceded him defying numerous calls over the years to replace the machines with systems that can be audited; they resisted these calls even as other states around the country, like California, Florida and Ohio, passed laws requiring their counties to switch to machines that produce a paper trail or use voter-marked paper ballots that can be audited.

Georgia isn’t the only state where the secretary of state oversees elections; that person is also chief election official in many states. But elsewhere, these offices serve a broad oversight function that doesn’t involve direct involvement in the administration of elections. Instead, local election officials in most states choose the machines they use, which generally results in a patchwork of voting machines around the state, and program those machines either through in-house staff, the voting machine vendor, or a third-party contractor. Georgia not only uses a single model of voting machine statewide, but also programs those machines from the secretary of state’s office.

A voter uses an electronic voting machine to cast a ballot during the Georgia primary runoff elections in Atlanta on July 24, 2018.

This wasn’t always the case. In 2002, when the state first purchased its paperless voting machines, the programming and testing of the machines was contracted out to the Center for Election Systems at Kennesaw State University. But a story I wrote for Politico last year revealed that security problems at the center allowed a researcher to download registration records for the state’s 6.7 million voters, as well as software files for the state’s electronic poll books — used by poll workers to verify that people are registered before they can cast a ballot — and many other files. An investigation by KSU revealed that the center had a number of security lapses that had existed for years, which raised the possibility that attackers could have altered voter records or votes in previous elections without the center knowing during that time.

After the story published, Kemp’s office canceled its contract with the center. A spokesperson for Kemp said at the time that the office was considering farming out the programming of voting machines to academics at the Georgia Institute of Technology, which has a highly respected institute for information security. But Kemp ultimately decided to program the voting machines in-house, hiring Michael Barnes, director of the now-defunct Center for Election Systems, to do the work, even though the center’s poor security practices had occurred during Barnes’s management of the operation.

At least two other states, Louisiana and Maryland, also program their statewide machines centrally before each election. But of these two, only Louisiana does the programming out of the secretary of state’s office. Louisiana uses paperless voting machines statewide like Georgia, but a different model. The secretary of state’s staff loads election software onto USB sticks that are driven to each of the state’s 64 parish warehouses and loaded onto machines, according to a spokesperson. In the case of Maryland, which uses a uniform model of optical-scan systems with paper ballots statewide, the state’s Board of Elections, an agency separate from the secretary of state’s office, programs the machines and delivers the election database to counties on DVDs, or via a closed network using a VPN, before elections.

A handful of other states also use a single system statewide. Delaware uses paperless direct-recording electronic machines; Oklahoma uses a single brand of paperless direct-recording electronic machines and optical-scan machines statewide; and Colorado, Oregon, and Washington state use mail-in ballots exclusively and scan them optically. Colorado election officials program their machines themselves, however. The Intercept was unable to reach election officials in Oklahoma, Oregon, and Washington on Monday — due to Veterans Day — to determine if they program the machines centrally at the state level or individually at the county level.

Georgia lawmakers plan to look at legislation to replace the current statewide voting machines with new systems that use paper and can be audited. A Georgia commission will likely decide between optical-scan machines that use voter-marked paper ballots or ballot-marking devices that use a touchscreen machine to mark ballots that are then printed out for voters to examine before they’re inserted into an optical reader that records and tallies the votes.

Both Barrow and Raffensperger have said they support switching to machines that use paper ballots, but Barrow has said he prefers voter-marked paper ballots, while Raffensperger has said he prefers ballot-marking devices. In both cases, the paper ballot serves as an auditing record that can be used to compare against the digital tallies tabulated by the software on the optical scanner. But election integrity activists say that some ballot-marking systems are problematic if they print a barcode on the ballot. With these systems, although the voter is able to see their selections printed on the ballot, the ballot reader uses the barcode to record and tally votes. A hacker could subvert the software on the ballot-marking device to print one thing in the human-readable portion of the ballot that the voter sees, while printing something else in the barcode that the machine reads and records. If Georgia doesn’t conduct manual audits of the paper ballots, no one would know if the barcodes were manipulated, which would essentially put Georgia in the same situation it’s in today with elections that aren’t verified.

It’s not clear how long it will take Georgia to decide on new systems and get them in place, though it won’t be soon enough for the secretary of state’s runoff in December. Election integrity activists fought to get a court to decertify Georgia’s paperless systems and force counties to use paper ballots for the midterms. Although U.S. District Judge Amy Totenberg agreed with the plaintiffs that the secretary of state’s office had failed to adequately secure the systems, she felt it would create too much of a burden on election officials to switch the entire state to paper so soon before the election.

Barrow said during a debate with Raffensperger this year that if elected, he would do what Kemp has resisted and decertify the state’s current paperless machines, forcing counties to switch to paper ballots until lawmakers choose replacement machines.

Henderson says the outcome of this election will have a huge impact on how future elections in the state are run.

“We have a lot to do to undo what Brian Kemp did during his nearly eight years in office as secretary of state,” she told The Intercept. “I think the world is really waking up to what a serious situation we have in Georgia regarding voter suppression.”