Eleven years ago, after Karen Handel had been elected as Georgia’s first Republican secretary of state since Reconstruction, Richard DeMillo, head of the Office of Policy Analysis and Research at Georgia Tech, got a call about an important project. The state’s election system, updated with new machines, needed a hard look.
“They said: Take a look at our processes, take a look at our technology, and give us your opinion,” DeMillo said. “I assigned some people from our Information Security Center to work on it.”
In May 2008, the Georgia Tech Information Security Center and Office of Policy Analysis and Research released its report, “A Security Study of the Processes and Procedures Surrounding Electronic Voting in Georgia.” A number of potential problems came up, from the transportation of election machines by prison laborers to password protection of machines and poll-watcher training.
“A malicious party with minimal knowledge of the voting machines could gain the confidence of the poll workers and thus access to the voting units,” the authors wrote. And the state’s Center for Election Systems, at Kennesaw State University, also was at risk. “The election center at Kennesaw State University fills a key role in Georgia’s statewide election procedures, which makes it a potential target of a systemic attack.”
In 2017, the threat became real; there was a data breach at Kennesaw State. While the Georgia secretary of state’s office said that key equipment was not touched, a lawsuit was filed in which worried parties demanded paper ballots in the June 20 special election for Georgia’s 6th Congressional District. The plaintiffs lost, but concerns about the state’s 15-year old election system have bubbled up as Democrat Jon Ossoff campaigns against his Republican opponent — Karen Handel.
According to DeMillo, she didn’t follow up on the report.
“She seemed very interested in getting this, at the time,” he said. “Once she was in office for a few months, we heard nothing.”
Georgia’s slow-paced, expensive special congressional election campaign, which is entering its final week, has diverted from the candidates’ records. Handel’s time as secretary of state, Georgia’s chief elections official, has been shrunk into a bio line about how she saved money in public office; Ossoff, a first-time candidate, has branded her a “career politician.”
Asked about the data breach, Handel’s campaign deferred questions to Rob Simms, who was deputy secretary of state for much of Handel’s term and is now working to elect her to Congress.
“You’re asking if we ever ‘responded’ to a report/study that was done more than 10 years ago?” Simms asked. “Doesn’t make sense to me.”
The office of Brian Kemp, Handel’s Republican successor as secretary of state, deferred to a statement from Kennesaw State. “There is no indication of any illegal activity and no federal laws were violated following unauthorized access of a dedicated server at the Center for Election Systems,” a spokesman for the college wrote after the breach.
Kemp, now a candidate for governor, has framed the work of the secretary of state’s office much as Handel did: The state has implemented a model voter ID law and prevented voter fraud. (“We have several elections under our belt as well without one problem,” Handel said at a 2008 news conference.) But he has had to fend off criticism after a data breach. In 2015, a private contractor hired to comply with a request from the state’s Revenue Department sent confidential voter information, in error, in the form of compact discs to a dozen organizations.
The Kennesaw breach appeared to be more serious, and possible because of flaws in security. In an interview with Politico, Logan Lamb, who accidentally accessed Kennesaw’s data while looking for information on the election center website, said that the opportunities for easy hacking were obvious.
“I was absolutely stunned, just the sheer quantity of files I had acquired,” he said. “You could just go to the root of where they were hosting all the files and just download everything without logging in.”
Lamb’s discovery became the basis for the lawsuit asking Georgia to carry out the June 20 special election in the 6th District with paper ballots. The failure of that lawsuit means that the election will be carried out on machines with no paper trails. Up to 100,000 ballots may have already been cast.
They’ve been cast in an election where the candidates’ political records have featured only as soft targets for attacks. Ossoff, a 30-year-old former congressional staffer, has tried to fend off charges that he inflated his brief time with a national security clearance. In her biographical ads, Handel has summed up her term as secretary of state by saying she “fought President Obama to implement photo ID, and won.”
The security of the voting system hasn’t come up; as Simms said, it had been nearly a decade since the report on possible problems, and seven years since Handel oversaw the state’s elections system. When she was a candidate for governor, her work as secretary of state was described as proof of her turnaround skills.
“The way to prioritize your programs is to start with zero,” Handel said in a 2010 runoff debate with now-Gov. Nathan Deal. Her message to conservative voters about the secretary of state’s office was that, under her leadership, it had cut costs. “I permanently downsized it by nearly 20 percent.”