DONNA CURLING, et al., Plaintiffs, v. BRAD RAFFENSPERGER, et al., Defendants.
CIVIL ACTION NO. 1:17-cv-2989-AT
IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF GEORGIA ATLANTA DIVISION
October 11, 2020
OPINION AND ORDER
I. Introduction and Overview
Now in Act 4, this voting case raising fundamental First Amendment and Fourteenth Amendment constitutional claims is before the Court on Plaintiffs’1 current Motions for Preliminary Injunction seeking relief before the November 3, 2020 general election. The Court held three days of hearings on Plaintiffs’ motions and has reviewed the parties’ extensive briefs and evidentiary submissions. The Plaintiffs’ motions are identified and described below.
(a) The Curling Plaintiffs’ August 19, 2020 Motion for Preliminary Injunction [Doc. 785] seeks to require Defendants “to conduct in-person voting in elections by a hand-marked paper ballot system” in combination with “provisions for pre-certification, post-election, manual tabulation audits of paper ballots and to independently check the accuracy of equipment and procedures used to tabulate votes based on well-accepted audit principles that assure a high probability that incorrect outcomes will be detected and remedied“; and
(b) The Coalition Plaintiffs’ August 24, 2020 Motion for Preliminary Injunction on BMDs, Scanning and Tabulating, and Auditing [Doc. 809] seeks to require the State Defendants to: (i) refrain from forcing in-person voters to use ballot marking devices (“BMDs“) and instead cause voters to use hand-marked paper ballots as the standard method for in-person voting; (ii) adopt scanning threshold settings for the Dominion optical scanners and vote review procedures that will ensure all voter marks on mailed and hand-marked paper ballots are counted; and (iii) require election superintendents to conduct meaningful, effective pre-certification audits of scanned hand-marked paper ballots to ensure the correctness of election outcomes.
The Coalition Plaintiffs’ Motion for Preliminary Injunction on Paper Pollbook Backups also sought related relief requiring the Secretary of State to direct county election superintendents to use paper backups of the electronic pollbook at each precinct polling location to facilitate issuance of regular or emergency ballots on election day in the event of voting machine breakdowns and mishaps, power outages, and associated long voter lines. (Doc. 800.) This Court‘s Order of September 28, 2020 (Doc. 918) addressed these issues at length and granted that separate motion.
Plaintiffs’ motions challenge the State Defendants’ mode of implementation of a new voting system enacted by the Georgia Legislature on April 2, 20192 and their ongoing use of software, data systems, policies and practices that allegedly burden and impede Plaintiffs’ exercise of
First and foremost, Plaintiffs’ challenge focuses on the Defendants’ implementation of the new statewide BMD system, pursuant to the terms of the State‘s 2019 contract with Dominion Voting Systems.5 The software and hardware system purchased provides for each citizen‘s BMD ballot vote selections to be printed on a paper ballot generated by a printer connected to the BMD. But the tabulation of the vote is actually based on the ballot‘s non-encrypted QR barcode on the ballot - designed to summarize the voter‘s ballot selections in code - that by itself is not voter reviewable or verifiable. Thus, Plaintiffs contend that the system precludes direct voter verification of the QR barcode of votes cast on the ballot. The printed ballot is fed into an ImageCast optical scanner that tabulates the ballot votes solely based on the QR code - and not based on the human readable text on the printed ballot. Plaintiffs challenge the constitutionality of the State Defendants’ implementation of a barcode-based system for all in-person voting, based on (1) this alleged fundamental vote verification defect; (2) the system‘s purported known and demonstrated risk vulnerabilities to access and manipulation identified by national cybersecurity experts; and (3) the inherent problems posed in properly auditing votes tallied based on QR barcodes that cannot be verified by voters.6
As a whole, the State Defendants have steadfastly denied the factual and legal merits of Plaintiffs’ constitutional claims. They argue that Plaintiffs have not carried their high burden of proof to show they are substantially like to prevail on their claims or their entitlement to relief under the rigorous legal standards for grant of a preliminary injunction.7 Defendants have also urged the Court to per se deny all relief on the grounds that it would interfere with the State Defendants’ authority and responsibility for oversight of election process and procedures, unfettered by burdens and confusion that can be caused by Court ordered changes to state election procedures or requirements on the eve of an election under Republican Nat‘l Comm. v Democratic Nat‘l Com., 140 S. Ct. 1205, 1207 (2020) and Purcell v. Gonzalez, 549 U.S. 1, 4 (2006).
The General Election will be held on November 3, 2020. In-person early voting will proceed in select polling locations in every Georgia county from October 12, 2020 through October 30, 2020. While early voting in counties is done on BMD machines, the state still denominates these votes as “absentee” ballots. Under Georgia law, counties are authorized to begin sending out traditional paper absentee ballots this year on September 15, 2020 and to continue to do so thereafter in the weeks ahead prior to the election. The last date for submitting an application for an absentee mail paper ballot in Georgia is October 30, 2020. October 5, 2020 is the deadline for voter registration.8
Faced with this looming timeline, the Secretary of State just two weeks discovered a system-wide ballot display issue on the BMD touchscreen voting machines for the U.S. Senate special election with 20 candidates in the race. The Secretary of State designed the ballot using a two-column display to ensure that all 20 candidates appeared at the same time to voters on a single screen. Because BMDs primarily display candidates in a single column list, the two-column display is not a typical setup. Logic and Accuracy testing performed
Not surprisingly, the parties take wildly different positions on the magnitude of the problem and its impact on the general election. The State Defendants characterize this as a very minor issue and the fix as a de minimis change to the voting system software. Plaintiffs assert instead that the State is undertaking substantial changes to the election equipment two weeks before early voting begins without adequate testing that further jeopardizes the reliability and security of the Dominion voting machines. These unforeseen circumstances, Plaintiffs insist, justify an emergency switch to hand-marked paper ballots.
Given the complex findings and analysis already covered by the Court‘s review of several lengthy preliminary injunction motions and issuance of related procedural orders over the last two years of intensive litigation, the Court refers the reader to its earlier orders for a further overview of the course of proceedings, relevant legal context, rulings, and factual findings. (See, e.g., Doc. 309, September 17, 2018 Order (denying motion to dismiss and motion for preliminary injunction); Doc. 579, August 15, 2019 Order (granting in part preliminary injunction motions); Doc. 751, July 30, 2020 Order (granting in part and denying in part Defendants’ most recent motion to dismiss including new BMD claims); Doc. 768, August 7, 2020 Order (denying without prejudice Plaintiffs’ initial motions for preliminary injunction, Docs. 619 and 540, that facially challenged the BMD system and were filed in October, 2019, long prior to the 2020 election cycle, and summarizing case history).)
Finally, the Court notes that it has already addressed and rejected the State Defendants’ renewed contention that several of Plaintiffs’ requests for relief fall outside the bounds of the case as pled and presented to this Court. (See, e.g., Order on Motion to Dismiss, Doc. 751 at 20-25; August 15, 2019 Order, Doc. 579 at 88-89.) Portions of the relief requested by Plaintiffs are clearly associated with their contentions regarding the Defendants’ non-implementation of some of the relief granted in the Court‘s August 15, 2019 Order, as discussed in the Court‘s Opinion and Order issued on September 28, 2020. (Doc. 918.) Similarly, Plaintiffs have repeatedly advocated in their amended and supplemental complaints, motions, and briefs as well as at court hearings for the relief addressed in the current preliminary injunction motions before this Court.
II. Legal Standards
A. Preliminary Injunction Standard
A preliminary injunction is an “extraordinary remedy” designed to prevent irreparable harm to the parties during the pendency of a lawsuit before a final decision on the merits can be rendered. See Winter v. Nat. Res. Def. Council, 555 U.S. 7, 24 (2008). “A request for equitable relief invokes the district court‘s inherent equitable powers to order preliminary relief . . . in order to assure the availability of permanent
Federal courts “possess broad discretion to fashion an equitable remedy.” Black Warrior Riverkeeper, Inc. v. U.S. Army Corps of Engineers, 781 F.3d 1271, 1290 (11th Cir. 2015); Castle v. Sangamo Weston, Inc., 837 F.2d 1550, 1563 (11th Cir. 1988) (“The decision whether to grant equitable relief, and, if granted, what form it shall take, lies in the discretion of the district court.“). “Crafting a preliminary injunction is an exercise of discretion and judgment, often dependent as much on the equities of a given case as the substance of the legal issues it presents.” Trump v. Int‘l Refugee Assistance Project, 137 S. Ct. 2080, 2087 (2017) (per curiam); Kansas v. Nebraska, 574 U.S. 445, 456 (2015) (noting that a court of equity may “mold each decree to the necessities of the particular case” and “accord full justice” to all parties). In formulating the appropriate remedy, “a court need not grant the total relief sought by the applicant but may mold its decree to meet the exigencies of the particular case.” Int‘l Refugee Assistance Project, 137 S. Ct. at 2087 (citation omitted). And the Supreme Court has repeatedly advised, “[w]hen federal law is at issue and ‘the public interest is involved,’ a federal court‘s ‘equitable powers assume an even broader and more flexible character than when only a private controversy is at stake.‘” Kansas v. Nebraska, 574 U.S. at 456 (citing Porter v. Warner Holding Co., 328 U.S. 395, 398 (1946) and Virginian R. Co. v. Railway Employees, 300 U.S. 515, 552 (1937)).
B. Standard for Challenging Constitutionality of State Election Laws/Systems
When considering the constitutionality of an election law, the Court applies the framework established by the Supreme Court in Anderson v. Celebrezze and Burdick v. Takushi. Under this framework, referred to as the Anderson-Burdick test, when deciding whether a state election law violates the due process rights guaranteed by the Fourteenth Amendment, the Court must weigh the character and magnitude of the burden the State‘s rule imposes on those rights against the interests the State contends justify that burden, and consider the extent to which the State‘s concerns make the burden necessary. Timmons v. Twin Cities Area New Party, 520 U.S. 351, 358 (1997); Burdick v. Takushi, 504 U.S. 428 (1992); Anderson v. Celebrezze, 460 U.S. 780 (1983). “[T]he level of the scrutiny to which election laws are subject varies with the burden they impose on constitutionally protected rights.” Stein v. Alabama Sec‘y of State, 774 F.3d 689, 694 (11th Cir. 2014). A law that severely burdens the right to vote must be narrowly drawn to serve a compelling state interest. Burdick, 504 U.S. at 434; Democratic Exec. Comm. of Florida v. Lee, 915 F.3d 1312, 1318 (11th Cir. 2019). But “reasonable, nondiscriminatory restrictions” that impose a minimal burden may be warranted by “the State‘s important regulatory interests.” Common Cause/Ga. v. Billups, 554 F.3d 1340, 1352 (11th Cir. 2009) (citing Anderson, 460 U.S. at 788). “And even when a law imposes only a slight burden on the right to vote, relevant and legitimate interests of sufficient weight still must justify that burden.” Lee, 915 F.3d at 1318-19; Billups, 554 F.3d at 1352.
III. Discussion of Claims and Relief Issues
A. Background Context
Georgia‘s new 2019 Election Code mandates that “all federal, state, and county general primaries and general elections as well as special primaries and special elections in the State of Georgia shall be conducted with the use of scanning ballots marked by electronic ballot markers and tabulated by using ballot scanners for voting at the polls and for absentee ballots cast in person, unless otherwise authorized by law; provided, however, that such electronic ballot markers shall produce paper ballots which are marked with the elector‘s choices in a format readable by the elector.”
The Election Code further requires the Secretary of State to certify the new BMD voting system as “safe and practicable for use” in compliance with the Rules of the Georgia State Election Board prior to authorizing its implementation in state, federal, and county elections in the State.
The legislation enacted in April 2019 was adopted on the heels of a number of public events revolving around Georgia‘s outdated DRE election system: a widely publicized breach of the State‘s election server maintained by the State‘s election services contractor, Kennesaw State University, that exposed voluminous voter data, as well as sensitive software applications and passwords that triggered the transfer of the University‘s Center for Election Services election operations directly to the
The State commenced replacement of the DRE/GEMS system with Dominion‘s BMD system beginning in the summer of 2019 after conclusion of the request for proposals and contracting processes. This voting system change, targeted for completion in time for full implementation in 2020, was a major shift and undertaking. Dominion plays a large role in all dimensions of the implementation of the new voting system in partnership with the Secretary of State‘s Office.11 The contract was entered at a time when the cybersecurity risks and vulnerabilities of digital election systems had emerged as a major concern of national leadership and as well as prominent computer engineering and cybersecurity experts and academic organizations. Election systems were now classified as critical national infrastructure. Voter-verified ballots and hand-marked ballots in particular were deemed important tools for protecting the security of voting systems by leaders in the academic cybersecurity field, including the sole information technology and cybersecurity expert on the Commission12 appointed by the Secretary of the State to provide recommendations regarding the replacement of the DRE System. (See August 15, 2019 Order, Doc. 579 at 35-42; September 17, 2018 Order, Doc. 309 at 11-12.)
Georgia is the only state using the Dominion barcode-based BMD system statewide as the mandatory voting method for all in-person voters. (See Decl. of Dr. Eric Coomer, Doc. 658-2 ¶ 5) (“Dominion‘s ImageCast X BMD system is currently used by Cook County and the City of Chicago, Illinois, several jurisdictions within the States of Michigan and Pennsylvania, and will be used by several California counties including San Francisco, Alameda, Riverside, Contra Costa, and San Diego in the upcoming 2020 election cycle.“). According
The Secretary of State‘s Office contracted with Dominion for all equipment and software components of the system (the BMD touchscreens, attached ballot printers, ImageCast optical scanners that tabulate ballot votes, and the KnowInk PollPads) but continued to use its ENET voter registration database system. The ENET system provides the voter data foundation for the PollPads used for voter check-in at the polls.
In entering into the Dominion contract, the Secretary of State proceeded with an agreement for the current level of capacity of Dominion‘s ImageCast optical scanner to tabulate votes based on the scanned image of the QR barcode encoded with the voter‘s designated ballot selections. The Dominion ImageCast optical scanners used by Georgia in tandem with the BMDs are capable of scanning and tabulating votes without a QR barcode. (Decl. of Dr. Eric Coomer, Doc. 658-2 ¶ 9; Decl. of Dr. Alex Halderman, Doc. 785-2 ¶¶ 4, 37-40.) In response to the State‘s request for proposals during the procurement process, Dominion represented that an upcoming version of its BMD software would not need to print barcodes on ballots.16 The BMDs under the prospective option would instead produce a human-readable ballot that would be counted by the optical scanner/tabulators based on voters’ electronic vote designations on the ballot by reading particular target areas associated with the voter selections, similar to how they are programmed to read hand-marked paper ballots. (Decl. of Dr. Eric Coomer, Doc. 658-2 ¶ 9; Decl. of Dr. Alex Halderman, Doc. 785-2 ¶ 37.) This option is described as an “upgrade” available only after “certification is complete at the EAC.”17 The Court assumes that cost considerations, among others, may have played a role in this purchasing decision, as it was currently available through some other vendors.18 However, the State‘s actual option in the long run of upgrading the system to one that tabulates from the voter designations, and not a QR barcode is potentially relevant.19 When that might occur is another
The Court focuses in this Order on the salient evidence that Plaintiffs have presented in support of their Motions to demonstrate the constitutional infirmity of the system because of its alleged impact on voters’ exercise of the right to vote and whether their votes will be counted as cast or at all.
The Court recognizes from the outset that the State Defendants did face significant challenges in implementing a new statewide voting system in barely 15 months and that early elections and primaries would occur prior to the ultimate election date of November 3, 2020. The Covid-19 pandemic further complicated that challenge. While this fact does not in any way erase the issues raised by Plaintiffs, especially in the context of the particular record in this case, the Court still bears this pragmatic reality in mind.
The Court divides its discussion below of the motions before it as follows. Section B addresses the evidence presented in conjunction with the Curling Plaintiffs’ Motion for Preliminary Injunction and a portion of the Coalition Plaintiffs’ Motion for Preliminary Injunction on BMDs, Scanners and Tabulators and Audits. Section C addresses the Coalition Plaintiffs’ Motion related to the issue of ballot secrecy. Section D addresses that portion of the Coalition‘s Motion as to Scanners and Tabulators focused on the review and counting of hand-marked ballots, including absentee ballots, provisional ballots, and finally, some portion of emergency ballots cast.20
B. Claims Relating to BMDs, Scanners/Tabulators, and Audits
1. Cybersecurity Risks and Reliability Issues Presented by Implementation of the BMD System
The evidence, expert opinion testimony, and argument Plaintiffs offer in support of their challenge to the constitutionality of the State Defendants’ implementation of a barcode-based system for all in-person voting falls into three main areas. They contend that the evidence shows:
(1) The QR barcode-based BMD voting system does not produce a voter-verifiable paper record of the votes cast. Therefore, voters will be unable to conduct any verification of the information encoded in the non-human readable barcode, will have no way of knowing what votes they are actually casting, and will instead be forced to trust that the barcode accurately conveys their intended ballot selections. Both the QR barcode recording of votes and the text summary of ballot selections are subject to being accessed and manipulated through hacking, unauthorized intrusion into the BMD computer system or its various components (scanner, printer, etc.), by USB flash drives (or similar devices), or by other interfaces with the internet through cyber attacks or applications that may be carrying malware (whether intentionally or not).
(3) The QR barcode-based BMD voting system is incapable of being meaningfully audited for a variety of reasons: (a) the QR code cannot itself be verified by a voter; (b) the length and complexity of many ballots and the printed ballot text‘s condensed mode of summarizing the voter‘s ballot selections (identifying solely the candidate selected by office or condensed constitutional amendment summaries identified by question number or by a few words); and (c) research reflecting that most voters do not review these printed ballot summaries, and those that do, will not detect errors in ballots presented for verification based solely on their memories.
Plaintiffs presented multiple expert witnesses to address their assessment of the Dominion system‘s cyber risk vulnerabilities and incapacity to provide a voter verifiable or auditable vote.21 Plaintiffs’ experts testifying at the hearing or by
affidavit included: Dr. Andrew W. Appel, Dr. Richard DeMillo, Dr. J. Alex Halderman, Mr. Harri Hursti, Mr. Vincent Liu, Mr. Kevin Skoglund, and Dr. Philip B. Stark.
Defendants have contested Plaintiffs’ cybersecurity, vote fidelity, and voting system evidence through cross-examination as well as through the testimony of the State‘s witnesses and Dr. Eric Coomer, Director of Product Strategy and Security for Dominion Voting Systems, and the testimony of Jack Cobb, the Director of Pro V&V, the United States EAC accredited private laboratory retained by the Georgia Secretary of State to assess and test Dominion‘s Democracy Suite 5.5-A voting system software and associated components22 and the KnowInk electronic pollbook as deployed in Georgia for EAC certification. Although Mr. Cobb‘s affidavits addressed cybersecurity related matters, his testimony at the injunction hearing plainly indicated that he actually claims no specialized knowledge or background in cybersecurity engineering and did not himself perform any security risk analysis of the BMD system. Defendants did not introduce any evidence from
security of the voting system. The Court preliminarily granted these requests by and large so as to rapidly move proceedings forward as it could not predict precisely what matters would be covered in the testimony or the import of information in advance. Plaintiffs preserved their objections to the sealing. The Court will reconsider these sealing decisions, if appropriate, upon a properly supported motion.
Fortalice Solutions, the cybersecurity consulting firm that previously has performed security
Plaintiffs’ substantive evidence regarding the Defendants’ implementation or usage of the BMDs, scanner/tabulators, and audits is the most complex, expert-intense evidence presented in this case. Indeed, this array of experts and subject
matter specialists provided a huge volume of significant evidence regarding the security risks and deficits in the system as implemented both in witness declarations and live testimony at the preliminary injunction hearing.24 As authorized discovery only commenced shortly before the preliminary injunction hearing, no expert or other depositions had been conducted.
While Plaintiffs’ experts provided illuminating evidence, this evidence still had its own constraints. First, security information from the Secretary of State‘s office was limited. The Secretary of State‘s response to Plaintiffs’ authorized expedited discovery requests indicated that its cybersecurity consultant, Fortalice Solutions, had not generated any consulting studies, audits, or assessments of data system security issues since August 1, 2019 when the State commenced its early work on implementation of the Dominion system, other than a November 2019 report requested by Defendants’ counsel and withheld based on attorney work product privilege.25 (See September 2, 2020 Order, Doc. 858 (approving non-disclosure based on assertion of privilege and in turn, granting on limited terms Plaintiffs’ request for inspection
and software issues prior to August 2019).) Second, while some of Plaintiffs’ experts had accessed other related BMD models and Dominion software previously, the specific BMD model and software variation (along with the optical scanners/tabulators programed with Dominion‘s proprietary software) used in Georgia was not accessible to the Plaintiffs and their cybersecurity expert, Dr. Halderman, until Friday, September 4, 2020 at 5:30 p.m. – and then, only by Court Order.26 This was just days before the preliminary injunction hearing commenced on September 10, 2020. Upon the Plaintiffs’ filing of a discovery dispute notice regarding their access issue, the Court ordered the swift production of a BMD and related ImageCast precinct scanner for Plaintiffs’ expert‘s testing and assessment, subject to various confidentiality provisions and other terms.27 (As the Dominion system uses an off-the-shelf printer, the Plaintiffs provided their own new printer of the same model used by the Defendants.)
Dr. Halderman‘s testing of the equipment and software occurred over the short period of time before the scheduled hearing.28 His evaluation in this abbreviated time frame yielded some supplemental results that supported the
Plaintiffs’ cybersecurity analysis of the malware vulnerability risks of this specific BMD system. In particular, Dr. Halderman‘s testing indicated the practical feasibility through a cyber attack of causing the swapping or deletion of specific votes cast and the compromise of the system through different cyber attack strategies, including through access to and alteration or manipulation of the QR barcode.29 As the National Academies of Sciences, Engineering, and Medicine, found in its seminal report, Securing the Vote: Protecting American Democracy 42, 80 (National Academies Press, 2018)(“National Academies Report” or “NAS Report“):
[A]ll digital information – such as ballot definitions, voter choice records, vote tallies, or voter registration lists – is subject to malicious alteration; there is no technical mechanism currently available that can ensure that a computer application – such as one used to record or count votes – will produce accurate results; testing alone cannot ensure that systems have not been compromised; and any computer system used for elections – such as a voting machine or e-pollbook – can be rendered inoperable.
(Doc. 285-1, Ex. 1.)
Dr. Halderman had physical access to the BMD system when conducting his
flash drive or another form of mini-computer, or connection with the internet. As discussed in the declarations and testimony of the proffered national cybersecurity experts in this case, a broad consensus now exists among the nation‘s cybersecurity experts recognizing the capacity for the unobserved injection of malware into computer systems to circumvent and access key codes and hash values to generate fraudulent codes and data. In these experts’ views, these risk issues are in play in the operation of Dominion‘s Democracy Suite 5.5-A GA, and take on greater significance because the system is one that does not provide a verifiable and auditable ballot record because it relies on the QR code for vote tabulation and that code itself cannot be read and verified by the voter. (See, e.g, Declaration of Vincent Liu, Doc. 855-2 at 6-8; Tr. Vol. II at 59, 64; Declaration of Dr. Andrew Appel, Doc. 855-3 at 6; Declarations of Dr. Alex Halderman, Doc. 682 at 4-11, Doc. 785-2; see also Appel, A.W., R. DeMillo, and P.B. Stark,30 Ballot-Marking Devices Cannot Ensure the Will of the Voters, Election Law Journal (2020), Doc. 619-10.) Hacking alterations of the barcodes and/or predicate text, security keys, or hash values renders tracing or auditing of the fraudulent change in voting data difficult
or impossible in their viewpoint – and in turn impacts the capacity to conduct appropriate auditing of ballot data or to implement corrective “re-count” measures.
Dr. Halderman‘s empirical evaluation of the Georgia programmed BMD voting equipment and software was partial and incomplete due to the short time allocated for the examination prior to the injunction hearing. And Dr. Halderman indicated that he would need more time with the equipment and software to conduct further testing of the software and modeling of other malware that could attack any component of the BMD system and infect the system and recording of votes or cause other mayhem. Dr. Halderman provided directly relevant information to a demonstration of the risks facing this specific voting system. However, his evaluation and testing of the system was limited as described and not fully subject to being itself examined in depth by Dominion‘s own cyber security staff given the last moment nature of the testing.31
tracks, alter data, or create system disruption. And while some attacks can be detected, their results often are not susceptible to full correction. For all these reasons, Dr. Halderman and Plaintiffs’ other cybersecurity expert witnesses testified that heightened proactive protection measures are needed beyond what the current Dominion system as implemented in Georgia provides32 or
alternatively, are simply not feasible given the
Plaintiffs’ voluminous expert testimony describes an interrelated range of systemic software and operational practices that define and impact the functioning of the voting system. The Plaintiffs maintain that the BMD system and software design as well State Defendants’ identified practices independently and as a whole undermine the integrity, security, and functionality of the voting system and in turn, adversely impact whether citizens’ votes will be counted as intended or counted at all. The Court has considered this challenge on its merits because a voting system, procedure, or practice can in reality subvert or impair citizens’ exercise of the franchise and the counting of their votes. Still, the Court notes from the outset that the voting system challenged here is a new system for Georgia,33 replacing the outdated DRE system that was dependent on totally obsolete software and defective usage practices that patently made it unreliable. Whatever the new BMD system‘s flaws in design, age, and reliability of components, or implementation – some of which may be significant – the evidence would at this early point in time have to be highly compelling to justify the Court‘s considering enjoining on a wholesale basis the State‘s use of the a BMD voting system approved
all voters are given the opportunity to use the ADA compliant marking device feature of the Democracy Suite 5.5 A. System.
by the Secretary of State, pursuant to his authority under a state law enacted as recently as 2019.
The issues and alleged practices identified by Plaintiffs as a basis for enjoining the system include:
- the BMD QR code‘s lack of encryption, that opens voting data up to breach, alteration, and other security weaknesses;
- cybersecurity risk management and practices that allegedly render the voting system vulnerable to compromise and breach, and alteration or loss of votes;
- alleged major shortcuts taken in state protocols now used for conducting Logic and Accuracy testing (“L & A“) of voting machines required under Georgia law preceding each election, even though L & A testing constitutes a fundamental threshold standard to verify the correct functioning and accurate output of the BMD system and its component parts;
- the alleged impossibility or inadequacy of using Risk-Limiting Audit methodology meaningfully to audit BMD ballots and votes tallied based on a scanned QR code, where evidence indicates that only a fraction of voters review their printed ballot;
- scanning software, practices, and settings that allegedly result in voters’ ballot selections on paper ballots (whether cast as absentee, provisional, or emergency ballots) being interpreted as blank and not counted, though clearly appearing on the hand-marked ballots cast by voters;
- the alleged failure to protect the confidentiality of the voting process by the use of timestamps on scanners that trace back to the voters at the precinct and by the large BMD screens that expose the voter‘s selection choices to other individuals in the precinct and burdening their free exercise of the franchise.
The Court at some length described in its August 15, 2019 Order the changed landscape of cybersecurity in which election systems operate. More evidence emerging in the past year has added to this picture of heightened security concerns. The Court does not further delve into this reality here because the Defendants do not appear to actually dispute that cybersecurity risks are significant in the electoral sphere. Dr. Halderman‘s voting machine testing exercise in the 2020 preliminary injunction hearing – as in 2019 – showed how this might play out. As several of Plaintiffs’ national cybersecurity and engineering experts explained in their testimony, the issues presented for any cyber electoral system is how to fortify the system‘s protection against unauthorized intrusion or accessing of software and databases, the system‘s detection and limitation of the impact of malware, and minimization of risk overall, including through active auditing procedures.34
The State Defendants presented the BMD system‘s cybersecurity as reliable and fortified both based on the testimony of Dr. Coomer as Dominion‘s Director of Product Strategy and Security and the testimony of Mr. Jack Cobb, the Laboratory Director for Pro V&V.35 The Secretary of State retained Pro V&V to perform a review of its newly adopted BMD voting system, as required for EAC certification purposes, for submission to the EAC for approval. Pro V&V originally certified the Dominion Democracy Voting‘s Democracy Suite 5.5-A system in August 2019 and has certified a modified version since that time – once in November 26, 2019 and once on October 2, 2020.36 Mr. Cobb represented in his affidavits filed by Defendants that the Dominion system‘s security was fortified by the encryption of the QR code and accompanying digital signature code as well as various other security measures such as use of a built in security feature that generates SHA-256 hash values. (Doc. 821-6 at 4.)
Mr. Cobb testified at the injunction hearing that he had fourteen years of experience in testing voting machines, but as became apparent in the course of these proceedings, he does not have any specialized expertise in cybersecurity testing or analysis or cybersecurity risk analysis. Further, Mr. Cobb had not personally done any of the security testing referenced in his affidavits.
In his first affidavit, Mr. Cobb stated that the BMD printed ballot‘s QR codes are signed and encrypted. (Doc. 821-6 at 4.) When Plaintiffs’ experts disputed this encryption claim, Mr. Cobb in his second affidavit pointed to Dominion‘s own documentation as the source of his prior statement
Mr. Cobb‘s first affidavit discloses that Pro V&V did not itself conduct any form of penetration or security testing of the 5.5-A software version specifically to be used in Georgia (certified by Dominion in August 2019) but relied on another company‘s security testing of earlier versions of the Dominion Democracy Suite software.39 (Doc. 865-1 at 5; Tr. Vol. II, at 233.)40 Dr. Coomer testified that there is a difference between the 5.5 and 5.5-A Dominion Democracy Suite versions – a change to the ICX software that was not deemed de minimis. (Tr. Vol. II at 138.) Pro V&V‘s assessment of the modified software version in November 2019 (“5.5-A GA” update) (classified as de minimis) was performed by an employee no longer with the company. Mr. Cobb‘s affidavit did not indicate that he actually had personal familiarity with that specific testing or actually any specific testing, as he testified he did not engage in this type of activity. (Tr. Vol. II at 243.) At the injunction hearing, he indicated that Pro V&V had never tried or tested alteration of the QR code in Dominion version 5.5-A, though he had previously declared in effect that this could not be done. (Tr. Vol. II at 238.) While Mr. Cobb‘s affidavits addressed cybersecurity matters and criticisms of Plaintiffs’ cybersecurity and engineering expert affidavits, he was candid in his testimony at the injunction hearing that he actually had no specific expertise in cybersecurity testing.
Mr. Vincent Liu, is a leading international cybersecurity analyst and consultant. He has focused on the “offensive side of security for 21 years,” starting with the National Security Agency as a global network exploitation analyst and moving from there to work at Ernst & Young in their advanced security centers. He subsequently led the global penetration team for
Mr. Liu addressed head-on the inaccuracy of any contention that the QR code or signature utilized in the Dominion BMD system in Georgia is encrypted. Mr. Liu testified at the injunction hearing that based on his and his firm‘s examination of the QR codes, the codes were not encrypted. “And the process that we undertook to perform the verification was to develop code that read the QR code. Wherein, we were able to extract the raw data and determine . . . whether or not it was encrypted. And our conclusion was that it was not.” (Liu Testimony, Vol. II at 56.) Mr. Liu further explained that encryption and encoding have
fundamentally different meanings. “The use of encryption implies that there is an algorithm that confers some measure of security to the system . . . . [A] way to think about it is encryption is used to provide security. Encoding is intended for usability. It is to make information more easily accessible, which is oftentimes counter to, say, encryption, which is something more secret . . . . [I]t is a concept that is very, very fundamental.” (Id. at 57.) QR codes, in short, are made to facilitate access, not to conceal the code.
Mr. Liu also addressed whether the digital signature in the Dominion QR code provided security for the QR code:
[T]ypically when you are thinking about digital signatures you are referring to the use of public-key cryptography. And the intention is to provide for integrity. In this case, public-key cryptography was not being used with QR codes. And so the implication is that with the BMDs and the generation of the QR codes the QR codes themselves – the implication with the design of the Dominion BMD system is that any device that has necessary keys to operate would be able to generate a fake QR code. And you would not be able to determine which machine generated it, whether it was the EMS, the BMD, the ICP, or any other system that had that key loaded on to it.
(Id. at 58.)
Mr. Liu goes on to dismiss Pro V&V‘s and Dominion‘s reliance on hash values as a central software security protective device. “[I]f you have an infected BMD that has been compromised [by malware], it can just tell you whatever value that it wants.” (Id. at 59.) “[A]s it is deployed within the Dominion devices, it does not appear to be used in a fashion that could be considered secure. It can easily be circumvented.” (Id. at 64.) Liu similarly addresses the insecurity of the encryption key and other gateways to the system that he states can be bypassed by malware to
allow access to QR codes (and faking of such). (Id. at 60-61, 63; Liu Decl., Doc. 855-2 at 5-8.)
On cross-examination, Mr. Liu explained that while he had not personally physically examined the BMD system in Georgia because
In contrast, Defendants contend that Plaintiffs’ evidence boils down to hypothetical speculation by Dr. Halderman about what “could” happen based on his experience with other electronic voter systems, and review of Dominion documentation, rather than a studied evaluation of the Dominion 5.5-A GA system or its implementation. They argue that the Plaintiffs’ experts have never actually
seen malware that would actually alter a ballot on the Dominion voting system. The State Defendants also question Dr. Halderman‘s mode of testing the BMD system when the Court ordered the equipment be made available for confidential testing in early September43 and assessment of the vulnerability of the system‘s design.
Given the Court‘s assessment of the limitations in Mr. Cobbs’ and Pro V&V‘s evaluation of cybersecurity elements of Georgia‘s BMD system and affidavit accuracy issues, the Court looks to Dr. Coomer‘s testimony for a fuller picture. Dr. Coomer averred in his November 2019 affidavit, “while all computers can be hacked with enough time and access, Dominion is not aware of any situation where an individual used the barcode on one of its units to launch software or to affect the operation of the unit.” (Doc. 852-1 at 8.) In his court testimony, Dr. Coomer describes Dominion‘s Democracy Suite system as a protected “end-to-end” election management system that is a “self-contained, self-functioning election management system and tallying tabulation system.” (Tr. Vol. II at 117.)
Dr. Coomer represents that the servers and work-stations are “hardened” to meet benchmarks set by NIST, the National Institute of Standards Technology. And he represented to the Court that the NIST benchmarks do not address whether other software applications – i.e., game applications that Mr. Hursti observed on
servers in Georgia county voting offices – must be removed to ensure that servers are securely hardened and protected.44 Dr. Coomer testified that one of the strong assets of
Dr. Coomer testified at the injunction hearing that Dominion did not intend to encrypt the QR barcode. He also testified regarding the use of digital signatures, secure keys in the system “that are part of the system and the standard SHA-256 hashing algorithm” as protective security architecture for the software system and the QR codes.45 (Tr. Vol. II at 123.) Responding to State Defendants’ question regarding what would be necessary to generate a valid (but false) QR code accepted by the ICP scanner, Dr. Coomer discussed how all physical and software defenses of the system would have to be defeated and source code accessed, which his testimony as a whole suggests he did not think likely. (Tr. Vol. II. at 124.) He also in his 2019 affidavit testified that as the BMD touch-screen tablets run the Dominion Voting Systems software in Kiosk mode (in a mode only showing the
Touchscreen voting display), “this prevents any access to software or features outside of the certified installed program.” (Doc. 821-1 at 2-3.) Finally, Dr. Coomer‘s affidavit represents that “the BMD has no physical component that would allow for wireless transmissions.”46 (Id.) Dr. Coomer acknowledged on cross examination, however, that the Democracy Suite software works on an Android operating system that is separate from the software and hardware, and that is not written by Dominion. (Tr. Vol. II at 86-87.) He further acknowledged the potential for compromise of the operating system, by exploiting a vulnerability, that could allow a hacker to take over the voting machine and compromise the security of the voting system software. (Id.)
The evidence of actual implementation presented by Harri Hursti‘s testimony suggest a very different picture as to the system‘s implementation at this juncture. Mr. Hursti is a nationally recognized cybersecurity expert who has worked in security-oriented IT technology for over 30 years, with a particular expertise in the knowledge, observation and prevention of malicious activities in networked environments. Mr. Hursti also has an expertise in optical scanning. (Doc. 680-1 at 37; Doc. 853-2; Tr. Vol. I at 120-121.) Mr. Hursti is the co-founder and organizer of one of the largest annual cybersecurity and hacker community meetings, attracting over 30,000 participants in Las Vegas in the four years prior to the Covid-19 pandemic. He also organized the 2018 Voting Machine Hacking
Village for which he was awarded a Cyber Security Excellence Award and has engaged in other organized efforts to work with local election officials to assist them in gaining security expertise.
In response to the State Defendants’ critique of his specific qualifications, Mr. Hursti indicates that “there are only a few independent voting system researchers with more hands-on experience than I
Mr. Hursti testified at the September 2020 injunction hearing and through several declarations regarding his observations made while visiting county facilities where voting activity was transpiring in the August 2020 elections and in other sites both before and after the August observations. Based on his cybersecurity expertise and in-depth knowledge hacker strategies, Hursti identified concerns regarding the security of these systems. He found that in the two county election offices he visited, election servers enabled unsafe remote access to the system through a variety of means, extending from frequent use of flash drives and accessing of the internet to the use of outside unauthorized applications (such as game programs) residing on election management and tabulation servers and other practices. Mr. Hursti testified that these practices drive a hole through the essential cybersecurity foundation requirement of maintaining a “hardened”48 server (and associated computers)
Hursti found that in one of the counties, server logs were not regularly recording or updated in full and that Dominion‘s technical staff maintained control over the logs and made deletions in portions of the logs. Yet secure and complete logs, Hursti testified, are essential as the most basic feature of system security as they provide the detailed activity trail necessary for the identification of security threats and server activity and are required for purposes of conducting a sound audit.49 (See Hursti Decl., Doc. 853-2; Tr. Vol. II at 117-169.)
In sum, at the preliminary injunction hearing, Mr. Hursti succinctly presented his opinion that given the irregularities that he observed as a cybersecurity expert he had serious doubt that the system was operating correctly and that “when you don‘t have an end-to-end chain of the voter‘s intent” and when a system could be maliciously or unintentionally compromised, there is no capability of auditing the system results.
3. Other Issues: Software Changes and Installation
In addition to the above issues, approximately two weeks after the last day of the injunction hearing in this case, a new development or crisis (depending on which party‘s perspective) was brought to the Court‘s attention. Logic and Accuracy testing in at least two counties demonstrated an unpredictable defect or bug in the presentation on the ballot of the 20 candidates for one of Georgia‘s U.S. Senate seats. A column of the senatorial candidates erratically would disappear from the ballot. Dominion conducted expedited testing to identify the source of the bug. At first it determined it would have to replace the database system wide across Georgia to address the issue. On the afternoon of September 25, 2020, Chris Harvey, the Director of Elections for the Secretary of State‘s Office, issued a written notice to all County election directors regarding a ballot problem that had arisen that might require replacement of the entire voting database. He therefore directed that all county election offices cease Logic & Accuracy testing until further notice. Georgia‘s 159 counties thus temporarily halted all Logic and Accuracy testing preparation of voting equipment for the elections.
Plaintiffs’ counsel notified the Court over the ensuing weekend of this significant new election system problem. The Court held a phone conference with counsel along with Dr. Coomer regarding the issues raised on September 28th. The Court was at that time advised that Dominion had now determined after further testing that the issue should be addressed by a software modification to run on the ICX BMD Touchscreen voting machines that would have to be installed in each of these BMD voting machines across the state. Meanwhile, Dominion sent a modified version of the software for running the election on the operative ICX BMD Touchscreen voting equipment to Pro V&V for
Although as it turns out, Pro V&V had not started their testing of the software modification (or so it seems) aimed at remedying the issue at the time of the September 28th phone call, Dr. Coomer initially advised the Court then that “so the testing lab has already deemed the change de minimis” — an instantaneous conclusion that bears consequences and raises questions, as later discussed here. (Tr., Sept. 28, 2020, Doc. 926 at 38.) Dr. Coomer then responded to the Court‘s question of when therefore did the testing actually occur. He further responded that Pro V&V had first analyzed the code change to determine if the change was “de minimis” pursuant to EAC standards and then, based on that finding, would conduct testing, which was proceeding on that day, Monday, September 28th.50 By Tuesday at latest, Pro V&V had given its full approval of the software modification, though it had yet to issue a written testing report. By that Tuesday afternoon or evening (or earlier), Pro V&V had transmitted the modified software to the State Elections Division for review, use, and distribution to counties on Wednesday. (Doc. 928-1.) The State in turn transmitted on Wednesday, September 30th one flash drive to each county elections office for mass reproduction in hundreds of flash drives for installation of replacement software on all BMDs.
At the time it was distributed to the counties, the Dominion software modification had not yet been reviewed or approved by the Election Assistance Commission.51 The State contends it could immediately legally proceed without such approval and has now launched and apparently completed the process of Counties’ (whether by county staff or Dominion staff or contract employees) removal of the prior software and installation of the new modified software in thousands of voting machines across the state. At conferences held by the Court on September 28th and October 1st, the State Defendants’ counsel maintained that the State did not need EAC approval to implement newly modified software essential to running all critical aspects of the voting machines as state law only requires that the BMD system be “certified by the United States Election Assistance Commission prior to purchase, lease, or acquisition.”
However, Dominion did not in fact submit the software modification for approval to the EAC as a de minimis change until Monday, October 5, 2020 and then re-submitted
EAC Certification requirements specify that pre-approval of software program modifications is necessary, even if considered “de minimis” because of the potential systemic impacts of software changes. Section 3.4.3 of the EAC Certification Manual (revised November 19, 2019) provides: “Manufacturers who wish to implement a proposed de minimis change must submit it for VSTL review and EAC approval. A proposed de minimis change may not be implemented as such until it has been approved in writing by the EAC.” The EAC Manual regulatory revision at 3.4.3.1. (3) specifies that a Voting System Test Laboratory (VSTL) (in this case, Pro V&V) must review and assess the proposed change and among other requirements, detail “the basis for its determination that the change will not alter the system‘s reliability, functionality, or operation.” It also must determine whether the change meets the definition or instead “requires the voting system to undergo additional testing as a system modification.” Section 3.4.3.1(7). In turn, if the VSTL endorses the proposed change as de minimis and provides requisite documentation, EAC “has sole authority to determine whether the VSTL endorsed change constitutes a de minimis change under this section.” Section 3.4.3.3. If the EAC determines that the proposed de minimis change cannot be approved, “the proposed change will be considered a modification and require testing and certification” consistent with the requirements of the EAC manual. The Manual provision goes on to delineate six types of features of a proposed software change that should be reviewed in determining whether a change is de minimis or a modification that requires more testing.
The Plaintiffs maintain that the software changes are far more than de minimis and can have broad systemic impact. Three of their cybersecurity experts submitted affidavits regarding the issues raised by the new software and its testing, thus far. The Plaintiffs’ experts’ affidavits address the EAC delineated characteristics for determining if a software change is de minimis and conclude that the VSTL (Pro V&V) failed to implement requisite testing measures and analysis to determine the impact of the proposed software code changes on overall system software functionality, as required for assessment of whether a software change is “de minimis.” They further contend that Pro V&V conducted a rubber-stamp highly abbreviated testing review of the software changes that failed to test the
Other substantive concerns were also raised in Plaintiffs’ experts’ affidavits regarding the nature of the Pro V&V testing, review, and issues posed by the software change. Pro V&V reproduced the bug on a mock election panel database it had created and ran Dominion‘s new software version on that sample to determine the bug did not reappear. However, as Pro V&V was never able to reproduce the flickering on/off appearance of one column of the 20 candidate screen on a copy of Douglas’ County‘s actual database that first demonstrated the bug, there is no indication that Pro V&V actually identified the root cause of the bug or that Pro V&V actually verified that the new software fixed the bug or fixed it without impacting other portions of the software. Finally, Plaintiffs’ two experts discuss how in their experience, rushed, last minute software code changes without assessment of their impact on the functionality of software and code as a whole constitutes an enormous functionality and security risk for the election system.53 Mr. Skoglund additionally states that Logic and Accuracy testing, that should follow the new software installation process in every county, will not be able to catch the range of errors and software functionality problems potentially created by the new software. (Skoglund Decl., Doc. 943.)
Additionally, Plaintiffs have offered an affidavit from cybersecurity expert Harri Hursti who witnessed on October 1, 2020 some of the initial installation of the software now proceeding on approximately 3,300 of Fulton County‘s ballot marking device touchscreen units to ICX software version 5.5.10.32 in the Fulton County Election Preparation Center. (Doc. 942.) He describes in detail how 14 Dominion technicians en masse engaged in removal of the old software and installation of the new software in disorganized, rushed, and careless form — without consistent implementation of various required steps and Dominion directives for installation of the software or any evident security standards or tracking of flash drives containing sensitive information. In Hursti‘s view, the entire hasty and unprofessional software swap out and installation process is itself cause for grave concern as to the future security and consistent functionality of the new system.
4. Logic and Accuracy Testing
Pre-election Logic and Accuracy Testing (L & A) is an important operations verification practice and standard in jurisdictions across the nation that use any form of computerized voting equipment. L & A testing is required under the 2019 Georgia statutory provisions enacted as part of the adoption of legislation approving the statewide usage of the BMD system. As discussed below, L & A testing is designed to
On or before the third day preceding a primary or election, including special primaries, special elections, and referendum elections, the superintendent shall have each electronic ballot marker tested to ascertain that it will correctly record the votes cast for all offices and on all questions and produce a ballot reflecting such choices of the elector in a manner that the State Election Board shall prescribe by rule or regulation. Public notice of the time and place of the test shall be made at least five days prior thereto; provided, however, that, in the case of a runoff, the public notice shall be made at least three days prior thereto. Representatives of political parties and bodies, news media, and the public shall be permitted to observe such tests.
(Emphasis added). The language of Georgia‘s 2019 statutory provision appears transparent: Each County superintendent shall have each electronic ballot marker machine (i.e., BMD and its components) tested to ascertain that “it will correctly record the votes cast for all offices and on all questions and produce a ballot” for such offices.
Dr. Coomer, Dominion‘s Director of Product Strategy and Security, “absolutely” agreed in his hearing testimony “that one of the goals of logic and accuracy testing and equipment is to do some measure of confirmation that that the equipment is working properly.” (Tr. Vol. II at 83.) His affidavit submitted earlier by Defendants both in 2019 and 2020 summarized in more detail the purpose and function of pre-election L & A testing in connection with the Dominion voting systems used in Georgia:
Dominion‘s optical scanners (ICP) can be used with BMD-marked paper ballots or hand-marked paper ballots. The ICP units do not interpret the human-readable (text) portion of either type of ballot. Instead, the ICP units are programmed to read the QR Code for the BMD ballot or particular coordinates on hand-marked ballot. . . . The target locations are then correlated to individual choices represented on the ballot. Pre-Logic and Accuracy Testing (Pre-LAT) is performed each election on every machine to verify that the target locations on hand-marked ballots, and the barcodes on BMD-marked ballots correspond correctly to the choices represented on the ballots and the digital cast-vote-records.
(Doc. 821-1 at 6.)
The Georgia State Election Board in early 2020 adopted a new Logic and Accuracy Testing Rule, SEB Rule 183-1-12.08.54 This Rule requires:
During the public preparation and testing of the electronic poll books, electronic ballot markers, printers, and ballot scanners to be used in a particular primary or election, the election superintendent shall cause each electronic ballot marker and scanner to be programmed with the election files for the precinct at which the electronic ballot marker and ballot scanner unit will be used. The superintendent shall cause the accuracy of the components to be tested by causing the following tasks to be performed: A. Check that the electronic poll books accurately look up and check-in voters via both the scanning function and manual lookup and create a voter access card that pulls up the correct ballot on the electronic ballot marker for every applicable ballot style.
B. Check that the touchscreen on the electronic ballot marker accurately displays the correct selections and that the touchscreen accurately reflects the selected choices.
C. Check that the printer prints a paper ballot that accurately reflects the choices selected on the touchscreen and immediately mark all printed paper ballots as “test” ballots.
D. Check that the ballot scanner scans the paper ballot, including both ballots marked by electronic ballot markers and ballots marked with a pen, and that the ballot scanner scans ballots regardless of the orientation the ballot is entered into the scanner.
E. Check that the tabulation contained in the ballot scanner memory card can be accurately uploaded to the election management system, and that the tabulated results match the selections indicated on the paper ballot.
Yet the Secretary of State‘s January 20, 2020 published procedures for conducting L & A testing give an instruction for a fraction of the testing required under
“Example: Ballot from BMD 1 contains a vote for only the first candidate in each race listed in Ballot style 1. Ballot from BMD 2 contains a vote only for the second candidate in each race on Ballot 1, and continue through the line of devices until all the candidates in all races within the unique ballot style will have received a single vote.” (Doc. 809-4 at 25.)
In other words, the testing instructions do not provide for a review of whether each BMD machine in the precinct can correctly produce candidate selections on the touchscreens, and aligned ballot results in turn on scanners and printers for all elective offices on the ballot. But whether a BMD machine or scanner may be able to accurately relay a vote designation for one office does not mean that it properly does so for all other races and offices listed on the ballot.
At the October 1, 2020 follow-up hearing to address the State‘s implementation of the brand new software modification on the BMDs, the Court explored whether the software change would impact the
Putting aside the intent and specifications of the L & A statutory provision, the Court looks at the basic purpose and function of L & A testing as a preliminary threshold standard for testing and ensuring the functionality of every voting machine to be used in an election by voters and capacity to produce pre-election an accurate record and tabulation of votes for candidates appearing on the ballot. First, the Court has considered Dr. Coomer‘s explanation above that describes the baseline functional examination that L & A provides of voting balloting equipment — and how this translates into correct operation of voting machines, production of ballot results that correlate with ballot position, and vote tabulation. Next, it considers the testimony of Plaintiffs’ expert, Mr. Kevin Skoglund, on this subject that goes into greater detail, along the same lines.
Mr. Skoglund, a cybersecurity expert with significant consulting experience with public jurisdictions, testified regarding the Secretary of State‘s L & A testing directive issued in January 2020. He explained that L & A testing is aimed at “verifying that every piece of equipment is going to operate properly and record votes properly on election day. And so we‘re crafting a set of questions to ask in advance to try and ascertain if that is true . . . . you would want to test every ballot style because you want every ballot style to work properly. And you want to check every contest. At a minimum, you want to make sure that every candidate is able to receive a vote . . . . But you also have to make sure that the votes aren‘t being swapped, that they are not crisscrossing.” (Tr. Vol. III at 128.) Mr. Skoglund further clarified that this involves checking to make sure that “whatever you do on the screen is reflected in what is output in the end. On a tabulator, you‘re validating that when you take the input of the ballot into the tabulator that the totals that come out at the end match correctly. In both cases, you are looking to see if what goes in gives you what you expect to come out the other side.” (Id. at 131-132.) Finally, he explained
The Secretary of State‘s Director of Elections, Mr. Chris Harvey, provides an affidavit in this case that addresses the Secretary of State‘s L & A testing policy. He states the Secretary of State‘s Office designed the current L & A testing process “in consultation with Dominion and local election officials, and considered the best practices in doing so.” (Doc. 834-3 ¶ 7.) In his opinion, the Coalition Plaintiffs’ proposal that all races within the unique ballot style be tested is “overly burdensome and require[s] a test deck that is extremely large for each BMD.” (Id. ¶ 6.) According to Mr. Harvey, the State/Dominion/local election officials group therefore concluded that the “increase in burden on local elections officials” would be “dramatic” and “unnecessary” if it conducted any more extensive L & A testing of the ballot than what is required in the January 2020 election procedures manual. However, Dr. Coomer testified at the injunction hearing that he was not aware that the Georgia Secretary of State now is only requiring testing of one vote position on each ballot. (Tr. Vol. II at 84.)
The Court understands Mr. Harvey‘s concern as to the testing burden. But the current state procedure slices and dices standard L & A protocols and objectives in testing for each voting machine (and scanner and printer) to only a small fraction of the electoral races for offices on the ballots to be run on each machine in each County precinct. This is a serious short cut that truncates L & A testing‘s basic objective of checking on a pre-election basis the voting equipment and software‘s functionality as well as logic and accuracy in producing a useable, proper ballot printout and vote count, as discussed both by Mr. Skoglund and Dr. Coomer, and anticipated under Georgia law. This makes no sense when the goal is for the system to run smoothly on election day and produce ballots that accurately reflect citizens’ votes cast on the BMD system tabulators.
The Court respects that the Secretary of State and Georgia State Election Board are vested with considerable discretion in implementing the mandate of
Recognizing that early voting starts on October 12, 2020 and the imminence of the November 3, 2020 general election, the Court must defer to the Secretary of State‘s Office and State Board of Elections determination of whether additional measures are pragmatically feasible at this juncture to strengthen the scope of L & A preparations for a general election with a huge anticipated turnout. As L & A testing has already commenced on BMD equipment to be deployed at early voting locations, the Court is not prepared to issue a ruling on the L & A testing issue purely standing on its own. Accordingly, the Court recommends that the Secretary of State and State Election Board expeditiously review in conjunction with Dominion: (1) the adequacy of the current January 2020 procedures, particularly in light of evidence of prevailing protocols used in states nationwide for conducting for logic and accuracy tests; (2) what modifications can and will be made by the time of the January 2021 elections runoffs and thereafter, or beforehand (if at all feasible). The Court further recommends that the process for evaluation and change in procedures shall be made public on a timely basis and that the results of such evaluation and any changes be made public on a timely basis.56
5. Audits
Plaintiffs assert that the Dominion BMDs should not be used in Georgia‘s elections because unlike hand-marked paper ballots the BMDs are unauditable. In conjunction with their request to enjoin the use of BMDs and to require hand-marked paper ballots as the primary voting method for in-person voting, Plaintiffs request that the State be required to adopt more robust election audit procedures based on generally accepted audit principles. Specifically, the Coalition Plaintiffs’ motion seeks an order “commanding the State Defendants to issue rules requiring meaningful pre-certification audits of election results, focusing on contested candidate races and ballot questions, with such auditing to be based on application of well-accepted audit principles in order to establish to a scientifically appropriate level of confidence that any incorrect outcomes will be detected in time to be remedied prior to certification of results.” (Doc. 809.) The Curling Plaintiffs similarly request that the Court order Defendants to file “a plan providing specific
steps the Defendants intend to take to . . . institute pre-certification, post-election, manual tabulation audits of the paper ballots to verify election results, in sufficient detail for the Court to evaluate its adequacy.” (Doc. 785.)
Plaintiffs presented expert testimony from Dr. Philip Stark, a preeminent renowned statistician and original inventor and author of the risk-limiting audit (“RLA“) statistical methodology for auditing election outcomes embraced by the National Academies of Sciences, Engineering, and Medicine, et al. Securing the Vote: Protecting American Democracy at 109 (National Academies Press, 2018) (“National Academies Report” or “NAS Report“).57 (See Declarations of Dr. Philip A.
As Dr. Stark explains, a RLA “offers the following statistical guarantee: if a full manual tally of the complete voter verifiable paper trail would show a different electoral outcome, there is a known, predetermined minimum chance that the procedure will lead to a full manual tally.” (Id.) If the RLA “does lead to a full manual tally, the result of that manual tally replaces the reported outcome, thereby correcting it.” (Id. ¶ 28.) In a RLA, “the ‘outcome’ means the political result: the candidate(s) or position that won, or the determination that a run-off is needed, not the exact vote totals.” (Id. ¶ 29.) “The maximum chance that the procedure will not lead to a full manual tally if that tally would show a different outcome is called the risk limit.” (Id. ¶ 30.) In other words, “the risk limit is the largest chance that the audit will fail to correct an outcome that is incorrect, where ‘incorrect’ means that a full manual tally of the voter-verifiable paper trail would find different winner(s).” (Id.) For example, a RLA with “a risk limit of 5% has at least a 95% chance of requiring a full manual tally, if that tally would show an outcome that differs from the reported outcome.” (Id. ¶ 31.)
According to Dr. Stark the “simplest risk-limiting audit is an accurate full hand tally of a reliable audit trail: Such a count reveals the correct outcome.” Lindeman, M. and Stark, P., A Gentle Introduction to Risk-Limiting Audits, IEEE SECURITY AND PRIVACY, SPECIAL ISSUE ON ELECTRONIC VOTING (2012) at 1. Because a full hand count is administratively burdensome and time consuming, Dr. Stark designed the RLA as a method of examining far fewer ballots that “can provide strong evidence that the outcome is correct,” where the “ballots are chosen at random by suitable means.” Id. RLAs provide “statistical efficiency” because a RLA of an election “with tens of millions of ballots may require examining by hand as few as several hundred randomly selected paper ballots. A RLA might determine that more ballots need to be examined, or even that a full hand recount should be performed, if the contest is close or the reported outcome incorrect.” NAS Report at 95.
Risk-limiting audits “do not guarantee that the electoral outcome is right, but they have a large chance of correcting the outcome if it is wrong” but they do “guarantee that if the vote tabulation system found the wrong winner, there is a large chance of a full hand count to correct the results.” Lindeman and Stark (2012) at 6. In order to provide this guarantee, a RLA must be based on a reliable and trustworthy audit trail produced by a voting system that is software independent. Id. at 1. (See also Stark Suppl. Decl., Doc. 680-1 ¶ 4; Stark Suppl. Decl. 640-1 at 42 ¶ 10.)
RLAs involve manually examining and interpreting randomly selected portions of an audit trail of ballots that voters had the opportunity to verify recorded their selections accurately. Lindeman and Stark (2012) at 1. The consensus among voting system experts is that the best audit trail is voter-marked paper ballots; voter-verifiable paper records printed by voting machines are not as good. Id.; see also NAS Report at 94-95.60
Dr. Stark‘s affidavits and hearing testimony address the impossibility of conducting a reliable audit of ballots and voting totals derived from QR codes for purposes of verifying the accuracy or integrity of election results or processes. In Dr. Stark‘s view, the risk-limiting audit methodology cannot be properly utilized to assess the accuracy of election results in the context of a BMD system where ballots are tabulated based on a humanly non-readable QR code that is not voter verifiable and where the computer voting system is vulnerable to data hacking or manipulation that can alter votes cast in untraceable ways – including in the votes actually shown on the ballots that are audited.
In his December 15, 2019 declaration, Dr. Stark explains,
The most compelling reason for post-election audits is to provide public evidence that the reported outcomes are correct, so that the electorate and the losers’ supporters have reason to trust the results. Audits that cannot provide evidence that outcomes are correct are little comfort. A transparent, full hand count of a demonstrably trustworthy paper record of votes can provide such evidence. So can a risk-limiting audit of a demonstrably trustworthy paper record of votes.
(Stark Suppl. Decl., Doc. 680-1 ¶ 3.) But if “there is no trustworthy paper trail, a true risk-limiting audit is not possible, because an accurate full manual recount would not necessarily reveal who won.” (Id. ¶ 4.) Unlike voting systems using optical scan hand-marked paper ballots, BMD based voting systems are not strongly software independent. (Stark Suppl. Decl., Doc. 640-1 at 42 ¶ 10.) According to Dr. Stark, a BMD “by its nature, erases all direct evidence of voter intent.” (Tr. Vol. I at 46.) There is no way to tell from a BMD printout what the voter actually saw on the screen, what the voter did with the device, or what the voter heard through the audio interface. (Id.) For this reason, there is no way to establish that a BMD printout is a trustworthy record of what the BMD displayed to the voter or what the voter expressed to the BMD. (Stark Suppl. Decl., Doc. 680-1 ¶ 10.) Because a BMD printout cannot be trusted to reflect voters’ selections, auditors can only determine whether the BMD printout was tabulated accurately, not whether the election outcome is correct. (Stark Suppl. Decl., Doc. 640-1 at 42 ¶ 10.) Nor can auditors determine the correct outcome under these circumstances. (Id.) Therefore, because a BMD printout is not trustworthy, “applying risk-limiting audit procedures to [a]
Plaintiffs provided additional affidavits, testimony, and evidence from other nationally recognized experts that addressed their similar views that the QR code based voting system does not produce a reliable voter-verifiable audit trail that can be audited consistent with established RLA standards and foundation principles. (See Decls. of Dr. Andrew W. Appel, Doc. 681-3, Doc. 855-3; Decls. of Dr. Alex Halderman, Doc. 619-2, Doc. 682, Doc. 692-3; Decls. Of Dr. Richard A. DeMillo, Doc. 680-1 at 45-56, Doc. 716-1; see also Doc. 615-2, Wenke Lee, Ph.D., Secure, Accessible & Fair Elections Commission, Basic Security Requirements for Voting Systems (October 8, 2018); Andrew A. Appel, Richard A. DeMillo, Philip B. Stark, Ballot-marking devices (BMDs) cannot assure the will of the voters (April 21, 2019); Doc. 692-3 at 8-23, Bernhard, M., A. McDonald, H. Meng, J. Hwa, N. Bajaj, K. Chang, and J.A. Halderman Can Voters Detect Malicious Manipulation of Ballot Marking Devices? IEEE Proc. Security & Privacy, 1, 679-694 (2020)).
Dr. Halderman has explained the many ways a BMD could be maliciously programed or otherwise malfunction such that the ballot printed by the BMD does not match the voter‘s intended selections. He also attests that “if voters do not reliably detect when their paper ballots are wrong, no amount of post-election auditing can detect or correct the problem.” (Halderman Decl., Doc. 619-2 ¶ 12.) Dr. Halderman, along with others at the University of Michigan, conducted experiments to determine how often voters fail to notice that their BMD printed ballots differ from the selections made on the touchscreen voting machines. (Id. ¶ 13.) When not given any prompting to review their ballots, only 6.5% of participants in the study noticed their votes had been changed by the BMD. (Id. ¶ 14.)
Between November 2018 and March 2019, Dr. Appel conducted a research collaboration with Dr. DeMillo of Georgia Tech and Dr. Stark, leading to the publication of a joint paper, Ballot Marking Devices (BMDs) Cannot Assure the Will of the Voters. After analyzing the consequences of a study of whether voters review ballot cards produced by BMDs, their research concluded:
Risk-limiting audits of a trustworthy paper trail can check whether errors in tabulating the votes as recorded altered election outcomes, but there is no way to check whether errors in how BMDs record expressed votes altered election outcomes. The outcomes of elections conducted on current BMDs therefore cannot be confirmed by audits.
(Appel Decl., Doc. 681-3 ¶¶ 11, 13, 21.)
Dr. Wenke Lee, the only cybersecurity expert appointed to the Georgia Secretary of State‘s “Secure, Accessible & Fair Elections Commission,” echoed Dr. Stark‘s opinions in advising the Commission on basic security requirements for voting systems:
In order to support risk-limited - auditing, paper ballots must be easily and clearly readable and manually countable. In particular, a paper ballot must show each and every vote exactly as cast by the voter. It cannot be just a summary of the votes (e.g., only a tally, or only the presidential ballot and not the down ballots). A manual count absolutely cannot rely upon a barcode, QR code, or any other kind of encoding scheme that is readable only by a machine because the cyber system that reads those codes also can be compromised and lie to the voter or auditor. In short, during a manual review, a human must be able to
clearly see evidence of the voter‘s original act.
(Doc. 615-2 at 3.)
In the face of this consensus as to the role of voter verification and auditing in ensuring voters’ ballots are properly and accurately counted, and that the voting tallies are reliable, the State Defendants presented two rebuttal expert witnesses regarding the viability of conducting a valid risk-limiting audit of a QR code based voting system. Both Dr. Gilbert and Dr. Adida‘s declarations focused on the RLA as the essential tool for protecting against voting system mishaps in the implementation of a BMD system. (Doc. 834-2 at 7; Doc. 658-3 at 13-14, 20-21.)
Professor Juan Gilbert, Professor and Chair of the Computer & Information Science & Engineering Department of the University of Florida and leader of the Department‘s Human Experience Research Lab61 testified regarding his views as to the value and reliability of RLA as part of the BMD system, which he endorses.
Dr. Gilbert‘s research currently focuses on human use of technology and access to voting systems as opposed to issues involving cybersecurity issues or statistical methodology. He described the access benefits of the BMD system and addressed why in his view, voters will verify their printed ballots and therefore enable a meaningful RLA audit which he saw as a vital protective device. Dr. Gilbert has himself not performed any studies of voter review of ballots at the polls. The Court notes that Dr. Halderman has recently published an article on this very subject.62 Dr. Gilbert‘s risk/benefit assessment of the vote integrity or manipulation risks entailed in a QR code BMD system clearly differed from Plaintiffs’ experts – and specifically Dr. Appel, Dr. Halderman, and Dr. Stark‘s views regarding the risks posed by the BMD system‘s reliance on tabulating votes based on a humanly unverifiable QR code.
Dr. Benjamin Adida is co-founder and Executive Director of VotingWorks, a non-profit vendor of election auditing technology and more recently, voting systems in the United States, including accessible ballot-marking devices and hand-marked ballots.63 Dr. Adida holds a PhD in cryptography and information security from MIT and has significant experience in the private and public sector.
While his academic background is impressive, Dr. Adida‘s background and expertise is not specifically in statistics.64
Dr. Adida‘s methodology contained the inherent assumption of voter ballot verification. Dr. Adida testified that “[i]f the paper ballots have a chance to be verified by the voter, they can be used in a RLA whether they were BMD-produced or hand-marked produced.” (Id. at 284.) Under the State‘s audit procedures, the RLA is conducted on the human readable text of the BMD ballot printout, not on the QR code. (Id. at 294; Adida Decl., Doc. 934-2 ¶ 12.) Therefore, according to Dr. Adida, “[a]s long as voters verify the text, and as long as RLAs are conducted on the basis of the same ballot text, then potential QR code mismatches are caught just like any other tabulation mistake might be caught. A successful RLA thus provides strong evidence that, if there were QR code mismatches, they did not affect the outcome of the election.” (Adida Decl., Doc. 934-2 ¶ 12.)
Dr. Stark has submitted two affidavits in which he severely criticizes the premise of Dr. Adida‘s position that a valid RLA or valid RLA results can be conducted in the context of a BMD election in which there is no meaningful audit trail and voters cannot verify the QR code, among other things.66
First, despite Dr. Adida‘s assumption that BMD voters will review and verify their ballot selections on the ballot printout, the overwhelming evidence from actual studies of voter behavior “suggests that less than ten percent of voters check their printouts and that voters who do check often overlook errors.” (Stark Suppl. Decl., Doc. 680-1 ¶¶ 14, 30(d); Stark Suppl. Decl., Doc. 891 ¶¶ 9-10, 12.) In an actual election, there is no way to know how many voters checked their BMD printouts for accuracy. (Stark Suppl. Decl., Doc. 891 ¶ 16.) “The fact that a voter has the opportunity to check the BMD printout does not make a BMD printout trustworthy.” (Id. ¶ 7.)
The fundamental disagreement between Dr. Stark and Dr. Adida boils down to the purpose and function of a risk-limiting audit. Dr. Adida testified at the hearing that the “point of a RLA is to check the tabulation of the votes matches what the voters saw on the paper ballot” and that the “most important function” of a RLA “is to make sure that bugs, malfunctions, dust on the scanner, [or] nation state attacks do not corrupt that function.” (Tr. Vol. II at 292.) According to Dr. Stark, ballot polling risk-limiting audits, the audit method piloted and planned in Georgia, do not check the tabulation of votes, per se.68 (Stark
A ballot-polling audit of a contest conducted on a BMD system cannot confirm the reported outcomes are correct because it cannot show that the BMDs functioned correctly. (Stark Suppl. Decl., Doc. 680-1 ¶ 21.) All such an audit can do is provide statistical evidence that a full manual tabulation of the BMD printouts would find the same winner that was reported in the audited contest.69 (Id.) “If the BMD printouts contained outcome-changing errors, the audit would have no chance of detecting that, nor of correcting the reported outcomes.” (Id.)
This is essentially what the pilot audits Georgia has conducted accomplish and what the planned audit for the selected contest in the November 2020 election will accomplish.70 However, this does not serve
Additionally, the Court pursued a range of questions with Dr. Adida when he testified about VotingWorks’ application of the RLA for the first time in a state of Georgia‘s size in solely one race under these circumstances. The Court cannot
say that it got close to understanding the rationale or specific contours of the sampling methodology to be used by Voting Works.
Suffice it to say, the experts here are in hot debate and approach these issues from different backgrounds and areas of expertise. The Court recognizes that the RLA is deemed by all of the experts as a control valve essential to election integrity. The question they differ on is whether a RLA can be validly implemented in the context of Georgia‘s QR code BMD voting system. While the Plaintiffs have marshalled a formidable amount of evidence that casts serious doubt on the validity of the use of the RLA with the current system (including the specific RLA methodology that VotingWorks is pursuing here), unless the Court determines that the BMDs must be enjoined from use in Georgia‘s upcoming elections, the requested remedy appears irrelevant. Absent such an injunction, there is no audit remedy that can confirm the reliability and accuracy of the BMD system, as Dr. Stark has stressed. Plaintiffs do not request, and have not offered, any other proposed audit procedures to accomplish the goal of the RLA. Nor is the Court in a position to reach a judgment regarding whether the Secretary of State‘s plan to conduct a single RLA assessment in one statewide race under these circumstances provides any meaningful protection or guidance regarding the accuracy of tabulation of the overall voting results (or system). The Court has some major doubts, given the entirety of the evidence discussed here. But under
6. Analysis of Preliminary Injunction Standards as Applied to Plaintiffs’ Primary BMD Vote Related Claims
The Court has in Section II A. above discussed the standards the Court must weigh and apply in determining the Plaintiffs’ entitlement to preliminary injunctive relief. The Court must first consider whether Plaintiffs have established a substantial likelihood of prevailing on the merits of their claims and related to that, “consider the character and magnitude of the asserted injury to the rights protected by the First and Fourteenth Amendment.” Anderson, 460 U.S. at 789.
The interest Plaintiffs seek to vindicate now is the same interest at stake when they brought this litigation under the old voting system in 2017. As the Court first recognized in its August 2018 Order, the Constitution affords Plaintiffs an interest in transparent, fair, accurate, and verifiable election processes that guarantee each citizen‘s fundamental right to cast an accountable vote. Plaintiffs assert they will suffer immediate and irreparable harm to this interest if required by the State to cast a ballot on the BMD system that cannot be confirmed or verified as reflecting their actual vote choices because the votes are tabulated solely from a computer generated QR barcode that is not human-readable and is vulnerable in the current system to failure or breach. They further assert that this injury is exacerbated because votes cast by BMDs pose the significant risk of having the votes altered, diluted, or effectively not counted.72 Plaintiffs have shown demonstrable evidence that the manner in which Defendants’ alleged mode of implementation of the BMD voting system, logic and accuracy testing procedures, and audit protocols deprives them or puts them at imminent risk of deprivation of their fundamental right to cast an effective vote (i.e., a vote that is accurately counted).
The Court views the burden and the threatened deprivation as significant under the Anderson/Burdick balancing framework. The right to vote derives from the right of individuals to associate for the advancement of political beliefs that is at the core of the First Amendment and is protected from state infringement by the Fourteenth Amendment. E.g., Williams v. Rhodes, 393 U.S. 23, 30–31 (1968); NAACP v. Button, 371 U.S. 415, 430 (1963). “Writing for a unanimous Court in NAACP v. Alabama, Justice Harlan stated that it ‘is beyond debate that freedom to engage in association for the advancement of beliefs and ideas is an inseparable
aspect of the ‘liberty’ assured by the Due Process Clause of the Fourteenth Amendment, which embraces freedom of speech.” Anderson, 460 U.S. at 786-87 (internal citation omitted). As discussed in both the Court‘s September 28, 2020 Order and this Order, the individual Plaintiffs have a strong preference to cast votes in person and do not want to be
“Since the right to exercise the franchise in a free and unimpaired manner is preservative of other basic civil and political rights, any alleged infringement of the right of citizens to vote must be carefully and meticulously scrutinized.” Reynolds, 377 U.S. at 562. “It does not follow, however, that the right to vote in any manner and the right to associate for political purposes through the ballot are absolute.” Burdick v. Takushi, 504 U.S. 428, 433 (1992). “Although these rights of voters are fundamental, not all restrictions imposed by the States . . . impose constitutionally-suspect burdens on voters’ rights to associate or to choose among candidates.” Anderson, 460 U.S. at 788. Rather, the Supreme Court has recognized that States retain the power to regulate their elections to provide fairness, honesty, and order in the democratic process. Id. The right to vote is the right to participate in an
electoral process that is necessarily structured to maintain the integrity of the democratic system. Anderson, 460 U.S. at 788. “To achieve these necessary objectives, States have enacted comprehensive and sometimes complex election codes.” Id. Election laws “invariably impose some burden upon individual voters,” whether they govern the “registration and qualifications of voters, the selection and eligibility of candidates, or the voting process itself,” and such laws “inevitably affect[] — at least to some degree — the individual‘s right to vote and his right to associate with others for political ends.” Id.; Burdick, 504 U.S. at 433. But, “cumbersome election machinery can effectively suffocate the right of association, the promotion of political ideas and programs of political action, and the right to vote.” Williams, 393 U.S. at 39 (Douglas, concurring). And, “[w]hen a State exercises power wholly within the domain of state interest, it is insulated from federal judicial review. But such insulation is not carried over when state power is used as an instrument for circumventing a federally protected right.” Reynolds, 377 U.S. at 566 (quoting Gomillion v. Lightfoot, 364 U.S. at 347).
Georgia‘s Election Code mandates the use of the BMD system as the uniform mode of voting for all in-person voters in federal and statewide elections.
Plaintiffs and other voters who wish to vote in-person are required to vote on a system that does none of those things. Rather, the evidence shows that the Dominion BMD system does not produce a voter-verifiable paper ballot or a paper ballot marked with the voter‘s choices in a format readable by the voter because the
As a result, each of the Plaintiffs attest that they are forced to forego their right to full and unfettered participation in the political process and to alternatively exercise their right to vote using Georgia‘s absentee ballot regime which carries its own burdensome procedures, though they may be minimal as compared to the burdens created by the BMDs.74 Absentee voting itself has been the subject of much constitutional litigation where the implementation of these procedures resulted in the rejection of absentee ballots and voter disenfranchisement. To avoid being denied the ability to verify their votes on the BMD system, Plaintiffs must trade one unfavorable burden for another. Plaintiffs are left with the choice of having to run another gauntlet of the absentee voting process because of potential uncertain postal delivery issues, untimely processing by the registrar‘s office, signature matches, etc. As discussed in Section III D herein, Plaintiffs have shown a significant burden resulting from the accuracy and voter invalidation issues that affect Dominion‘s scanner/tabulators and adjudication software used for determining voter intent and tallying hand-marked absentee ballots. A choice between two evils is no choice at all; the Equal Protection Clause guarantees the opportunity for equal participation by all voters in the election regardless of which method they choose to cast their vote.
That Plaintiffs and other voters have the alternative of casting an absentee hand-marked paper ballot does not lessen or absolve the State of the burdens imposed
While the Court recognizes Plaintiffs’ strong voting interest and evidentiary presentation that indicate they may ultimately prevail in their claims, the Court must perforce address the posture of this case as a whole as well as the Plaintiffs’ burdens “against the interests the State contends justify that burden, and consider the extent to which the State‘s concerns make the burden necessary.” Timmons v. Twin Cities Area New Party, 520 U.S. 351, 358 (1997); New Georgia Project v. Raffensperger, ---F.3d. ---- 2020 WL 5877588, at *2 (11th Cir. 2020).
In election cases, the Supreme Court and Eleventh Circuit have made ever more abundantly clear the mandate that district courts must exercise great restraint in considering the grant of injunctive relief that requires new rules on the cusp of an election where the Court‘s Order could cause electoral disruption and voter confusion. Purcell v. Gonzalez, 549 U.S. 1, 4-5 (2006); Republican National Committee v. Democratic National Committee, --- U.S. ---, 140 S.Ct. 1205, 1207 (2020); Republican Nat‘l Comm. v. Common Cause R.I., --- U.S. ---, 2020 WL 4680151, at *1 (U.S. Aug. 13, 2020); Merrill v. People first of Alabama, ---S. Ct --- , 2020 WL 3604049 (U.S. July 2, 2020); New Georgia Project v. Raffensperger, 2020 WL 5877588 at *3. The Court expressed its concerns anew to Plaintiffs’ counsel about this timing issue when Plaintiffs filed a renewed motion for preliminary injunction in August 2020, shortly after the denial without prejudice of their initial October, 2020 preliminary injunction motions targeting the BMD system and other voting practices.75 The timing of the relief sought plays a paramount role in the evaluation of the practicality of granting the requested remedy at this point.
Litigation since Plaintiffs’ amendment of their claims to include a challenge to the BMD system as a whole has stretched on since October 2019, with plenty of delays occurring. But these delays were not attributable to any lack of litigation diligence or aggressiveness on Plaintiffs’ counsel‘s part. For a variety of reasons, including multiple motions to dismiss that stalled discovery, the Court‘s own schedule especially after the advent of the Covid-19 pandemic, and challenges posed by the difficulty of the case as a whole, Plaintiffs’ motions for preliminary injunction were not heard until September in this Presidential election cycle year. Some evidentiary
Plaintiffs have presented a massive and complex record in this matter for the Court‘s review that has consumed its attention for long swaths of time. Plaintiffs also in the course of their hearing preparation presented an expanded array of expert affidavits as well as voter and election evidence, collected primarily from the June and August 2020 statewide primary and runoff elections. These elections produced more substantive empirical evidence and helped to bring into sharper focus the evidentiary issues in this case.
Defendants also have presented substantive evidence in support of their overarching legal defense. They generally minimize the claims, concerns, and risk threats documented in Plaintiffs’ challenge. At core, the State Defendants’ counsel argue that Plaintiffs’ legal claims boil down to their disagreement with the policy choices legally vested in the Secretary of State and State Election Board‘s purview. In turn, they contend that Plaintiffs have suffered no cognizable threat of harm or burden in their exercise of their First and Fourteenth Amendment rights. Defendants also maintain that they have taken sufficient proactive measures in implementation of the new voting system to ensure its security and reliability.
The preliminary injunction hearing started on September 9, 2020 and concluded on September 13, 2020. But that was not the end, by any means, of the parties’ continuing supplemental submissions to the Court. And record developments such as the State Defendants and Dominion‘s last-minute introduction of a modified system-wide software change to the voting system and dealings with the EAC continued to roll out before the Court — some of which was directly relevant to the evidentiary issues before the Court. Early voting in Georgia with the use of BMD voting machines, will commence now in one day, on October 12, 2020.
Some of Plaintiffs’ claims pursued involved discrete and limited relief that do not upset the election apple cart. The Court has considered relief in two instances where there was strong evidence of state-imposed burdens to Plaintiffs’ First Amendment constitutionally protected exercise of the franchise as well as narrowly tailored relief that was fully consistent with state law. The Court in those instances balanced the state‘s interests and burdens as well as relief issues relative to the operation of the elections before granting any form of narrowly tailored relief or delaying such relief until after the election. Indeed, the Court‘s Pollbook relief76 was expressly framed based on the State‘s emergency ballot voting statutory and regulatory provisions to ensure that these emergency procedures could pragmatically be implemented on Election Day, November 3, 2020, if necessary so as to mitigate the severe burdens experienced by Plaintiffs and other voters in casting votes in
By comparison, the Plaintiffs’ BMD systemic injunctive challenge and request for replacement of the system with hand-marked paper ballots pose relief issues of an entirely different, more expansive scope. After reviewing all of the evidence in scrupulous detail, the Court must step back at this juncture, despite the persuasive evidence that Plaintiffs have provided. Plaintiffs’ central claim seeks statewide relief, requesting that the Court enjoin implementation of the State‘s newly designated BMD voting system under
Risks are posed both by a sudden shift to a statewide hand-marked paper system and proceeding with the BMD system. Ultimately, the Court must find that imposition of such a sweeping change in the State‘s primary legally adopted method for conducting elections at this moment in the electoral cycle would fly in the face of binding appellate authority and the State‘s strong interest in ensuring an orderly and manageable administration of the current election, consistent with state law. So, for this reason alone, despite the strength of Plaintiffs’ evidence, the Court must decline the Plaintiffs’ Motions for Preliminary Injunction.
C. Coalition Plaintiffs’ Claims Relating to Ballot Secrecy
The Coalition Plaintiffs seek to enjoin the use of BMDs on the basis that they severely burden the fundamental right to vote by depriving voters of secrecy of the ballot. They assert two theories as to how BMDs result in the deprivation of ballot secrecy: (1) the large size of the BMD touchscreens, if not configured to shield the screens from public view, permit anyone in the polling place to observe how a voter is voting; and (2) the precinct scanners record timestamp information such that a voted BMD ballot card can be traced back to the individual in-person voter by comparing the timestamps on the scanned cast vote records with the order in which voters used the machines.
For Plaintiffs, this is an all or nothing proposition, as they seek to enjoin the BMDs outright and do not propose other solutions to the ballot secrecy problems posed by the oversize BMD touchscreens. However, it is not necessary to scrap the new voting machines where a less burdensome fix exists. Georgia‘s Election Code places the responsibility of arranging voting equipment at polling places to ensure voter privacy with “the governing authority of each county and municipality.”
In support of their second contention, Plaintiffs assert that the “Dominion precinct scanners record timestamp information directly onto the digital cast vote record that is created when a ballot is scanned, with the result that a voted BMD ballot card can easily be connected afterward with the individual voter who cast that ballot by simply comparing the scanned cast vote records (ordered by timestamps) with the order in which voters are observed going through the voting process.” (Br. Supp. Mot., Doc. 809-1 at 32-33.)
The Coalition Plaintiffs have not offered a single instance of actual infringement of voter anonymity as a result of the use of digitally recorded scanner timestamp records. And despite the lack of evidence of any local election official going to such great lengths to discover how someone voted, the evidence in the record describing and illustrating how the precinct scanners actually operate does not bear this out.
Instead, the Coalition Plaintiffs rely on scanned ballot images from Fulton County bearing timestamps recorded by the ICC central count scanner used to tabulate absentee and provisional ballots by election
Unlike the ICC central scanner, the ICP precinct scanner does not record a digital timestamp on the ballots of in-person voters. Rather, ballots scanned on the ICP precinct scanner/tabulator includes a “randomized sequence number” that “preserves voter anonymity as there is no way to correlate the sequence number to either an individual voter, or a specific point in time that the ballot was cast. When results and images are stored on the removable memory (Compact Flash cards), no date-timestamp information is included which prevents the ability to recreate the sequence of how the ballots were cast thus preserving voter anonymity.” (Coomer Decl. ¶ 10; Doc. 821-1; see also Ex. 19-A to Decl. of Marilyn Marks, Doc. 853-4 at 6 (showing ballot image from ICP scanner without any timestamp).) Dr. Coomer confirmed this again at the September 11 hearing, stating that there is no timestamp associated with ballot images scanned and stored in the digital cast vote records created by the ICP precinct scanner/tabulator. (Tr. Vol. II at 91-92.)
Accordingly, the Coalition Plaintiffs have failed to establish a likelihood of succeeding on the merits of their claim that the BMD system violates their right to ballot secrecy.
D. Hand-Ballot Scanning and Its Impact on Counting of the Vote
The Coalition Plaintiffs request that the Court require the State Defendants “to adopt scanning threshold settings for the Dominion scanners and vote review procedures that will ensure all voter marks on mailed and hand marked paper ballots are counted.” (Br. Supp. Mot., 809-1 at 10.) They assert that the Dominion scanner and tabulation software and equipment are failing to count all legal votes as defined under Georgia law, resulting in an unconstitutional denial of review of the ballot before arbitrarily discarding perceptible ballot votes containing such marks. Plaintiffs contend that Defendants’ challenged practices in connection with scanning and tabulation of such hand ballot votes violate Georgia law, which requires votes to be counted if the intent behind a voter‘s mark can be ascertained upon review. See
The Coalition Plaintiffs have presented ballot images that they assert are evidence of clear voter disenfranchisement. The 5 ballot images shown below depict actual unadjudicated ballot images from Fulton County‘s August 11, 2020 election, showing the ICC scanner interpreted as a “blank contest” several voter marks that indicate a clear visible selection for the candidate78:
The State Defendants assert in opposition to Plaintiffs’ motion that “[t]he only possible burden on a voter arising from the scanner-threshold settings is if the voter disregards the instructions that come with the ballot. That is not a burden on the right to vote — it is a voter choosing to not follow the required regulatory structure of the state.” (State Defs.’ Resp., Doc.
1. Operation of the Scanners
The Dominion precinct (ICP)80 and central count (ICC)81 scanners do not interpret the text of a hand marked paper ballot.82 (Decl. of Dr. Eric Coomer ¶ 9, Doc. 658-2.) Instead, the scanners detect votes by reading particular coordinates on the ballot, what is known as a “target area” inside an oval next to a voter‘s choice as shown below:
When a ballot is fed into an ImageCast tabulator – at the precinct level or centrally – a complete duplex image is created and then analyzed for tabulation by evaluating the pixel count of a voter mark. The pixel count of each mark is compared with two thresholds (which can be defined through the Election Management System) to determine what constitutes a vote. If a mark falls above the upper threshold, it‘s a valid vote. If a mark falls below the lower threshold, it will not be counted as a vote.
(Ex. M to Decl. of Harri Hursti, Doc. 809-3 at 48.) However, if a mark falls between the two thresholds, in what is known as the “ambiguous zone,” it will be deemed as a “marginal mark”83 and the ballot should be flagged for review by a vote review panel — either manually or using Dominion‘s vote adjudication software application. (Id.)
The default scanner threshold settings in Democracy Suite 5.5A for both the ICP and ICC are 12% for the low-end and 35% for the high-end. (Defs.’ Hrg. Ex. 4 at 1, Doc. 887-4 at 2.) Dominion‘s “Democracy Suite 5.5A is not designed to register voter intent from a hand-marked ballot if the vote target area (oval to the left of the choice) is not marked in some manner” and does not meet or exceed the
high-end threshold setting. (Id.) A visual representation of the threshold interpretation of voter marks is shown below:
For all elections conducted on the new Dominion voting system to date, including the June 2020 primary and August 2020 runoff elections, the ICP and ICC scanners were set to the default threshold settings. Using these default settings, when a ballot is scanned by either the ICP or ICC scanners, the scanners are programmed to interpret voter marks as follows: (a) any mark deemed by the scanner to be less than 12% darkened within the vote target areas (i.e., ovals) is designated as a blank vote for the given contest; (b) any mark deemed by the scanner to be equal to or greater than 35% darkened within the target ovals is designated as a vote for the choice associated to the target area marked; and (c) any mark deemed by the scanner to be equal to 12% or less than 35% darkened within the vote target ovals is designated as an ambiguous mark. (Defs.’ Hrg. Ex. 4 at 1, Doc. 887-4 at 2.) Any ambiguous mark within a vote target oval does not count toward the vote total. (Id.) Instead, “[i]t is anticipated that ballots isolated by the ICP or ICC scanners containing scanner-deemed ambiguous marks are adjudicated manually or electronically by the designated election official in order to determine the voter intent that is in question by the ICP or ICC scanners.” (Id.)
According to the Coalition Plaintiffs’ expert Harri Hursti, Dominion‘s precinct and central count scanners cannot be relied upon to accurately count all votes using the default threshold settings and the current configuration for image resolution. (Tr. Vol. I at 125.) In addition to the use of arbitrary default threshold settings, Hursti criticizes Dominion‘s configuration of the ICC central count scanner to intentionally downgrade the resolution quality of the scanned image. Hursti testified that the ICC central count scanner “can be configured to capture higher quality and more information retaining images” and is capable of producing images of a significant higher order of magnitude than it currently produces based on Dominion‘s programming. (Id. at 126, 133-34.) As Hursti explained, “the way the scanner is used in this environment is like driving your sports car locked on the first gear.” (Id. at 134.) The central count scanner is recording a lower quality image than it is capable of because “as part of the configuration, that scanner is instructed to produce low quality images with a reduced amount of
During the September 10, 2020 injunction hearing, Mr. Hursti explained that he would have expected the ICC scanner to have counted the clear voter marks shown in the ballot images of the Fulton County August 11 election interpreted by the ICC as “blank” contests. (Tr. Vol. I at 136.) The problem according to Hursti is that “the scanner is reducing all information to either black or white and that predetermination tells what the image is recording. And after that, a mathematical algorithm is applied which is only blindly counting how many black and white pixels it sees and based on that make[s] a determination if there is a vote or not. So based on that reduced information, the system didn‘t cross the threshold to see [those markings] as a vote or even as ambiguous mark[s].” (Id. at 137.) An ambiguous mark means “that the system sees something, which it says that it is not clear whether it is a mark or not. And that would have then gone to the human [ballot review] process.” (Id. at 138.) But in the case of the Fulton County ballot images in Plaintiffs’ Hearing Exhibit 7, “the system didn‘t even see that there would be a mark requiring a human observation.” (Id.)
The Coalition Plaintiffs conducted an examination of test ballots scanned on the ICP precinct scanner/tabulator using test ballots with various types of markings and different colors of pens. (See Pls.’ Hrg. Ex. 7.1, Doc. 888-6.) Plaintiffs’ Hearing Exhibit 7.1 illustrates two images of the same ballot produced by two different image resolutions and qualities and the scanner‘s resulting interpretation of the voter markings from the lower quality scan.84 According to Mr. Hursti, the visible differences in the two images are “hallmarks of bad quality scanning and bad quality technology.” (Tr. Vol. I at 139.) The poor quality of the ballot image scanned on the ICP does not even show the ovals that would be filled in by the voter. (Id.) Mr. Hursti believes that for the ICC scanner, the DPI level could be increased from the current 200 DPI configuration to 300 DPI, which is the standard setting for commercial off-the shelf scanners in order to improve the quality of the image of the ballots scanned for interpretation by the system software threshold settings.85
During the court-authorized testing of the Dominion equipment supplied by Fulton County, Coalition member Jeanne Dufort marked and scanned a series of test ballots to see how the marks were interpreted and tabulated by the scanner. To replicate the various ways voters might
Dr. Eric Coomer, the Director of Security for Dominion Voting Systems disagrees with Plaintiffs’ contention that the Dominion scanners either discard or disregard valid votes or do not count certain marks as a vote even though the marks are obvious to the human eye as indications of a vote. (Tr. Vol. II at 73, 77.) According to Dr. Coomer, the system is simply scanning the image and detecting the percentage fill of the target area. Based on the settings, it will automatically say whether it is a valid counted vote, whether it is an ambiguous mark, or whether the system does not characterize it as any. “There are further processes in the system, mainly adjudication, which allows secondary review -- voter review for voter intent issues, which is integral to the system, which is where you can apply voter intent guidelines and processes to essentially characterize a vote that the system is not automatically specifying as a vote.” (Id. at 73.)
During the hearing on September 11, 2020, Dr. Coomer was shown the Fulton County ballot images in Plaintiffs’ Hearing Exhibit 7. Although Dr. Coomer disagrees with the contention that the scanners do not count certain marks that are visible to the human eye as votes, he admits that the mark shown by candidate Theodore “Ted” Jackson‘s name on the first page of Plaintiffs’ Hearing Exhibit 7 looked like a vote to him but that according to the AuditMark created at the time of scanning, the ICC did not recognize the mark as a vote and did not count it as a vote. (Id. at 73-74.) Dr. Coomer also admitted that if a voter‘s mark is below the low-end threshold, it does not register as either an ambiguous mark or a vote. (Id. at 77.) According to Dr. Coomer‘s hearing testimony, the AuditMark created at the time of scanning, which contains the text indicating how the scanner interpreted the voter mark, does not indicate whether the ballot fell within the ambiguous threshold required for adjudication. (Id. at 75.) Therefore, one cannot tell from the AuditMark for the ballot image at page one of Plaintiffs’ Hearing Exhibit 7 whether the ballot was flagged for adjudication. (Id.) Dr. Coomer stated that the “AuditMark simply shows everything
Dr. Coomer also disagrees with Mr. Hursti, testifying that the accuracy of the ICP and ICC scanners “has absolutely nothing to do with the scanner resolution, the DPI setting.” (Id. at 72.) According to Dr. Coomer, because the “Dominion scanners capture the percentage fill of the targets for every mark that is made on the ballot, that has absolutely nothing to do with the scanner resolution, the DPI setting, whether a mark is characterized as a ballot vote, an ambiguous mark, or not a vote is wholly dependent on the threshold settings of the lower and upper threshold limits as well as the percentage fill of the target detected by the system.” (Id.) He went on to “categorically state that going from the current 200 DPI to some higher level of 300 DPI does not improve the accuracy of the system.” (Tr. Vol. II at 147.) Referring back to the ballot images in Plaintiffs’ Hearing Ex. 7, Dr. Coomer explained that “just to put it simply, we have all seen the images. And the images clearly show the voter‘s mark . . . if you had a physical ballot and you had some mark on there and then you showed the [scanned ballot] image and that mark wasn‘t there, then we could talk about DPI. But the fact is we‘re looking at the image. The mark is there” so the issue is “not the fact that the image is not, you know, sufficiently fine enough resolution to capture that.” (Id. 147-48.) But, the ballot images in Plaintiffs’ Ex. 7.1 show the exact scenario Dr. Coomer admits might indicate a problem with low DPI resolution. In these side-by-side images of the same ballot, the first image scanned at high resolution shows clearly the voter marks while the second image scanned on the ImageCast shows several of the voter marks having been erased by the system and some portions of the ballot printing totally distorted due to the poor image quality.
Dr. Coomer also attempted to explain why Jeanne Dufort experienced inconsistent results when she scanned the same ballot through the ICP scanner multiple times. According to Dr. Coomer, “the scanners have what is called a CIS array. It is contact image sensor array. That is what is used to actually digitize the image of the ballot. And those inherently, like all electronic systems, have some variability, plus or minus ten percent. So on one scan you could certainly have a target area that registers 12.5 percent and you round that up to 13. And on the next scan it could be 11.9 percent. There is inherent variability in all electronic systems . . . that is irrespective of the resolution setting that‘s on the system. (Tr. Vol. II at 148-149.)
The Coalition Plaintiffs presented testimony from individuals who either served on or observed vote review panels. According to Coalition member Jeanne Dufort, who testified at the September 10 hearing and serves on the adjudication panel in Morgan County, the vote review panel “makes up for the limits of technology. We take ballots that can‘t be scanned or ballots that have marks that the scanner can‘t interpret, and we put human eyes on them. So I like to think of us as backstop to make sure that every vote . . . where voter intent is clear gets counted.” (Tr. Vol. I at 171.) Under the new system, counties have the option to use the Dominion adjudication software to review scanned ballot images cued up on a computer screen. (Id.)
Adam Shirley served on the Clarke County Vote Review Panel for the June 9, 2020 Presidential Preference Primary and General Primary. (Decl. of Adam Shirley, Doc. 809-7.) Out of approximately 15,000 scanned absentee ballots, about 350 were flagged for adjudication by the software. When adjudicating a ballot, a scanned image of the complete ballot was displayed on the screen. The software indicated the flagged contests for human review by outlining them in red. The software used highlighting to indicate how it had interpreted the voter‘s mark. This highlighting was used for the entire ballot, not only the contests that were flagged for adjudication. Green highlighting indicated the software recognized the mark as a vote and counted it unless it was also flagged as an overvote. Yellow highlighting indicated the software categorized the mark as ambiguous and would not be counted until there was a vote review panel adjudication. When at least one oval in a contest was darkened sufficiently to be categorized as “ambiguous,” the software highlighted the ambiguous option(s) in yellow, outlined the contest in red, and sent the entire ballot to an adjudication queue. Below is an example illustrative of the adjudication screen:
(Exhibit 2 to Shirley Decl., Doc. 809-7 at 12.)
The most common reason for ballots to be flagged as ambiguous was the voter
In the course of reviewing the entire ballot to inform their adjudication of flagged contests, the panel discovered clear ballot markings made by the voter that had not been highlighted by the software for adjudication. These markings were not counted as a vote (and therefore were not highlighted in green by the software) nor were they categorized as ambiguous (and therefore were not highlighted in yellow by the software). Below is the scanned image on one such marked ballot.
(Ex. 3 to Shirley Decl., Doc. 809-7 at 13.) The top and middle contests bear the red box flagging them for adjudication and yellow highlighting showing marks the software has classified as ambiguous. The bottom contest, though clearly marked by the voter, bears no red box or highlighting of any kind. This shows the software did not count that vote and was programmed not to send such a ballot to adjudication. The system seemed to simply ignore such votes.
In every instance the panel encountered where the system had not counted such votes (or flagged them for adjudication), the review panel agreed without question
The vote review panel expressed these concerns to elections staff, Election Director Charlotte Sosebee, and the Board of Elections. In response to these concerns, the Board of Elections ordered a pre-certification partial recount of only the absentee ballots for 5 of Clarke County‘s 24 precincts. The partial recount took place on June 17. The Election Board was not authorized by statute or rule to conduct a recount using any method other than what had been used for the first count. In the recount, 2,665 absentee ballots were re-scanned and 76 ballots were flagged for adjudication. For those 76 ballots, the vote review panel unanimously agreed that 35 individual votes had not been counted by the software. Those votes were spread across 12 separate ballots. A Dominion technician confirmed the software was programmed to classify votes in one of three ways: a normal vote (highlighted in green), an ambiguous mark (highlighted in yellow), and an uncounted vote (which the system recognized, quantified, but was programmed not to count and not to be flagged for review).
As a voter, Shirley finds such a high rate of missed votes -- nearly 16% of the adjudicated ballots -- to be alarming. He also found concerning the procedures followed by the review panel in not providing a paper audit trail, not verifying the record of changes made to vote tallies, and not referencing the original ballot to determine if the low quality image was an accurate depiction of the voter-marked ballot. Shirley also found troubling that there was no attempt to reconcile the votes added to the vote tally before and after the adjudication process, leaving the opportunity for unauthorized changes to the tallies by others with access to the system.
Jeanne Dufort, served on the Vote Review Panel for the Morgan County Board of Elections and Registration for the combined Presidential Preference and General Primaries in June 2020. (Decl. of Jeanne Dufort, Doc. 809-6.) When she arrived at 8pm on June 9 for her duties, the elections office was still in the process of opening absentee ballots. Dufort assisted the team in opening the remainder of approximately 3,000 mail ballots. Ballots were scanned from 10pm to 2am. Dufort noticed voters marking their choices in a number of ways, including filling in the oval, circling the oval, making X or check marks, and one who made smiley faces in the oval to mark their selection.
The Vote Review Panel convened on the afternoon of June 10. Morgan County used the adjudication software provided by Dominion. The Election Supervisor Jennifer Doran instructed the Dominion technician to pull up all ballots with overvote and ambiguous marks. There were about 150 out of 3,000 ballots to review. The Morgan County review panel used the same procedure described by Adam Shirley.
The first time the panel encountered a contest with no highlights (meaning it was deemed blank by the software), but with a clearly marked vote, Dufort asked the on-site Dominion technician whether that vote was counted, and he said “of course, that‘s a vote,” and assured the panel it was counted. The panel moved on to the next ballot. This time Dufort asked the Dominion
Dufort attended the Morgan County Election Board meeting on June 11, and spoke about her concerns as a review panel member and the need to expand the adjudication process to determine whether other votes had been rejected by the system. The Morgan County Election Board denied the motions of board member Helen Butler to expand the adjudication process to review the remaining 2,700 mail ballots to see if there were additional uncounted votes.
Coalition member Rhonda Martin observed somewhat similar adjudication procedures at the Fulton County Elections Preparation Center on August 14, 2020. (Decl. of Rhonda J. Martin, Doc. 809-4.) The adjudication process took place entirely on a low resolution black and white on-screen image, without looking at the original paper ballot. Based on her observation of the two vote review panels used by the Fulton County elections office, the panel members quickly clicked here and there and switched from one view to another as they examined the ballot images, without making a record of who approved each vote change or why the decision was made. Martin also observed that at times, the panel members appeared to almost forget to confer with one another and confirm that they agreed on the interpretation of the vote because they were so focused on operating the adjudication software.
Of the ten ballots Martin observed being adjudicated, three appeared to be completely blank with no votes marked anywhere on the ballot. The first review panel to encounter a blank ballot with no single vote shown paused to ask the Registrations Chief, Ralph Jones, what to do. After waiting for a while for Mr. Jones to finish up with the second review panel, the first review panel decided to accept the blank ballot so they could continue adjudicating other ballots. They did not request to see the original paper ballot to confirm that it was, in fact, blank. While not impossible, Martin found it odd that a voter would go to the trouble of returning a ballot with no vote marks at all.
3. The Secretary of State‘s Center for Election Systems Study on Scanner Settings
When Plaintiffs filed their motion in August 2020, the State Election Board was considering proposed revisions to the regulation providing for “the definition of a vote” to designate specific settings for the ballot scanners used to tabulate optical scan ballots marked by hand. Plaintiffs’ expert Harri Hursti asserted that before the State sets threshold standards for the Dominion system, extensive testing is needed to establish optimal configuration and to identify a setting that will not have the widespread effect of discarding at least some valid votes. (See Hursti Decl. ¶ 77, Doc. 809-3.) At that time, neither Mr. Hursti nor the Plaintiffs were aware of a study undertaken by the Center for Election Systems of the Secretary of State‘s Office in July of 2020 to determine “how various reductions to the default, ambiguous mark threshold setting within Democracy Suite 5.5A would impact the scanning and interpretation of ambiguously marked ballot samples” on the ICC central count
As further explained in the draft report, CES undertook an examination to determine whether “the high-end setting of 35% is forcing election officials to review ballots that should instead be processed as marked by the ICC scanner on the initial read by the IC scanner” and counted as a valid vote. (Defs.’ Ex. 4 at 2, Doc. 887-4 at 3.) Because “Democracy Suite 5.5A gives the end user the ability to adjust ambiguous mark threshold settings used by the Dominion scanners to interpret voter intent on hand-marked optical scan ballots,” CES ran ballot test decks through the ICC scanner using various threshold settings. (Defs.’ Ex. 4 at 1, Doc. 887-4 at 2.)
At the start of the examination, a “test deck of 100 hand-marked optical scan ballots was prepared. The instructions at the top of the ballot instruct the voter to fill in the oval next to the candidate of their choice. The filling in of the oval (vote target area) is designed to provide a clear intent for the ICC scanner to interpret.” (Defs.’ Ex. 4 at 2, Doc. 887-4 at 3.) To examine the various ways the scanner might interpret different marks, the testers did not fill in the vote target areas as instructed. Instead, “testers placed a variety of marks that only darkened a portion of the vote target areas” on the deck of test ballots. “Testers also used differing marking devices (i.e., blue ink, black ink, red ink, pencil, etc.) and marking pressures.” On some ballots, testers marked outside the vote target area (by circling or underlining the candidate name rather than filling in the oval) “to confirm that marks [placed] outside the vote areas would not be recognized” by the scanner. (Id.)
Each test ballot had three contests with a total of 6 vote target areas (two ovals per contest). “Testers used the same type of variable mark within each of three contests when marking a ballot in an attempt to simulate how an individual voter would most likely mark each oval on their ballot in the same manner throughout.” (Id.) As described in the CES draft report, the scanner will interpret a marked ballot in one of three ways: (1) Marked -- the scanner will “interpret the mark within all vote target areas on the ballot and increment vote totals and ballots cast total forward” (the mark falls above the high-end threshold and is counted as a vote); (2) Blank -- the scanner “will interpret the vote area as not including a mark and would not increment vote total forward, but would increment the ballots cast forward” (the mark falls below the low-end threshold and is not counted as a vote in the vote totals); and (3) Ambiguous -- the scanner will “not be able to determine marks and set the ballot aside for review” (the mark falls below the high-end threshold to count as a vote but above the low-end threshold to register as a blank). (Id.)
After marking the test ballots, the test deck was scanned a total of two times on an ICC scanner configured with the default low-end 12% and the high-end 35% settings. This process created two batches collected by the ICC scanner, each batch containing 100 ballots. Each batch was then loaded into Dominion‘s Adjudication Client application. The Adjudication Client application was set to review all ballots within the batch and isolate any ballots containing Ambiguous Marks, Blank Ballots, and Overvotes (the standard Adjudication Client settings). The testers created
Upon completing the review of each scanned batch within the Adjudication Client software, the testers documented the following results:
- Marked 53
- 1/3 Ambiguous 15
- 2/3 Ambiguous 11
- Ambiguous 12
- Blank 9
- Overvote 0
(Defs.’ Ex. 4 at 3, Doc. 887-4 at 4.) A total of 47 ballots required some level of review after being processed by the ICC. The testers were concerned that nearly half of the test deck required additional review to determine voter intent.
In an effort to assess what impact a reduction in the high-end setting level would have on potential ambiguous marked ballots being registered on the ICC, testers reduced the default high-end setting 3 times: from 35% to 30%, from 30% to 25%, and finally from 25% to 20%. (Defs.’ Ex. 4 at 3-5, Doc. 887-4 at 4-6.) In the third test pass, the testers ran the test deck through the scanner following the same protocol but the ICC scanner was configured with the low-end default setting of 12% but the high-end setting was reduced from 35% to 20%. (Defs.’ Ex. 4, Doc. 887-4 at 5.) Using a high-end setting of 20%, testers documented the following results for each batch within the Adjudication Client software:
- Marked 70
- 1/3 Ambiguous 10
- 2/3 Ambiguous 8
- Ambiguous 1
- Blank 10
- Overvote 1
(Defs.’ Ex. 4 at 4-5, Doc. 887-4 at 5-6.) With a low-end 12% and high-end 20% setting, there was a 36% reduction in the number of ballots (47 to 30) after scanning needing further review, in relation to the original default setting. (Defs.’ Ex. 4 at 5, Doc. 887-4 at 6.) The adjustment of the high-end setting down to 20% also resulted in 17 more ballots being processed as marked (an increase of 53 to 70) and voter intent being registered and tabulated without need of further review or adjudication. The reduction to 20% also resulted in a potential overvote being detected in the test deck that had previously been undetected using the higher high-end settings. This reduction in the high-end setting from 35% to 20% also decreased the number of ballots with all three contests registering ambiguous marks from 12 ballots down to 1 ballot. The reduction did not eliminate the presence of ambiguous marks, but it does appear to reduce the number of instances where the review of all contests on a ballot would be needed. (Id.)
In an effort to reveal if there were any additional ambiguous marks that could be detected and made available for review to users, the testers reduced the low-end threshold setting from 12% to 10% (keeping the high-end at the adjusted 20% threshold). (Id.) The testers ran the test
- Marked 71
- 1/3 Ambiguous 13
- 2/3 Ambiguous 6
- Ambiguous 2
- Blank 7
- Overvote 1
(Id.) With the low-end 10% and high-end 20% settings, there was a 38% reduction in the number of ballots (47 to 29) after scanning needing further review, in relation to the original default setting. This configuration reduced the number of instances of ambiguous (12 to 2) and blank ballots (9 to 7) from the original default settings. Under these settings, 29 ballots remained as needing some physical review. (Defs. Ex. 4 at 6, Doc. 887-4 at 7.) Of those 29, 7 ballots were seen by the ICC as completely blank. Upon physical review of the 7 ballots, 5 ballots contained no physical mark anywhere within the vote target oval, but did have the candidate name circled or underlined. The remaining 2 ballots seen as blank by the ICC, upon visual review, did have discernable marks within the vote target area, however, the mark was made with red ink. While it did not remove the detection of ambiguous marks or blank ballots, it does appear the combination of these settings eliminated the need to review some ballots and reduced the number of contests per ballot needing review when a ballot review was detected. (Defs. Ex. 4 at 5, Doc. 887-4 at 6.)
During the assessment, the testers made note of whether the type and placement of marks in and around the vote target oval had an impact on the scanner‘s interpretation. (Defs. Ex. 4 at 6, Doc. 887-4 at 7.) In addition to partial filling in of the vote target oval, the ICC scanner registered various types of marks, including an X, checkmark, dash, and dots, when they were placed within the vote target oval. The darker the mark within the vote target area, the easier the ICC registered the mark. These findings indicate that instructions to voters should inform the voter to fill in the oval next to the candidate name and to avoid circling, underlining, or placing checkmarks or Xs, or otherwise marking the candidate name outside the vote target oval. Voters should also be warned to NOT use red ink.
4. Georgia‘s Election Code and Regulations Pertaining to Optical Scan Ballots
Based on the results of the CES study in July 2020, the State Election Board proposed a rule adopting the adjusted threshold settings that was. The regulation, approved by the Board on September 10, 2020 now provides:
Ballot scanners that are used to tabulate optical scan ballots marked by hand shall be set so that:
- Detection of 20% or more fill-in of the target area surrounded by the oval shall be considered a vote for the selection;
- Detection of less than 10% fill-in of the target area surrounded by the oval shall not be considered a vote for that selection;
- Detection of at least 10% but less than 20% fill-in of the target area surrounded by the oval shall flag the ballot for adjudication by a vote review panel as set forth in
O.C.G.A. 21-2-483(g) . In reviewing any ballot flagged for adjudication, the votes shall be counted if, in the opinion of the vote review panel, thevoter has clearly and without question indicated the candidate or candidates and answers to questions for which such voter desires to vote.
The State Election Board‘s regulation providing for the definition of a vote, states that for optical scan paper ballots, the voter must “fill in the oval” to mark their vote choice.
Similarly, “[i]f, in reviewing an optical scan ballot marked by hand, a discrepancy is found between the voter‘s mark on the ballot that clearly and without question indicated the voter‘s intent and the result tabulated by the ballot scanner, the voter‘s mark shall control and be counted.”
5. Plaintiffs’ Proposed Remedy
Coalition Plaintiffs seek from this Court “[a]n order commanding the State Defendants to standardize required settings of Dominion precinct and central ballot scanners and related tabulation software to ensure that all perceptible votes written on mailed and hand marked paper ballots are either counted as votes or flagged for human review by a Vote Review Panel, and requiring that Dominion scanner sensitivity settings and tabulation software be uniform across all counties.” (Mot., Doc. 809 at 2). According to their motion, the full problem with the ballot scanners will not be solved by the State‘s new rule, but it can be solved by restraining the State from requiring scanner settings that automatically discard any degree of perceptible voter markings. In response, the State Defendants
For the reasons that follow, the court will not grant the requested relief for the November general election based on pragmatic timing considerations where absentee voting has already begun and alteration of the scanner settings would require changes to the election system database and would result in disruption of the ongoing administration of the election by the State and the Counties. Instead, the Court has directed the State to itself explore and determine whether a solution exists for the discounting of votes resulting from system deficiencies in the tabulator/scanning and the potential implementation of remedial measures in time for any runoffs in January 2021.
There is no question that the default scanner settings used in elections conducted to date on the Dominion system caused certain voter marks to register as blank and therefore prevented some valid votes on hand-marked ballots from being counted. (See ballot images at Doc. 809-5.) The testimony of the vote review panelists clearly establish the differences between the scanner‘s perception and human perception of voter intent. In addition, the ballots provided in the record show that different results were reached by the scanners and the vote review panel members about whether voter markings counted. Dr. Coomer acknowledged that the scanners will not count marks that fall below the low-end threshold setting. It is also evident that the State‘s adjustment of the Dominion default settings (used to date) pursuant to the SEB‘s newly promulgated regulation will not cause the scanner software to capture all perceptible ballot vote markings and count them as votes in the upcoming November election. (See Defs.’ Ex. 4 at 6, Doc. 887-4 at 7) (noting that even after the adjustment, 7 out of 100 test ballots were seen by the ICC as completely blank though voter markings could be discerned upon physical human review).
The scanners are programmed to flag overvotes87 for review and adjudication. They are not, however, programmed to flag undervotes (i.e., blank contests) for review. As evidenced by the Fulton County ballots shown in Plaintiffs’ Exhibit 7, the result is that some votes are not recorded by the scanners and are not counted. Under the current procedures used with the Dominion system, these votes escape any review before being rejected – resulting in irreversible voter disenfranchisement.88 It appears that prior to the use of the Dominion system and introduction of the adjudication software, no voter‘s ballot choices were getting kicked out based on their visible designations of candidate choices with an X or check mark, as these markings are recognized under Georgia‘s Election Code as clear manifestations of voter intent. These circumstances are quite troubling and present an opportunity to potentially disenfranchise older voters in particular – based on their historical experience voting under the State‘s prior systems – at a greater percentage than younger voters.
To decide whether Plaintiffs have established a substantial likelihood of prevailing
Here the asserted injury is that Plaintiffs and other absentee mail voters face a risk of suffering a diminished ability to participate fully in the democratic process and to elect the candidates of their choosing if the scanners do not recognize their ballot markings as valid votes. To echo the late Congressman John Lewis, “The vote is precious. It is the most powerful non-violent tool we have in a democratic society, and we must use it.” As this Court has repeatedly recognized in this case, “[t]he right to vote freely for the candidate of one‘s choice is of the essence of a democratic society, and any restrictions on that right strike at the heart of representative government.” Reynolds, 377 U.S. 533, 555 (1964). This right carries with it the right not only to cast a ballot but to have it counted. United States v. Classic, 313 U.S. 299, 315 (1941); Democratic Exec. Comm. of Florida v. Lee, 915 F.3d at 1315 (“of course, voting alone is not enough to keep democracy‘s heart beating. Legitimately cast votes must then be counted“). The loss of a vote cast is permanent.89 The significance of the indelible nature of the injury cannot be overstated.
It is precisely because of the character and magnitude of the interest at stake that voters themselves have an independent responsibility to proceed with care and caution when exercising the franchise. Georgia has implemented a voting system that relies on the efficiencies afforded by technology. The State Election Board has adopted a regulation for processing and tabulating hand marked ballots using optical scanners that requires the voter to “fill in the oval” to mark their vote choice.
The Court must weigh the burden on the right to vote against “the precise interests put forward by the State as justifications for the burden imposed by its rule,’ taking into consideration the ‘extent to which those interests make it necessary to burden the plaintiff‘s rights.” Burdick, 504 U.S. at 434 (quoting Anderson, 460 U.S. at 789); see also People First of Alabama v. Sec‘y of State for Alabama, 2020 WL 3478093, at *6 (11th Cir. June 25, 2020) (Rosenbaum, J. & Pryor, J., concurring) (“But whatever the burden, no matter how slight, ‘it must be justified by relevant and legitimate state interests sufficiently weighty to justify the limitation.‘“) (internal citations omitted).
State Defendants assert that any burden on the right to vote created by the 10% threshold for discarding voter marks is justified by the regulatory interests of the State as outlined by the Secretary of State‘s Director of Elections, Chris Harvey. Mr. Harvey attested that “[r]equiring a manual review of every stray mark that happens to be in a target area would require significant time by county officials and would result in delays of finalizing results, certifying results, and conducting audits.” (Decl. of Chris Harvey, Doc. 834-3 ¶ 9.) According to Harvey, “[u]sing a 10% threshold for scanners minimizes the burden on election officials while still ensuring that ambiguous marks are properly evaluated.” (Id. ¶ 10.)
The Court understands that the State does not want to make the standard so low that it sweeps in thousands of ballots with actual blank contests and some truly errant marks for adjudication panel review because it might lead to an unreasonably inefficient process and become potentially unmanageable in the timeframe permitted under Georgia law for finalizing the results of the election. However, there is no evidence in the record of any burden on the Counties were the Court to grant some form of relief to address the ballot scanner settings. No evidence has been presented from any county election official to support Mr. Harvey‘s supposition that changes to the scanner, tabulation, and adjudication software to ensure that all perceptible votes written on mailed and hand marked paper ballots are either counted as votes or flagged for human review by a Vote Review Panel would create an undue administrative burden on county officials and would “result in delays of finalizing results, certifying results, and conducting audits.” And notably, Fulton County‘s response to Plaintiffs’ motion is silent on the issue of the ballot scanner settings.
Each county election superintendent must certify the county‘s consolidated election results not later than 5:00 P.M. on the second Friday following the date of the election (i.e., Friday, November 13, 2020) and immediately transmit the certified returns to the Secretary of State, “provided, however, that such certification date may be extended by the Secretary of State in his or her discretion if necessary to complete
Under these provisions, the counties have ten days to tabulate and certify their results to the Secretary of State,91 who in turn has an additional seven days to certify the election after a thorough review of the returns. The State Defendants’ fear of an unsupported and unquantified “delay” in certification caused by review of additional ballots by a Vote Review Panel is outweighed by the burden on voters. See Common Cause Georgia v. Kemp, 347 F. Supp. 3d 1270 (N.D. Ga. 2018) (rejecting the State‘s argument that remedy requiring measures to ensure proper counting of provisional ballots would delay certification of election under statutory timeline for certification); Doe v. Walker, 746 F. Supp. 2d 667, 678–80 (D.Md. 2010) (finding that Maryland‘s statutory deadline for the receipt of absentee ballots imposed a severe burden on the absent uniformed services and overseas voters that was not justified by the state‘s interest in certifying election results).
The Court finds that Plaintiffs have satisfied the first two prerequisites for preliminary injunctive relief. Plaintiffs have presented enough evidence to establish a substantial likelihood of success on the merits of their claim that the State Defendants’ use of an arbitrary threshold on its ballot scanners to discard voter ballot markings for specific candidates or initiatives that are obvious to the human eye results in a violation of the fundamental right of each voter to have his or her vote accurately recorded and counted. See Wash. State Grange v. Wash. State Republican Party, 552 U.S. 442, 451 (2008) (holding that state and local laws that unconstitutionally burden the right to vote are impermissible); Democratic Exec. Comm. of Florida v. Lee, 915 F.3d at 1321 (characterizing disenfranchisement by signature mismatch rules as imposing a serious burden on the right to vote); League of Women Voters of N.C. v. North Carolina, 769 F.3d 224, 244 (4th Cir. 2014) (“[E]ven one disenfranchised voter—let alone several thousand—is too many.“) The threat of this injury is substantial and irreparable if relief is not granted before the election. See Elrod v. Burns, 427 U.S. 347, 373 (1976) (plurality opinion) (The “loss of First Amendment freedoms, for even minimal periods of time, unquestionably constitutes irreparable injury.“); Martin v. Kemp, 341 F. Supp. 3d 1326, 1340 (N.D. Ga. 2018) (“The Court finds that [p]laintiffs have established irreparable injury
The Court must now consider the requested relief in connection with the two remaining requirements for granting a preliminary injunction: whether the threatened injury to the Plaintiffs outweighs the harm an injunction may cause the Defendants and whether granting the injunction is in the public interest. The Court considers these last two factors “in tandem . . . as the real question posed in this context is how injunctive relief at this eleventh-hour would impact the public interest in an orderly and fair election, with the fullest voter participation possible. . . .” Curling v. Kemp, 334 F. Supp. 3d 1303, 1326 (N.D. Ga. 2018), aff‘d in part, appeal dismissed in part, 761 F. App‘x 927 (11th Cir. 2019); see also Purcell v. Gonzalez, 549 U.S. 1, 4 (2006)). Indeed, the Supreme Court has recognized that there are special considerations involved with impending elections and the critical issues at stake. In Reynolds v. Sims, the Court stated:
[O]nce a State‘s [election-related] scheme has been found to be unconstitutional, it would be the unusual case in which a court would be justified in not taking appropriate action to insure that no further elections are conducted under the invalid plan. However, under certain circumstances, such as where an impending election is imminent and a State‘s election machinery is already in progress, equitable considerations might justify a court in withholding the granting of immediately effective relief in a legislative apportionment case, even though the existing apportionment scheme was found invalid. In awarding or withholding immediate relief, a court is entitled to and should consider the proximity of a forthcoming election and the mechanics and complexities of state election laws, and should act and rely upon general equitable principles.
377 U.S. at 585. The Court notes, however, that Reynolds is not an inviolable commandment against pre-election injunctions where the constitutional violations are significant, and the relief is not adverse to the public interest.
Plaintiffs’ requested relief is based on proposed solutions of their cybersecurity and scanner expert, Harri Hursti.
First, in his August 24, 2020 declaration, Mr. Hursti called for extensive testing before choosing mandated threshold settings. The Secretary of State‘s Center for Election Systems conducted an assessment of various scanner settings before landing on the low-end 10% and high-end 20% threshold settings. But the CES did not test or assess thresholds lower than 10%. CES‘s assessment resulted in a significant increase in the number of marks recognized by the ICC as valid votes and a corresponding decrease in the number of marks characterized as blank votes as well as significant decrease in the number of marks flagged as ambiguous requiring further adjudication. Despite this notable improvement, this one adjustment alone does not address the outstanding injury experienced by a significant number of voters who cast hand marked ballots (and votes) that will continue to be excluded from “counting” although they manifest the voter‘s
Second, for the ICC central count scanner Mr. Hursti proposes that the current configuration be modified “to allow the scanner to capture the images with a higher resolution and higher amount of information, meaning either color or gray scale images” and to adjust the DPI from 200 to the “current minimum standard of office technology” of 300 DPI.92 (Vol. I at 143.) He recommends as a stop-gap measure and mitigation for the November 2020 election that the State undertake an examination of the necessary changes to ensure that every vote is counted. (Id. at 161-62.)
As previously discussed, Dr. Coomer testified, scanner threshold settings for the Dominion Democracy Suite 5.5-A are not set on each individual scanner. Instead, scanner threshold settings are set when the voting database is built. (Tr. Vol II at 83.) While Dr. Coomer acknowledged that the settings on the central count scanners could be changed before the project is
Accordingly, the Court must consider remedies that go beyond the 10 to 20 percent threshold standard recently adopted by the Secretary of State, while balancing the potential for administrative confusion and serious vote mishaps by any course of action that is not deliberate and properly researched. The Court is not prepared to direct the State to make additional adjustments to the settings prior to the November election because it is not feasible under the circumstances where the voting database has already been built, has been rolled out to the counties, and has already or soon will be undergoing logic and accuracy testing. There are additional challenges of implementing manageable relief where the evidence is not clear that the resolution can be fixed on the software in time or moreover, whether a software fix of ballot image resolution quality would be effective or not in increasing the number of ballot markings that will be automatically read and counted as votes by the scanner/tabulators.
The current adjustments of the default settings adopted by the State in time for the November election lowers the gateway and allows more paper ballots with voter marks such as Xs or checks (rather than oval fill-ins) to be counted or referred for adjudication of voter intent. This change in settings used in the 2019 pilots and the 2020 primary elections, while an incomplete remedy, should be an improved mechanism to address the issue of lost scanned hand marked ballot votes in the voting tabulation in the November election. Plaintiffs as well as the Defendants or County Boards of Election may of course revisit the question of additional relief related to the ballot scanners if there turns out to be more evidence after the election and if huge swaths of voters’ absentee, provisional, or emergency paper ballot votes did not count.93
That said, the evidence supports a finding that the modified scanner settings may well still result in the rejection of valid votes and ballots falling through the identified crack in the system by failing to flag visibly clear voter marks for adjudication by a review panel. Although the Court will not require further changes to the scanner settings prior to the November election, another potential measure may allow for an expanded review of optical scan hand-marked ballots in connection with the adjudication software. Ballot contests flagged for human review by the adjudication software appear on the review screen with a red box outline around the contest. The adjudication software assigns green highlighting to voter marks that meet the high-end threshold setting to count as a vote and assigns yellow highlighting to voter marks that fall between the high and low-end threshold settings and deemed by the scanner as ambiguous. Currently, the adjudication software does not assign any highlighting to voter marks that are deemed blank because they fall under the low-end threshold setting.94 Because the adjudication software is capable of isolating ballot marks flagged as ambiguous, it would
Accordingly, the Court GRANTS relief that is narrowly tailored to address the specific voter disenfranchisement by operation of the optical scanners/tabulators in tandem with the BMD adjudication software raised in Plaintiffs’ motion. The Court finds that injunctive relief is warranted but based on the testimony and evidence in the record, recognizes that there will not be an “instant fix” of this issue, though in any event, remedial measures should be in place by the next election cycle following the January 2021 election cycle, or if feasible, by the January 2021 runoff elections.
The Court has reviewed the Coalition Plaintiffs’ requested relief (Docs. 809, 817) and finds that the relief identified is at once broader than what is called for to address the specific injury identified97 and on the other hand, insufficiently precise. Accordingly, the Court DIRECTS Plaintiffs to submit a proposed injunctive relief order that delineates the specific measures or course of action they are seeking that the Court adopt to address this vote counting issue by October 26, 2020. In that connection the Court recognizes the State Election Board and Secretary‘s staff and/or Plaintiffs may likely need to conduct a further review with Dominion and other potential experts of some additional
In a rational world, the parties’ representatives would sit down and discuss these matters together to discuss alternative remedial courses of action and further review. The Court would be more than willing to facilitate this by modifying timelines. In any event, the expanded method(s) to address the scanner/tabulator and adjudication software‘s per se “blank” exclusion of marks that may reasonably be considered by an adjudication panel as indicating voter intent must be in place no later than the next election cycle following the conclusion of the January 2021 runoffs. The Court will enter a further relief order upon receipt of Plaintiffs’ proposed remedy by October 26, 2020 and Defendants’ response within 14 days of receipt of the Plaintiffs’ proposal.
IV. Conclusion
The Constitution‘s preamble speaks first of “We, the People,” and then of their elected representatives. The judiciary is third in line and it is placed apart from the political fray so that its members can judge fairly, impartially, in accordance with the law, and without fear about the animosity of any pressure group.
In Alexander Hamilton‘s words, the mission of judges is “to secure a steady, upright, and impartial administration of the laws.” I would add that the judge should carry out that function without fanfare, but with due care. She should decide the case before her without reaching out to cover cases not yet seen. She should be ever mindful, as Judge and then Justice Benjamin Nathan Cardozo said, “Justice is not to be taken by storm. She is to be wooed by slow advances.”98
Plaintiffs’ challenge to the State of Georgia‘s new ballot marking device QR barcode-based computer voting system and its scanner and associated software presents serious system security vulnerability and operational issues that may place Plaintiffs and other voters at risk of deprivation of their fundamental right to cast an effective vote that is accurately counted. While these risks might appear theoretical to some, Plaintiffs have shown how voting equipment and voter registration database problems during the 2019 pilot elections and again in the June and August 2020 primary elections caused severe breakdowns at the polls, severely burdening voters’ exercise of the franchise. (See September 28, 2020 Order, Doc. 918.)
Established Supreme Court authority recognizes that States retain the authority and power to regulate their elections and the voting process itself, subject to the preservation of citizens’ fundamental First and Fourteenth Amendment rights. And the Supreme Court has repeatedly emphasized in the last months the principle that
Thus, although Plaintiffs have put on a strong case indicating they may prevail on the merits at some future juncture, the Court must exercise real caution in considering the grant of their request for extraordinary injunctive relief, given its obligation to follow governing Supreme Court and Eleventh Circuit authority. Despite the profound issues raised by the Plaintiffs, the Court cannot jump off the legal edge and potentially trigger major disruption in the legally established state primary process governing the conduct of elections based on a preliminary evidentiary record. The capacity of county election systems and poll workers, much less the Secretary of State‘s Office, to turn on a dime and switch to a full-scale hand-marked paper ballot system is contradicted by the entire messy electoral record of the past years. Implementation of such a sudden systemic change under these circumstances cannot but cause voter confusion and some real measure of electoral disruption. As with any systemic change, implementation of a statewide hand-marked paper ballot system as the State‘s primary electoral system would require long term planning and advanced poll worker training. Accordingly, based on the binding appellate legal authority, the State‘s strong legal interest in ensuring an orderly and manageable administration of the current election, and the Court‘s assessment of the operational realities before it, the Court must deny the Plaintiffs’ Motions for Preliminary Injunctive Relief in so far as they request immediate replacement of the current BMD system with a statewide hand-marked paper ballot system.99
But the Court cannot part with that message alone. The Court‘s Order has delved deep into the true risks posed by the new BMD voting system as well as its manner of implementation. These risks are neither hypothetical nor remote under the current circumstances. The insularity of the Defendants’ and Dominion‘s stance here in evaluation and management of the security and vulnerability of the BMD system does not benefit the public or citizens’ confident exercise of the franchise. The stealth vote alteration or operational interference risks posed by malware that can be effectively invisible to detection, whether intentionally seeded or not, are high once implanted, if equipment and software systems are not properly protected, implemented, and audited. The modality of the BMD systems’ capacity to deprive voters
The Plaintiffs’ national cybersecurity experts convincingly present evidence that this is not a question of “might this actually ever happen?” – but “when it will happen,” especially if further protective measures are not taken. Given the masking nature of malware and the current systems described here, if the State and Dominion simply stand by and say, “we have never seen it,” the future does not bode well.
Still, this is year one for Georgia in implementation of this new BMD system as the first state in the nation to embrace statewide implementation of this QR barcode-based BMD system for its entire population. Electoral dysfunction – cyber or otherwise – should not be desired as a mode of proof. It may well land unfortunately on the State‘s doorstep. The Court certainly hopes not.
The Court recognizes the major challenges facing the Secretary of State‘s Office in rapidly implementing a new statewide voting system. Yet the vital issues identified in this case will not disappear or be appropriately addressed without focused State attention, resources, ongoing serious evaluation by independent cybersecurity experts, and open-mindedness. The Secretary of State and Dominion are obviously not without resources to tackle these issues. And at very least, the Court cannot fathom why, post-election, the State and Dominion would not at least be moving toward consideration of the software upgrade option Dominion originally promised, allowing voters to cast ballots that are solely counted based on their voting designations and not on an unencrypted, humanly unverifiable QR code that can be subject to external manipulation and does not allow proper voter verification and ballot vote auditing.
Time will tell whether Act V here can be still avoided or at least re-written.
For the foregoing reasons, the Court DENIES the Curling Plaintiffs’ Motion for Preliminary Injunction [Doc. 785] and DENIES IN PART AND GRANTS IN PART the Coalition Plaintiffs’ Motion for Preliminary Injunction on BMDs, Scanners, and Tabulators, and Audits [Doc. 809].
IT IS SO ORDERED this 11th day of October, 2020.
Honorable Amy Totenberg
United States District Judge
Notes
An evidence-based election would produce not only a reported (or initial) election outcome, but also evidence that the reported outcome is correct. This evidence may be examined in a “recount” or in a “post-election audit” to provide assurance that the reported outcome indeed is the result of a correct tabulation of cast ballots.
Voter-verifiable paper ballots provide a simple form of such evidence provided that many voters have verified their ballots. The ability of each voter to verify that a paper ballot correctly records his or her choices, before the ballot is cast, means that the collection of cast paper ballots forms a body of evidence that is not subject to manipulation by faulty hardware or software. These cast paper ballots may be recounted after the election or may be selectively examined by hand in a post-election audit. Such an evidence trail is generally preferred over electronic evidence like electronic cast-vote records or ballot images. Electronic evidence can be altered by compromised or faulty hardware or software.
(NAS Report at 96.) As Dr. Stark has attested, the BMDs are not software independent and therefore cannot establish high confidence in the accuracy of the results “even if the equipment that produced the original tallies is faulty.”RLAs can establish high confidence in the accuracy of election results—even if the equipment that produced the original tallies is faulty. This confidence depends on two conditions: (1) that election administrators follow appropriate procedures to maintain the chain-of-custody and secure physical ballots—from the time ballots are received, either in-person or by mail, until auditing is complete; and (2) that the personnel conducting the audit are following appropriate auditing procedures and the equipment and software used to audit the election are independent of the equipment and software used to produce the initial tallies. In the latter case, this not only requires that the software be independent of the software used to tally votes, but also that the software‘s specifications/algorithms, inputs, and outputs are transparent to permit members of the public to reproduce the software‘s operation.