ATLANTA — Georgia’s voting system continues to be scrutinized by some lawmakers and voters following the highly contentious 2020 general election where the system was first put to use in mass.

Republicans especially have heightened their criticism of the state’s use of the Dominion Voting System, particularly after a report from University of Michigan Prof. J. Alex Halderman showed the potential of the system’s vulnerabilities to being hacked.

Halderman is also the director of U-M’s Center for Computer Security & Society and his report on the Georgia voting system indicated potential attacks that could alter the QR codes on printed ballots without the knowledge of voters, use malicious hardware on voting machines, or remotely install vote-stealing malware on ballot marking devices.

At the very least, most critics are pushing Georgia Secretary of State Brad Raffensperger to expedite DVS’s latest system upgrade, Democracy Suite 5.17, ahead of the 2024 elections, which they say could help mitigate some of the vulnerabilities noted in the report.

However, Raffensperger said time constraints won’t allow the upgrades to be implemented in time.

In a statewide call with elections officials in May, Raffensperger’s office announced that the state would begin piloting the new Election Assistance Commission-certified upgrade they say is equipped with improvements in usability, functionality, technology and security.

The program is currently being piloted in five counties’ municipal elections: Appling, Heard, Lee, Rabun and Rockdale.

“Because our system is not connected to the internet, we can’t just push a button and send an update out,” explained Charlene McGowan, legal counsel for the Georgia SOS office, at a Nov. 1 Senate Ethics Committee meeting. “We have to physically touch every single piece of election equipment. We have approximately 40,000 pieces of equipment that we must go in and physically touch and install 5.17 on each piece of equipment.”

Acceptance testing then has to be conducted on all equipment. Implementing the new software for the 2024 elections would be a “rushed process” she said.

“There’s a process that we have to follow that we are working through that is required by law and we feel it is the responsible and reasonable course of action,” McGowan added. “There is always a risk involved with every new change to your election system, especially a major change. We don’t need to introduce more risk when we want our local election workers to succeed and we want our elections to continue to succeed.”

Committee member Sen. Greg Dolezal, R-Alpharetta, spewed several critical questions to SOS representatives and Robert Giles, vice president of Certification and Compliance for DVS. Dolezal appeared to blame Giles for the delay in implementing the 5.17 upgrade in Georgia.

Initially, the update was not compatible with polling pads used in Georgia. The new software was certified for Georgia equipment in March.

“We’re your largest customer and we use the KNOWiNK poll pads and everybody knows that we use the KNOWiNK poll pads,” Dolezal said to Giles. “You submitted a version of software to federal testing that didn’t work with our poll pads. and that, to me, basically means that there’s no internal testing happening at all as it relates to your largest customer. That set us back months.”

Giles said moving forward, compatibility discussions would happen much sooner. He also responded to Dolezal’s questioning regarding measures put in place to ensure security following Halderman’s report.

“We do our internal testing. and the way it’s going to work moving forward is when we make an application to the EAC prior to acceptance of the application, a (penetration) testing will be done,” Giles said. “And we’ve used labs to do internal testing as well prior to release. Penetration testing has been done and penetration testing will be done via the EAC moving forward.”

Giles ensured that despite the newly available upgrade, the 5.5A system that is still being used currently in Georgia is secure.

“We constantly upgrade our system and produce new products for our customers,” Giles said. “We then present those to the jurisdictions and then it becomes their decision if they want to update their system. 5.5A is secure and has been thoroughly tested.”

Bob Evans, director of elections for the SOS also said the 5.5A system undergoes vigorous logic and accuracy testing and risk-limiting audits.

A bill passed by the Georgia legislature this year increases the number of risk-limiting audits required for the state to perform; the audits will now be conducted after the presidential preference primary, general primary, and the general election at a minimum, Evans said.

“It’s completely done by hand,” Evans said, “County election officials will pull randomly selected batches, they will manually tally those batches, then at the end of it, will post the machine count from those batches along with the hand count from those batches.”

Skepticism surrounds use of QR codes on ballots

Much of the concerns of those who spoke during the ethics committee’s meeting was the use of QR codes that are scanned to cast a voter’s ballot.

To vote in person, voters are given their voter card by a poll worker after checking in at the polling place. The card is inserted into a machine and the voter’s ballot is displayed on the screen. After a voter completes their ballot on the screen, their paper ballot is printed that includes a QR code and a summary of the voter’s selections.

The voter must then scan their paper ballot into a machine that scans the QR code to submit their ballot.

Mike Vallante of American First Policy Institute was among many speakers to the committee who urged the use of hand-marked paper ballots after expressing uncertainty about using the QR vote tabulation system. He noted that Georgia is the only state that uses solely ballot marking devices as the only way to vote in person.

“Even though a voter may walk away with a ballot or a piece of paper that says how they voted, it is possible that the QR code that is sent in that actually does the counting may not necessarily reflect that paper ballot,” Vallante said. “Unless you can definitively say that there is no way that that can happen, then the QR code is a question mark.”

Evans said the purpose of the QR code was designed in mind to help voters with disabilities be able to verify their ballots.

“So if I’m a voter, I’ve got a ballot, I can put it under this machine and it can look at the text on the ballot and read back to me what I have selected to confirm,” Evans said.

Evans said the 5.17 upgrade has the option to remove the QR code from ballots, but it would require counties to bring in new printers and hardware to be able to support a lengthier ballot, which is a costlier option.

When questioned whether the QR code could be manipulated, Evans responded: “Our system mitigates any concerns that somebody in a lab environment might be able to manipulate it.”

Senate Ethics Committee Chair Max Burns, R-Sylvania, recommended SOS officials to put visible security marks on all ballots (including absentee); incrementally implement the 5.17 upgrade system over the upcoming months; and find an alternative to scanning ballots without using QR codes.