Georgia

receives a

Georgia D
Footnotes show that much of the information for the evaluation was
prepared by Chris Harvey at SOS office.

Although Georgia adheres to a number of minimum cybersecurity best practices

for voter registration systems, its practice of voting using machines that do not
provide a paper record and its failure to mandate post-election audits do not
provide confirmation that ballots are cast as the voter intends and counted as cast.
The state did earn points for prohibiting absentee voters from returning voted bal-
lots electronically, a practice that election security experts say is notoriously inse-
cure. In Georgia, all voted ballots are returned by mail or delivered in person. The The current system does NOT meet
EAC standards and SOS Kemp argues
state also exercises good practices by requiring that all voting machines be tested that the requirement applies only to
to EAC Voluntary Voting System Guidelines before being purchased or used in future systems that might be purchased.

the state and for its ballot accounting and reconciliation procedures. Additionally,
Georgia requires election officials to conduct pre-election logic and accuracy test-
ing on all machines that will be used in an upcoming election.

To improve its overall election security, Georgia should switch over to a paper-
based voting system and require mandatory post-election audits that test the
accuracy of election results after every election. Encouragingly, a new piece of
bipartisan legislation would require paper ballots and establish risk-limiting
audits. The state should also work alongside DHS for the purposes of identifying
and assessing vulnerabilities in its voter registration system. While recognizing the
importance of state autonomy when it comes to elections, federal agencies with
expertise in cybersecurity and access to classified information on contemporane-
ous cyberthreats have the personnel and resources necessary to thoroughly probe
and analyze complex election databases, machines, and cybervulnerabilities. By
combining their expertise on cyberthreats and their insight into the unique quali-
ties of localized election infrastructure, state and federal officials can better assess
and deter attempts at electoral disruption. These provisions, if implemented cor-
rectly, would significantly affect the security of Georgia’s elections.

Minimum cybersecurity standards for voter registration system: Fair

This ignores the massive security failure
• The state implemented a new voter registration system in 2013.417 that permitted 6.5 million voters' personal
• The state’s voter registration system provides access control to ensure that only information to be exposed completely
unsecured for many months on the KSU
authorized personnel have access to the database.418 system.

63  Center for American Progress  |  Election Security in All 50 States

 But they appear to have deleted the logs when
they destroyed the servers at KSU.
• The state’s voter registration system has logging capabilities to track modifica-
tions to the database.419
• The state’s voter registration system is protected by an intrusion detection sys- Is this true for just the "Official" database of
SOS or the one that has been controlled by
tem that monitors incoming and outgoing traffic for irregularities.420 KSU for use in the polling places?
• The state performs regular vulnerability assessments on its voter
registration system.421
• The state has not enlisted DHS to help assess and identify potential threats to its Georgia implemented a new voter
voter registration system.422 registration system in 2013.427
• The state provides cybersecurity training to election officials. 423
How could such horrendous security failures occur if there is training?

• Electronic poll books are used statewide in Georgia.424 The state conducts In addition to conducting its own
pre-election testing on electronic poll books prior to an election. Paper voter
425
vulnerability testing on its voter
registration lists are available at polling places that use electronic poll books on registration system, Georgia also
Election Day.426 contracts with third-party vendors
to conduct regular vulnerability
Voter-verified paper audit trail: Unsatisfactory assessments that include
• Elections are carried out using paperless DRE machines.429 penetration testing.428

Post-election audits: Unsatisfactory

• State law does not require post-election audits.

Ballot accounting and reconciliation: Fair

• All ballots are accounted for at the precinct level.432 Bipartisan legislation would require
• Precincts are required to compare and reconcile the number of ballots with the that paper ballots be used statewide
number of voters who signed in at the polling place.433 in Georgia and provide for post-
• Counties are required to compare and reconcile precinct totals with countywide election risk-limiting audits.430
results to ensure that they add up to the correct number.434
• There is no statutorily mandated review process to ensure that all voting “I think it is important that we
machine memory cards have been properly loaded onto the tally server at the have a paper ballot trail that
county level.435 However, the election management software that tabulates ensures that accuracy is there,
results provides a warning if all memory cards that were created for the election and that there are no games that
are not properly uploaded.436 That system failed in Fulton CD6 election. potentially could be played.”
• The state requires that all election results and reconciliation procedures be —Lt. Gov. Casey Cagle (R) 431
made public.437

Paper absentee ballots: Fair

• The state does not permit voters—including UOCAVA voters—to submit
completed ballots electronically. All ballots must be returned by mail or deliv-
ered in person.438

64  Center for American Progress  |  Election Security in All 50 States

Voting machine certification requirements: Fair
Current system is NOT certified by EAC
• Before they may be purchased and used in the state, all voting machines must be standards. SOS Kemp argues that EAC
certified by the Election Assistance Commission.439 certification only necessary for FUTURE
system purchases.
• Some jurisdictions in the state likely still use voting machines that were pur-
chased more than a decade ago.440 ALL use machines purchased
over a decade ago.

Pre-election logic and accuracy testing: Fair

• Election officials conduct mandatory logic and accuracy testing on all voting
machines prior to an election.441 Testing is ineffective and proves little.
• Testing is open to the public.442
• Testing occurs at least three days before an election.443

65  Center for American Progress  |  Election Security in All 50 States