Lawmakers mull cybersecurity concerns as they prepare for overhaul of Georgia’s voting system

Georgia seems poised to switch to a hand-marked paper ballot system for the 2028 election, but researchers and cybersecurity experts say there is a lot more to consider to ensure that voting stays secure and free from undue influence.

Election security concerns have long been at the forefront of the conversation around election equipment. Georgia’s current voting machines, which use a QR code to tally votes, have repeatedly faced criticism from advocates of hand-marked paper ballots, who say that ballots should be counted based on text that can be deciphered by humans. 

State lawmakers have passed legislation to phase out the use of QR codes on ballots, but are still developing the guidelines that state lawmakers will use when selecting their next statewide voting system.

Sen. Max Burns, a Sylvania Republican who is co-chairing a special committee tasked with helping select Georgia’s next statewide election system, said he is hoping to land on a system that is as secure as possible, while maintaining the convenience that he said Georgia voters have come to expect.

“100% [security] is a goal,” he said. “We have to get as close to that as we can, and then we have to build other processes and mitigation opportunities around it to ensure that we address any potential challenges that we find.”

At a Thursday meeting at the state Capitol in Atlanta, cybersecurity experts and researchers gathered to share their insights with members of the legislative panel. Here are some of the election security issues state lawmakers will have to consider.

Equipment maintenance

Georgia’s current ballot-marking devices were purchased under a 10-year contract, and used statewide in Georgia for the first time in 2020. More than half a decade later the machines are still in use, but experts say the lack of software upgrades has left vulnerabilities in the system. 

Lawmakers weigh seismic changes to Georgia’s voting equipment

Whichever system the state turns to next, state leaders say, will likely be in use for at least the next decade. However, Geoff Hale, a fellow at the nonpartisan Washington-based Center for Democracy and Technology, said technology and cybersecurity risks often evolve much more quickly, meaning that Georgia’s voting equipment will likely need to be updated several times over the course of its lifespan.

“Georgia is not purchasing something that will remain permanently secure,” Hale said. “Election security is a process and not a purchase.”

In addition to picking equipment that meets Georgia’s current specifications, Michael Barnes, the deputy director of information technology for voting systems for the secretary of state’s office, said lawmakers should ensure that the vendor they select has a plan to continue providing support, technology updates and spare parts for however long the state plans to keep using the system.

“What is the vendor providing, and what is their plan for providing that, not only for the initial deployment, but for five, 10, 15 years down the road?” he said.

Voter secrecy

The question of how to ensure that a voter’s selections remain private is another issue lawmakers will have to juggle. 

Georgia’s constitution mandates that voters’ ballots be kept secret. However, rapid developments in artificial intelligence and other technology can make that harder to guarantee, especially in smaller counties. Last month, a Princeton University researcher claimed that he was able to use AI to tie thousands of voters in Heard and Cherokee counties to specific ballots with relative certainty by putting publicly available data through an AI tool.

The intersection of privacy and accessibility is another challenge. Precincts are required to keep at least one voting machine on hand for voters with disabilities according to federal law. But in jurisdictions where most voters mark ballots by hand, it may be fairly easy to determine how voters who used accessibility software voted.

Mark Lindeman, Philadelphia-based Verified Voting’s policy and strategy director, said that while he supported minimizing the role of ballot-marking devices in Georgia’s elections, there shouldn’t be restrictions on who gets to use the machines.

He noted that many voters who don’t consider themselves disabled may benefit from using a machine-marked system. A larger pool of people casting ballots marked by voting machines will also give voters with disabilities an increased level of anonymity when casting their ballot.

“It doesn’t have to be hundreds in a polling place, but to protect voter privacy and dignity, it shouldn’t be just a handful,” he said.

Foreign interference

Federal cuts to election security systems and a recent spike in cyberattacks may also fuel the risk of foreign interference in the midterm elections. Already this year, several Georgia counties have been hit by cyber attacks targeting their water systems. States like Minnesota, Michigan and Wisconsin have also faced similar attacks, according to the FBI. The Cybersecurity and Infrastructure Security Agency put out an advisory in April warning that such attacks may be linked to Iran.

Expert says Georgia water system attack highlights critical security deficiencies

But experts say it’s impossible to implement a system that completely eliminates the risk of bad actors interfering with elections. According to Michael Specter, an assistant professor and cybersecurity researcher at Georgia Tech, the most secure systems assume that a breach will happen at some point and develop transparent protocols to disclose and adapt to such instances.

“A system is only secure if the adversary knows how the system works and it is still secure,” he said.

Switching to hand-marked ballots may lessen the risk of certain security breaches, but experts emphasized that no technology is impervious to manipulation.

“Ballot on demand [printing] does not remove software from the election entirely,” said Hale, the Center for Democracy and Technology fellow. “Instead, it changes where software sits in the process.”

Paulding County Elections Director Deirdre Holden said that she worries about bad actors trying to access voter data, but added that in her experience, state officials had been quick to respond in instances where counties had faced cyberattacks.

“We have a very, very robust state system that takes care of us that knows when things like that are going on and they alert us very quickly,” she said.