Investigation Shows Governor's Claims That Democrats Tried To Hack The Georgia Election Were Bullshit

from the another-unforced-error-by-Brian-Kemp dept

Georgia Governor Brian Kemp is very involved with the electorate. Well, perhaps not that involved with the residents of the state, but he does seem to keep a very close -- and very partisan -- eye on election security. Election security is important, especially as more states move to electronic ballots, but Kemp has spent most of the last four years using election security as a political football to score points with.

When President Obama was still leading the nation, Kemp (while still Georgia's Secretary of State) claimed the DHS had breached his office's firewall during its security testing -- something he had directly asked it not to do. Kemp claimed his state had already implemented the DHS's recommendations and had asked to be left out of this nationwide testing. The DHS apparently ignored that, resulting in Kemp making lots of noise about an overreaching federal agency.

Kemp's tune changed once Trump was elected. While running for the job of governor against Democrat Stacey Abrams, Kemp -- a Republican -- generated a lot of bad press for himself by allegedly engaging in voter suppression efforts. He capped this off with a bad judgment two-fer.

First, he insisted the Democratic Party was trying to hack the voter registration system. The only evidence Kemp had for this is that a hacking attempt had been made. He responded to this by opening an investigation into the Democratic Party based on apparently nothing more than his animosity towards it. This was capped off a few days later when Kemp released a ton of absentee voting info, including names, addresses, and the reason they voted absentee.

Two years later, ProPublica -- using documents obtained from the Georgia Bureau of Investigation (GBI) -- has published the investigation's findings. No surprise, GBI's conclusions don't agree with Kemp's baseless and partisan assertions.

“The investigation by the GBI revealed no evidence of damage to (the secretary of state’s office’s) network or computers, and no evidence of theft, damage, or loss of data,” according to a March 2 memo from a senior assistant attorney general recommending that the case be closed.

Unlike Kemp's 2016 assertion about DHS meddling (which was later shown to be routine checks of the state's firearm database by law enforcement) where it wasn't asked to, the alleged "failed hacking attempt" seen by Brian Kemp's office was actually the DHS doing something the state had asked it to do.

The internet activity that Kemp’s staff described as hacking attempts was actually scans by the U.S. Department of Homeland Security that the secretary of state’s office had agreed to, according to the GBI. Kemp’s chief information officer signed off on the DHS scans three months beforehand.

Kemp continues to be wrong about election security -- something that only seems to concern him when it can be leveraged to (incorrectly in every case) target political opponents. The state's election system still has security issues. The article points out the site where voters can check their information still contains a "significant vulnerability" that Kemp has been notified of, but refused to acknowledge.

All the bluster worked, though. Kemp was elected governor in 2018 and now has an even bigger platform to be wrong about election security issues. And he -- and his former office -- were completely wrong about this one. The other alleged hacking his office thought it was witnessing -- other than the DHS's pentest traffic -- was nothing more than someone doing what anyone could do: altering site URLs to view other voters' data.

That's not hacking. That's what anyone who knows how websites work can do at any time with zero skill or additional tools. And from that, an entire conspiracy theory was erected by Kemp's office, resulting in thousands of tax dollars being wasted to pursue Kemp's politically motivated accusations. There's some hackery going on here, but it's only of the partisan variety.

Filed Under: brian kemp, dhs, e-voting, georgia, hacking, politics, voting machines, voting security

Don't Panic, But Do Reflect: Lessons From The Iowa Democrat Debacle

from the don't-throw-in-the-towel dept

As I write this post, party officials in Iowa are still trying to figure out the results of last night's Democratic Caucus, while pundits and political opponents have wasted no time in tearing into the Democratic Party, technology, and the very idea of democracy itself. Although there is plenty of reason for criticism, much of what there has been overwrought. Professor Ed Felten's twitter thread here provides plenty of useful perspective on this:

Nevertheless, there are many lessons to draw from last night's Iowa caucus mess, but first and foremost is this one: don't panic.

The biggest reason not to panic is that only the technology supporting the tabulation of the results broke. Whereas the systems for recording the results appear to be working just fine: there was paper, instruments for marking the paper, and (eventually) a way to transmit the recorded results to a place where they could all be added together. Sure, it will take a bit longer to add up all the results for the night, but that's ok. Because there's a paper trail we can still know what they are.

That said, there are still some cautionary lessons we as Americans can learn from the experience, not just for primaries and caucuses but for every election for every office, no matter how partisan, run in America.

First, of all the things elections need to be optimized for, speed is not one of them. And should not be one of them. The most important thing elections need is accuracy. While, sure, it would certainly be nice to have accurate results also quickly (and perhaps caucus officials thought the perceived convenience of the app would help towards that end), adding to the list of things it might be nice for election results to be tends to take away from what election results MUST be. And it is not worth the compromise. Which we can understand if we take a moment to think about the consequences if something does go wrong, as something almost always will. The reality is that if election results are delayed, we can still cope. As it is, in general elections results are often not certified until weeks or even months later. There is rarely a legitimate governance need requiring us to know electoral outcomes within hours of polls closing. We can wait a while, and it would probably behoove us to all expect to wait a while, because it's our hunger for instant gratification that is creating pressure to rely on tabulation systems that are not optimized for what we can't live without: accurate results we can all believe in. Ultimately nothing else matters, and we should be dubious about any voting solution that offers to deliver anything other than that.

Next is a lesson that applies to more than just elections, which is that just adding tech does not magically make everything better. Often, and as this situation illustrates, it can instead make things worse. Which is not to say that there is no room for technological innovation at all. The world would not be a better place if it were artificially locked into a 20th, or even 19th, century technological environment. Certainly there is a role for technology to play, and for technology innovation. However, not all new technology is necessarily an improvement over what came before. Sometimes what we already had was perfectly fine, or at least good enough for what we needed. And even if a new innovation might someday be better, it won't necessarily be right away. In the case of the Iowa caucus, it appears they replaced the traditional tried-and-true telephonic support for reporting results with a brand new cell phone driven app, and it is not apparent why. True, sometimes older systems can have their own quirks and imperfections and things we might want to be better, and it's not a bad thing to want to improve them. But where systems have at least been proven and reliable, any innovation needs to at least be able to deliver that same degree of trustworthiness before it can be considered a replacement, much less an improvement. No technology is magic; no innovation will suddenly solve all of our problems. Even the technology that is now regarded as proven and reliable was once new and untested itself. It takes a lot of time and a lot of work to get a technology to a point where we can depend on it for our most important functions, like elections. Expecting any new technology to immediately be able to be an adequate substitute for what came before, let alone an improvement, is therefore a mistake.

Next, paper matters. Again, the most important thing we need any electoral system to deliver is accuracy. Having a paper record helps deliver it. First, it affords redundancy. Even if our digital systems were perfect and bug-free, it would still be a good idea to have a back-up analog record. But especially while our digital technology is still evolving so rapidly and is still so decidedly NOT bug-free, it is critical to have a way to validate the results it gives us. Even when we think technology is working properly we still need to be able to audit it to make sure it is, and paper lets us do that. And then in those instances, like this one, when the technology has come up short, as it is still very much prone to do, paper means that we can still get what we need: accurate results of how people voted.

There is also one more critical lesson for now, and it's one mentioned above: something will always go wrong, and so, by anticipating that something will go wrong, we can make it ok when it does. The more complex the system, the more likely something will go wrong. But on the other hand, a system complex enough to have problems is also complex enough to contain solutions.

Elections are complex systems, so there are plenty of opportunities for hiccups. Which is not to say that we want hiccups; naturally we should try to minimize them. The issue though is that no matter how much you try to eliminate them, hiccups will still happen, so what we need to do is be ready. And that means at least two things: one, that we design our systems to have the resiliency needed to overcome those hiccups. For instance, in the case of Iowa, the results could not be transmitted to a central accounting system via the app, and that was a problem. But because there was a paper record they will be able to overcome the problem.

And it means something else, which goes back to the first point made in this post: don't panic. Don't rush to throw away faith in our electoral systems when things go wrong, because it is almost a near certainty that something will go wrong. But just because something has gone wrong does not mean it's the end of the world. Yet if, instead of allowing our systems to self-correct, we instead jump immediately to panic, we create a new problem. The reason we need accurate election results is because we need to be able to believe in them. It won't matter how accurate they are though if we simply refuse to.

When things go wrong, as they are wont to, we need to take a deep breath and give them a chance to right themselves, which is what will happen in Iowa since they have paper records. Furthermore, as the saying goes, never attribute to malfeasance what can be more readily explained by incompetence. What happened in Iowa was the result of a poor deployment of a technological solution. It was not a conspiracy. It was not the Russians. It was plain old human error to have so heavily depended on this untested mobile app system. And the good news is that we can deal with these sorts of bad decisions. Sure, there are plenty of things we can and should do to minimize these sorts of problems and improve our electoral systems, like better fund and train local election authorities, end reliance on unproven new technologies for supporting elections, ensure we always have paper records, reinforce the franchise, and so on. But there's no point in attacking our own democracy with distrust. Especially when it is so likely so misplaced.

Filed Under: apps, caucuses, data, election security, elections, iowa, voting, voting security

John Oliver Takes On Fucked Up Voting Machines In The Way Only He Can

from the nicely-done dept

At Techdirt, we've been writing about the problems of electronic voting for just about our entire existence. I believe the first time we wrote about the problematic nature of electronic voting was in June of the year 2000, a few months before the controversy over "hanging chads" in the 2000 election in Florida. Over the years, we've continued to write about electronic voting and its myriad problems dozens upon dozens of times -- and to this day I remain amazed at how little companies and election officials have taken this space seriously. Part of the issue is that there is no easy solution. There isn't a "good" solution, there are only options that are "less bad" than others. The problem is that many places use solutions that are obviously bad when there are at least better options on the table.

So it's great to see John Oliver step in and explain the problems with voting machines in a way that only he can:

If you've followed this space for some time (as, apparently, we have), you won't find much that's surprising in the piece, but it does such a good job of highlighting just how ridiculous the discussion currently is around voting machines, and how little politicians and voting machine companies seem inclined to do anything about it all.

Filed Under: e-voting, electronic voting, john oliver, voting machines, voting security