Curling v. Kemp

• Court: U.S. District Court — Northern District of Georgia
• Writing for the Court: Amy Totenberg, United States District Judge
• Citation: Curling v. Kemp, 334 F.Supp.3d 1303 (N.D. Ga. 2018)
• Decision Date: 17 September 2018
• Docket Number: CIVIL ACTION NO. 1:17-CV-2989-AT
• Parties: Donna CURLING, et al., Plaintiffs, v. Brian KEMP, et al., Defendants.

334 F.Supp.3d 1303

Donna CURLING, et al., Plaintiffs,

v.Brian KEMP, et al., Defendants.

CIVIL ACTION NO. 1:17-CV-2989-AT

United States District Court, N.D. Georgia, Atlanta Division.

Signed September 17, 2018

Catherine L. Chapple, David D. Cross, Jane P. Bentrott, John P. Carlin, Robert W. Manoso, Morrison & Foerster, LLP, Edward Bruce Schwartz, Joe Robert Caldwell, Jr., Steptoe & Johnson, Washington, DC, Robert Alexander McGuire, III, Pro Hac Vice, Robert McGuire Law Firm, Seattle, WA, Aaron Wright, Bryan Myerson Ward, Marvin Lim, Holcombe and Ward, LLP, Adam Martin Sparks, Halsey G. Knapp, Jr., Krevolin & Horst, LLC, Bruce P. Brown, Bruce P. Brown Law, Cary Ichter, Ichter Davis, LLC, William Brent Ney, Ney Hoffecker Peacock & Hayle LLC, Atlanta, GA, for Plaintiffs.

John Frank Salter, Jr., Roy E. Barnes, The Barnes Law Group, LLC, Haynie Litchfield Crane & White, Marietta, GA, Cristina Correia, Elizabeth Ahern Monyak, Attorney General's Office-Atl Department of Law, Josiah Benjamin Heidt, Georgia Department of Law Office of the Attorney General, Cheryl Ringer, David R. Lowman, Kaye Woodard Burwell, Office of Fulton County Attorney, Grant Edward Schnell, Robert S. Highsmith, Holland & Knight LLP, Atlanta, GA, for Defendants.

ORDER

Amy Totenberg, United States District Judge

I. Introduction...1307

II. Background...1307

III. Threshold Jurisdictional Issues...1314

A. Standing...1314

B. Eleventh Amendment Immunity...1320

IV. Plaintiffs' Motions for Preliminary Injunction...1321

V. Conclusion...1327

I. Introduction

This case involves colliding election and voting rights dynamics and dilemmas. The State of Georgia Defendants have delayed in grappling with the heightened critical cybersecurity issues of our era posed for the State's dated, vulnerable voting system that provides no independent paper audit trail. The Plaintiffs did not bring their preliminary injunction motions in a sufficient time span to allow for thoughtful, though expedited, remedial relief, despite the important, substantive content of their evidentiary submissions in connection with their preliminary injunction motions. There are no easy answers to the conflicts posed here. In a democracy, citizens want to be assured of the integrity of the voting process, that their ballots are properly counted and not diluted by inaccurate or manipulated counting, and that the privacy of their votes and personal information required for voter registration is maintained. But citizens also depend on the orderly operation of the electoral and voting process. Last-minute, wholesale changes in the voting process operating in over 2,600 precincts, along with scheduled early voting arrangements, could predictably run the voting process and voter participation amuck. Transparency and accountability are, at the very least, essential to addressing the significant issues that underlie this case.

Currently before the Court in this matter are Defendants' motions to dismiss [Docs. 82, 83, 234] and Plaintiffs' more recently filed motions for preliminary injunction [Docs. 258, 260, 271]. Given the time sensitivity of Plaintiffs' motions with respect to the upcoming November 2018 elections, the Court held an extended full-day hearing on Plaintiffs' motions on September 12, 2018 as well as the threshold jurisdictional issues of standing and Eleventh Amendment immunity raised in Defendants' motions to dismiss.¹ The Court, out of an abundance of caution, addressed the issues of standing and Eleventh Amendment immunity first and determined whether it could properly exercise jurisdiction over this case before considering Plaintiffs' request for emergency injunctive relief. After hearing argument on these issues, the Court announced orally its determination that it could properly exercise jurisdiction for purposes of proceeding with the hearing on Plaintiffs' preliminary injunction motions. The Court further announced that a written order would follow setting forth more specifically the basis for this finding. Accordingly, this Order addresses issues of standing and Eleventh Amendment immunity as well as Plaintiffs' motions for preliminary injunction.

II. Background²

In their complaints, their motions for preliminary injunction, and their presentations during the September 12th hearing, Plaintiffs³ paint an unsettling picture of the vulnerabilities of Georgia's voting system along with the recent, increased, and real threats of malicious intrusion and manipulation of the system and voter data by nation states and cyber savvy individuals.

Plaintiffs start by describing Georgia's voting system. The system relies on the use of Direct Recording Electronic voting machines ("DREs") for electors to cast their votes in public elections. This computer voting equipment is used in tandem with the State's Global Election Management Systems ("GEMS") server and County GEMS servers that communicate voting data.⁴ DRE touchscreen computer voting machines are located at polling stations in every precinct during elections and are otherwise stored in various county facilities throughout the state. Electors use DRE machines if they are voting early and in-person with absentee ballots or if they are voting in-person on election day. "The voting machines are computers with reprogrammable software." (Halderman Affidavit, Doc. 260-2 ¶ 16.) The DRE machines record votes electronically on a removable memory card, and each card is later fed into the county GEMS server to tabulate the vote totals by candidate and the results of other ballot questions. When the polls have closed, poll workers prompt the DRE machines to internally tally the electronic total number of votes and print a paper tape of the vote totals per machine.

Most significantly, the DREs do not create a paper trail or any other means by which to independently verify or audit the recording of each elector's vote. i.e., the actual ballot selections made by the elector for either the elector's review or for audit purposes. Instead, at the hearing, Dr. Alex Halderman, a Professor of Computer Science and Engineering and Director of the Center for Computer Security and Society at the University of Michigan in Ann Arbor, discussed and demonstrated how a malware virus can be introduced into the DRE machine by insertion of an infected memory card (or by other sources) and alter the votes cast without detection.⁵ Dr. Halderman gave a live demonstration in Court with a Diebold DRE using the same type of equipment and software as that used in Georgia. The demonstration showed that although the same total number of votes were cast, the contaminated memory card's malware changed the actual votes cast between candidates. There was no means of detection of this as the "malware modified all of the vote records, audit logs, and protective counters stored by the machine, so that even careful forensic examination of the files would find nothing amiss." (Halderman Affidavit, Doc. 260-2 ¶ 19.) The DRE machine's paper tape simply confirmed the same total number of votes, including the results of the manipulated or altered votes. Viruses and malware have also been developed by cyber specialists that can spread the "vote stealing malware automatically and silently from machine to machine during normal pre-and post-election activities," as the cards are used to interface with the County and State GEMS servers. (Id. ¶ 20.)

Other cybersecurity elections experts have shared in Professor Halderman's observations of the data manipulation and detection concealment capacity of such malware or viruses, as well as the ability to access the voting system via a variety of entry points. Plaintiffs filed affidavits in the record for several of these experts.⁶ Professor Wenke Lee (Professor of Computer Science at Georgia Tech and a member of a new study commission convened by the Secretary of State) also prepared a PowerPoint presentation summary on the topic for the Commission that identified this malware detection and manipulation capacity. (Pl. Ex 5, Preliminary Injunction Hearing.) Professor Halderman's analysis of the severe limitations of the "logic and accuracy" and "parallel testing" auditing processes used by Georgia to test ballot counting are summarized in his affidavit and will be discussed later. (Doc. 260-2 at ¶¶ 37-48.) Suffice it to say, at this juncture, that national- and state-commissioned research-based studies by cybersecurity computer scientists and elections experts consistently indicate that an independent record of an elector's physical ballot is essential as a reliable audit confirmation tool.

The DREs record individual ballot data in the order in which they are cast, and they assign a unique serial number and timestamp to each ballot. This design for recording ballots, according to Plaintiffs, makes it possible to match the ballots to the electors who cast them. Additionally, the Georgia DREs use versions of Windows and BallotStation (developed in 2005) software, both of which are out of date – to the point that the makers of the software no longer support these versions or provide security patches for them. (Halderman Affidavit, Doc. 260-2 ¶¶ 24-28.) The DRE machines and related election software are all the product of Premier Election Solutions, formerly known as Diebold Election Systems. A large volume of the voting machines were purchased when the DRE initiative was first implemented in the 2002 to 2004 period in Georgia.

Statewide, Georgia uses its central GEMS server at the Secretary of State's offices to build the ballots for each election for each county.⁷ The central GEMS server communicates the election programming and other files onto the memory cards before an election. From 2002 to December 2017, the Secretary of State contracted with Kennesaw State University to maintain the central server for the State at a unit in the University called the Center for Election Services ("CES"). Plaintiffs allege that the central server was accessible via the internet for a...