Curling v. Raffensperger

• Decision Date: 21 May 2019
• Docket Number: CIVIL ACTION NO. 1:17-CV-2989-AT
• Parties: Donna CURLING, et al., Plaintiffs, v. Brad RAFFENSPERGER, et al., Defendants.
• Court: U.S. District Court — Northern District of Georgia

403 F.Supp.3d 1311

Donna CURLING, et al., Plaintiffs,
v.
Brad RAFFENSPERGER, et al., Defendants.

CIVIL ACTION NO. 1:17-CV-2989-AT

United States District Court, N.D. Georgia, Atlanta Division.

Signed May 21, 2019

403 F.Supp.3d 1317

Catherine L. Chapple, David D. Cross, Jane P. Bentrott, John P. Carlin, Marcie Brimer, Robert W. Manoso, Cameron A. Tepfer, Morrison & Foerster, LLP-DC, David R. Brody, Ezra David Rosenberg, Jacob Paul Conarck, John Michael Powers, Lawyers' Committee for Civil Rights Under Law, Washington, DC, Robert Alexander McGuire, III, Robert McGuire Law Firm, Seattle, WA, Adam Martin Sparks, Halsey G. Knapp, Jr., Krevolin & Horst, LLC, Bruce P. Brown, Bruce P. Brown Law, Cary Ichter, Ichter Davis, LLC, Atlanta, GA, William Brent Ney, Ney Hoffecker Peacock & Hayle, LLC, Lawrenceville, GA, for Plaintiffs.

Alexander Fraser Denton, Brian Edward Lake, Kimberly K. Anderson, Joshua Barrett Belinfante, Carey Allen Miller, Vincent Robert Russo, Jr., Robbins Ross Alloy Belinfante Littlefield LLC, Bryan P. Tyson, Bryan Francis Jacoutot, Frank B. Strickland, Taylor English Duma LLP, Cheryl Ringer, Kaye Woodard Burwell, Office of Fulton County Attorney, Fulton County Government Center, David R. Lowman, Fulton County Attorney's Office, Grant Edward Schnell, Robert S. Highsmith, Holland & Knight LLP-Atl, Cristina Correia, Attorney General's Office-Atl Department of Law, Josiah Benjamin Heidt, Georgia Department of Law Office of the Attorney General, Anne Ware Lewis, Strickland Brockington Lewis, LLP, Barclay Hendrix, Krevolin & Horst, LLC, Atlanta, GA, John Frank Salter, Jr., Roy E. Barnes, The Barnes Law Group, LLC, Daniel Walter White, Haynie Litchfield Crane & White, Marietta, GA, for Defendants.

ORDER

Amy Totenberg, United States District Judge

403 F.Supp.3d 1318

This case challenges the constitutionality of the State of Georgia's use of Direct Recording Electronic voting machines ("DREs") and associated software systems in today's era of heightened cybersecurity threats.

Approximately two weeks the November 2018 general election, the Court held a full day evidentiary hearing on Plaintiffs' Motion for Preliminary Injunction, and in so doing, considered Defendants' jurisdictional related defenses. Following the hearing, the Court entered an Order denying Defendants' Motions to Dismiss Plaintiffs' claims based on Eleventh Amendment immunity and for lack of standing. The Court also denied Plaintiffs' Motion for Preliminary Injunction seeking to require the State of Georgia to use paper ballots for the 2018 general election. Although the Court found (with a measure of caution) that Plaintiffs demonstrated a likelihood of success on the merits for at least some of their claims, the Court ultimately determined that the Plaintiffs' eleventh-hour request for an immediate rollout of paper ballots statewide would adversely impact the public interest in an orderly and fair election, with the fullest voter participation possible under the circumstances precluded.

On an expedited appeal, the Eleventh Circuit denied and dismissed the State Defendants' appeal of the Court's jurisdictional rulings. Currently before the Court are the remaining arguments in Defendants' motions to dismiss [Docs. 82, 83, 234] which the Court reserved for ruling pending review of the threshold jurisdictional issues of standing and Eleventh Amendment immunity in the context of expeditiously addressing Plaintiffs' preliminary injunction motions. (See Order at Doc. 309.) As the Court stated in its September 17, 2018 Order, Defendants' Motions to Dismiss also raised other non-jurisdictional arguments that Plaintiffs have failed to state viable claims for relief and that their claims are barred by res judicata and collateral estoppel.

I. Background

Although the issues now before the Court are narrower than those addressed in the September 17, 2018 Order, in the interest of judicial efficiency the Court incorporates its lengthy factual background discussion of Plaintiffs' allegations and the evidence provided in support of their injunction request in connection with the

403 F.Supp.3d 1319

November 2018 general election.¹

In their complaints, their motions for preliminary injunction, and their presentations during the September 12th hearing, Plaintiffs² paint an unsettling picture of the vulnerabilities of Georgia's voting system along with the recent, increased, and real threats of malicious intrusion and manipulation of the system and voter data by nation states and cyber savvy individuals.

Plaintiffs start by describing Georgia's voting system. The system relies on the use of Direct Recording Electronic voting machines ("DREs") for electors to cast their votes in public elections. This computer voting equipment is used in tandem with the State's Global Election Management Systems ("GEMS") server and County GEMS servers that communicate voting data.³ DRE touchscreen computer voting machines are located at polling stations in every precinct during elections and are otherwise stored in various county facilities throughout the state. Electors use DRE machines if they are voting early and in-person with absentee ballots or if they are voting in-person on election day. "The voting machines are computers with reprogrammable software." (Halderman Affidavit, Doc. 260-2 ¶ 16.) The DRE machines record votes electronically on a removable memory card, and each card is later fed into the county GEMS server to tabulate the vote totals by candidate and the results of other ballot questions. When the polls have closed, poll workers prompt the DRE machines to internally tally the electronic total number of votes and print a paper tape of the vote totals per machine.

Most significantly, the DREs do not create a paper trail or any other means by which to independently verify or audit the recording of each elector's vote. i.e., the actual ballot selections made by the elector for either the elector's review or for audit purposes. Plaintiffs allege that Georgia's voting machines are susceptible to the introduction of undetectable malware designed to alter votes. At the September 2018 hearing, Dr. Alex Halderman, a Professor of Computer Science and Engineering and Director of the Center for Computer Security and Society at the University of Michigan in Ann Arbor, discussed and demonstrated how a malware virus can be introduced into the DRE machine by insertion of an infected memory card (or by other sources) and alter the votes cast without detection.⁴ Dr. Halderman gave a live demonstration in Court with a Diebold DRE using the same type of equipment and software as that used in Georgia. The demonstration showed that although the same total number of votes

403 F.Supp.3d 1320

were cast, the contaminated memory card's malware changed the actual votes cast between candidates. There was no means of detection of this as the "malware modified all of the vote records, audit logs, and protective counters stored by the machine, so that even careful forensic examination of the files would find nothing amiss." (Halderman Affidavit, Doc. 260-2 ¶ 19.) The DRE machine's paper tape simply confirmed the same total number of votes, including the results of the manipulated or altered votes. Viruses and malware have also been developed by cyber specialists that can spread the "vote stealing malware automatically and silently from machine to machine during normal pre- and post-election activities," as the cards are used to interface with the County and State GEMS servers. (Id. ¶ 20.)

As detailed in Plaintiffs' complaints, other cybersecurity elections experts have shared in Professor Halderman's observations of the data manipulation and detection concealment capacity of such malware or viruses, as well as the ability to access the voting system via a variety of entry points. Plaintiffs filed affidavits in the record for several of these experts.⁵ Professor Wenke Lee (Professor of Computer Science at Georgia Tech and a member of a new election study Commission convened by the Secretary of State) also prepared a PowerPoint presentation summary on the topic for the Commission that identified this malware detection and manipulation capacity. (Pl. Ex 5, Preliminary Injunction Hearing.) According to Plaintiffs' allegations and supporting evidence, national-and state-commissioned research-based studies by cybersecurity computer scientists and elections experts consistently indicate that an independent record of an elector's physical ballot is essential as a reliable audit confirmation tool.

The DREs record individual ballot data in the order in which they are cast, and they assign a unique serial number and timestamp to each ballot. This design for recording ballots, according to Plaintiffs, makes it possible to match the ballots to the electors who cast them. Additionally, the Georgia DREs use versions of Windows and BallotStation (developed in 2005) software, both of which are out of date – to the point that the makers of the software no longer support these versions or provide security patches for them. (Halderman Affidavit, Doc. 260-2 ¶¶ 24-28.) The DRE machines and related election software are all the product of Premier Election...