Heindel v. Andino

• Decision Date: 08 February 2019
• Docket Number: Civil Action No.: 3:18-cv-01887-JMC
• Citation: 359 F.Supp.3d 341
• Parties: Frank HEINDEL and Phil Leventis, Plaintiffs, v. Marci ANDINO, Executive Director of the South Carolina State Election Commission, in Her Official Capacity; Billy Way, Jr., Chair of the South Carolina State Election Commission, in His Official Capacity; Mark A. Benson, Marilyn Bowers, and Nicole Spain Wright, Members of the South Carolina State Election Commission, in Their Official Capacity, Defendants.
• Court: U.S. District Court — District of South Carolina

359 F.Supp.3d 341

Frank HEINDEL and Phil Leventis, Plaintiffs,

v.Marci ANDINO, Executive Director of the South Carolina State Election Commission, in Her Official Capacity; Billy Way, Jr., Chair of the South Carolina State Election Commission, in His Official Capacity; Mark A. Benson, Marilyn Bowers, and Nicole Spain Wright, Members of the South Carolina State Election Commission, in Their Official Capacity, Defendants.

Civil Action No.: 3:18-cv-01887-JMC

United States District Court, D. South Carolina, Columbia Division.

Signed February 8, 2019

Marcus Angelo Manos, Victoria Lamonte Eslinger, Nexsen Pruet Jacobs and Pollard, Columbia, SC, Anne Harden Tindall, Pro Hac Vice, Jamila Goldkamp Benkato, Pro Hac Vice, Protect Democracy Project Inc, Washington, DC, David Frankel, Pro Hac Vice, Harry P. Morgenthau, Pro Hac Vice, Samantha V. Ettari, Pro Hac Vice, Kramer Levin Naftalis and Frankel LLP, New York, NY, Jessica Ann Marsden, Pro Hac Vice, Protect Democracy Project Inc, Carrboro, NC, Laurence Michael Schwartztol, Pro Hac Vice, Protect Democracy Project Inc, Cambridge, MA, Nancy Gertner, Pro Hac Vice, Fick and Marx LLP, Boston, MA, for Plaintiffs.

Alan Wilson, Robert Dewayne Cook, Thomas Parkin C. Hunter, William Jeffrey Young, Harley Littleton Kirkland, Wesley Aaron Vorberger, SC Attorney General's Office, Columbia, SC, for Defendants.

ORDER AND OPINION

J. Michelle Childs, United States District Judge

Before the court for review is a Motion for Summary Judgment¹ (ECF No. 5) by Defendants Marci Andino, Executive Director of the South Carolina State Election Commission ("SCSEC"); Billy Way, Jr., Chair of the SCSEC; and Mark A. Benson, Marilyn Bowers, and Nicole Spain Wright, Members of the SCSEC (collectively "Defendants" or "SCSEC"). Defendants move the court to dismiss Plaintiffs Frank Heindel and Phil Leventis' (collectively "Plaintiffs") declaratory judgment action for lack of standing. For the reasons that follow, the court GRANTS Defendants' Motion.

I. FACTUAL AND PROCEDURAL BACKGROUND

Plaintiffs are "South Carolina voters seeking to vindicate their right to participate effectively in the state's elections." (ECF No. 1 at 3 ¶ 7.) On July 10, 2018, Plaintiffs filed a Complaint for Declaratory and Injunctive Relief, claiming that "the capacity of [South Carolina]'s election system to record and count votes reliably is deeply compromised by the state's" use of the iVotronic Direct Recording Electronic (DRE) system. (Id. at 2 ¶ 2.) After a Request for Proposal ("RFP")² in 2003, the SCSEC obtained 11,000 iVotronic voting machines from Electronic Systems & Software ("ES & S") for $35 million dollars. (Id. at 7–8 ¶¶ 22–23.) By 2006, the machines were in use statewide. (Id. at 8 ¶ 23.)

In their Complaint, Plaintiffs explain how the iVotronic DRE voting machines work:

The iVotronic system consists of several components. The physical components—its "hardware"—include the following:

• Voting terminals, which are computer systems that include touchscreens where users indicate their votes;

• Personalized Electronic Ballots ("PEBs"), which are plastic cartridges housing infrared scanners that poll workers insert into the machines to open (or activate) the machines at the beginning of voting, close (or deactivate) the machines at the end of voting, make the correct ballot appear for each voter, and collect votes stored on the machine; and

• Compact flash cards that store image files and an event log...from each machine....

The system also includes two software systems. The main one is iVotronic firmware—permanent software programmed into read-only memory—that directs the recording and tabulating of votes within the machines. The firmware creates the screen each voter sees as she scrolls through her electronic ballot. All of South Carolina's iVotronic machines utilize iVotronic firmware version 9.1.6.2, which the [SC]SEC certified in August 2006.

A second software system, Unity, works in conjunction with the machines' iVotronic firmware. Unity, an interconnected set of Windows-based software applications, runs on the counties' and [SC]SEC's server systems to translate the data captured via the iVotronic firmware into election results by county as well as statewide.

The process of voting on the iVotronic system is entirely digital. The user stands at the terminal, which presents the user's choices for each race or ballot question on a touchscreen; the user then votes by pressing the touchscreen to select and submit her choice. At no point in the process does the user create or receive a paper record reflecting her vote.

On Election Day, counties supply each precinct with one "red stripe" (also referred to as "master" or "supervisor") PEB and several "green stripe" (also referred to as "voter" or "ordinary") PEBs. Poll workers use the master PEB to open each terminal at the beginning of the day and close the terminals once voting ends. When closing voter terminals, the master PEB downloads and stores the vote totals collected over the course of the day in each machine. Poll workers then transport the master PEBs back to county elections headquarters, where officials transfer the results from the master PEBs to the Election Report Manager, a software system that tallies county-wide vote totals.

The "voter" PEBs serve a different role. Each time a voter checks in to vote, a poll manager uses a voter PEB to activate a terminal for that voter's use. The voter PEB prompts the terminal to show the proper ballot on the touchscreen and allows the user to vote once.

Each voter terminal also houses a compact flash card. The flash card is a removable electronic storage device, like a thumb drive or USB. Over the course of Election Day, the flash card stores "vote image files," digital records of ballots cast on that machine, and the selections made during completion of that ballot. The flash card also stores an event log showing what operations voters and poll workers caused the machine to execute over the course of the day. Operations include opening the machine, selecting a candidate, changing a selection, submitting a ballot, and closing the machine at the end of voting.

At county elections headquarters and the [SC]SEC, election officials employ the Unity system to create and manage election databases, design ballots, program the PEBs, and tabulate election results. The [SC]SEC certified Unity version 3.0.1.1 in August 2006. In 2014, the [SC]SEC certified Unity version 3.4.1.1. In 2017, it certified Unity version 4.0.0.3v4.

(Id. at 8–10 ¶¶ 24–31.)³

Plaintiffs allege that, "The iVotronic system is plagued with vulnerabilities that undermine its reliability and open numerous pathways for potential hacking." (Id. at 12 ¶ 38.) In support of their claim, Plaintiffs cite several reports that studied the same iVotronic voting machines and software in use in South Carolina. The first is a 2007 report commissioned by the Ohio Secretary of State entitled, "EVEREST: Evaluation and Validation of Electronic-Related Equipment, Standards and Testing."⁴ (Id. at 13 ¶ 39.) The EVEREST Report concluded that the iVotronic system

lack[s] the fundamental technical controls necessary to guarantee a trustworthy election under operational conditions. Exploitable vulnerabilities allow even persons with limited access—voters and precinct poll workers—to compromise voting machines and precinct results, and, in some cases, to inject and spread software viruses into the central election management system.

(Id. at ¶ 40 (quoting EVEREST Report at 29).) Plaintiffs further allege that, "The architecture of the iVotronic system creates numerous inroads for potential hackers," and the fact that the machines are not connected to the Internet does not insulate the system from attacks. (Id. at 16 ¶ 50 (citing EVEREST Report at 57).) For example, Plaintiffs assert that the PEBs, which are used to open and close the voting system, can transfer viruses to the iVotronic machines and to the central server with widespread and potentially undetectable consequences for the entire county's election process. (Id. ) Plaintiffs argue that the security flaws identified by the EVEREST Report are not just theoretical because the EVEREST researchers performed several simulated attacks.⁵ (Id. at 17 ¶ 52.)

In addition to the EVEREST Report, Plaintiffs cite a report commissioned by the South Carolina General Assembly ("General Assembly") to review the iVotronic system. (Id. at 19 ¶ 58.) In March 2013, the General Assembly's Legislative Audit Council ("LAC") published "A Review of Voting Machines in South Carolina," a study commissioned by the South Carolina Senate's President Pro Tempore.⁶ (Id. ) In addition to various "Election Day mishaps" associated with the iVotronic system, the 2013 LAC Report catalogued studies revealing the iVotronic's "deep and systematic vulnerabilities, including the EVEREST...report[ ]." (Id. )

In 2015, the General Assembly passed legislation establishing a "Joint Voting System Research Committee." (Id. at 19–20 ¶ 59.) This Joint Committee found "[a] new voting system must include some type of audit function, or ‘paper trail,’ that would allow the voter to confirm his or her ballot, as it will be tabulated by the [SC]SEC." (Id. at 20 at ¶ 59 (quoting 2013 LAC Report at 6).) The Joint Committee also held two public hearings in preparing its report. (Id. at ¶ 60.) At the second hearing, Defendant Andino submitted testimony that South Carolina's current voting system has a life expectancy of twelve to fifteen years, and is approaching "end of life." (Id. at ¶ 61 (quoting 2013 LAC Report at 9).) Defendant Andino also reported that ES & S, the state's iVotronic machine vendor, informed the [SC]SEC that securing replacement parts "will become a problem at some time in the future." (Id. ) Moreover, Plaintiffs assert that "ES & S no longer manufactures the outdated iVotronic machines." (Id. )

Plaintiffs further allege that the iVotronic "machines have failed in ways that impede voting," inc...