Transparency Is the Best Policy: the Case for Georgia to Allow Access to the Source Code of Proprietary Voting Software

• Publication year: 2023

Transparency is the Best Policy: The case for Georgia to Allow Access to the Source Code of Proprietary Voting Software

Grace Repella
University of Georgia School of Law, jwt74222@uga.edu

Transparency is the Best Policy: The case for Georgia to Allow Access to the Source Code of Proprietary Voting Software

Cover Page Footnote
J.D. Candidate, 2024, University of Georgia School of Law. A special thanks to Professor Lori Ringhand, who sparked my interest in election law.

[Page 375]

TRANSPARENCY IS THE BEST POLICY: THE CASE FOR GEORGIA TO ALLOW ACCESS TO THE SOURCE CODE OF PROPRIETARY VOTING SOFTWARE

Grace Repella^*

[Page 376]

Table of Contents

I. Introduction...............................................................................................377

II. Background.................................................................................................379

A. Types of Voting Systems..............................................................379

B. Presidential Election of 2000 as the Impetus of the Help America Vote Act (HAVA)..........................................................380

C. Probing in the 2016 Presidential Election.........................382

D. Claims of Foreign Actors Hacking Voting Systems in the 2020 Election....................................................................................384

III. Analysis..........................................................................................................385

A. Georgia's Current, Insufficient Legislation....................385

B. Other States' Legislation Promoting Transparency and Voter Confidence..........................................................................386

1. California........................................................................................386
2. Wisconsin ....................................................................................... 387
3. North Carolina...............................................................................388
4. Florida.............................................................................................388

C. IP Issues.................................................................................................................388

1. Trade secrets .................................................................................. 388
2. Copyright Protection of Source Code........................................389

IV. Conclusion....................................................................................................390

A. The Legislation Georgia Should Pass to Secure the Integrity of its Elections..........................................................390

B. The Case for Georgia to Pass this Legislation................391

[Page 377]

I. Introduction

In recent years, most states have traded paper ballots for electronic voting machines to safeguard and secure their elections.¹ Electronic voting offers many advantages over paper ballots, but with these comes a serious risk to the integrity of our elections.² Voting machines are digital devices that run on software.³ Thus, they are susceptible to hacking, which can occur if there are vulnerabilities in the software's source code—the collection of code written in a human-readable programming language, such as Python, Java, or Javascript to develop a software.⁴ While it is easy to conceptualize these technical terms as being transcendental and error-free, fallible human software engineers write and develop the source code.⁵ They make mistakes.

If voting machines are hacked or even susceptible to hacking, then the integrity of our election system could be severely hurt.⁶ A hacker could tamper with a single ballot or alter the results of the entire election.⁷ Thus, there is a strong incentive for the country and each state to pass legislation to ensure that our elections are secure.

Following the 2000 presidential election, Congress passed the Help America Vote Act ("HAVA") "to make sweeping reforms to the nation's voting process."⁸ As part of HAVA, the U.S. Election Assistance Commission must provide information to state and local governments relating to the "testing,

[Page 378]

certification, decertification, and recertification of voting system hardware and software."⁹

Ultimately, the authority to regulate federal and state elections rests with state governments, and each state must pass laws regulating their statewide elections.¹⁰ In the 2016 election, there was evidence that the Russian government attempted to "access election infrastructure."¹¹ Thus, many states passed legislation to better safeguard their respective states' elections.¹²

The 2020 election proved to further incentivize states to pass more rigorous and protective legislation. There were claims that the voting software of certain brands of voting machines had been hacked, leading to claims that the results of the entire election were inaccurate and fraudulent.¹³

To combat these claims and guarantee election security, several states have passed legislation that requires voting software vendors to provide access to their software's source code. For example, California requires any entity interested in selling or acquiring a voting system—in whole or in part—to give the secretary of state the right to demand the "source code for all software and firmware and a working model of the voting system "¹⁴ North Carolina requires voting system vendors to place all software—including "a complete copy of the source and executable code,"—in escrow with an independent escrow agent chosen by the State Board of Elections and to turn over a "list of programmers responsible for creating the software and a sworn affidavit that the source code includes all relevant program statements in low-level and high-level languages."¹⁵ Florida requires access to voting software to test the voting system before approving it,¹⁶

[Page 379]

and it also requires copies of the "program codes and copies of all software" to be filed with the state.¹⁷ These are all examples of the affirmative steps states can take to help bolster confidence in their election systems.

Georgia, however, only provides that the Secretary of State can examine a device, but "electronic ballot markers, DREs, ballot scanners, pollbooks, and software or data bases used for voter registration, shall not be open for public inspection . . . ."¹⁸ Georgia only requires that the source code of voting software be given to the Georgia Certification Agent, chosen by the Secretary of State, to certify the voting system,¹⁹ but Georgia does not require voting software vendors to give any state official or entity access to their source code.²⁰

Georgia should increase voter confidence in its elections through transparency. To that end, Georgia should adopt legislation that—like the laws in California, Wisconsin, North Carolina, and Florida—requires voting software vendors to give the Secretary of State access to the human-readable source code of the software used in the electronic voting machines. Further, the Secretary of State should have to ability to disseminate the source code to election officials of each county in the state.

II. Background

A. Types of Voting Systems

American elections use one of five types of voting systems: hand-count paper, mechanical lever machines, punch-card machines, scanned paper ballots, and direct-recording electronic devices.²¹ Hand-counted paper ballots are somewhat self-explanatory. A voter marks the ballot by hand, and the ballots are then counted by hand.²² However, they are rarely used in the United States today.²³ In the 1890s, the U.S. moved towards using mechanical lever machines.²⁴

[Page 380]

Voters pulled a handle that closed the machine's curtains and unlocked it, and then pulled knobs to make their selection.²⁵ A counter device was built into the inside of the machine and kept track of each vote.²⁶ The biggest issue with this form of voting is the lack of a paper trail.²⁷

Beginning in the 1960s, some states used punch card voting devices—the voter punches holes in cards to indicate their selection and then deposits it in either a tabulating device or places it in a ballot box which will be tallied later.²⁸

Scanned paper ballots were also used in the '60s.²⁹ The voter marks the ballot just as they would a normal paper ballot, but then the ballot is scanned, and then all votes are counted, and the totals are printed out.³⁰ As of 2016, scanned paper ballots are the most widely used voting technology throughout the United States.³¹

Then, in the 1970s, direct-recording electronic machines ("DRE") began to be used in several states.³² The newest DREs display the ballot on a computer touch screen, and the voter presses the screen to indicate their selection.³³ They also include a paper record called a Voter-Verified Paper Audit Trail ("VVPAT").³⁴ Utilization of DREs has proven controversial due to the vulnerabilities of being fully electronic.³⁵ However, many states are choosing to use DRE machines in their election systems.³⁶

B. Presidential Election of 2000 as the Impetus of the Help America Vote Act (HAVA)

In the 2000 presidential election, the outcome hinged on the state of Florida. Several recounts within the state had to take place. An investigation into the voting systems in place during the 2000 election revealed many irregularities in

[Page 381]

voting systems throughout the country.³⁷ Following the election, Congress passed HAVA.³⁸ HAVA created mandatory minimum standards for voting systems and election administration and provided funding to the states to meet the specified standards.³⁹ it established the Election Assistance Commission ("EAC"), which oversees creating and maintaining voting system guidelines⁴⁰ and the federal government's voting system certification process.⁴¹

Section 301 of the Act outlines the minimum standards for a state's voting system. Under these minimum standards, a voter has the right to verify their ballot, and a...