A federal judge ruled late Monday that Georgia need not replace paperless voting machines before the midterms, dealing a blow to election security activists even as she acknowledged the machines are woefully insecure and that continuing to use them may infringe on voters’ constitutional right to a free and fair election.

“While Plaintiffs have shown the threat of real harms to their constitutional interests, the eleventh-hour timing of their motions and an instant grant of the paper ballot relief requested could just as readily jeopardize the upcoming elections, voter turnout, and the orderly administration of the election,” Judge Amy Totenberg wrote in her ruling siding with Georgia Secretary of State Brian Kemp and the other state defendants over the activists.


The legal victory for Kemp, a Republican who is running for governor in November, means that the state will not have to quickly switch out all of its direct-recording electronic, or DRE, machines and replace them with systems that produce paper records.

But even as Totenberg denied the plaintiffs' request to force Georgia to ditch its DREs, she also wrote that they had "demonstrated a real risk of suffering irreparable injury without court intervention" and that they were "substantially likely to succeed" with at least one of their constitutional arguments about the harm that paperless machines caused.

"Plaintiffs have so far shown that the DRE system, as implemented, poses a concrete risk of alteration of ballot counts that would impact their own votes," she wrote.

Morning Score newsletter Your guide to the permanent campaign — weekday mornings, in your inbox. Email Sign Up By signing up you agree to receive email newsletters or alerts from POLITICO. You can unsubscribe at any time. {{#success}} {{heading}} {{message}} {{heading}} {{message}} More Subscriptions {{message}}

"Given the absence of an independent paper audit trail of the vote," she added, "the scope of this threat is difficult to quantify, though even a minor alteration of votes in close electoral races can make a material difference in the outcome."


The case will now proceed and deal with the plaintiffs' constitutional arguments, and Totenberg warned Kemp that his concerns about a chaotic last-minute DRE swap-out will "hold much less sway in the future — as any timing issues then would appear to be exclusively of Defendants’ own making at that point."

Totenberg added that she was "gravely concerned about the State’s pace in responding to the serious vulnerabilities of its voting system — which were raised as early as 2016 — while aging software arrangements, hardware, and other deficiencies were evident still earlier."

Robert McGuire, the lead attorney for one of the groups of Georgia voters, said he was optimistic about the final outcome of the case.

"We are disappointed that DREs will be used in Georgia this November, but we remain confident that the U.S. Constitution guarantees voters the right to cast their ballots in verifiable, trustworthy elections," McGuire said in a statement. "Although we were unfortunately unable to obtain preliminary relief in time for this November, we are glad the case can now move forward on the merits."


Kemp, meanwhile, promised that Georgia would continue working through its election security commission "to responsibly upgrade Georgia’s secure — but aging — voting system."

"Our state needs a verifiable paper trail," he said in a statement, "but we cannot make such a dramatic change this election cycle."

Election integrity advocates, cybersecurity experts and election officials nationwide have been closely tracking the court case in Georgia, which is one of five states that exclusively uses paperless systems. Amid frantic preparations for the midterms, the case became an urgent test of whether constitutional arguments could force election technology upgrades.

Cybersecurity experts argue that paper-based systems are vital to protecting elections from undetectable tampering by sophisticated hackers, such as the Russian intelligence operatives who allegedly interfered in the 2016 presidential election. Those hackers sought to penetrate numerous state voter registration systems and successfully breached a voting technology vendor, according to an indictment by Special Counsel Robert Mueller.

The ruling comes as voters in South Carolina pursue a similar lawsuit against their state’s election administrators. South Carolina, like Georgia, relies exclusively on DREs.

Even though she ruled for Georgia, Totenberg’s offered plenty of ammunition for critics of Kemp, who has developed a reputation as the leading bête noire of election security activists and federal officials urging states to upgrade their technology.

Kemp has been a fierce critic of federal efforts to improve election security, which has been a fraught task nationwide given how protective states are of their election management responsibilities.

In January 2017, when the Obama administration classified elections as critical infrastructure weeks before leaving office, Kemp accused Obama of planning a federal takeover of the election process. He also falsely accused the Department of Homeland Security of trying to hack his state’s servers — a charge debunked by the department’s inspector general after Kemp wrote to then-President-Elect Donald Trump seeking an investigation.


Kemp has also faced questions about his stewardship of Georgia elections. In July 2017, his office terminated a contract with Kennesaw State University, which had been running the state’s elections, after officials at the university’s Center for Election Systems ignored warnings about security flaws in a key server and then erased the server, depriving the eventual trial of key evidence.

In her ruling, Totenberg excoriated Kemp and his allies for shrugging off the plaintiffs' cybersecurity concerns while offering scant contrary evidence. She noted that the state defendants "presented no witnesses with actual computer science engineering and forensic expertise" to discuss the KSU server, the state's DREs, or other security issues.

"The Defendants’ response brief is close to non-responsive to the concerns that Plaintiffs raise about the serious vulnerability of the server and the election data system at large to intrusion, virus, or attack," she wrote.

In addition, she said, the plaintiffs' claims about security vulnerabilities in Georgia's election system "have hardly been rebutted by Defendants except via characterizations of the issues raised as entirely hypothetical and baseless."