Please Follow us on Gab, Minds, Telegram, Rumble, GETTR, Truth Social, X, Youtube, Instagram
When citizens walk into a voting booth, two constitutional promises must be kept: that their vote remains completely secret, and that the count is transparent, lawful, and accurate following procedures defined in the law.
On September 28, the Georgia State Election Board passed a formal resolution instructing its Executive Director to ask the U.S. Department of Justice to intervene and inspect Georgia’s voting system for critical cybersecurity vulnerabilities, ballot privacy breaches, and non-compliance with federal law.[1–3] On October 8, the Georgia Association of Voter Registration and Election Officials (GAVREO) fired back with a sharp letter, claiming that federal oversight is an overreach, that county election workers have everything under control, and that fixing the system is simply unworkable.[1]
GAVREO’s defense offers a polished narrative of reassurance, but it relies on technical obfuscation and administrative convenience. Saying a system is too difficult to fix does not make it secure.
For more than six years, citizens, computer scientists, and cybersecurity professionals have taken these exact facts to county boards of elections, county commissions, state legislative hearings, the Secretary of State, the Governor, and the State Election Board. At every step, the response has been delay, denial, and deflection.
Here are the documented facts behind GAVREO’s claims—and the hard questions Georgia officials continue to evade.
1. Shared Credentials: The “Unique Key” Myth vs. Plain-Text Reality
GAVREO insists that “there are no statewide passwords, administrator codes or security keys” because counties generate unique keys each election cycle.[1]
This claim is a half-truth that conceals a catastrophic architectural failure. Princeton Computer Science Professor Dr. Andrew Appel and independent forensic analyses have documented that the underlying Dominion system stores X.509 cryptographic keys in unencrypted plain text.[4,6] Storing cryptographic keys in plain text directly violates Federal Information Processing Standards (FIPS 140-2), which govern baseline federal cryptographic security.[7]
These plain-text keys have repeatedly been extracted and used to decrypt the master Dominion administrator password (dvscorp08!), a vendor credential that has been exposed and unpatched since at least 2010.[6] Expert testimony in DeKalb County Republican Party v. Raffensperger confirmed that storing encryption keys in plain text leaves the entire architecture exposed.[4,7] Generating new county keys each election accomplishes nothing if the master keys can be harvested in plain text.
If an election system stores its master encryption keys in plain text where anyone with system access can extract them, how come officials continue to tell the public that changing county election keys makes the system secure?
2. The Ballpoint-Pen Demonstration: Passive Oversight Is Not Security
GAVREO dismisses the courtroom demonstration where election systems expert Dr. Alex Halderman manipulated a ballot-marking device (BMD) using a ballpoint pen, claiming that vigilant poll workers watching the room and post-election paper audits eliminate the threat.[1]
Relying solely on human vigilance is a passive security model that completely ignores insider threats, ballot-programming tampering, and human error. In State Election Board Case SEB2023-025, ‘intentional human intervention’ resulted in double-counting of ballots. Poll workers are civic volunteers, not forensic counter-intrusion specialists.
More crucially, Risk-Limiting Audit (RLA) creator Professor Philip Stark has established that machine-marked paper summaries cannot be audited against voter intent. An audit merely recounts the paper printout that the machine produced; it cannot tell you what the voter saw on the touchscreen if malicious software intercepted the choice before printing.[8] The pen demonstration exposed an absence of hardware-level secure boot, storage encryption, and intrusion detection.[5]
If top election audit experts warn that paper summaries cannot detect a hacked touchscreen, why do election officials pretend that watching the room protects the vote?
3. Obsolete Operating Systems: Running End-of-Life Software from Day One
GAVREO argues that undertaking a system upgrade is too risky and slow, comparing the current demand for security to the quick display patch deployed in 2020.[1]
This is a false equivalence that conceals a staggering neglect of basic IT hygiene. The 2020 update was a last-minute display fix for a specific candidate list bug. The current reality is that Georgia’s voting system was certified in 2019 under voluntary voting system guidelines (VVSG 1.0) published in 2005.[9] The official EAC certificate of conformance reveals that the underlying infrastructure relies on software that has reached its official end of life:
GAVREO dismisses these expired systems by stating the machines are not connected to the internet.[1] But CISA Advisory ICSA-22-154-01 warns that critical vulnerabilities can be exploited offline via infected USB sticks, election setup media, or unauthorized physical connections.[5] Running end-of-life operating systems without security patches is not risk mitigation; it is managed negligence.
If no bank, healthcare provider, or critical infrastructure operator would dare run ten-year-old, unsupported operating systems, how come Georgia officials force citizens to cast their votes on them?
4. Ballot Privacy: Violations by Screen and by Digital Record
GAVREO claims that redacting voter names from election public records fully protects ballot secrecy.[1]
This claim ignores modern data linkage and technical research. Forensic researchers at DVSorder.org demonstrated that Dominion scanners and system log files (SLOGs) preserve ballots in the exact order they are scanned.[12] When Cast Vote Records (CVRs) and scanner logs are cross-referenced with polling-place check-in logs or exterior security cameras, individual ballots can be linked directly to specific voters—especially in smaller precincts.[12]
Furthermore, Article II, Section I, Paragraph I of the Georgia Constitution guarantees that voting shall be by secret ballot. Yet across the state, voters cast ballots on massive, brightly illuminated touchscreens that are easily visible from ten feet away by poll workers, observers, and neighbors standing in line.[13]
When the Georgia Constitution guarantees an absolute right to a secret ballot, why does the state use a system that exposes voter choices on bright public screens and preserves digital records that allow votes to be unmasked?
5. Unreadable QR Codes: Federal Violations Cannot Be Postponed
GAVREO defends the continued use of QR codes on ballots by noting that the Georgia General Assembly moved the statutory deadline to eliminate them to 2028.[1]
A legislative delay passed by state lawmakers does not cure a federal civil rights violation. Under the Help America Vote Act (HAVA) and O.C.G.A. § 21-2-300, voting systems must be uniform, reliable, and accessible, ensuring that voters can independently verify their ballots. Under Georgia’s current setup, the human-readable text on the paper ballot is not what the optical scanner counts; the scanner tabulates the 2D barcode.[8]
No voter can verify the contents of an encrypted barcode with their eyes.[5,8] Pushing a statutory deadline back to 2028 is a legislative admission that the system is non-compliant, leaving voters without a lawful remedy for another two years.
If state law and federal civil rights require voters to independently verify their own ballots, how come the state counts an encrypted computer barcode that no human eye can verify?
6. ERIC vs. the State Election Board: Who Gets Georgia’s Voter Data?
GAVREO defends the Secretary of State sharing voter registration records with ERIC (the Electronic Registration Information Center), arguing that data privacy is protected because sensitive numbers are hashed.[1]
This defense ignores chain of custody and constitutional accountability. While the Secretary of State shares statewide voter data with ERIC—an out-of-state, private third-party entity that has faced scrutiny for sharing data with external researchers—the state’s own official State Election Board (SEB) has been denied access to the unredacted voter roll data required to carry out its statutory oversight duties.[1–3]
Why is an out-of-state private entity granted access to Georgia voter data, while the state’s own constitutional election oversight board is blocked from obtaining the records needed to verify the rolls?
7. The Impracticability of the System and the Mandatory Legal Remedy
GAVREO argues that implementing a major software upgrade or replacing machines is impossible before an upcoming election, treating the issue as an unavoidable stalemate.[1]
Georgia law already anticipates this exact problem. Under O.C.G.A. §§ 21-2-281 and 21-2-334, whenever it becomes “impracticable” for any reason to use electronic voting machines, election superintendents are legally authorized and required to supply paper ballots.[13–14]
If electronic voting machines run on expired operating systems, rely on plain-text credentials, and print unreadable barcodes that cannot be verified by voters, using them is legally impracticable. Georgia State Election Board Rule 183-1-12-.11 and emergency procedures outline the standard protocols for paper ballots.[13] Hand-marked paper ballots, whether tabulated on verified optical scanners or manually tallied as required by O.C.G.A. § 21-2-437, provide an immediate, lawful remedy that requires zero software overhauls.
If election officials admit that electronic voting machines cannot be upgraded or secured in time, how come they refuse to implement the emergency paper-ballot remedy already written into Georgia law?
8. Federal Non-Compliance: A HAVA State Plan Frozen in 2008
GAVREO asserts that the federal government and the Department of Justice have no authority to review Georgia’s election system administration.[1]
This argument ignores the constitutional supremacy of federal law and the binding terms of federal election grants. Under the Help America Vote Act, states receive tens of millions of dollars in federal funding on the condition that they maintain an updated, approved HAVA Implementation Plan with the U.S. Election Assistance Commission (EAC).
Freedom of Information Act (FOIA) records reveal that the official Georgia HAVA Implementation Plan on file with the EAC is dated September 2008.[15] It has not been updated in nearly two decades. Since 2008, Georgia scrapped its previous DRE voting system, spent over $100 million on an entirely new Dominion touchscreen fleet, and enacted sweeping overhauls to its election statutes. By failing to update its formal HAVA plan, has Georgia operated outside federal reporting compliance? This fact alone establishes clear federal jurisdiction for DOJ inquiry. [2,15]
When Georgia has accepted millions in federal election funding, why has the state failed for eighteen years to update its formal federal compliance roadmap to reflect the machines it actually uses?
Six Years of Warnings, Zero Real Action
This confrontation is not a sudden development. It is the culmination of six years of institutional stonewalling.
For more than six years, citizens, computer scientists, and election security advocates have presented these exact facts to every level of Georgia government. They brought them to county boards of elections and were told it was a state issue. They brought them to county commissions and were told it was an administrative detail. They brought them to state legislative committees, where deadlines were pushed to 2028. They brought them to the Secretary of State, who issued public reassurances that machines aren’t on the internet while ignoring memory-card threats.
The most disturbing reality is that local election workers—our neighbors, retirees, and volunteers—are the ones trapped in the middle. They are tasked with administering an election on an outdated, closed-source system they did not build, do not control, and are legally forbidden to alter.[13] Meanwhile, county boards use taxpayer dollars to fund membership dues to GAVREO, an unelected private association that lobbies against outside technical scrutiny and defends the very vendor architecture that puts those local workers in legal jeopardy.
Georgia voters are tired of being dismissed and told not to believe what independent cybersecurity experts have proven under oath. Saying a fix is difficult does not relieve state officials of their constitutional duty. If the officials entrusted with our elections cannot provide technical proof that our votes are secret, accurate, and secure, they should not be surprised when the citizens hold them accountable.
After six years of documented warnings from the nation’s top cybersecurity experts, federal agencies, and everyday voters, how come Georgia’s political leadership has spent more energy defending an obsolete vendor system than protecting the constitutional rights of the people?
Field Searcy is a technologist and co-founder of GeorgiansForTruth.org, a grassroots volunteer effort to bring election integrity to Georgia. Visit for more information and supporting documentation.
Sources and Documentation
[1] GAVREO Executive Board, letter to the Georgia State Election Board, October 8, 2026. Outlines GAVREO’s defenses regarding county security keys, the 2020 patch, operating system status, and legislative deadlines.
[2] James Mills, Executive Director, Georgia State Election Board, “Formal Request for Department of Justice Intervention,” September 30, 2026. Documenting formal board requests for federal investigation into system security, QR codes, and voter file sharing.
[3] Georgia State Election Board, “Dominion Update Coordination” Resolution, adopted September 28, 2026. Official board resolution directing the executive director to seek federal assistance from DOJ and DHS.
[4] Dr. Andrew Appel, “Georgia still using tragicomically insecure voting system”, Princeton Center for Information Technology Policy, February 24, 2026. Technical analysis of symmetric cryptographic keys, system vulnerabilities, and recommendations for hand-marked paper ballots.
[5] Cybersecurity and Infrastructure Security Agency (CISA), “Vulnerabilities Affecting Dominion Voting Systems ImageCast X,” Advisory ICSA-22-154-01, June 3, 2022. Federal advisory documenting software vulnerabilities in ImageCast X machines and outlining required physical and operational controls.
[6] Cyber Ninjas, Antrim County, MI—Election Management System Application Security Analysis, April 9, 2021. Review documenting plain-text X.509 cryptographic key storage and decryption of administrative passwords (dvscorp08!).
[7] National Institute of Standards and Technology (NIST), FIPS 140-2 Standards Publication, May 25, 2001. Federal Information Processing Standards governing cryptographic modules and unauthorized key exposure.
[8] Dr. J. Alex Halderman, “Security Analysis of the Dominion ImageCast X”, Princeton Center for Information Technology Policy, June 14, 2023. Expert analysis detailing BMD barcode tabulation, outdated Android builds, and audit limitations on machine-printed summary ballots.
[9] U.S. Election Assistance Commission (EAC), Democracy Suite 5.5-A Certificate of Conformance and Scope of Certification, January 30, 2019. Certified system manifest listing Windows Server 2012 R2, SQL Server 2016, and VVSG 1.0 (2005) testing standards.
[10] Microsoft Corporation, “Plan your Windows Server and SQL Server end of support”. Official Microsoft lifecycle documentation covering extended support and security updates for server products.
[11] Raff Technologies, “Windows Server End of Life Dates: Every Version Compared”, updated September 17, 2026. Lifecycle timeline comparing Windows Server mainstream support, extended support, and security update cutoffs.
[12] Crimmins, Narayanan, Springall, Halderman, et al., DVSorder Research Summary, October 14, 2022. Forensic research detailing scanner ballot sequencing, Cast Vote Record correlation, and ballot privacy risks.
[13] Georgia Secretary of State, Official Rules and Regulations, Subject 183-1-12. State rules governing voting equipment, emergency paper ballots (Rule .11), polling place screen privacy (Rule .05), and state authorization for software changes (Rule .01).
[14] Official Code of Georgia Annotated (O.C.G.A.), § 21-2-334 (Use of paper ballots when voting machines impracticable). State statute governing procedures and mandatory paper ballot deployment when electronic systems are impracticable.
[15] U.S. Election Assistance Commission, Federal Register Notice: Publication of Georgia State Plan Under HAVA, 73 FR 54141, September 18, 2008. Federal Register filing recording Georgia’s last official Help America Vote Act state plan submission.
Get the latest on Georgia delivered straight to your mailbox.
