Coalition Plaintiffs' Motion For Preliminary Injunction

Case 1:17-cv-02989-AT Document 258 Filed 08/03/18 Page 1 of 5
IN THE UNITED STATES DISTRICT COURT

FOR THE NORTHERN DISTRICT OF GEORGIA
ATLANTA DIVISION
DONNA CURLING, ET AL.,

Plaintiffs,
Civil Action No. 1:17-CV-2989-AT
v.
BRIAN KEMP, ET AL.,

Defendants.
COALITION PLAINTIFFS’ MOTION FOR

PRELIMINARY INJUNCTION
Pursuant to Rule 65 of the Federal Rules of Civil Procedure, Plaintiffs
Coalition for Good Governance, William Digges III, Laura Digges, Megan
Missett, and Ricardo Davis (the “Coalition Plaintiffs”) move this Court to grant a
preliminary injunction prohibiting the Defendants from conducting the November
2018 general election and the related December 2018 runoff election through direct
recording electronic (DRE) voting units for in-person voting.
In connection with the foregoing requested relief, Coalition Plaintiffs request
this Court to order Defendants instead to conduct such elections using paper
ballots, as permitted by Georgia law, and to make available at each polling place at
least one voting system equipped for individuals with disabilities that produces a
permanent paper record, which may not be a paperless DRE voting unit (unless no
other equipment equipped for individuals with disabilities is reasonably available
that satisfies the requirement to have a manual audit capacity), as required by
federal law.
In connection with the foregoing requested relief, Coalition Plaintiffs request
this Court to order the Defendant State Election Board Members to promulgate
rules requiring and specifying appropriate procedures for conducting pre-
certification audits of the results of both such elections and, to order the Defendant
Secretary of State, before October 1, 2018, to conduct an audit of and correct any
identified errors in the DRE system’s electronic pollbook data that will be used in
both such elections.
Pursuant to Rule 65(d), Plaintiffs have filed with this Motion a proposed
order directed at the persons to be bound thereby, stating the reasons why the order
should issue, stating the order’s terms specifically, and describing the acts
restrained and required.
Pursuant to Rule 7.1A of the Local Rules of the Northern District of
Georgia, and Part III (a) of this Court’s Standing Order, Plaintiffs have filed
herewith a brief citing legal authorities supporting the motion and the facts relied
upon. Attached to the brief are declarations from the following:
1. Matt Bernhard
PAGE 2
PLAINTIFFS’ MOTION
FOR PRELIMINARY INJUNCTION
AUGUST 3, 2018
2. Dana Bowers
3. Bruce Brown
4. Jasmine Clark
5. Kimberly Copeland
6. Rob Kadel
7. Logan Lamb
8. Carri Luse
9. Marilyn Marks
10. Laurie Mitchell
11. Rebecca Wilson
Respectfully submitted this 3nd day of August, 2018.
/s/ Bruce P. Brown /s/ Robert A. McGuire, III

Bruce P. Brown Robert A. McGuire, III
Georgia Bar No. 064460 Admitted Pro Hac Vice
BRUCE P. BROWN LAW LLC (ECF No. 125)
Attorney for Coalition for Attorney for Coalition
Good Governance for Good Governance, William
1123 Zonolite Rd. NE Digges III, Laura Digges, Ricardo
Suite 6 Davis, and Megan Missett
Atlanta, Georgia 30306 ROBERT MCGUIRE LAW FIRM
(404) 881-0700 113 Cherry St. #86685
Seattle, Washington 98104-2205
(253) 267-8530
PAGE 3
AUGUST 3, 2018
/s/ William Brent Ney /s/ Cary Ichter

William Brent Ney CARY ICHTER
Georgia Bar No. 542519 Georgia Bar No. 382515
Attorney for Coalition Attorney for Coalition
for Good Governance, William for Good Governance, William
Digges III, Laura Digges, Ricardo Davis, Digges III, Laura Digges, Ricardo
and Megan Missett Davis and Megan Missett
NEY HOFFECKER PEACOCK & HAYLE, LLC ICHTER DAVIS LLC
One Midtown Plaza, Suite 1010 3340 Peachtree Road NE
1360 Peachtree Street NE Suite 1530
Atlanta, Georgia 30309 Atlanta, Georgia 30326
(404) 842-7232 (404) 869-7600
CERTIFICATE OF COMPLIANCE
I hereby certify that the foregoing document has been prepared in
accordance with the font type and margin requirements of LR 5.1, using font
type of Times New Roman and a point size of 14.
/s/ Bruce P. Brown

Bruce P. Brown
Georgia Bar No. 064460
BRUCE P. BROWN LAW LLC
Attorney for Coalition for
Good Governance
1123 Zonolite Rd. NE
Suite 6
Atlanta, Georgia 30306
(404) 881-0700
PAGE 4
AUGUST 3, 2018
CERTIFICATE OF SERVICE
This is to certify that I have this day caused the foregoing COALITION
PLAINTIFFS’ MOTION FOR PRELIMINARY INJUNCTION to be served upon
all other parties in this action by via electronic delivery using the PACER-ECF
system.
This 3RD day of August, 2018.
/s/ Bruce P. Brown

Bruce P. Brown
Good Governance
Suite 6
(404) 881-0700
PAGE 5
AUGUST 3, 2018
Case 1:17-cv-02989-AT Document 258-1 Filed 08/03/18 Page 1 of 369

ATLANTA DIVISION

Plaintiffs,
v.
BRIAN KEMP, ET AL.,

Defendants.
COALITION PLAINTIFFS’ BRIEF IN SUPPORT OF

MOTION FOR PRELIMINARY INJUNCTION
August 3, 2018
Table of Contents
INTRODUCTION AND SUMMARY ................................................................................ 1

LEGAL STANDARDS ....................................................................................................... 2
A. Granting of a Preliminary Injunction ............................................................................... 2
B. Procedure and Evidence .................................................................................................. 2
ARGUMENT .................................................................................................................. 3
A. Coalition Plaintiffs Are Likely to Succeed on the Merits ................................................. 3
1. Georgia’s Current DRE System ................................................................................... 6
2. DREs Are Profoundly Insecure and Vulnerable ........................................................... 9
3. Georgia’s System Has Already Been Compromised .................................................. 12
4. Secretary Kemp’s Agents Have Destroyed All the Evidence of Who Accessed the KSU
Server ............................................................................................................................... 15
5. Georgia’s Voting Security Failure Has Not Been Remedied ...................................... 16
6. Evidence of Malfunctions in Recent Elections ........................................................... 17
7. International Threat Intensifies: “The Lights Are Blinking”....................................... 19
8. Conclusion – Plaintiffs are Likely to Succeed on the Merits ...................................... 19
B. Plaintiffs Are Likely to Suffer Irreparable Harm............................................................ 20
C. Balance of Equities Favors Granting the Injunction ....................................................... 22
D. Injunction Is in the Public Interest ............................................................................. 25
CONCLUSION ............................................................................................................. 25
Page ii
Plaintiffs Coalition for Good Governance, William Digges III, Laura
Digges, Megan Missett, and Ricardo Davis (the “Coalition Plaintiffs”) file this
Brief in Support of their Motion for Preliminary Injunction.
INTRODUCTION AND SUMMARY
Officials from the highest levels of the Federal Government have issued
repeated and increasingly urgent warnings to states like Georgia to not use
electronic voting machines in the upcoming elections and instead to switch to
paper ballots. Defendants stubbornly refuse to take any action, insisting -- against
overwhelming evidence to the contrary -- that Georgia’s system is secure. The
Coalition Plaintiffs are therefore compelled to bring this motion for preliminary
injunctive relief to protect their fundamental right to vote and their rights under the
Equal Protection Clause of the United States Constitution.
As will be explained below, Georgia AccuVote DRE electronic voting
system is extremely vulnerable to undetectable attack or system error. Plaintiffs
will further show the likelihood of irreparable harm because the results of any
election using the DRE machines is unverifiable and highly likely to be inaccurate.
Moreover, notwithstanding the Secretary’s protestations to the contrary, Georgia
can lawfully switch to a paper ballot system using existing resources with minimal
effort. For these reasons, Defendants should be enjoined through the pendency of
this litigation from using the unverifiable and hopelessly compromised AccuVote
Page 1
DRE paperless voting system, and instead should be enjoined to use paper ballots.
LEGAL STANDARDS
A. Granting of a Preliminary Injunction
Chief Justice Roberts summarized the familiar test for the granting of a
preliminary injunction in Winter v. NRDC, 555 U.S. 7, 20 (2008):1
A plaintiff seeking a preliminary injunction must establish that he is

likely to succeed on the merits, that he is likely to suffer irreparable
harm in the absence of preliminary relief, that the balance of equities
tips in his favor, and that an injunction is in the public interest.
These are not rigid requirements to be applied by rote. “The essence of
equity jurisdiction has been the power of the Chancellor to do equity and to mold
each decree to the necessities of the particular case. Flexibility rather than rigidity
has distinguished it.” Weinberger v. Romero–Barcelo, 456 U.S. 305, 312 (1982).
B. Procedure and Evidence
Though discovery in this case has not formally opened and the Defendants
have not answered the Third Amended Complaint, this Motion is not premature.
“The grant of a temporary injunction need not await any procedural steps
perfecting the pleadings or any other formality attendant upon a full-blown trial of
this case.” United States v. Lynd, 301 F.2d 818, 823 (5th Cir. 1962) (Tuttle, J.).
1
See also Alabama v. U.S. Army Corps of Engineers, 424 F.3d 1117, 1131 (11th Cir. 2005).
Page 2
In considering this Motion, the Court also is permitted to rely upon hearsay
and upon affidavits in lieu of live testimony. “[A] preliminary injunction is
customarily granted on the basis of procedures that are less formal and evidence
that is less complete than in a trial on the merits.” Univ. of Tex. v. Camenisch, 451
U.S. 390, 395 (1981); Levi Strauss & Co. v. Sunrise Int’l Trading, Inc., 51 F.3d
982, 985 (11th Cir. 1995) (at the “preliminary injunction stage, a district court may
rely on affidavits and hearsay materials which would not be admissible evidence
for a permanent injunction”).
ARGUMENT
A. Coalition Plaintiffs Are Likely to Succeed on the Merits
Plaintiffs are likely to succeed on their claims that the use of Georgia’s DRE
voting system to record votes burdens the Plaintiffs’ fundamental right to vote
(Count One) and violates the Equal Protection Clause (Count Two).
Plaintiffs’ fundamental-right-to-vote claim is based upon “the right of
qualified voters within a state to cast their ballots and have them counted.” United
States v. Classic, 313 U.S. 299, 315 (1941). “No right is more precious in a free
country than that of having a voice in the election of those who make the laws
under which, as good citizens, we must live. Other rights, even the most basic, are
illusory if the right to vote is undermined.” Wesberry v. Sanders, 376 U.S. 1, 17
(1964).
Page 3
This foundational constitutional right necessarily includes the right to have
one’s vote counted accurately. “Every voter’s vote is entitled to be counted once.
It must be correctly counted and reported.” Gray v. Sanders, 372 U.S. 368, 380
(1963). “Having once granted the right to vote on equal terms, the State may not,
by later arbitrary and disparate treatment, value one person’s vote over that of
another.” Bush v. Gore, 531 U.S. 98, 104-05 (2000).
States may not, by arbitrary action or other unreasonable impairment, burden
a citizen’s right to vote. Baker v. Carr, 369 U.S. 186, 208 (1962) (“citizen’s right
to a vote free of arbitrary impairment by state action has been judicially recognized
as a right secured by the Constitution”). “[T]he free exercise and enjoyment of the
rights and privileges guaranteed to the citizens by the Constitution and laws of the
United States” entails
the right and privilege to express by their votes their choice of a

candidate for Senator and their right to have their expressions of
choice given full value and effect by not having their votes impaired,
lessened, diminished, diluted and destroyed by fictitious ballots
fraudulently cast and counted, recorded, returned, and certified.
United States v. Saylor, 322 U.S. 385, 386 (1944). See also Reynolds v. Sims, 377
U.S. 533, 555 (1964) (“[T]he right of suffrage can be denied by a debasement or
dilution of the weight of a citizen’s vote just as effectively as by wholly prohibiting
the free exercise of the franchise.”).
Page 4
Plaintiffs need not establish at trial, much less at the preliminary injunction
stage of the case, that an impairment of their right to have their votes counted
accurately has already occurred or that it is certain to occur. Instead, Plaintiffs will
prevail at trial with a showing that the burden imposed upon their rights by the
very substantial risk that votes will be miscounted or diluted by the DRE system
outweighs any of the State in insisting upon the continued use of the DRE
machines. Crawford v. Marion County Election Bd., 553 U.S. 181, 190 (2008).
As to Plaintiffs’ claim under the Equal Protection Clause, the issue is
whether Georgia voters using AccuVote DREs are “less likely to cast an effective
vote” than absentee voters using paper ballots. Wexler v. Anderson, 452 F.3d 1226
(11th Cir. 2006).2 See also Dunn v. Blumstein, 405 U.S. 330, 336 (1972) (“[A]
citizen has a constitutionally protected right to participate in elections on an equal
basis with other citizens in the jurisdiction.”).
There is a substantial likelihood that Plaintiffs will prevail on both claims.
2
The Wexler case involved Florida’s use of AccuVote DRE machines, but the plaintiffs there did not
allege or prove that the machines were vulnerable to attack. Instead, the plaintiffs’ theory was that “by
certifying touchscreen voting systems that are incapable of providing for the type of manual recounts
contemplated by Florida law, the defendants have violated the equal protection and due process rights of
voters in touchscreen counties.” 452 F.3d at 1226. In rejecting this claim, the Eleventh Circuit explained
that the allegations Plaintiffs make in this case – that voters using touchscreen systems are less likely to
cast an effective vote than voters using paper ballots – would state an equal protection violation. Id. at
1231.
Page 5
1. Georgia’s Current DRE System
The primary features of Georgia’s current DRE system are not in dispute.
The voting system used in Georgia today consists of the Diebold Global Election
Systems (“Diebold”) AccuVote DRE touchscreen voting units (“DREs”), the
Diebold optical scanners for tabulating paper ballots, and the Diebold General
Election Management Software (“GEMS”) for tabulation and reporting of data
generated by DRE and Diebold optical scanners, as well as the electronic pollbook
components and electronic accessories that interface with the vote recording
system. Georgia uses approximately 27,000 Diebold DRE touchscreen voting
machines. (Third Amended Complaint (“TAC”) ¶ 59).
Each DRE internally contains much of the same hardware that might
typically be found in a very low-end general-purpose personal desktop computer in
use in the early 2000s. (Bernhard Decl. ¶ 11). Georgia’s DREs run a Diebold-
modified version of Microsoft’s Windows CE operating system, the most recent
version run in Georgia is Windows CE 4.1—which Microsoft stopped supporting
in early January 2013. (Bernhard Decl. ¶ 11). As a consequence, Microsoft is no
longer issuing updates or security patches for that software. (Bernhard Decl. ¶ 23).
“As the operating system is over twenty years old, it lags behind the two decades
of computer security research and is extremely vulnerable to a wide variety of
attacks that Diebold’s software, regardless of version, cannot defend against.” Id.
Page 6
A proprietary Diebold software application called BallotStation provides the user
interface that voters and poll workers see. BallotStation interacts with the voter,
accepts, records, and tallies votes on the DRE. ( Bernhard Decl. ¶ 21).
DREs are configured by inserting a memory card into a slot behind a locked
door on the side of the machine. Before the election, the file system on the
memory card stores the election definition, sound files, interpreted code that is used
to print reports, and other configuration information. When operating properly,
DREs use software to translate the voter’s physical act of touching a particular
place on the touchscreen into a vote for the corresponding candidate or issue,
which vote is then recorded on both the DRE’s removable memory card and
internal flash memory. Both records of the votes are unreadable to humans.
Crucially, Georgia’s DREs do not create or retain any non-electronic record of the
voter’s selections. (Bernhard Decl. ¶ 12; Lamb Decl. ¶ 5).
Upon the closing of the polls, poll workers cause DREs to interpret collected
electronic vote information, tabulate vote tallies, and convert it to human readable
form to print tallies. The DRE memory cards are removed, secured for transport to
a transmission center, in the case of Fulton County, or to county election offices.
(TAC ¶ 72-73). DRE memory cards are collected and uploaded into the county
election office GEMS server (running on a desktop computer). (TAC ¶ 75).
Georgia uses paper ballots for mail-in absentee ballots and in-person
Page 7
provisional ballots. These paper ballots are scanned and tabulated by Diebold
AccuVote Optical Scan units, located in the county election offices. On election
night, the memory cards from the Diebold AccuVote Optical Scan units are
uploaded to the Diebold GEMS server and combined with the data from the DREs
to create unofficial consolidated results and generate reports in human readable
form. (TAC ¶ 76-78).
For present purposes, there are two crucial features of Georgia’s election
system that must be re-emphasized. First, DREs, by design, create no non-
electronic record of voter intent. There is no possible way to verify if the DRE
system has correctly recorded and counted the intent of the voters. This is
completely unacceptable for public elections. As Director of Homeland Security
Kirstjen Nielsen recently testified: “You must have a way to audit and verity the
election result.”3 Second – and this is significant in the evaluation of the proposed
remedy – every county in Georgia currently uses the paper ballot/optical scan
system proposed by Plaintiffs. Thus, the remedy of conducting the upcoming
November and December 2018 elections using paper ballots instead of DREs is
3
Volz, Dustin, and Patricia Zengerle. “Inability to audit U.S. elections a ‘national security concern’:
Homeland chief,”Reuters (March 21, 2018), available at https://www.reuters.com/article/us-usa-trump-
russia-security/inability-to-audit-u-selections-a-national-security-concern-homeland-chief-
idUSKBN1GX200. For a videotape of Secretary Nielsen’s testimony before the Senate, see
https://www.youtube.com/watch?v=lXjYNLJ9yAM&feature=youtu.be (video of testimony at 3:38).
Page 8
eminently feasible.
2. DREs Are Profoundly Insecure and Vulnerable
The unreliability and vulnerability of electronic voting systems like the one
used by the State of Georgia has attracted widespread and uniform alarm at all
levels of government. On July 26, 2018, House Intelligence Committee Chairman
Devin Nunes joined many federal officials and agencies concerned with national
security to call for a complete ban on electronic voting.4 In May, the Senate Select
Committee on Intelligence concluded that paperless DREs “are at highest risk of
security flaws,” and stated that “[s]tates should rapidly replace outdated and
vulnerable voting systems” with machines that “[a]t a minimum . . . have a voter-
verified paper trail.”5 Similarly, in March, DHS Secretary Nielsen labeled
electronic voting systems “a national security concern.”6
In January 2018, the Congressional Task Force on Election Security issued a
Final Report addressing the insecurity of the country’s voting infrastructure:
Given the breadth of security risks facing voting machines, it is

especially problematic that approximately 20% of voters are casting
their ballots on machines that do not have any paper backup. These
voters are using paperless Direct Recording Electronic (DRE)
machines that have been shown over and again to be highly
4
http://thehill.com/hilltv/rising/398949-house-intel-chair-calls-for-ban-on-electronic-voting-systems.
5
Senate Select Committee on Intelligence, Russian Targeting of Election Infrastructure During the 2016
Election: Summary of Initial Findings and Recommendations (May 8, 2018) (“SSCI Report”), at
https://www.burr.senate.gov/imo/media/doc/RussRptInstlmt1-%20ElecSec%20Findings,Recs2.pdf.
6 See supra note 3.

Page 9
vulnerable to attack. Because these machines record votes on the

internal memory of the machine, and do not leave any paper backup, it
is near impossible to detect whether results have been tampered with.7
As detailed in the Declaration of Matthew D. Bernhard, attached hereto as
Exhibit A, and in the Brief of Amici Curiae Common Cause, National Election
Defense Coalition, and Protect Democracy (“Common Cause Amici Brief”), these
recent alarms from the federal government amplify years of warnings from
computer scientists, who have uniformly concluded that paperless balloting is
unreliable, unquestionably insecure, and unverifiable. (Bernhard Decl. ¶¶ 13- 20;
Common Cause Amici Brief, [Doc. 240-1, passim]). California’s 2007 “Top-to-
Bottom Review” (“TTBR”)8 found that DREs were “inadequate to ensure accuracy
and integrity of the election results…”; that the system contained “serious design
flaws that have led directly to specific vulnerabilities, which attackers could
exploit to affect election outcomes…”; and that “attacks could be carried out in a
manner that is not subject to detection by audit, including review of software
logs.”9 Citing these vulnerabilities of the Diebold’s AccuVote DREs, California
7
Congressional Task Force of Election Security, Final Report, https://democrats-
homeland.house.gov/sites/democrats.homeland.house.gov/files/documents/TFESReport.pdf (Feb. 14,
2018), at 24 (emphasis added).
8
See Joseph A. Calandrino, et al., Source Code Review of the Diebold Voting System,
http://votingsystems.cdn.sos.ca.gov/oversight/ttbr/diebold-source-public-jul29.pdf (Jul. 20, 2007).
9
See California Secretary of State, Withdrawal Of Approval,
http://votingsystems.cdn.sos.ca.gov/vendors/premier/premier-11824-revision-1209.pdf (Dec. 31, 2009
rev.), at 2, 3.
Page 10
Secretary of State Debra Bowen decertified California’s voting system.10 Ohio’s
2007 “Evaluation and Validation of Election-Related Equipment, Standards and
Testing (“EVEREST”)11 concluded that Ohio’s AccuVote “system lacks the
technical protections necessary to guarantee a trustworthy election under
operational conditions.” 12
Any number of published studies are in accord. (Bernhard Decl. ¶¶ 14, 15,
16, 17; id., fn. 1, 2, 3). 13 The vulnerabilities identified by all of these
governmental authorities and computer experts apply specifically to the DREs used
by the State of Georgia today. (Bernhard Decl. ¶ 21; Lamb Decl. ¶¶ 7-10 ).
Significantly, the flaws in DREs can be exploited whether or not the
machines are directly connected to the Internet. An attacker can gain physical
access to a memory card in many different ways and could by that means install
malicious code that spreads automatically from machine to machine. Similarly, an
attacker could infect the programming by emailing a virus to election officials
responsible for programming the machines. An attacker with access to the server
on which DRE software is stored – like the KSU server discussed below – could
10
See Withdrawal Of Approval, supra note 9, at 5.
11
Pennsylvania State Univ., et al., EVEREST: Evaluation and Validation of Election-Related Equipment,
Standards and Testing, https://www.eac.gov/assets/1/28/EVEREST.pdf (Dec. 7, 2007).
12
See EVEREST, supra note 11, at 103.
13
See also Feldman, et al., “Security Analysis of the Diebold AccuVote-TS Voting Machine,” Proc. 2007
USENIX/ACCURATE Electronic Voting Technology Workshop, 1 (Aug. 2007).
Page 11
alter the software surreptitiously so that election officials themselves install the
malware in the course of election preparations. Demonstrations show that it is
easy to break into AccuVote TSXs with nothing more than a BIC pen and install
vote-stealing software that changes votes in undetectable ways. (Bernhard Decl.
¶¶ 29-30).
3. Georgia’s System Has Already Been Compromised
The already unacceptable extreme vulnerability of Georgia’s system was
greatly increased by Secretary Kemp’s failure to secure the State’s central election
server before and after the 2016 elections. (See generally Lamb Decl. ¶¶ 11- 19).
From at least 2002 until at least December 31, 2017, Georgia’s Secretaries of State
have contracted with Kennesaw State University (“KSU”), for the creation of the
Center for Election Services (“CES”) at KSU to assist the Secretary in the
fulfillment of his statutory duties to manage Georgia’s DRE system. CES’s
Executive Director Merle King maintained a computer server with the URL
“elections.kennesaw.edu,” on which CES hosted a comprehensive assemblage of
electronic files consisting of software applications, password files, tabulation
database programs, encryption keys, confidential voter registration information,
ballot proofs, technical training videos, and other sensitive information critical to
the safe and secure operation of Georgia’s DRE-based voting system. The
information hosted on the “elections.kennesaw.edu” server was not authorized to
Page 12
be publicly accessible. But between at least August 2016 and March 2017, and
likely for a much longer time, this server was fully accessible to any computer user
with Internet access.
In late August 2016, cybersecurity researcher Logan Lamb accessed files
hosted on the “elections.kennesaw.edu” server on the public internet, including the
voter histories and personal information of all Georgia voters, tabulation and
memory card programming databases for past and future elections, instructions and
passwords for voting equipment administration, and executable programs
controlling essential election resources. When he accessed these sensitive files,
Lamb noted that the files had been publicly exposed for so long that Google had
cached (i.e., saved digital backup copies of) and published much of the sensitive
data on the Internet. (Lamb Decl. ¶¶ 13- 14).
On August 28, 2016, Lamb contacted King by telephone and email to warn
him that CES should assume that the sensitive documents hosted on the
“elections.kennesaw.edu” server had already been downloaded by unauthorized
persons and that all sensitive files should be considered compromised. King
immediately informed CES staff of the breach. Yet for reasons that have never
been explained, the server was not secured for months. Lamb and colleague
Christopher Grayson accessed the server again several times in late February 2017
and on March 1, 2017, and they were repeatedly able to access and download the
Page 13
same types of files that Lamb had accessed months earlier. (Lamb Decl. ¶ 15).
On March 1, 2017, Grayson contacted a KSU Computer Science Instructor
and informed him of the exact times and IP addresses of his own recent repeated
access of the unsecured voting system server. KSU finally caused the elections
server to be isolated from the public Internet on or about March 1, 2017.
After it became known that the “elections.kennesaw.edu” server was
compromised, CES staff emails indicate that Secretary Kemp’s agents at KSU did
not conduct or order a forensic examination to determine whether the server had
been altered or manipulated. Neither Secretary Kemp’s agents at KSU, nor his
internal staff at the Secretary of State’s office, has ever properly verified the
integrity of any software, passwords, databases or encryption keys that were hosted
on the compromised “elections.kennesaw.edu” server. As a consequence, the
compromised software, passwords, and encryption keys continue to be used on the
equipment that has been and will be employed to conduct Georgia’s public
elections. (Lamb Decl. ¶ 19).
According to recent indictments issued by Special Counsel Robert Mueller,
at the same time that Lamb was alerting Secretary Kemp’s team at KSU that
Georgia’s server was completely exposed, and Secretary Kemp’s team were doing
nothing about it, Russian operatives were visiting “the websites of certain counties
Page 14
in Georgia, Iowa, and Florida to identify vulnerabilities.”14
4. Secretary Kemp’s Agents Have Destroyed the Evidence of Who

Accessed the KSU Server
Evidence of these and other intrusions into Georgia’s system has probably
been destroyed and lost forever due to the deliberate actions of Secretary Kemp’s
agents after the filing of this lawsuit. At least by the filing of this lawsuit on July
3, 2017, Secretary Kemp and his agents were under a duty to preserve evidence.
In clear breach of this duty, the Secretary’s agents, three days after this lawsuit was
filed, destroyed all data on the hard drives of the KSU “elections.kennesaw.edu”
server. On August 9, 2017, less than 24 hours after this action was removed to this
Court, Secretary Kemp’s agents went further and destroyed all data on the hard
drives of a secondary server hosted at “unicoi.kennesaw.edu,” which contained
similar, but not identical data, to that on the “elections.kennesaw.edu” server. The
“logfiles” that contain historical records of external access from the public Internet
to the “elections.kennesaw.edu” and “unicoi.kennesaw.edu” servers would have
been deleted when all data on the respective servers’ hard drives were destroyed.
The destruction of this data is significant in two respects. First, the loss of
the data will make it impossible for Georgia to determine the nature and extent of
any intrusions into the system and, accordingly, to remedy the harm caused
14
United States v.Netyksho, et al., Indictment (D.D.C., July 13, 2018) ¶ 75.
Page 15
thereby. Second, the destruction of the data on these servers entitles Plaintiffs, at a
bare minimum, to evidentiary presumptions that will make success on the merits
even more likely. Kraft Reinsurance Ireland, Ltd. v. Pallets Acquisitions, LLC,
845 F. Supp. 2d 1342, 1358 (N.D. Ga. 2011) (“Spoliation is the
destruction...of evidence, or the failure to preserve property for another’s use
as evidence in pending or reasonably foreseeable litigation.”).
5. Georgia’s Voting Security Failure Has Not Been Remedied
Secretary Kemp may contend that the fact that Georgia’s server may have
been ravaged by foreign or domestic criminals in 2016 and 2017 does not have an
impact on the current vulnerability of Georgia’s election system because election
files are now on a new server with purported proper security under the direct
control of the Secretary of State.
The overwhelming evidence, however, establishes to the contrary. “A
massive, time-consuming effort would be required to address the security breaches
that occurred in Georgia,” states expert Matt Bernhard, “requiring experienced
technicians to give hands-on attention to individual machines (tens of thousands of
pieces of equipment), one at a time.” (Bernhard Decl. ¶ 44). Because of the
interconnected nature of the system, which consists of thousands of vulnerable
electronic components, properly decontaminating the components at risk across the
state would be a nearly impossible undertaking. (Bernhard Decl. ¶ 45; see also
Page 16
Lamb Decl. ¶ 20). There is no evidence that Georgia has even attempted to
mitigate the massive risks created by the KSU exposure.
6. Evidence of Malfunctions in Recent Elections
In addition, there is alarming new evidence that Georgia’s DRE voting
system has inexplicably malfunctioned in recent elections in ways that impact
voters directly:
• Voter eligibility information in the Diebold electronic pollbooks (part of the
certified DRE system) differs from Secretary of State’s official voter
registration records, which has caused potential and actual
disenfranchisement. (Clark Decl. ¶¶ 10-15; Bowers Decl. ¶¶ 35-46; Marks
Decl. ¶ 2).
• Inaccurate political party designation in electronic pollbook has caused voter
disenfranchisement. (Luse Decl. ¶¶ 6-8).
• Unauthorized changes in the voter registration records have changed polling
places and assigned voters to improper districts. (Mitchell Decl. ¶¶ 8-11).
• Inaccurate DRE electronic ballots have been issued to at least one voter,
causing the DRE screen to display wrong districts and candidates during
early voting – plainly subjecting unwary voters to disenfranchisement.
(Kadel Decl. ¶¶ 8-28).
Page 17
• Numerous polling place recap sheets provided by Fulton County to Coalition
Plaintiffs have revealed unresolved material differences between the number
of voters voting at the polling place and the number of ballots cast as
reported on the DRE machine results tapes. (Marks Decl. ¶ 2, Ex. 2).
• A DRE machine tabulation results tape in Hall County did not include
results from 9 races, suggesting the possibility that voters were not given a
complete ballot or votes were not counted. (Bowers Decl. ¶¶ 5-8; Copeland
Decl. ¶ 5).
• DRE machines have printed irregular timestamps indicating materially
delayed ballot tallies and reporting and machine malfunction. (E.g., Bowers
Decl. ¶ 19; Copeland Decl. ¶ 9).
• A Hall County voting machine malfunctioned, was taken out of service and
showed no votes cast on a delayed closing tape. Pollworkers had difficulty
closing the polls and disagreed on whether votes were cast on the problem
machine. (Bowers Decl. ¶¶ 25-31).
• Voter turnout of more than 100% was reported in precincts in Habersham
County and Fulton County. (Marks Decl. ¶ 4, Ex. 3).
It is almost a certainty that the discrepancies reported to Plaintiffs and
described above are only a small fraction of the actual number of problems
encountered state-wide. These errors are consistent with the kinds of errors that
Page 18
experts would expect to be generated by malware, programming errors, or other
sources of computer system malfunction. (Bernhard Decl. ¶ 49).
7. International Threat Intensifies: “The Lights Are Blinking”
The vulnerability of Georgia’s DRE voting system is not only an issue of
past exposure, but a matter of ongoing and growing concern. Director of National
Intelligence Daniel Coats stated on July 17, 2018: “Every day, foreign actors —
the worst offenders being Russia, China, Iran and North Korea — are penetrating
our digital infrastructure and conducting a range of cyber intrusions and attacks
against targets in the United States.”15 The federal government is issuing similar
reports and warnings daily. At a hearing on this Motion, Plaintiffs will present
expert testimony that makes plain to this Court what the U.S. government and
private researchers already know — Georgia’s voting system is a catastrophically
open invitation to malicious actors intent on disrupting our democracy.
8. Conclusion – Plaintiffs are Likely to Succeed on the Merits
On the basis of the foregoing, as to Plaintiffs’ fundamental right to vote
claim (Count One), Plaintiffs are likely to succeed at trial on the merits by
establishing with overwhelming evidence that Georgia’s DRE voting system is
extremely vulnerable to attack, by design is unverifiable, and has been further
15
Remarks of D. Coats to Hudson Institute, July 17, 2018. Transcript available at
https://www.npr.org/2018/07/18/630164914/transcript-dan-coats-warns-of-continuing-russian-
cyberattacks. (Last viewed July 30, 2018).
Page 19
compromised by the Defendants’ neglect. Plaintiffs will further show that the risk
that votes will be miscounted or diluted outweighs any interest of the State in
insisting upon the continued use of these machines. Crawford, 553 U.S. at 190.
As to Plaintiffs’ claim under the Equal Protection Clause (Count Two),
Plaintiffs will likely succeed in establishing that users of DRE machines are “less
likely to cast an effective vote” than users of paper ballots because of the foregoing
vulnerability and flaws in the DRE voting system. Wexler, 452 F.3d at 1231.
B. Plaintiffs Are Likely to Suffer Irreparable Harm
The harm to Plaintiffs if the injunction is not granted is by its very nature
irreparable. Voting is a “fundamental political right, because preservative of all
rights.” Yick Wo v. Hopkins, 118 U.S. 356, 370 (1886). There will be no remedy –
through damages or otherwise – if the DRE system fails to issue correct ballots or
count the votes in the November and December 2018 elections correctly.
Defendants may contend that Plaintiffs cannot prove to a metaphysical
certitude that the DREs will miscount their votes. This argument misstates the
legal test and miscomprehends the nature and extent of the threatened injuries.
First, the test for granting equitable relief is not whether injury is certain to occur,
but whether it is “likely” to occur. Winter, 555 U.S. at 20. Plaintiffs have shown
that, unless this injunction is granted, the legitimacy of Georgia’s election results
will be cast into doubt and irreparable harm is likely to occur to the right of voters
Page 20
to have their votes correctly counted. Second, the likely miscounting of any votes
infringes upon Plaintiffs’ constitutional rights. Anderson v. United States, 417
U.S. 211, 226 (1974) (Marshall, J.) (“The deposit of forged ballots in the ballot
boxes, no matter how small or great their number, dilutes the influence of
honest votes in an election, and whether in greater or less degree is immaterial.”).
Third, Georgia’s use of paperless electronic voting system undoubtedly
increases the risk of irreparable harm, and the increased risk of harm constitutes
actual injury. See Monsanto Co. v. Geerston Seed Farms, 561 U.S. 139, 153-154
(2010) (“A substantial risk of gene flow injures respondents in several ways”);
Massachusetts v. E.P.A., 549 U.S. 497, 526 (2007) (“The risk of
catastrophic harm, though remote, is nevertheless real.”); Farmer v. Brennan, 511
U.S. 825, 828 (1994) (“‘A prison official's ‘deliberate indifference’ to a
substantial risk of serious harm to an inmate violates the Eighth Amendment.”).
Indeed, the actual harm with respect to Plaintiffs’ equal-protection claim is the
increased risk that DRE votes will not be counted correctly or verified in post-
election challenges relative to verifiable paper ballots. Wexler, 452 F.2d at 1231.
That harm – the increase in the risk - is certain to occur.
Finally, the widespread acceptance of the legitimacy and accuracy of an
election is itself a value that is certain to be irreparably harmed if the election goes
forward using Georgia’s profoundly vulnerable and concededly unverifiable
Page 21
system. What Judge Biery said in Casarez v. Valverde County over twenty years
ago unquestionably remains true today: “‘Those who have studied history and have
observed the fragility of democratic institutes in our own time realize that one of
country’s most precious possessions is . . . widespread acceptance of election
results.’” 957 F. Supp. 847, 865 (W.D. Tex. 1997) (citation omitted).
C. Balance of Equities Favors Granting the Injunction
The balance of equities tips heavily in Plaintiffs favor. On the one hand, the
weight of Plaintiffs’ equities is substantial. “No right is more precious in a free
country than that of having a voice in the election of those who make the laws
under which, as good citizens, we must live. Other rights, even the most basic, are
illusory if the right to vote is undermined.” Wesberry, 376 U.S. at 17.
On the other hand, the injunction will not cause Defendants substantial
harm, but will merely require Defendants to do what every federal agency on
record has urged the State to do: use paper ballots to record votes. An injunction
also will not cause Defendants to do anything new. Defendants already record
votes by paper ballot and count them by optical scanner or by hand; the injunction
will of course cause a substantial increase in the number of votes cast by paper
ballot, but the actual burden of this change on the Defendants will be slight.
Indeed, the cost of additional paper ballots and associated supplies (felt tip
pens, cardboard privacy screens) is likely to be more than offset by the savings
Page 22
associated with not having to deploy tens of thousands of labor-intensive DRE
machines. The State of Maryland in 2016 switched from the type of DRE
machines that Georgia uses to the paper ballot/optical scanner process that would
be deployed if this preliminary injunction were granted. Rebecca Wilson, Chief
Election Judge at Precinct 17-01 in Prince George’s County, Maryland, states in
her declaration that Maryland’s paper ballot system “is far easier and faster to set
up, manage and close down” than were the previous DRE machines. (Wilson
Decl. ¶ 5). Ms. Wilson’s highly detailed declaration shows how the number of
steps necessary to set up and close down the paper ballot and optical scanning
system is a small fraction of the effort to set up and close down the DRE machines
in her precinct. (Wilson Decl. ¶¶ 6-12). Wilson further explains that it took little
or no pollworker training to make the switch, and that “[v]oters have expressed to
me that they were happy with the new paper balloting equipment.” (Wilson Decl.
¶¶ 13-17, 26). Indeed, even this framing of the issue is overly generous to
Defendants, for these cost estimates do not measure the astronomical cost to the
State if the election is hacked.
Finally, District Courts have repeatedly found that fundamental voting rights
outweigh the administrative cost associated with fixing election systems or
procedures. An illustrative case is NAACP v. Cortes, 591 F. Supp. 2d 757 (E.D.
Pa. 2008). In Cortes, the plaintiff sued seven days before the 2008 general
Page 23
election, seeking an injunction addressing Pennsylvania’s contingency plans in the
event that the DREs in a polling place malfunctioned. The District Court granted
the injunction and issued an order requiring the Secretary of the Commonwealth to
direct County Boards to distribute paper ballots whenever 50% of the electronic
voting machines in a precinct became inoperable. The District Court rejected as
factually unfounded the defendants’ arguments that changing the rule as to use of
paper ballots would “cause chaos and confusion,” and that poll workers had not
been trained as to the simultaneous use of paper ballots and DRE machines. While
the court agreed that the suit was filed “at the eleventh hour,” the court found that
“the granting of injunctive relief as requested will cause minimal harm to
defendants.” 591 F. Supp.2d at 763, 768.
Other district courts have reached the same conclusion in cases involving
election systems and processes. “Although these reforms may result in some
administrative expenses for Defendants, such expenses are likely to be minimal
and are far outweighed by the fundamental right at issue.” United States v. Berks
County, 250 F. Supp. 2d 525, 541 (E.D. Pa. 2003) (granting preliminary
injunction); see also Johnson v. Halifax County, 594 F. Supp. 161, 171 (E.D.N.C.
1984) (granting preliminary injunction, finding that administrative and financial
burdens on defendant not undue in light of irreparable harm caused by unequal
opportunity to participate in county election).
Page 24
D. Injunction Is in the Public Interest
The requested relief is in the public interest because it is in accord with the
unanimous, and urgent, recommendations from officials at the highest levels of the
Federal Government. In addition, public confidence in Georgia’s election systems
will be greatly enhanced by the granting of the requested relief. “‘The public must
have confidence that the election process is fair.’” Casarez, 957 F. Supp. at 865
(granting preliminary injunction in election case) (citation omitted). The
preliminary injunction requested by the Coalition Plaintiffs is manifestly in the
public interest.
CONCLUSION
For the foregoing reasons, the Motion should be granted.
This 3rd day of August, 2018.
/s/ Bruce P. Brown /s/ Robert A. McGuire, III

Bruce P. Brown Robert A. McGuire, III
Georgia Bar No. 064460 Admitted Pro Hac Vice
BRUCE P. BROWN LAW LLC (ECF No. 125)
Attorney for Coalition for Attorney for Coalition
Good Governance for Good Governance
1123 Zonolite Rd. NE ROBERT MCGUIRE LAW FIRM
Suite 6 113 Cherry St. #86685
Atlanta, Georgia 30306 Seattle, Washington 98104-2205
(404) 881-0700 (253) 267-8530
Page 25
/s/ William Brent Ney /s/ Cary Ichter

William Brent Ney CARY ICHTER
Georgia Bar No. 542519 Georgia Bar No. 382515
Attorney for Coalition Attorney for Coalition
for Good Governance, William for Good Governance, William
Digges III, Laura Digges, Digges III, Laura Digges,
Ricardo Davis, and Megan Ricardo Davis and Megan
Missett Missett
NEY HOFFECKER ICHTER DAVIS LLC
PEACOCK & HAYLE, LLC 3340 Peachtree Road NE
1360 Peachtree Street NE Suite 1530
Atlanta, Georgia 30309 Atlanta, Georgia 30326
(404) 842-7232 (404) 869-7600
Page 26

ATLANTA DIVISION

Plaintiffs,
v.
BRIAN KEMP, ET AL.,

Defendants.
CERTIFICATE OF COMPLIANCE
I hereby certify that the foregoing document has been prepared in
accordance with the font type and margin requirements of LR 5.1, using font
type of Times New Roman and a point size of 14.
/s/ Bruce P. Brown

Bruce P. Brown
Good Governance
Suite 6
(404) 881-0700
Page 1

ATLANTA DIVISION

Plaintiffs,
v.
BRIAN KEMP, ET AL.,

Defendants.
This is to certify that I have this day caused the foregoing COALITION
PLAINTIFFS’ BRIEF IN SUPPORT OF MOTION FOR PRELIMINARY
INJUNCTION to be served upon all other parties in this action by via electronic
delivery using the PACER-ECF system.
/s/ Bruce P. Brown

Bruce P. Brown
Good Governance
Suite 6
(404) 881-0700
Page 2

ATLANTA DIVISION

Plaintiffs,
v.
BRIAN KEMP, ET AL.,

Defendants.
DECLARATIONS IN SUPPORT OF PLAINTIFFS’ MOTION FOR

PRELIMINARY INJUNCTION
August 3, 2018
DECLARATION OF MATTHEW D. BERNHARD


UNITED STATES DISTRICT COURT FOR
THE NORTHERN DISTRICT OF GEORGIA
ATLANTA DIVISION

)
DONNA CURLING, et al. )
)
Plaintiff, )
) CIVIL ACTION FILE NO.:
vs. ) 1:17-cv-2989-AT
)
BRIAN P. KEMP, et al. )
)
Defendant. )
)
)

DECLARATION OF MATTHEW D. BERNHARD

MATTHEW D. BERNHARD ("Declarant") hereby declares as follows:

1. I am Ph.D. candidate at the University of Michigan in Computer Science with a
focus on computer security. I received my Bachelor’s degree from Rice University, and my
Master’s in Computer Science from the University of Michigan.

2. I have focused my study in the field of computer science, including cyber-security
in voting systems since 2012, including specific work on new, secure voting technology (the
STAR-Vote system from Austin, Texas). I have worked with the Verified Voting Foundation on
gathering data about currently deployed voting systems. I consulted with the Jill Stein recount
campaign in 2016 to assess threat models and incident reports in Michigan, Wisconsin, and
Pennsylvania. I have also worked with other experts in the field to provide a theoretical survey of
properties of election security.

3. Following the 2016 recount, I, along with a colleague, performed a statistical
analysis of the data generated in the 2016 recounts in Wisconsin and Michigan. Our findings
highlighted a lack of strong evidence towards concluding that the 2016 election was sufficiently
secured in those states, as well as highlighting some anomalous data. For example, our findings
indicated that the Optech IIIPEagle machines in use in some Wisconsin counties had a
significantly high error rate. These machines were subsequently decertified and taken out of use
in Wisconsin. We also found significant anomalies in Michigan’s Wayne County, owing to the
fact that the chain of custody had been compromised in almost half of precincts. In response to

1
BERNHARD DECLARATION
these anomalies, the state launched an investigation into Wayne county and subsequently
purchased new voting equipment for the whole of the state.

4. During the last 8 months I have conducted focused research on Diebold AccuVote
voting system, of the type used by Georgia, with a specific emphasis on TS and TSX machines.
That research has included inlab testing at the University of Michigan on machines acquired
through eBay, during which we performed an indepth technical analysis of the systems and
found significant vulnerabilities. I have also on several occasions observed AccuVote units in the
field in Georgia, both at the Fulton County Election Preparation Center on multiple occasions
and at the Grady High School precinct during an election. As with lab testing, I observed a
significant number of operational vulnerabilities that make Georgia’s election infrastructure
fundamentally unsafe and untrustworthy.

5. I have published and spoken extensively about the cybersecurity and other risks
of electronic voting systems and have assisted in preparation of other experts for Congressional
testimony concerning these topics.

6. A copy of my curriculum vitae is attached as Exhibit A.
T I
7. Paperless voting machines, of the type used in Georgia, directly record votes to an
electronic storage medium. Such machines are called Direct Recording Electronic voting
machines, or DREs for short.

8. As DREs only record votes to an electronic medium, e.g. a USB stick, a voter has
no way of independently verifying that the button they touched on the screen is what the machine
recorded in memory. Other voting mechanisms, like paper ballots, provide this feature, which is
called a voterverifiable paper audit trail (VVPAT). VVPATs allow voters to check that the vote
cast is the vote they intended, independent of the system itself.

9. As DREs do not have this feature, it is impossible for a voter to check that their
vote was recorded as they intended. Since voters are stored solely in memory, if something in the
software were causing votes to be misrecorded, such an error could similarly cause the system to
misreport that it was correctly recording votes. If the system is not correctly recording votes,
either in error or out of malice, there is no way to tell. Any assurance provided by the machine
would be akin to a criminal insisting that he did not commit the crimeother evidence is needed
to corroborate the claim.

10. Because DREs provide no way to independently verify that votes are correctly
recorded, security experts strongly recommend against their use with near unanimity, a
recommendation with which I concur.

11. DREs are essentially just regular computers, often running the same software as a
commodity laptop. Like any regular computer, DREs are vulnerable to any kind of malicious

2
exploitation, and in fact often moreseo as they typically run outofdate software that lacks
critical security patches. Exploitable vulnerabilities in DREs run the full gamut: buffer overflows
in the vote recording software, privilege escalation bugs in the operating system, improper
checksum verification by the bootloader, and architectural flaws such as improper use of voter
authentication technologies are just a few examples at various levels of the DRE system. Using
one of these exploitations, an attacker can make the DRE do just about anything. For example,
my academic advisor made one such DRE, the Sequoia AVC Edge, run PacMan. There is
nothing different about Georgia’s voting system that would prevent a similar exploitation. This
level of vulnerability makes it exceedingly possible for DREs to be infected with software that
does not accurately record votes.

12. Since DREs have no way to independently verify votes as recorded, any software
that could change votes could do so undetected. Since DREs are not made available for public
auditing, there is no way to determine if their software has been modified in anyway. Even if
such an audit were to be performed, it is still not certain that it would definitively prove the
machines are free from infection. As such, for the individual voter and election official, there is
no way to know that a DRE machine has accurately recorded votes. These machines could
essentially output random results and, barring results that prove surprising in light of other
evidence, no one would know. Worse, even if suspicions about incorrect election results were
raised, DREs provide no recourse to explore, detect, or correct for these mistakes. In short, DREs
are in no way fit to be trusted with any election process.

13. Other experts in the field of voting system security and computer science and I
rely on a body of academic research conducted over the years that includes the following key
reports as summarized in paragraphs 14 through 25.

14. Kohno et al.’s 2004 “Analysis of an Electronic Voting System”1 report is the first
independent security analysis of a Diebold voting system that I am aware of. The report focuses
on the election management system (EMS) and AccuVote TS machine, the same that is used in
Georgia. The report’s authors found that it is possible to create voter access cards which enable
the voter to vote an unlimited number of times. The report also highlighted numerous
vulnerabilities in the source code that can be exploited to gain complete control over the voting
system as well as show how each voter voted. This report spurred the commissioning of
additional analyses of the AccuVote TS by the states of Ohio (Compuware2) and Maryland
(SAIC3, RABA4). All of these reports corroborated the findings of Kohno et al., even
implementing voter access cards granting unlimited votes.

3
15. An independent study on behalf of Blackbox Voting was conducted by Harri
Hursti in 2006,5 following the work of Kohno et al. This study looked exclusively at the
AccuVote TS and TSX machines. This report explains the vulnerabilities present in Windows
CE, the operating system of the machines, which provides almost no security beyond what an
application itself can provide. Essentially, rather than attacking the voting software itself, an
attacker can attack the operating system to completely control the system, or, at a lower level, the
bootloader. The report also notes that the machine lacks physical security: with just a Philips
head screwdriver an attacker can completely circumvent the locks and seals meant to protect the
internals of the machine. With this level of vulnerability, an attacker can coerce the voting
machine into doing anything.

16. A contemporaneous 2006 study done at Princeton by Feldman et al.6 examined
just the AccuVote TS. This study confirmed findings of prior work. Additionally, this study
implemented a new attack, whereby software designed to steal votes (a virus) is installed on the
machine by exploiting the vulnerabilities highlighted in previous work. Once on the machine, the
virus can completely change votes, and additionally make copies of itself onto any removable
media that is plugged into the machine. In this way, an attacker with access to only one voting
machine can potentially infect an entire precinct, county, or in Georgia’s case, state, as the
software reproduces in an exponential fashion with each new infection. Some of the
vulnerabilities highlighted in the study are hardwarebased, and thus not patchable. These
vulnerabilities exist in the machines to this day. The study also found that logic and accuracy
testing and parallel testing, methods to detect and reduce machine errors, do not detect any
malicious behavior by the machine.

17. Kiayias et al., researchers from the University of Connecticut,7 built on Hursti and
Feldman et al., designing an attack against the AccuVote TSX machine that could swap
candidate order or remove a candidate from the ballot by exploiting many of the vulnerabilities
pointed out in the earlier studies.

18. The ToptoBottom Review (TTBR),8 commissioned by the State of California in
2007, found that every component of Diebold voting systems, of the type used in Georgia, were
riddled with vulnerabilities. With access only to the election management system (EMS, called
GEMS by Diebold) and a few of the machines, researchers found vulnerabilities which, if
exploited, permit attackers to gain full access to the election management system and complete
control of individual voting machines, including the ability to surreptitiously add, delete, or
change votes. The EMS was found to have insufficient passwords, integer overflow bugs, no
security enforcement outside the graphical user interface, and lack of critical security patches to
the Windows operating system it runs on. Essentially, an attacker could modify any data in the
EMS (ballot styles, vote databases, etc.) as well as gain control of the operating system. The
TTBR corroborated prior work about significant, numerous vulnerabilities in the voting
machines and expanded it, finding a lack of input validation in voteraccessible fields that lead to

4
erratic behavior, privilege escalation that would enable a voter to gain full administrative control
over the voting machine with little to no effort, and that election administrator credentials can be
extracted from the memory cards used to store votes during the close of election process. The
TTBR also found that the machines expose how voters vote.

19. The EVEREST report9 commissioned by the State of Ohio in 2007 corroborated
the TTBR and found similar issues in Premier (Diebold) systems. In addition to further
confirming prior work, EVEREST also examined ExpressPoll books, computers used to verify
voter registration data and authorized voters to vote on election day. The ExpressPoll, considered
to be a critical component of Georgia’s DRE election system, was found to have similar
vulnerabilities to the other systems already studied: lack of security patches, unencrypted voter
records, and insecure booting procedures that allow an attacker to run any software, including
malware, on the unit. EVEREST also found new vulnerabilities in GEMS and the AccuVote
TSX, including key reuse, unauthenticated log access (anyone can forge an audit log), a shared
SSL certificate between the EMS and TSX, allowing an attacker to impersonate the EMS and
upload fake election results, lack of accurate security protections on data keys, BIOS password
reuse that would allow an attacker to run arbitrary software, and unpatched operating system
vulnerabilities that allow an attacker to gain full access to the EMS or voting machine.

20. The Florida Department of State commissioned a study of Diebold voting
software in 200710 to examine Diebold election management software, touchscreen voting
machines, and optical scan voting machines. This report was independent and contemporaneous
with the EVEREST and TTBR reports. The study focused only on corroborating prior
vulnerability findings from Hursti, Feldman et al., Kohno et al., Ohio’s Compuware assessment,
and Maryland’s RABA and SAIC reports. The study found that some issues from prior source
code reviews had been fixed in inthefield machines, but many other attack vectors, like
unlimited votes with smart cards or operating system vulnerabilities had not been fixed and still
presented an avenue for attack.

21. All of these studies explore electronic voting systems used in Georgia. Much of
the research was conducted on BallotStation versions 4.3, 4.4.1, and 4.6.4. While the version
used in Georgia, 4.5.2! has a high overlap in functionality and form to these previously studied
systems, it is not known how much functionality, and by extension vulnerability, overlap.
However, given that many of the vulnerabilities above rely on the architecture of the voting
system, not particular features of the software, it is almost certain that they apply to Georgia’s
system.

22. A few cursory examples of vulnerabilities that apply to Diebold software,
regardless of version, include the smartcard vulnerabilities, wherein any malicious party can craft
a smartcard that impersonates a voter access card but which ignores the machine’s command to
deactivate itself. In effect, voter cards which allow an unlimited number of votes are still possible
in the Georgia system.

5
23. Georgia’s system still runs on Windows CE, an operating system which has not
been supported in 5 years. This means that critical security patches that would mitigate some of
the lowerlevel attacks proposed and implemented above simply do not exist. As the operating
system is over twenty years old, it lags behind the two decades of computer security research and
is extremely vulnerable to a wide variety of attacks that Diebold’s software, regardless of
version, cannot defend against. If Diebold’s software is a house, the operating system is the
foundation upon which the house is built. No amount of drywall repair can fix a cracked
foundation.

24. Georgia’s voting machine are still programmed using PCMCIA memory cards,
and any piece of software hosted on such a memory card can infect the voting machine, as the
Princeton study demonstrated. Officials are quick to claim that the machines are not connected to
the Internet, and therefore secure, but as we have witnessed in the Stuxnet episode11 as well as
recent Russian attempts to infiltrate other critical infrastructure,12 this does not prevent malware
from coming in contact with the voting machines.

25. Finally, the fundamental architecture of Georgia’s voting machines, specifically
the AccuVote TS and AccuVote TSX, prevent them from providing reliable evidence that the
election results they produce are correct. Votes merely exist on memory cards, and any source of
error, malice, or act of god can change the votes and leave absolutely no indication that such a
change has occurred. Even if such a change were detected, all original evidence of voter intent
no longer exists, so it is not possible to reconstruct a correct election result. In short, Georgia’s
voting machines fail to meet the burden of proof for accurate, verifiable election outcomes: a
durable record of voter intent. For this reason, these machines are unfit for use in any electoral
context.

M D
26. In recent months my academic advisor and I have begun replicating past research
into AccuVote TS and TSX machines, as well as attempting to find new vulnerabilities in more
recent versions of the software. As Georgia’s software is totally unavailable, my efforts have
primarily focused on BallotStation 4.7.

27. We have successfully recreated the unlimited voter access card attack, and I am
confident that, given just a few seconds with access to one of Georgia’s voting machines, I could
very easily produce a card that would let any Georgia voter vote as many times as they would
like.

28. We have observed that more recent versions of the voting software application,
BallotStation, does include fixes for some of the more egregious vulnerabilities found in prior

6
work. For instance, votes are no longer stored completely in plaintext, and the cryptographic key
used on each machine is now no longer the same. However, the fixes put in place are fairly easily
defeated: malware can read the keys out of memory and decrypt votes.

29. The physical security of the machines is easily defeated. The AccuVote TS
machines have their memory cards and power buttons protected by a lock that is keyed by the
same key used in minibars and jukeboxes, which is readily available for purchase online. Failing
this, the locks can be picked in under 10 seconds. The power button and memory card are
protected in a similar fashion on the TSX, however the lock used on that machine is a cylindrical
lock. I can pick this lock in less than ten seconds with nothing but a BIC pen. Video of my first
attempt at this can be found here: https://www.youtube.com/watch?v=vqNJL0fYwSk .

30. Votestealing software that changes votes in an undetectable way has been put on
TSX machines by my advisor and I, targeting the 4.6.4 version of BallotStation. We
demonstrated this for the New York Times here:
https://www.nytimes.com/video/opinion/100000005790489/i-hacked-an-election-so-can-the-russ
ians.html

31. We have observed that the seals used to secure individual voting machines after
the close of polls may be purchased on Amazon13. If an attacker were to break off a seal, it would
be easy to simply replace it, and etch the serial number of the broken seal on the replacement
seal. The same can be said for the cable ties used to secure the voting machines in a precinct to
each other.

32. In short, with even a short window of access to one of Georgia’s voting machines,
it would be easy for an attacker to install undetectable votestealing software. I have personally
observed Georgia election workers leave voting equipment unattended and insufficiently sealed
to prevent tampering within the last 30 days.

33. Due to the architectural flaws of the system, and failures in operational security at
many levels, it is not possible for any person to faithfully attest that each voting machine in the
state of Georgia is free from malware that could affect election results.

N
34. After the primary on Tuesday, July 24th, 2018, I and my colleagues observed the
close of polls at Grady High School in Atlanta, Georgia. After the poll workers had closed down
the polling place, they stacked the voting machines and sealed them. At this point, they all left
the gym, leaving myself and my colleagues alone with the voting machines, with only one
security camera watching over us. It would have been very easy for an attacker to disable the
camera and modify the voting machines without detection. As the results of the Princeton study
demonstrate, it only takes one lapse for a virus to propagate from machine to machine, silently
changing votes all over the state of Georgia. As mentioned above, the seals and cable locks on

7
the machines are available for purchase, so they provide no security against this kind of attack.

35. I have also on several occasions visited the Fulton County Election Preparation
Center in 2017 and 2018. On several occasions, I was allowed to roam the warehouse where all
of Fulton County’s voting machines are programmed, serviced, and stored, as well as where
election night results are tabulated and published. The facility was wholesale lacking in
operational security necessary to protect Georgia’s machines from tampering or misuse.

36. In the Fulton County Election Preparation Center warehouse, I witnessed

a. stacks of voter access and supervisor cards that could easily be stolen,
with no chain of custody to ensure none have left the facility,

b. printouts of password sheets are pasted all over the facility, divulging
passwords that would allow anyone to render voting machines
unusable,

c. stacks of memory cards were strewn about during the election
programming process, as many cards are programmed at once using
card replicators. If a virus were present on even one of these memory
cards, the card replicators would ensure that the virus could spread
even more quickly than first imagined in the Princeton study,

d. I was able to learn the threedigit password for the codeprotected door
into the facility while being invited in by a poll worker, and

e. the election prep center has no surveillance on its exterior, save for a
motion detector, and the security cameras inside the facility are often
obstructed by the high warehouse shelves.

37. In Fulton County, votes are transmitted on election night from annexes via
modem, meaning that all ballots from the annexes are sent unencrypted to the tabulation server.
An employee reported that occasionally the phone lines leading into the tabulation server receive
telemarketing calls.

38. Votes transmitted via modem are routed using AccuVote TSX machines into the
tabulation server. Given the vulnerabilities present in the machine, any malware resident on these
machines could very efficiently change election results.

39. In June of 2018 at the Fulton County Election Preparation Center, I observed the
logic and accuracy testing performed on the voting machines before they are sent to their
precincts. These tests are fully automated, and could be easily defeated by malware that simply
kept track of the date. In 2015, it came to light that Volkswagen had written software in their cars

8
to fool emissions tests in just this way, and a voting machine logic and accuracy test is far more
simple than an automobile emissions test.14

40. I understand that four poll books in Georgia were stolen in April 201715. This
raises additional security concerns. The poll books contain an encryption key to generate voter
access cards (VACs). Someone in possession of the poll books could, thus, extract these keys
and use them later to generate VACs that could be used to cast illegal votes, as discussed above.
To address the threat posed by this breach of security, it would be necessary to generate new
encryption keys and install them in all poll books and voting machines.

ADVANCED PERSISTENT THREAT
41. Advanced Persistent Threats (APTs) are cyber attackers that specialize in gaining
unauthorized access to system and maintain that access over a long period of time, undetected. In
order to defend against these kinds of attackers, an incredibly high level of security discipline is
required. After a period of vulnerability, it is a significant effort to identify the presence of APTs
and successfully eliminate their access.

42. Advanced Persistent Threat actors often try to penetrate critical infrastructure
systems in order to gain access, gather intelligence, and gain the ability to create damage at a
time of their choosing. As one example, Exhibit B is an FBI bulletin from 2013 on Advanced
Persistent Threat actors’ attacks against the aviation sector. Exhibit C is a more recent alert from
the Department of Homeland Security, revised on August 23, 2017, detailing activities by “actors
of the North Korean government to target the media, aerospace, financial, and critical
infrastructure sectors in the United States and globally.”

43. Given my knowledge and study of cybersecurity as it pertains to voting systems,
it is extremely likely that APTs are trying to access and manipulate election systems. Given the
level of vulnerability present in Georgia’s voting system, it is a near certainty that if an APT has
tried to get in, it has succeeded. As I myself have gained access to Georgia’s election system, it is
certainly true that a well resourced and motivated attacker could do so as well.

44. A massive, timeconsuming effort would be required to address the security
breaches that occurred in Georgia, requiring experienced technicians to give handson attention
to individual machines (tens of thousands of pieces of equipment), one at a time. The memory
cards also would need to be disinfected or replaced. Such an effort could mitigate the potential
effects of past breaches but future breaches would still be possible.

9
45. Due to the apparent lack of chain of custody of election equipment in Georgia,
specifically voter cards and memory cards, Georgia would have to first provide a way to
exhaustively inventory every piece of election equipment in its possession, and then
meticulously scrub each component to ensure no malware persists. Such an effort would be
enormously costly, and potentially not possible.

46. Even if such a task could be completed, if at any time in the future another
exposure or breach occurs, the entire process would have to be repeated, again at enormous cost.

47. Because of the vulnerability of Georgia’s voting system to software manipulation,
and because of intelligence reports about APTs having attempted to affect elections in the United
States, such precautions appear to be necessary in Georgia. Without significant effort to detect
and revoke access to attackers, the ability for Georgia’s voting systems to correctly carry out
elections should be viewed with even greater skepticism.

48. DREs are fundamentally unable to provide sufficient evidence that the election
results they produce are correct. Given Georgia’s reliance on these machines, and known security
breaches in 2016 and 2017, and the significant challenges to mitigate current vulnerabilities in
the system, it is my opinion that Georgia, in order to effectively run its elections, must abandon
its DREs prior to the upcoming November election.

49. I have reviewed the affidavits and exhibits listed in paragraph _____ of the
Motion for Preliminary Injunction, as well as additional documentation of numerous similar
irregularities from recent elections. The errors reported are consistent with the kinds of errors I
would expect to see generated by malware, programming errors, or other sources of computer
system malfunction. The Diebold DRE system, including the ExpressPollbook, is known to be
vulnerable to malicious manipulation that would produce such errors. Without a forensic
examination of the machines involved in the reports, the reported errors cannot be explained to
any degree of certainty. In some cases, the lack of a reliable audit trail and the ability for
malicious users to install undetectable malware could result in the original source of the
irregularities and malfunctions being indeterminable even in spite of a forensic examination.

50. I declare under penalty of perjury, in accordance with 28 U.S.C. § 1746, that the
foregoing is true and correct.

Executed on this date, August 2, 2018.
3

Matthew D. Bernhard

10
E
X
H
I
B
I
T
Matthew D. Bernhard 2260 Hayward Street
matber@umich.edu Ann Arbor, MI 48109
Main/Cell: 2817258544

EDUCATION
University of Michigan, Ann Arbor, MI (2015 – present)
PhD Candidate Student, Computer Science and Engineering
Advisor: J. Alex Halderman
University of Michigan, Ann Arbor, MI (2015 – 2018)
Master of Science, Computer Science and Engineering
Rice University, Houston, TX (2012 – 2015)
Bachelor of the Arts, Computer Science
Advisor: Dan Wallach
EXPERIENCE
Verified Voting – 2018 - present
Data Science Consultant , Ann Arbor, MI
– Collected, organized, and wrote up technical information about new voting machines
being acquired by localities

Cloudflare – San Francisco, CA
Cryptography Intern, Summer 2017
– Developed Certificate Transparency monitoring features. Also built an SSL detector to
determine what SSL settings customer sites can support.

Computer Security Lab – Rice University, Houston TX
Lead Software Developer , Fall 2012 - Spring 2015
– Lead a team in upgrading and maintaining STAR-Vote, a pedagogical voting system
– Performed usability study on ballot preparation tool
– Explored leveraging utilities provided by the Chromium project to process sandbox and
enforce tighter systems controls
– Examined secure data structures such as authenticated dictionaries for implementing a
secure web bulletin board

Microsoft Research – Microsoft, Redmond WA
Research Intern, Summer 2015, Advised by Josh Benaloh
– Investigated trusted computing features in the Windows operating system
– Designed ASKVote, the Auditably Secure Voting scheme to provide software assurance
and election evidence
– Designed voting client for conference demonstration hall survey
TEACHING
Introduction to Computer Security – University of Michigan
Graduate Student Instructor , Winter, 2018
– Lectured, led discussion section, graded, and provided course support.

Securing Digital Democracy – University of Michigan, Coursera

Course Operations Liaison , 2014 – 2018
– Compiled and maintained course resources and facilitated student discussion in message
boards for course introducing the field of voting technology in the context of computer
security
Fundamentals of Parallel Programming – COMP 322, Rice University
Teaching Assistant, Spring 2015
– Shaped curriculum and led lab discussions for an introductory course on parallel
programming featuring Java parallelism and Apache Spark

Introduction to Program Design – COMP 215, Rice University
Teaching Assistant, Fall 2014
– Led lab discussions and wrote and reviewed assignments and exams for an introductory
course on Java and Object Oriented Programming
PEERREVIEWED PUBLICATIONS
403 Forbidden: A Global View of Geoblocking
Allison McDonald, Matthew Bernhard, Benjamin VanderSloot, Will Scott, J. Alex Halderman,
Roya Ensafi
To appear at the ACM Internet Measurement Conference 2018 (IMC ‘18), Boston,
Massachussetts. November 2018.

Voting Technologies, Recount Methods and Votes in Wisconsin and Michigan in
2016
Walter R. Mebane, Jr. and Matthew Bernhard
Proc. of the 3rd Workshop on Advances in Secure Electronic Voting (Voting '18). Nieuwpoort,
Curaçao. March 2, 2018.

Public Evidence from Secret Ballots
Matthew Bernhard, Josh Benaloh, J. Alex Halderman, Ronald L. Rivest, Peter Y. A. Ryan, Philip
B. Stark, Vanessa Teague, Poorvi L. Vora, Dan S. Wallach
Proc. of the Second Annual Joint Conference on Electronic Voting (E-Vote-ID '17). Bregenz,
Austria. October 24 - 27, 2017.

Understanding the Mirai Botnet
Manos Antonakakis, Tim April, Michael Bailey, Matthew Bernhard, Elie Bursztein, Jaime
Cochran, Zakir Durumeric, J. Alex Halderman, Luca Invernizzi, Michalis Kallitsis, Deepak
Kumar, Chaz Lever,Zane Ma, Joshua Mason, Damian Menscher, Chad Seaman, Nick Sullivan,
Kurt Thomas, Yi Zhou
Proc. of the 26th USENIX Security Symposium (USENIX Security '17). Vancouver, BC, Canada.
August 16 - 18, 2017.

Towards a Complete View of the Certificate Ecosystem
Benjamin VanderSloot, Johanna Amann, Matthew Bernhard, Zakir Durumeric, Michael Bailey,
and J. Alex Halderman
Proc. 16th ACM Internet Measurement Conference (IMC ’16), Santa Monica, California.
November 2016

Implementing Attestable Kiosks
Matthew Bernhard, Gabe Stocco, and J. Alex Halderman
Proc. 14th Annual Conference on Privacy, Security, and Trust (PST ’16), Auckland, New Zealand.
December 2016
SELECTED OTHER PUBLICATIONS
What Might Go Wrong in the 2016 Election
Matthew Bernhard and J. Alex Halderman
Security at Michigan (a Medium publication), November 7th, 2016
The Security Challenges of Online Voting Have Not Gone Away
Robert Cunningham, Matthew Bernhard, and J. Alex Halderman
IEEE Spectrum, November 3rd, 2016
TALKS
Do We Want to Recount or Not? Presidential Election 2016
Matthew Bernhard and Kimball Brace
Election Verification Network (EVN) Symposium 2017, March 15, 2017
Recount 2016: An Uninvited Audit of the U.S. Presidential Election
atthew Bernhard and J. Alex Halderman
M
Roadsec 2017, São Paulo, Brazil, November 11th, 2017
Roadsec Pro 2017, São Paulo, Brazil, November 10th, 2017
Electoral Technology Workshop, SBSeg 2017, Brasília, Brazil, November 6th, 2017
33rd Chaos Communication Congress (33c3), December 28th, 2016
MEDIA APPEARANCES
NPR, Reuters, BBC News, The Guardian, Le Monde, Motherboard, Forbes, The New Republic,
Gothamist, The New Political, The Outline, and Voice of America News and others

E
X
H
I
B
I
T
UNCLASSIFIED//FOR OFFICIAL USE ONLY
FBI Cyber Division

Private Sector Advisory
July 10, 2013
(U//FOUO) APT Actors Increased Interest in the Aviation

Industry
(U) General Observations
(U//FOUO) Since June 2013, the FBI has observed advanced persistent threat (APT) actors’
increased interest in the aviation industry. APT actors have sent spear-phishing e-mails targeting
individuals associated with the air travel industry. Some of the spear-phishing e-mails
originated from a spoofed sender in an attempt to make the e-mail appear more legitimate.
E-mail recipients should be aware of suspicious and potentially malicious e-mail attachments or
links.
(U) Impact of APT Activity
(U//FOUO) Every organization is at risk of UNCLASSIFIED//FOR OFFICIAL USE ONLY

being the target of an APT attack. APT actors,
who are semi-sophisticated and difficult to (U) APTs versus Hackers/Cyber Criminals
detect while on network systems, have already (U//FOUO) Advanced persistent threat actors differ
cost US entities hundreds of millions of from common hackers or cyber criminals by
dollars over the past decade as a result of conducting targeted, rather than opportunistic,
harvesting enormous amounts of critical attacks that seek precise information rather than
information including proprietary data, source monetary gain, more closely resembling espionage.
code, negotiation tactics, and strategic While the activity cannot often be definitively linked
operational plans. These actors have also to any particular nation state, the sophistication,
breached networks containing sensitive resources, and types of information sought suggests
national security information. Going forward, governmental support.
this activity can best be mitigated with
paradigmatic shifts in cyber security.
(U//FOUO) A general overview of the process by which APT actors compromise networks and systems is
detailed in the table below, the vector of infection being most crucial:
Actors search open sources to identify and assess targets for collection
Reconnaissance
1 - Infiltration
and entities/relationships to exploit in the attack.
Typically, well-crafted spear phishing e-mails with linked or embedded

Infection
files containing malicious code serve as the intrusion vector.
Attackers maintain network footholds by obtaining domain

Establish Backdoors administrative credentials and moving laterally through a network,
establishing multiple backdoors.
Persistent threat intruders laterally enumerate a network gathering

2 - Persistence
Enumerate the Network

valid credentials (user accounts and passwords) for multiple systems.
Attackers install any number of several malicious utilities necessary to

Install Utilities
maintain persistence and ultimately steal information.
With access and persistence established, intruders escalate their

Escalate Privileges
privileges and prepare for exfiltration.
Specific documents and e-mails containing targeted data are collected

Harvest Data and packaged into a single, encrypted, and password-protected
compressed file.
3 - Exfiltration
The intruders exfiltrate the compressed file to another compromised

Exfiltration
system in their command and control infrastructure.
Finally, intruders either attempt to clean up their tools, maintaining

Conceal Activity persistence, or set the attack in a dormant state to evade detection
while maintaining access.
(U) Defending Against APT Activity
(U) When weighing available options pertaining to the implementation of appropriate mitigation
strategies, organizations must begin by asking themselves the following:
(U) If proprietary data, personally identifiable information (PII), research and

development-related data, e-mail, or other critical information were stolen, what would
the current and future consequences be?
(U) Has my organization evaluated data criticality based on risk? What must be protected
in the organization?
(U) To mitigate the threat of APT activity, DHS’s United States Computer Emergency Readiness
Team (US-CERT) recommends the following actions:
(U) Audit what needs to be networked and remove (“air gap”) vital information from
networked devices to ensure data protection.
(U) Monitor for and report on suspicious activity, such as spear phishing e-mails, leading
up to significant events and meetings.
(U) Educate users about social engineering and e-mail phishing related to high-level
events and meetings.
(U) Measure expected network activity levels so that changes in patterns can be more
easily identified.
(U) Always treat unsolicited or unexpected e-mail containing attachments or links with
caution, even (and perhaps especially) when the e-mail appears related to known events
or projects.
(U) Reporting Notice

(U) The FBI and US-CERT encourage recipients of this document to report information
concerning suspicious or criminal activity to the local FBI field office. The FBI’s 24/7 Strategic
Information and Operations Center can be reached by telephone at 202-323-3300 or by e-mail at
SIOC@ic.fbi.gov. FBI regional phone numbers can be found online at
http://www.fbi.gov/contact/fo/fo.htm. US-CERT can be reached by telephone at 888-282-0870
or by e-mail at SOC@us-cert.gov. The US-CERT homepage can be found online at www.us-
cert.gov. When available, each report submitted should include the date, time, location, type of
activity, number of people, and type of equipment used for the activity, the name of the
submitting company or organization, and a designated point of contact.
(U) Administrative Note: Law Enforcement Response

(U) Information contained in this product is for official use only. No portion of it should be
released to the media, the general public, or over non-secure Internet servers. Release of this
material could adversely affect or jeopardize investigative activities.
E
X
H
I
B
I
T
TLP:WHITE
Alert (TA17-164A)
HIDDEN COBRA – North Korea’s DDoS Botnet Infrastructure
Original release date: June 13, 2017 | Last revised: August 23, 2017
Systems Affected
Networked Systems
Overview
This joint Technical Alert (TA) is the result of analytic efforts between the Department of
Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). This alert provides
technical details on the tools and infrastructure used by cyber actors of the North Korean
government to target the media, aerospace, financial, and critical infrastructure sectors in the
United States and globally. Working with U.S. Government partners, DHS and FBI identified
Internet Protocol (IP) addresses associated with a malware variant, known as DeltaCharlie,
used to manage North Korea’s distributed denial-of-service (DDoS) botnet infrastructure. This
alert contains indicators of compromise (IOCs), malware descriptions, network signatures,
and host-based rules to help network defenders detect activity conducted by the North Korean
government. The U.S. Government refers to the malicious cyber activity by the North Korean
government as HIDDEN COBRA. For more information related to HIDDEN COBRA activity,
go to https://www.us-cert.gov/hiddencobra.
If users or administrators detect the custom tools indicative of HIDDEN COBRA, these tools
should be immediately flagged, reported to the DHS National Cybersecurity Communications
and Integration Center (NCCIC) or the FBI Cyber Watch (CyWatch), and given highest priority
for enhanced mitigation. This alert identifies IP addresses linked to systems infected with
DeltaCharlie malware and provides descriptions of the malware and associated malware
signatures. DHS and FBI are distributing these IP addresses to enable network defense
activities and reduce exposure to the DDoS command-and-control network. FBI has high
confidence that HIDDEN COBRA actors are using the IP addresses for further network
exploitation.
This alert includes technical indicators related to specific North Korean government cyber
operations and provides suggested response actions to those indicators, recommended
mitigation techniques, and information on reporting incidents to the U.S. Government.
For a downloadable copy of IOCs, see:
IOCs (.csv)
IOCs (.stix)
On August 23, 2017, DHS published a Malware Analysis Report (MAR-10132963) that
examines malware functionality to provide detailed code analysis and insight into specific
tactics, techniques, and procedures (TTPs) observed in the malware.
TLP:WHITE
For a downloadable copy of the MAR, see: TLP:WHITE
MAR (.pdf)
MAR IOCs (.stix)
Description
Since 2009, HIDDEN COBRA actors have leveraged their capabilities to target and
compromise a range of victims; some intrusions have resulted in the exfiltration of data while
others have been disruptive in nature. Commercial reporting has referred to this activity as
Lazarus Group[1] and Guardians of Peace.[2] DHS and FBI assess that HIDDEN COBRA
actors will continue to use cyber operations to advance their government’s military and
strategic objectives. Cyber analysts are encouraged to review the information provided in this
alert to detect signs of malicious network activity.
Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers,
remote access tools (RATs), and wiper malware. Variants of malware and tools used by
HIDDEN COBRA actors include Destover,[3] Wild Positron/Duuzer,[4] and Hangman.[5] DHS
has previously released Alert TA14-353A,[6] which contains additional details on the use of a
server message block (SMB) worm tool employed by these actors. Further research is
needed to understand the full breadth of this group’s cyber capabilities. In particular, DHS
recommends that more research should be conducted on the North Korean cyber activity that
has been reported by cybersecurity and threat research firms.
HIDDEN COBRA actors commonly target systems running older, unsupported versions of
Microsoft operating systems. The multiple vulnerabilities in these older systems provide cyber
actors many targets for exploitation. These actors have also used Adobe Flash player
vulnerabilities to gain initial entry into users’ environments.
HIDDEN COBRA is known to use vulnerabilities affecting various applications. These
vulnerabilities include:
CVE-2015-6585: Hangul Word Processor Vulnerability
CVE-2015-8651: Adobe Flash Player 18.0.0.324 and 19.x Vulnerability
CVE-2016-0034: Microsoft Silverlight 5.1.41212.0 Vulnerability
CVE-2016-1019: Adobe Flash Player 21.0.0.197 Vulnerability
CVE-2016-4117: Adobe Flash Player 21.0.0.226 Vulnerability
DHS recommends that organizations upgrade these applications to the latest version and
patch level. If Adobe Flash or Microsoft Silverlight is no longer required, DHS recommends
that those applications be removed from systems.
The IOCs provided with this alert include IP addresses determined to be part of the HIDDEN
COBRA botnet infrastructure, identified as DeltaCharlie. The DeltaCharlie DDoS bot was
originally reported by Novetta in their 2016 Operation Blockbuster Malware Report.[7] This
malware has used the IP addresses identified in the accompanying .csv and .stix files as both
source and destination IPs. In some instances, the malware may have been present on
victims’ networks for a significant period.
Technical Details
DeltaCharlie is a DDoS tool used by HIDDEN COBRA actors, and is referenced and detailed
in Novetta’s Operation Blockbuster Destructive Malware report. The information related to
DeltaCharlie from the Operation Blockbuster Destructive Malware report should be viewed in
conjunction with the IP addresses listed in the .csv and .stix files provided within this alert.
DeltaCharlie is a DDoS tool capable of launching Domain Name System (DNS) attacks, TLP:WHITE
Network Time Protocol (NTP) attacks, and Carrier Grade NAT (CGN) attacks. The malware TLP:WHITE
operates on victims’ systems as a svchost-based service and is capable of downloading
executables, changing its own configuration, updating its own binaries, terminating its own
processes, and activating and terminating denial-of-service attacks. Further details on the
malware can be found in Novetta’s report available at the following URL:
https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-
Destructive-Malware-Report.pdf
Detection and Response
HIDDEN COBRA IOCs related to DeltaCharlie are provided within the accompanying .csv and
.stix files of this alert. DHS and FBI recommend that network administrators review the IP
addresses, file hashes, network signatures, and YARA rules provided, and add the IPs to their
watchlist to determine whether malicious activity has been observed within their organization.
When reviewing network perimeter logs for the IP addresses, organizations may find
numerous instances of these IP addresses attempting to connect to their systems. Upon
reviewing the traffic from these IP addresses, system owners may find that some traffic
corresponds to malicious activity and some to legitimate activity. System owners are also
advised to run the YARA tool on any system they suspect to have been targeted by HIDDEN
COBRA actors. Additionally, the appendices of this report provide network signatures to aid in
the detection and mitigation of HIDDEN COBRA activity.
Network Signatures and HostBased Rules
This section contains network signatures and host-based rules that can be used to detect
malicious activity associated with HIDDEN COBRA actors. Although created using a
comprehensive vetting process, the possibility of false positives always remains. These
signatures and rules should be used to supplement analysis and should not be used as a sole
source of attributing this activity to HIDDEN COBRA actors.
Network Signatures
alert tcp any any -> any any
(msg:"DPRK_HIDDEN_COBRA_DDoS_HANDSHAKE_SUCCESS"; dsize:6;
flow:established,to_server; content:"|18 17 e9 e9 e9 e9|"; fast_pattern:only; sid:1; rev:1;)
________________________________________________________________
alert tcp any any -> any any (msg:"DPRK_HIDDEN_COBRA_Botnet_C2_Host_Beacon";
flow:established,to_server; content:"|1b 17 e9 e9 e9 e9|"; depth:6; fast_pattern; sid:1; rev:1;)
________________________________________________________________
YARA Rules
meta:
description = “RSA Key”
strings:
$rsaKey = {7B 4E 1E A7 E9 3F 36 4C DE F4 F0 99 C4 D9 B7 94
A1 FF F2 97 D3 91 13 9D C0 12 02 E4 4C BB 6C 77
48 EE 6F 4B 9B 53 60 98 45 A5 28 65 8A 0B F8 39 TLP:WHITE
TLP:WHITE
73 D7 1A 44 13 B3 6A BB 61 44 AF 31 47 E7 87 C2
AE 7A A7 2C 3A D9 5C 2E 42 1A A6 78 FE 2C AD ED
39 3F FA D0 AD 3D D9 C5 3D 28 EF 3D 67 B1 E0 68
3F 58 A0 19 27 CC 27 C9 E8 D8 1E 7E EE 91 DD 13
B3 47 EF 57 1A CA FF 9A 60 E0 64 08 AA E2 92 D0}
condition:
any of them
________________________________________________________________
meta:
description = “DDoS Misspelled Strings”
strings:
$STR1 = "Wating" wide ascii
$STR2 = "Reamin" wide ascii
$STR3 = "laptos" wide ascii
condition:
(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) ==
0x46445025 or uint32(1) == 0x6674725C) and 2 of them
________________________________________________________________
meta:
description = “DDoS Random URL Builder”
strings:
$randomUrlBuilder = { 83 EC 48 53 55 56 57 8B 3D ?? ?? ?? ?? 33 C0 C7 44 24 28 B4 6F 41
00 C7 44 24 2C B0 6F 41 00 C7 44 24 30 AC 6F 41 00 C7 44 24 34 A8 6F 41 00 C7 44 24 38
A4 6F 41 00 C7 44 24 3C A0 6F 41 00 C7 44 24 40 9C 6F 41 00 C7 44 24 44 94 6F 41 00 C7
44 24 48 8C 6F 41 00 C7 44 24 4C 88 6F 41 00 C7 44 24 50 80 6F 41 00 89 44 24 54 C7 44
24 10 7C 6F 41 00 C7 44 24 14 78 6F 41 00 C7 44 24 18 74 6F 41 00 C7 44 24 1C 70 6F 41
00 C7 44 24 20 6C 6F 41 00 89 44 24 24 FF D7 99 B9 0B 00 00 00 F7 F9 8B 74 94 28 BA 9C
6F 41 00 66 8B 06 66 3B 02 74 34 8B FE 83 C9 FF 33 C0 8B 54 24 60 F2 AE 8B 6C 24 5C
A1 ?? ?? ?? ?? F7 D1 49 89 45 00 8B FE 33 C0 8D 5C 11 05 83 C9 FF 03 DD F2 AE F7 D1
49 8B FE 8B D1 EB 78 FF D7 99 B9 05 00 00 00 8B 6C 24 5C F7 F9 83 C9 FF 33 C0 8B 74
94 10 8B 54 24 60 8B FE F2 AE F7 D1 49 BF 60 6F 41 00 8B D9 83 C9 FF F2 AE F7 D1 8B
C2 49 03 C3 8B FE 8D 5C 01 05 8B 0D ?? ?? ?? ?? 89 4D 00 83 C9 FF 33 C0 03 DD F2 AE
F7 D1 49 8D 7C 2A 05 8B D1 C1 E9 02 F3 A5 8B CA 83 E1 03 F3 A4 BF 60 6F 41 00 83 C9 TLP:WHITE
FF F2 AE F7 D1 49 BE 60 6F 41 00 8B D1 8B FE 83 C9 FF 33 C0 F2 AE F7 D1 49 8B FB 2B TLP:WHITE
F9 8B CA 8B C1 C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 7C 24 60 8D 75 04 57 56 E8 ??
?? ?? ?? 83 C4 08 C6 04 3E 2E 8B C5 C6 03 00 5F 5E 5D 5B 83 C4 48 C3 }
condition:
$randomUrlBuilder
________________________________________________________________

Impact
A successful network intrusion can have severe impacts, particularly if the compromise
becomes public and sensitive information is exposed. Possible impacts include:
temporary or permanent loss of sensitive or proprietary information,
disruption to regular operations,
financial losses incurred to restore systems and files, and
potential harm to an organization’s reputation.
Solution
Mitigation Strategies
Network administrators are encouraged to apply the following recommendations, which can
prevent as many as 85 percent of targeted cyber intrusions. The mitigation strategies
provided may seem like common sense. However, many organizations fail to use these basic
security measures, leaving their systems open to compromise:
1. Patch applications and operating systems – Most attackers target vulnerable
applications and operating systems. Ensuring that applications and operating systems are
patched with the latest updates greatly reduces the number of exploitable entry points
available to an attacker. Use best practices when updating software and patches by only
downloading updates from authenticated vendor sites.
2. Use application whitelisting – Whitelisting is one of the best security strategies because
it allows only specified programs to run while blocking all others, including malicious
software.
3. Restrict administrative privileges – Threat actors are increasingly focused on gaining
control of legitimate credentials, especially credentials associated with highly privileged
accounts. Reduce privileges to only those needed for a user’s duties. Separate
administrators into privilege tiers with limited access to other tiers.
4. Segment networks and segregate them into security zones – Segment networks into
logical enclaves and restrict host-to-host communications paths. This helps protect
sensitive information and critical services, and limits damage from network perimeter
breaches.
5. Validate input – Input validation is a method of sanitizing untrusted input provided by
users of a web application. Implementing input validation can protect against the security
flaws of web applications by significantly reducing the probability of successful
exploitation. Types of attacks possibly averted include Structured Query Language (SQL)
injection, cross-site scripting, and command injection.
6. Use stringent file reputation settings – Tune the file reputation systems of your anti-
virus software to the most aggressive setting possible. Some anti-virus products can limit
TLP:WHITE
execution to only the highest reputation files, stopping a wide range of untrustworthy code TLP:WHITE
from gaining control.
7. Understand firewalls – Firewalls provide security to make your network less susceptible
to attack. They can be configured to block data and applications from certain locations (IP
whitelisting), while allowing relevant and necessary data through.
Response to Unauthorized Network Access
Enforce your security incident response and business continuity plan. It may take time
for your organization’s IT professionals to isolate and remove threats to your systems and
restore normal operations. Meanwhile, you should take steps to maintain your organization’s
essential functions according to your business continuity plan. Organizations should maintain
and regularly test backup plans, disaster recovery plans, and business continuity procedures.
Contact DHS or your local FBI office immediately. To report an intrusion and request
resources for incident response or technical assistance, you are encouraged to contact DHS
NCCIC (NCCICCustomerService@hq.dhs.gov or 888-282-0870), the FBI through a local field
office, or the FBI’s Cyber Division (CyWatch@fbi.gov or 855-292-3937).
Protect Against SQL Injection and Other Attacks on Web Services
To protect against code injections and other attacks, system operators should routinely
evaluate known and published vulnerabilities, periodically perform software updates and
technology refreshes, and audit external-facing systems for known web application
vulnerabilities. They should also take the following steps to harden both web applications and
the servers hosting them to reduce the risk of network intrusion via this vector.
Use and configure available firewalls to block attacks.
Take steps to secure Windows systems, such as installing and configuring Microsoft’s
Enhanced Mitigation Experience Toolkit (EMET) and Microsoft AppLocker.
Monitor and remove any unauthorized code present in any www directories.
Disable, discontinue, or disallow the use of Internet Control Message Protocol (ICMP) and
Simple Network Management Protocol (SNMP) as much as possible.
Remove unnecessary HTTP verbs from web servers. Typical web servers and
applications only require GET, POST, and HEAD.
Where possible, minimize server fingerprinting by configuring web servers to avoid
responding with banners identifying the server software and version number.
Secure both the operating system and the application.
Update and patch production servers regularly.
Disable potentially harmful SQL-stored procedure calls.
Sanitize and validate input to ensure that it is properly typed and does not contain
escaped code.
Consider using type-safe stored procedures and prepared statements.
Audit transaction logs regularly for suspicious activity.
Perform penetration testing on web services.
Ensure error messages are generic and do not expose too much information.
Permissions, Privileges, and Access Controls
System operators should take the following steps to limit permissions, privileges, and access
controls.
Reduce privileges to only those needed for a user’s duties. TLP:WHITE
Restrict users’ ability (permissions) to install and run unwanted software applications, and TLP:WHITE
apply the principle of “Least Privilege” to all systems and services. Restricting these
privileges may prevent malware from running or limit its capability to spread through the
network.
Carefully consider the risks before granting administrative rights to users on their own
machines.
Scrub and verify all administrator accounts regularly.
Configure Group Policy to restrict all users to only one login session, where possible.
Enforce secure network authentication, where possible.
Instruct administrators to use non-privileged accounts for standard functions such as web
browsing or checking webmail.
Segment networks into logical enclaves and restrict host-to-host communication paths.
Containment provided by enclaving also makes incident cleanup significantly less costly.
Configure firewalls to disallow Remote Desktop Protocol (RDP) traffic coming from
outside of the network boundary, except for in specific configurations such as when
tunneled through a secondary virtual private network (VPN) with lower privileges.
Audit existing firewall rules and close all ports that are not explicitly needed for business.
Specifically, carefully consider which ports should be connecting outbound versus
inbound.
Enforce a strict lockout policy for network users and closely monitor logs for failed login
activity. Failed login activity can be indicative of failed intrusion activity.
If remote access between zones is an unavoidable business need, log and monitor these
connections closely.
In environments with a high risk of interception or intrusion, organizations should consider
supplementing password authentication with other forms of authentication such as
challenge/response or multifactor authentication using biometric or physical tokens.
Logging Practices
System operators should follow these secure logging practices.
Ensure event logging, including applications, events, login activities, and security
attributes, is turned on or monitored for identification of security issues.
Configure network logs to provide adequate information to assist in quickly developing an
accurate determination of a security incident.
Upgrade PowerShell to new versions with enhanced logging features and monitor the
logs to detect usage of PowerShell commands, which are often malware-related.
Secure logs in a centralized location and protect them from modification.
Prepare an incident response plan that can be rapidly administered in case of a cyber
intrusion.
References
[1] IBM. Actor Lazarus Group – Blog Post by IBM X-Force Exchange.
[2] AlienVault. Operation Blockbuster Unveils the Actors Behind the Sony Attacks.
[3] Symantec. Destover: Destructive Malware has links back to attacks on South Korea.
[4] Symantec. Duuzer back door Trojan targets South Korea to take over computers.
[5] FireEye. Zero-Day HWP Exploit.
[6] US-CERT. Alert (TA14-353A) Targeted Destructive Malware. Original Release Date:
12/19/2014 | Last revised: 9/30/2016 TLP:WHITE
[7] Novetta. Operation Blockbuster Destructive Malware Report. TLP:WHITE
Revisions
June 13, 2017: Initial Release
August 23, 2017: Updated YARA Rules and included MAR-10132963 (.pdf and .stix files)
This product is provided subject to this Notification and this Privacy & Use policy.
TLP:WHITE
DECLARATION OF DANA BOWERS

IN THE UNITED STATES DISTRICT COURT FOR

ATLANTA DIVISION
)
)
Plaintiff, )
vs. ) 1:17-cv-2989-AT
)
)
Defendant. )
)
)
DECLARATION OF DANA BOWERS
DANA BOWERS hereby declares as follows:
1. I am have been a Georgia voter since May 7, 2002 and am currently
registered to vote at 3514 Debbie Ct. Duluth, GA 30097 I have been
registered to vote at this address continuously since April 16, 2013.
2. When I have voted on Election Day, I have voted at Precinct 96 at
3180 Bunten Rd. Duluth, GA 30096 for 5 years, without a problem.
3. I am the Advocacy Coordinator in candidate Josh McCall’s campaign
for the the 9th Congressional District. As a part of my McCall
campaign work, I have been active in voter protection, voter outreach
and voter registration activities.
BOWERS DECLARATION
4. One of my responsibilities for the campaign is monitoring possible
voting problems in the 9th Congressional District, which includes Hall
County.
5. On approximately June 28, 2018 I received reports of a machine
results tape in Hall County Precinct 10 that did not include the 9th
Congressional District race in the May 22, 2018 primary election,
which it should have, as well as other races (identified below). I
received a photo of the key portion of the voting machine results tape
(Exhibit 1) taken on election night by Kim Copeland, Chairman of the
Hall County Democratic Party. I immediately undertook research on
the discrepancy. That research is incomplete because Hall County has
declined to fulfill my public records requests for information related
to the discrepancy.
6. The photo of the results tape (Exhibit 1) shows that the following
races were missing from the machine results tape in Hall County:
• U.S. Representative, District 9 - REP

• U.S. Representative, District 9 - DEM
• State Senator, District 49 - REP
• State Representative, District 30 - REP
• State Representative, District 30 - DEM
• District Attorney, Northeastern Circuit - REP
• Solicitor General - R
• County Commissioner P1 - R
• County Commissioner P1 – D
BOWERS DECLARATION
7. I obtained additional photos of machine tapes (Exhibit 2) from Alana
Watkins, Democratic Candidate for State Representative in District
30, whose race was missing from the tape. The particular tape in
question was for machine serial number 291032 and was printed at
9:59 pm. This was approximately 3 hours after the closing of the
polls; tapes are required to be printed upon the closing of the polls.
8. I also obtained Mr. Copeland’s video recording of the Precinct 10
results tapes, that provided more data for comparison. The video
shows that the pollworkers certified all results tapes on the door,
including the tape from machine 291032 missing certain races.
The video recording can be found at the following link:
https://www.dropbox.com/s/ea0599yeo5kiy5u/Candler%20elec
tion%20tape.mp4
9. On June 29, 2018 requested public records related to this discrepancy
from Hall County Elections. After repeated emails, meetings, phone
conversations and visits to her office, the majority of my requests for
such public records have not been honored. The denial of access to
public records has curtailed my ability to assess the cause of the
problems or recommend mitigation efforts to Candidate Josh McCall.
BOWERS DECLARATION
10. I attended the Hall County Board of Elections meeting on July 10,
2018 and presented my concerns. Other citizens presented similar
concerns at the meeting. In response, Elections Director Lori Wurtz
stated that there were “no discrepancies” and that the photo was not
proof of a discrepancy. Ms. Wurtz did not provide any explanation for
the missing races. The Board of Elections refused to discuss the issue
and adjourned the meeting.
11. As noted above, I made repeated oral and formal written requests for
the related public records without meaningful success. Hall County
initially took the position that the public records at issue related to this
litigation and were not to be shown to the public.
12. On July 13, 2018 the Hall County Board of Elections conducted a
special meeting to go into executive session to discuss “threatened
litigation,” and public records request. I have not threatened Hall
County with litigation nor am I aware of any threatened litigation. I
attended the very short public portion of the meeting to attempt to
again express concern not only about the discrepant machine tapes,
and reporting delays, but also their refusal to honor public records
requests for key election records.
BOWERS DECLARATION
13. I was met at the July 13, 2018 meeting by five armed security officers
assigned to the meeting (there were approximately 4 members of the
public in attendance). I felt intimidated by this show of force which I
interpreted to communicate to me and other concerned citizens that
we should not pursue questions on election irregularities.
14. At the July 13, 2018 meeting, citizens challenged the Board of
Elections about the legitimacy of their planned closed door session.
Nevertheless, the Board shut out the public, and did not accept public
comment before going into closed session.
15. Mr. Tom Smiley, Chairman of the Board of Elections, reported to me
after the meeting that the Board decided in their closed door session
that they would honor my public records request because I was not
involved in the Curling v Kemp litigation, but would not honor
requests from people associated with this lawsuit. However, to date,
the County has only permitted me to examine a small portion of the
records I requested.
16. I am concerned that by filing this affidavit, I will be retaliated
against by the Hall County Board of Elections for involvement in the
lawsuit, and the McCall campaign will continue be denied access to
important public records.
BOWERS DECLARATION
17. On July 13, 2018 I was permitted to review the county’s paper copy
of the machine results tape from Precinct 10. Ms. Wurtz stated that
they do not collect the tapes on the precinct doors and this was the
county’s copy printed at the same time. The county’s copy contained
vote tallies for the races missing from the tape copy on the door.
18. I note that, on the May 22, 2018 election night, Hall County results
were delayed and not reported by media until after 11:30pm.
19. Because my public records request have been denied by Hall County,
I have been unable to confirm reports of election night machine
malfunctions that contributed to the late results reporting, although the
late printing times for the machine tapes in Precint 10 indicate an
unusual condition that should be thoroughly investigated.
20. I am aware that even if I have access to the public records, I will be
unable to confirm that the results recorded reflect voters’ votes on the
unaudtiable touchscreen machines. I will be unable to confirm
whether the missing races were on the electronic ballot on the
problem machine because there is no paper record.
21. I have talked with voting system experts and read the research to
understand that there is no way to audit whether the votes that were
reported in the official results were actually cast by voters on the
BOWERS DECLARATION
touchscreen machines. However, I want to review and compare the
records of this discrepancy.
22. I was told by Ms. Wurtz and Mr. Smiley that the likely cause for the
missing races is that the problem machine tape may have failed to
engage and print a portion of the results. Even if this speculation is
accurate, there appears to be no way to verify whether that is sole
problem and what impact it had, nor does it address why the results
tapes were late in being printed, nor why they were certified by poll
workers as accurate, when they were missing 9 races.
23. As of the date of this declaration, weeks after my repeated requests,
Hall County has not yet permitted me to review public records related
to the reported voting machine closing problems, results printing
discrepancies, results reporting delays, and system logs for the
machines.
24. On July 24, 2018 I voted in Gwinnett County precinct 100 (and report
on discrepancies in my voter records below), and observed a voting
machine discrepancy of concern to me.
25. When I was in the polling place, I noticed that one DRE voting
machine (serial number 291429) was marked “Do Not Touch” and
was not in service. I inquired about the machine and was told by Ms.
BOWERS DECLARATION
Williams, a poll worker, that the out-of-service machine “froze a few
times” earlier in the day, and the poll manager made the decision to
discontinue its use for the remainder of the election. I asked Ms.
Williams if voters had been casting votes on the out-of-service
machine before it appeared to malfunction. Ms. Williams confirmed
that, yes, the out-of-service machine had been in use and ballots had
been cast on it for approximately “an hour to an hour and a half” after
the polling location, Gwinnett 100, had opened at 7am. Ms. Williams
told me of one voter who attempted to use the machine when it froze
up on the language selection screen.
26. Poll Manager Denise Sullivan, however, told me that voters had not
cast votes on that machine. I have no way of knowing which story is
accurate as to whether voters cast votes on the machine.
27. I asked whether the voter who experienced the frozen machine at the
language selection screen had been able to cast a ballot and Ms.
Sullivan told me that the voter had been given a provisional ballot to
complete. I could not learn whether there was an attempt made to
determine if this voter had successfully cast a vote on the DRE voting
machine in addition to his provisional ballot.
BOWERS DECLARATION
28. If the machine was not functioning, I do not know why this voter
would have been given a provisional ballot instead of being instructed
to cast a vote on another machine without the necessity of checking
his eligibility through the provisional process. I am concerned about
the process of forcing voters to use provisional ballots when machines
do not accept their vote. Provisional ballot credentials are time
consuming to complete and therefore discourage some voters.
29. After the closing of the polls, I overhead the pollworkers talking about
two machines for which the tabulations were not reconciling. I
became curious about what the ballot and voter certificate
reconciliation on the precinct recap sheet would show. Therefore, I
asked Poll Manager Sullivan to see the polling place recap sheets,
which I believe are public records. I wanted to see the discrepancy for
myself, but I was denied access.
30. After the closing at the polls at 7pm, I watched carefully as poll
workers attempted to print the closing tape on the out-of-service
machine. Poll workers appeared to attempt at least four times to print
the results tape. I stayed inside the polling place to watch the
shutdown process which was being delayed by the problem machine.
BOWERS DECLARATION
31. I then went outside the polling place with Ms. Sullivan and took
photographs of the DRE machine results tapes including machine
number 192429 after they were posted on the door at approximately
8:40pm. I noticed that the results tape for this DRE machine showed
no votes tallied on the machine and the results tape was attached to a
“Zero tape” (used at opening of the polls to purportedly show that no
votes are stored in memory). Both opening zero report and the closing
results tape displayed printing times of 7:42 a.m. with no votes
recorded for any candidate. (Exhibit 3)
32. Given that the tape was printed from a machine that had reportedly
been used to record votes that day, and was printed well after the polls
were closed, I was puzzled to see a 7:42 am time stamp, no votes cast,
and the “Zero report” also attached to the results tape. The printing
time of 7:42 am was also concerning as it would have been 42
minutes after the polls were open and over 11 hours before the polls
were closed. Machine reports are supposed to be printed before the 7
am opening and immediately after the 7pm close.
33. Other machine results tapes that I recorded posted on the door showed
print times of 7:36 pm and 7:29pm, which times are consistent with
the time of day I observed the printing of the results tapes.
BOWERS DECLARATION
34. I am gravely concerned about the integrity of the upcoming election
based my personal observations of DRE machine malfunctions in
recent elections.
ELECTRONIC POLLBOOK AND
VOTER REGISTRATION DISCREPANCIES
35. Based on my awareness of widespread problems with wrong ballot
issuance at polling places in the May 22, 2018 primary, I decided to
verify my own voter registration records before voting on July 24,
2018. I checked my voter registration and polling place location on
the My Voter Page on the Secretary of State’s website
( https://www.mvp.sos.ga.gov/MVP/mvp.do ), and saw that my
precinct number had apparently changed to Precinct 100, although I
had not received a notice of such change.
36. My precinct has long been precinct 96, but I assumed the precinct
assignments had changed and were authorized.
37. I went to Precinct 100 at 54 Buford Highway, Suwanee, Georgia, at
approximately 6:20 pm and completed the voter application form in
order to vote.
38. I presented my driver’s license to the pollworker whose first name is
Christine. I do not know her last name. She located my name in the
BOWERS DECLARATION
electronic pollbook and told me that I was in the wrong precinct
location, and that I was supposed to vote in Precinct 96, not 100. I
explained that I had checked my registration on the Secretary of State
website that morning and that my assigned precinct was 100 at the
Suwanee polling place.
39. Another pollworker, Carolyn Williams told me, “Don’t worry Ms.
Bowers, this has been happening all day,” and went on to tell me that
she was aware of approximately 50 voters who had been assigned the
wrong precinct.
40. Pollworker Christine suggested that I vote a provisional ballot given
that there was not time to get to precinct 96 by 7 pm when the polls
would close. She assured me that the provisional ballot would be
counted.
41. I completed my provisional ballot information, marked the paper
ballot, and cast it, enclosed in an envelope, and in the large locked
black box I had been directed to.
42. At 8:55pm that evening, I checked my voter registration page again on
the My Voter Page on the Secretary of State website and captured
screenshots (Exhibit 4) which showed the same Precinct 100
assignment as it had that morning (Election Day).
BOWERS DECLARATION
43. Several days later, at 7:24pm on July 29, 2018, I checked My Voter
Page again and my precinct assignment displayed Precinct 096,
having been changed back to my original precinct 96. (Exhibit 5). I
had not made any changes to my voter registration nor requested a
correction.
44. Precincts 96 and 100 are not identical precincts in the same
governmental jurisdictions. The misassignment can have the effect of
disenfranchising voters by giving them the wrong ballots or forcing
them to vote provisional ballots because they are not on the electronic
pollbook in the precinct stated on the SOS voter registration website. I
am concerned that a wrong assignment will also occur in the
November election and I will be disenfranchised. I am also concerned
about the impact on election integrity overall, as these malfunctions in
the pollbooks or voter records happen to other voters.
45. In my work to protect 9th Congressional District voters’ ability to vote
in the correct races and avoid disenfrachinsement in the upcoming
November election, I have undertaken research work using the voter
registration records. I personally researched dozens of registration
records for voters who were allegedly assigned to the wrong Georgia
House District and allegedly received incorrect ballots in Habersham,
BOWERS DECLARATION
Banks, Stephens, Franklin and Jackson Counties in the May 22, 2018
primary, based on voter specific information disclosed in the election
contest pending in Fulton Superior Court (Fulton County Superior
Court (2018CV306197)). These counties are in the 9th Congressional
District so they are of primary interest.
46. I used information on from Vote Builder, the Democratic Party’s
voter history database, fed by the Secretary of State’s official
database, and designed specifically for use by candidates and
campaign staff, and My Voter Page on the Secretary of State’s
website to compare House District assignments on the two records to
the information disclosed in the election contest complaint. I
personally reviewed numerous discrepancies between the various
voter assignment records including the House District Maps.
47. I am concerned about discrepancies in the pollbooks and voter
registration files in anticipation of the November election. I do not
believe that provisional ballots are an adequate remedy for inaccurate
voter rolls. I recognize that provisional ballots can unintentionally
disenfranchise voters voting in the wrong precinct, as candidates in
their home precinct may not be on the provisional ballot voted in a
different precinct.
BOWERS DECLARATION
48. Because of the numerous and widespread voter registration
discrepancies I am personally aware of, I am concerned about my own
vote, the votes for Mr. McCall in the 9th Congressional District, and
more generally for the voters of the state in the upcoming election.
49. If Georgia does not adopt paper ballots in the polling places for the
November 2018 election, I plan to vote by mail-in paper ballot. I will
accept the inconvenience of the absentee ballot application and voting
process where I must vote in advance so that I may vote a verifiable
ballot. In order to cast a secure ballot, I will have to give up my
preference of voting in my home precinct on Election Day when all
last minute campaign information will be available.
50. I will personally launch activist efforts to encourage voters to request
a mail-in absentee ballot, so that their votes can be verified and
recounted if necessary, even if it adds expense and inconvenience to
the voting process.
51. I am a member of Coalition for Good Governance.
I declare under penalty of perjury, in accordance with 28 U.S.C. § 1746, that
the foregoing is true and correct.
BOWERS DECLARATION
Dana Bowers
BOWERS DECLARATION
E
X
H
I
B
I
T
BOWERS DECLARATION
UNTED
ES BLANK VOTED
MILLER
J. NOEL
J. C, WHITE
************
Psc Pr; demore-- R •/fi p
RACE # 95 PARTY·
# RUNNING
2
1
# TO VOTE FOR
75
# TI MES COUNTED
# TI MES BLANK VOTED
11
J. HITCHINS III 3o
TI PRIDEMORE 0) 3a
************************
PSC Pridemore- D
RACE # 96 PARTY:OEM
# RUNNING 2
# TO VOTE FOR 1
# TIMES COUNTED 21
# TIMES BLANK VOTED
RACE # 476 PARTY:REP
# RUNNING 1
# TO VOTE FDR 1
# TIMES COUNTED 74
# TIMES BLANK VOTED 9
B. THOMPSON (I) 65
************************
BOE At Large - D
RACE # a77 PARTY:OEM
# RUNNING 1
# TO VOTE FOR 1
# TIMES COUNTED 18
# TIMES BLANK VOTED a
S. LOPEZ 15
************'***********
BOE 1 - R BOWERS DECLARATION
# RUNNING 1
E
X
H
I
B
I
T
BOWERS DECLARATION
BOWERS DECLARATION
E
X
H
I
B
I
T
BOWERS DECLARATION
BOWERS DECLARATION
E
X
H
I
B
I
T
BOWERS DECLARATION
Corporations Elections ' News Room rofessional Licensing Boards I Securities I
I I
t1y Voter Page
oter Information Polling Place for State, County, and Municipal Elections
DANA LORRAINE BOWERS

Prec1 net 100
3514 DEBBIE CT GEORGE PIERCE PARK
DULUTH, GA, 30097 55 BUFORD HWY
Race: Whit e not of Hispanic Origin SUWANEE, GA, 30024- 0000
Gender: Female Status: Active Election Day polling place hours are 7:00 am - 7:00 pm.
Regist ration Dat e: 05/07/2002
Dire ctions to Polling Place
1
Change Voter Information

Click Here for Early Voting Locations and Times
Click Here for Sample Ballots Click Here for Municipal Polling Place
NOTE: Non-specific rura l addresses may not be available.
BOWERS DECLARATION
E
X
H
I
B
I
T
BOWERS DECLARATION
Corporations Elections News Roo fessional Licensing Boards I Securities II Ch
My Vot er Page
olling Place for State, County, and Municipal Elections
Precinct 096
351 4 DEBBI E CT BUNT EN ROAD PARK
DULUTH, GA, 30097 3180 BUNTEN RD
Race: White not of Hispanic Orig in DULUTH, GA, 30096 - 0000
Gender: Female Stat us: Active Election Day polling place hours are 7:00 am - 7:00 pm.
Registration Date: 05/07 /2002
Directions to Polling Place
NOTE: Non-specific rural addresses may not be available.
BOWERS DECLARATION
DECLARATION OF BRUCE P. BROWN

BRUCE BROWN DECLARATION

E
X
H
I
B
I
T


Roy E. Barnes
John F. Salter
July 26, 2018
Page 2 of 2
cc: (continued)
David D. Cross
Halsey G. Knapp, Jr.









E
X
H
I
B
I
T

OFFICIAL ELECTION BULLETIN

August 1, 2018
TO: County Election Officials and County Registrars
FROM: Chris Harvey, Elections Division Director
RE: Response to Coalition for Good Governance Communication
Dear County Commissioners ancj Officials,
I am writing to you as the State of Georgia's Elections Director, a position I have held since July
2015. From August 2007 until July 2015, I was the Chieflnvestigator and Deputy Inspector
General for the Secretary of State's office, investigating, among other items, potential violations
of state election law. For over a decade, it has been my job to be intimately familiar with both
Georgia election law, systems, processes, and procedures.
Before joining the Secretary of State's office, I was the Director of the Cold Case Homicide Unit
with the Fulton County District Attorney's office where I investigated previously unsolved
homicides. Prior to that role, I was the Chief Investigator with the DeKalb County District
Attorney's Office where I led investigations in all crimes, including public corruption. Over my
career in law enforcement, it has been my intention to serve Georgia by promoting public safety,
security and fidelity to the law.
Throughout my tenure at the Secretary of State's office, election security has been a top priority
for me personally, as it is for the entire Secretary of State's office and county election officials.
Now more than ever, and especially since the election of 2016, voting security is featuring more
prominently as a topic of national conversation. However, it has been a way of life in the
Secretary of State's office for far longer. I write to you today to explain some of the protections
that we, along with county election officials, have in place to ensure that Georgia's elections are
secure and ask for your assistance in continuing to ensure secure elections in our state.
Elections irt Georgia are a partnership between the state and the counties. County election
officials run elections while the Secretary of State's office maintains the voter registration
database and provides support to the counties. We work with your county election officials every
day, and these hard-working public servants are truly the linchpin of our democracy.
Long before the public spotlight turned to the realm of elections, we recognized the real threat of
people and entities - both foreign and domestic - seeking to interfere with our electoral process.
Page 1 of 3

To combat this threat, we work with federa l, state, local, and private sector partners every day,
and we are continually adding additiona l levels of both cyber and physical security to Georgia's
election system . It is our duty to provide Georgians with the opportunity to vote on a secure and
reliable voting system, which we regularly test to ensure ongoing compliance with state law and
State Election Board rules.
Georgia 's election system consists of many components, including the voter registration system,
election management system, voting machines, and election night reporting website. Strict
security mechanisms surround each component. These safeguards include, but are not limited to,
frequent password changes, brute force and inactivity account disabling, and two-factor
authentication . Many people are pleasantly surprised to hear that Georgia builds its encrypted
ballot databases on machines which are never connected to the internet - a safeguard which
many other states have not yet implemented. We also deploy cybersecurity protections, secure
armed transport of election materials, and physical security for our voting machines. Your
county election officials are familiar with these processes and treat them with the utmost
importance.
Recently, some county boards have received communications from parties who filed a federal
lawsuit against Georgia to stop the use of voting machines -Direct Recording Electronic (DRE)
equipment - and demand hand-counted paper ballots . In these communications to you, they
mistakenly cite a state law which was superseded by a newer law for the assertion that counties
can unilaterally elect to stop using DRE voting equipment. Their assertion is not an accurate
statement of Georgia law.
In 2003, Georgia moved to a state -wide, unified system in 2003. O.C.G.A. § 21-2-300 (a) states,
"Provided that the General Assembly specifically appropriates funding to the Secretary of State
to implement this subsection, the equipment used for casting and counting votes in county, state, ,
and federal elections shall, by the July, 2004, primary election and afterwards, be the same in
each county in this state and shall be provided to each county by the state, as determined by the
Secretary of State." Further, O.C.G.A. § 21-2-381 requires absentee in-person ballots (early
voting) to be on a DRE and O.C.G .A. § 21-2-379 .7, which requires at least one DRE unit
accessible to handicapped voters to be placed in each precinct, and State Election Board rules
align with both of these statutes.
There are some who believe that because the current DRE machines are fully electronic, there is
no way to verify that voter selections match the vote count's output. This belief is not true. There
are numerous ways to ensure that our voting machines are accurately counting votes, and
election officials test and demonstrate the accuracy of these machines through logic and accuracy
testing before every single use. Last year, the state also conducted a re-examination 0f the voting
machines to ensure accuracy. In each of the three selected counties, each machine 's output ·
exactly matched its input on simulated election day conditions. Furthermore , on election days in
2018, the Secretary of State's office conducts parallel testing, which means we take an actual
county's ballot database and run a mock election to ensure that output matches the ballot
selections. In each instance, the machine's output has exactly matched the selections. We have
ever taken accuracy for granted. It is constantly tested and re-tested .
There is a provision of Georgia law that allows the state to move to paper ballots in the event that
the machines are "inoperable or unsafe." If we ever reach a point where our office feels that these
Page 2 of 3
f3r).

Case 1:17-cv-02989-AT Document 258-1 Filed 08/03/18 Page 104 of 369 \
machines cannot be trusted to accurately deliver election results, we will invoke this statutory )
( provision. To this day; there is no credible evidence that our election process is anything except
secure and accurate. v
While we are confident in the integrity of our elections, we remain vigilant and committed to ..
ensuring that the confidence of Georgia voters in their elections and government is well-
deserved. The Secretary of State's commitment to constant vigilance is why we have supported a
move towards a new voting system to replace the current, aging system in a responsible fashion.
This year, Secretary Kemp appointed the bi-partisan Secure, Accessible, and Fair Elections
(SAFE) Commission, which consists of numerous county election officials, legislators, election
law experts, a cybersecurity expert, and an accessibility expert. The SAFE Commission, working
with our office, will present recommendations to the General Assembly by this January on how
to responsibly move to a new system.
As county officials, we recognize the role that you play in keeping our system secure and
accurate. The Secretary of State's Office values our county partners who work hand-in-hand with
county elections boards and officials to run Georgia's elections. Thank you for your continued
support and dedication to secure elections in Georgia. Please feel free to contact me directly with
any questions.
Sincerely,
Chris Harvey
State ElectionsDirector
Page3of3

DECLARATION OF JASMINE CLARK


ATLANTA DIVISION
)
)
Plaintiff, )
vs. ) 1:17-cv-2989-AT
)
)
Defendant. )
)
)
DECLARATION OF JASMINE CLARK
JASMINE CLARK hereby declares as follows:
1. I am have been a Georgia voter since 2006 and am currently
registered to vote at 280 Braxton Place in Gwinnett County. I have
been continuously registered to vote at this address since 2016.
2. My precinct is Lucky Shoals Park and my polling place is located at
4651 Britt Rd, Norcross, GA.
3. I have not made changes to my voter registration while living at this
addresss.
CLARK DECLARATION
4. I am a candidate for Georgia House of Representatives District 108 in
the upcoming November, 2018 election.
5. As a candidate, I have become aware of chronic problems in
Georgia’s electronic election system and I follow the news of Georgia
voting problems. I followed news reports of the security failures and
breach of the KSU election server and voter files, as well as
numerous problems reported with incorrectly assigned districts such
as the inaccurate voter assignments of approximately 600 voters

1
reported in House District 81.
6. I frequently visit the My Voter Page section of the Secretary of State’s
website (https://www.mvp.sos.ga.gov/MVP/mvp.do ) as I campaign
and help voters check their registrations, which I routinely encourage
them to do.
7. I frequently verify my own registration to be certain that unauthorized
changes have not been made. I am aware of the security breaches in
the voter files and want to be certain that my registration is never
affected.
https://politics.myajc.com/news/state--regional-govt--politics/doraville-voters-might-have-been-given-wron
g-ballots/XIyZEXgkEwhuV4q9hrdFvM/
CLARK DECLARATION
8. On Election Day, July 24, 2018, I arrived at my precinct polling place
at 4651 Britt Rd, Norcross, GA at approximately 7:50 a.m., planning
to vote before going to work.
9. A person in line in front of me at the voter check-in table was turned
away without voting as I overhead the poll worker tell him that he was
in the wrong polling place, although he insisted that it was his
traditional polling place. I wondered if discrepancies were being
encountered with the electronic pollbooks in my polling place.
10. I presented my drivers license and after the poll official checked the
electronic pollbook, he told me that I was not in the pollbook for
precinct 012 but that I must go to the Chinese Christian Church on
Britt Rd., another precinct nearby, but in a different District.
11.I was completely confident of my polling place precinct assignment
and location and refused to leave, but instead made phone calls and
inquiries to try to vote in my polling place on a regular (not
provisional) ballot.
12.I talked with the precinct workers and managers and was repeatedly
told that I was in the wrong precinct polling location and not on the
electronic voter list for precinct 012.
CLARK DECLARATION
13.I opened my smart phone and pulled up my information on My Voter
Page and showed the workers that I was present in the correct precinct
according to the live Secretary of State’s website. They contined to
insist that the electronic pollbook showed my voting location at
another precinct polling place, and would not issue a ballot for my
precinct to me.
14.After spending approximately 25 minutes on the phone trying to
resolve my problem, pollworkers told me that suddenly my name had
appeared on the electronic pollbook for that voting location. There
was no explanation offered as to how this was possible after so many
election officials had previously checked the records, reportedly
finding that I was not eligible to vote in this precinct 012.
15.I was issued a voter access card and voted my electronic ballot on the
touchscreen machine without incident, although I had spent at least a
half-hour more at the polls than I had planned. Unlike other people I
met that day who were turned away, I had the flexibility to stay to
fight for my right to vote in the right precinct on the correct ballot.
CLARK DECLARATION
16. Although I had no logical explanation for what happened, I took the
first opportunity at approximately 10 am that morning to record and

2
post a video to Facebook to explain my experience to other voters
and offer advice on what to do if they encountered voting problems
because of their pollbook or voter registration issues.
17. Both as a candidate and a citizen, I am deeply concerned about the
security failures of the electronic voting system, and the discrepancies
and errors in the electronic pollbooks that disenfranchise and
discourage people from voting.
18.I heard people in the precinct 012 polling place who were turned away
say that they did not have time to travel to another polling place. I did
not hear pollworkes offer them a provisional ballot, making it likely
that these people did not get the opportunity to vote.
19.I plan to vote in the November 2018 election and based on my
experience, I am concerned that I may be given an inaccurate ballot,
or that my name may not be found in the pollbook, or that I will be
otherwise disenfranchised.
2
https://www.facebook.com/annakellyleary/posts/10155422963347096
CLARK DECLARATION
20.As a candidate, I am concerned about voters in my district potentially
being disenfranchised and the impact on my House District 28 race
and all other races on the ballot.
21.As additional voting problems are discovered and exposed, I expect
that voters will be discouraged from voting and voter confidence will
continue to diminish, along with voter turnout, if the immediate
corrections are not made to the election system.
Executed on this date, July __,

31 2018.
_______________________________
Jasmine Clark
CLARK DECLARATION
DECLARATION OF KIMBERLY C. COPELAND


ATLANTA DIVISION
)
)
Plaintiff, )
) CIVIL ACTION FILE NO.: 1:17-cv-
vs. ) 2989-AT
)
)
Defendant. )
)
)
DECLARATION OF KIMBERLY C. COPELAND
KIMBERLY C. COPELAND hereby declares as follows:
1. I am a Georgia voter registered to vote at my residence at 3420 Meadow
Lane, Gainesville, Georgia, 30506.
2. I served for 11 years on the Hall County Board of Elections until November
2017. I am currently the Chairman of the Hall County Democratic
Committee. My role in the county Democratic Party includes promoting
voter rights, election integrity, voter registration, supporting our candidates’
campaigns and voter turnout.
3. On May 22, 2018, late in the evening of Primary Election Day, I received a
call from Alana Watkins, Democratic Party candidate for House District 30.
She reported that she had just visited her home Precinct 10 (Candler) polling
place at Hopewell Baptist Church, 5086 Poplar Springs Rd, Gainesville,
COPELAND DECLARATION
Georgia, 30507, on her way home from our victory party to review the
machine results tapes posted on the door. She reported that one tape did not
contain her race. I told her that I would investigate.
4. I went to the Candler polling place that night a little before midnight. I
observed ten DRE voting machine results tapes posted on the door. I
observed one results tape that was missing the House District 30 race as Ms.
Watkins had reported, and was also missing several other races such as the
Congressional District 9 races, and County Commissioner races, among
others.
5. At approximately 11:58 pm, I took the picture as Exhibit A of the portion of
the results that was missing races. I also shot a short video of the results tape
comparing it the other tapes posted on the door. It is posted at:
https://www.dropbox.com/s/ea0599yeo5kiy5u/Candler%20election%20tape.
mp4?dl=0.
6. I examined the tape and confirmed that there were no tears, folds or other
signs of a change in the tape that could account for the missing data.
7. I provided copies of the photograph (Exhibit A) and video recording
(Exhibit B) to Ms. Watkins, state party officials, and Dana Bowers of the
Josh McCall campaign for the 9th Congressional District for follow up.
8. I have been involved in Hall County election mechanics and reporting for
over 10 years. I had never before seen a machine tape posted that is missing
races, so this naturally concerns me as to the extent to which such
malfunctions can impact or alter the vote on the paperless unauditable
machines.
9. In addition, on Primary Election Night, I noticed the election results from
Hall County were unusually late in being reported. Michelle Jones of the
Hall County Board of Elections reported she was told that about one-half of
the voting machines in the county were experiencing problems closing
down.
10. I have not received further information on the nature of the reported
machine shutdown issues.
11. I am concerned about the inability to recount, verify, or audit Georgia's
election results from the electronic voting system without a paper audit trail.
I declare under penalty of perjury, in accordance with 28 U .S.C. § 1746, that the
Executed on this date, August 2, 2018 . ~
~/,
LKimberly C. Copeland ·
E
X
H
I
B
I
T
UNTED
ES BLANK VOTED
MILLER
J. NOEL
J. C, WHITE
************
Psc Pr; demore-- R •/fi p
RACE # 95 PARTY·
# RUNNING
2
1
# TO VOTE FOR
75
# TI MES COUNTED
# TI MES BLANK VOTED
11
J. HITCHINS III 3o
TI PRIDEMORE 0) 3a
************************
PSC Pridemore- D
RACE # 96 PARTY:OEM
# RUNNING 2
# TO VOTE FOR 1
# TIMES COUNTED 21
# TIMES BLANK VOTED
# RUNNING 1
# TO VOTE FDR 1
# TIMES COUNTED 74
# TIMES BLANK VOTED 9
B. THOMPSON (I) 65
************************
BOE At Large - D
RACE # a77 PARTY:OEM
# RUNNING 1
# TO VOTE FOR 1
# TIMES COUNTED 18
# TIMES BLANK VOTED a
S. LOPEZ 15
************'***********
BOE 1 - R COPELAND DECLARATION
# RUNNING 1
DECLARATION OF ROB KADEL


FOR THE NORTHERN DISTRICT OF
GEORGIA ATLANTA DIVISION

Plaintiffs,
v.
BRIAN KEMP, ET AL.,

Defendants.
DECLARATION OF ROB KADEL
I, ROBERT S. KADEL pursuant to 28 U.S.C. § 1746, hereby declare as
follows:
1. I am a registered voter in DeKalb County, Georgia, and registered to vote
at my home address of 2426 Sherbrooke Ct. NE, Atlanta, GA 30345.
2. I am employed by the Georgia Institute of Technology as Assistant
Director for Research in Education Innovation, Center for 21st Century
Universities.
3. As a Georgian, a sociologist (Ph.D., Emory University, 1998), and a
research volunteer on Georgia’s election processes, I have sought a
greater understanding of the operation of touchscreen voting systems.
KADEL DECLARATION
4. Therefore when I voted in advance voting on May 4, 2018 at The Gallery
at South DeKalb Mall in Decatur, Georgia, I was attentive to the details
of the voting process.
5. Prior to voting, I had accessed the Georgia Secretary of State’s website
to check my registration details and print a sample ballot for races and
questions for which I am eligible to vote.
6. I carried my marked sample ballot with me to the polling place for
reference.
7. I arrived at the polling place at approximately noon, and there were very
few people in the polling place.
8. I filled out the paper form for application for early voting and handed a
poll worker that completed form and my driver’s license. The poll
worker verified my information and signature and then asked me to take
my license and the form to another table with four laptops on it.
9. At that table, I gave the poll worker my form and license. She scanned
my license barcode and handed it back, then she gave me an activated
yellow voter access card with which to initiate the voting process on the
touchscreen machine.
10. I used a machine with serial number 116649.
KADEL DECLARATION
11. I selected choices in the races for Governor and a few others and then
noticed that the electronic ballot presented on the screen displayed
Congressional District 5 and State Senate District 44.
12. I live in Congressional District 6 and State Senate District 42, and was
alarmed to see races to vote for which I am ineligible, and to see that my
electronic ballot was missing races for which I am eligible to vote.
13. I alerted a poll worker who alerted her supervisor, Ms. Atkinson, who
was managing certain areas of the polling place that I had an incorrect
ballot.
14. The poll worker whom I had alerted held her finger on the “page" button
at the bottom of the machine screen for about 10 seconds and then
cancelled my ballot and ejected the card.
15. The poll worker and I walked over to the table of laptops where they
were coding the yellow voter access cards, and I explained that I should
be voting in Georgia Congressional District 6 and Georgia State Senate
District 42.
16. The poll worker said that if I was seeing “Georgia 5,” it is because I live
in “Georgia 5.”
17. I told her that I had voted in the Georgia’s 6th Congressional District
Special Election last year.
KADEL DECLARATION
18. I have not changed my residence since voting in the 6th District Special
Election in 2017.
19. The poll worker called over Ms. Atkinson who looked at the sample
ballot I had brought with me (to indicate which candidates I wanted to
vote for). The supervisor said that I had a nonpartisan ballot that
wouldn’t have shown any races.
20. I corrected her and said that this was the Democratic sample ballot that I
had printed at home, and that she could see that it had the Stacey
Abrams / Stacey Evans race for Governor at the top.
21. Ms. Atkinson instructed another poll worker to re-enter my information
into a touch screen device sitting on the table (operated with an
electronic stylus), and then they finally saw that I had been presented
with the wrong ballot.
22. They generated a new yellow voter access card for me at that time,
which was approximately 12:11 pm.
23. The original poll worker with whom I had spoken walked back with me
to the machines and I voted on machine serial number 158583.
24. The poll worker watched me insert my card and asked if I would quickly
hit the Next button to get to the screens with the congressional races and
KADEL DECLARATION
verify that I was presented with the correct races on the electronic ballot.
I did that, and all looked correct.
25. The poll worker then left to provide voter privacy, and I skipped back to
the beginning and began making my electoral selections.
26. I cast that electronic ballot on the touchscreen machine at 12:15 p.m.
27. I walked to another table and returned my yellow card to another poll
worker. She asked me if I had time to take a survey, and I said that I
really needed to get going.
28. Based on my personal research and my May 4, 2018 voting experience, I
do not believe that the DRE voting system can be relied on to produce
accurate election results. However, I still desire to vote in the November
2018 election.
29. I plan to vote by mail-in paper ballot to ensure that I can thoroughly
check the accuracy of the ballot issued to me and that my vote can be
verified and recounted if necessary. If I vote by mail, I will incur
additional inconvenience of requesting and voting a mail ballot in order
to case a more secure ballot. I would prefer to maintain the flexibility to
vote in my neighborhood precinct on Election Day when all last-minute
campaign information is available. However, if paper ballots are not
available at the polling place, I will be forced to choose between casting
KADEL DECLARATION
a verifiable paper ballot and giving up my ability to vote on Election
Day in my local polling place.
I DECLARE UNDER PENALTY OF PERJURY THAT THE FOREGOING IS
TRUE AND CORRECT.
Executed on August 2, 2018
______________________
Robert S. Kadel
KADEL DECLARATION
DECLARATION OF LOGAN LAMB

LAMB DECLARATION
LAMB DECLARATION
LAMB DECLARATION
LAMB DECLARATION
LAMB DECLARATION
LAMB DECLARATION
LAMB DECLARATION
LAMB DECLARATION
LAMB DECLARATION
LAMB DECLARATION
E
X
H
I
B
I
T
LAMB DECLARATION
Michael Barnes
From: Steven Dean <stevendean@kennesaw.edu>

Sent: Wednesday, March 15, 2017 10:51 AM
To: Michael L. Barnes; Merle Steven King
Subject: Request for data retrieval from elections.kennesaw.edu
We would like to retrieve certain records from elections.kennesaw.edu, including equipment inventory records
and workflow databases used during ballot building. These data are located in the cesuser user directory at
/home/cesuser. We would like to retrieve the entire cesuser directory.
Steven Dean
Technical Coordinator
KSU Center for Election Systems
3205 Campus Loop Road
Kennesaw, GA 30144
P: 470-578-6900 F: 470-578-9012
LAMB DECLARATION
From: Stephen Craig Gay

To: Lectra Lawhorne
Subject: CES Investigative update
Date: Friday, March 17, 2017 5:11:58 PM
Lectra,
Good afternoon. I wanted to take a moment and provide you with an update on the Center for Election Systems
Incident Response process:
- We met with CES Staff today to review the architecture of their internal network, review physical access controls,
and understand the services running on the internal network. We validated that an air gap exists between the internal
and external network and further validated via arp tables that no routes were available from the intranet servers to an
external network. Several opportunities for improvement were identified and CES staff are working on
documentation for the system. An executive summary with recommendations is forthcoming
- All external-facing servers associated with the Center are isolated to elections.kennesaw.edu which is hosted in the
Enterprise instance ofOmniUpdate and contains only public information.
- UITS WinServ, in partnership with the ISO and CES, is provisioning a dedicated Virtual Server which will be used
for internal file storage for CES. The server will be locked down via AD group memberships and will use verbose
logging and monitoring tied to our splunk instance. The logs will specifically audit for file access and alert on any
modifications to the authorizing AD group. Furthermore a local firewall will be in place and all traffic outside the
CES IP range blocked.
- I met with FBI Agent Ware at 4:30pm to receive the elections server - Dell PowerEdge R610 Tag Number
96J2F21. The ISO team will be performing a data recovery for data requested by the CES (Business Operations) on
Monday. We have confirmed that the FBI is maintaining a forensic image and changes to the server can occur.
Agent Ware shared that "the investigation is wrapping up" and mentioned being in attendance at the March 29th
meeting with AUSA Grimberg.
Please let me know if you have any questions or if I can provide any additional information.
In service,
Stephen C Gay CISSP CISA

KSU Chief Information Security Officer & UITS Executive Director
Information Security Office
University Information Technology Services (UITS)
Kennesaw State University
Technology Services Bldg, Room 031
1075 Canton Pl, MB #3503
Kennesaw, GA 30144
Phone: (470) 578-6620
Fax: (470) 578-9050
sgay@kennesaw.edu
LAMB DECLARATION
Milestone Due Date Status Lead Notes

Private Network Assessment Meeting 26-Jun Complete S.Gay
Spec UPS 13-Jul Complete C.Dehner
Order UPS 13-Jul Complete C. Dehner
DBAN R610 Hard Drives 7-Jul Complete C. Dehner
Deliver R610 to Networking 7-Jul Complete C. Dehner
Image Dell PowerEdge R630s (101614 & 101613) 26-Jul Complete C. Darrow
Rack Dell PowerEdge R630 and migrate DC and NAS 28-Jul In progress C. Darrow
Install UPS 4-Aug Complete C. Darrow Due data dependant on delivery of UPS from CDW-G.
LAMB DECLARATION
192.168.3.1
:_:-_· --. ~ - - - ~ ~ ' - ~ - ~ · - - -
Llrwx2.6.8 ·IIMl6ooM86
. - -
IMI Card Duplicator

192.168.3.119 Linux 2.6.8 -MCl6ooM73 IMI Card Du llcator
192.168.3.Bl Llnux2.8.B ·M4!600Mao IMI Card Duplicator
192.168.3. Unux2.6.8 ~ IMI Card Du licator
192.168.3.116 Linux 2.6.8 ·IIMl6ooM82 IMI Card Du llcator
192.168.3.104 Llnux2.8.8 ~70 IMI Card Du licator
192.168.3.115 Unux2.6.8 ~M71 IMI Card Du licator
192.168.3.1130 Linux2.6.12 •I\Ml6ooM81 IMI Card Duplicator
192.168.3.745 Unux2.6.8 -MfSeooM69 IMI Card Du licator
192.168.3.1~ Llnux2.6,8 •MIM!OOM26 IMI Card Du licator
192.188.3.1 Llnux2.6.8 -M~M79 IMI Card Duplicator
192.168.3.1<11 Linux2.6.8 •Mf!sooM84 IMI Card Duplicator
192.168.3.71 Llnux2.6.8 •MfieooM83 IMI Card Du licator
192.168.3.1,12 Llnux2.6.8 IMI Card Du llcator
192.188.3.6 Llnux2.6.8 IMI Card Duplicator
192.168.3.641 Unux2.6.8 IMI Card Duplicator
192.168.3.2 Microsoft Windows Server 2003 R2 SP2
192.168.3.5;3 HP P2055 Series ·F~-Printar
•FAX.PRINTER
192.168.3.~ Microsoft Windows XP •SIJEAN-GEMS-2
192.168.3. 7 Microsoft Windows XP -Cl\u.CENTER
192.168.3.51) Microsoft Windows Serv~r 2008 R2, •E C
Standard Edition
192.168.3.4 Microsoft Windows Serv~r 2008 R2, -C.S-OC1
En ·seedition
192.168.3.3 Microsoft Windows Serv~ 2008 R2, •C"S-NAS
Standard Ecfrtion
192.188.3.1 Mk:n>aoft WindoWa Serv~r 2008 -CifS-OC.CES,KENNESAW,EDU
192.188.3.5,j Mlcroaoft Windows XP •Ml>EARS09-980
192.168.3.51; Microsoft Windows XP -Gl:MS-DDESSERT
192.168.3.6 Microsoft Windows 7 HO!lie, Premium Edition •S VEN7-GEMS
SP1 Audio recording
192.168.3.70 WindowsXP h57-marle,CES.KENNESAW.EDU
192.188.3.66 WlndowsXP GEMS-mking.CES.KENNESAW.EDU
192.168.3.51 Microsoft Windows 7.5 ·~VCE8-2H.A.LL Audio recording
192.168.3.61 Unknown
192.168.3.5~ WindowsXP semlnole-termln.CES.KENNESAW.EDU
LAMB DECLARATION
From: Chnstopher Dehner

To: Steven Dean; Jason Figueroa
Cc: Michael Barnes; Stephen Gay
Subject: CES server surplus
Date: Wednesday, August 9, 2017 11:24:58 AM
Fellas,
I will arrive at the center around 1:30 today to pick up the old DC. I will also get the old
unicoi server from secure storage. Additionally, I sent in a service ticket for this request.
Regards,
Chris
Get Outlook for Android
LAMB DECLARATION
STATE OF GEORGIA
FULTON COUNTY
AGREEMENT BETWEEN THE SECRETARY OF STATE
AND
THE BOARD OF REGENTS OF THE UNIVERSITY SYSTEM OF GEORGIA
This AGREEMENT ("Agreement"), made this ~ day o f ~ 2016, by and

between the OFFICE OF THE SECRETARY OF STATE OF THE STATE OF GEORGIA
(hereinafter the "Secretary of State"} and the BOARD OF REGENTS OF THE UNIVERSITY
SYSTEM OF GEORGIA through KENNESAW STATE UNIVERSITY, a unit of the University
System of Georgia, (hereinafter "University") for the consulting services of the Center for Election
Systems of KENNESAW STATE UNIVERSITY (hereinafter" KSU").
WI1NESSETH
WHEREAS, the Secretary of State desires to employ the services ofKSU to assist the staff
of the Elections Division of the Office of the Secretary of State (hereinafter "the Elections
Division") with: technical support and training of State election officials in the use ofthe Statewide
unifonn electronic voting system {hereinafter "the voting system") in the State of Georgia;
acceptance testing for the fiscal year 2017 of the GEMS software, the direct recording electronic
voting devices (hereinafter "DREs"), and the electronic poll book/encoders "ExpressPoll" which
constitute components of the voting system; ballot building and related activities for counties and
municipalities in the State of Georgia ("State");
WHEREAS, the Secretary of State has the authority under the Laws of the State ofOeorgia
to enter into this Agreement; and
WHEREAS, the University is both qualified to enter into this Agreement and has offered
such services to the Secretary of State under the terms and conditions stated herein; and
WHEREAS, the parties wish to enter into this Agreement under the terms and conditions
set forth herein;
NOW THEREFORE, in consideration of the mutual promises and agreements hereinafter

set forth, the satisfactory consideration each for the other hereby expressly recognized and agreed,
the parties hereby contract for services in accordance with the following provisions.
-1-
LAMB DECLARATION
ARTICLE I. SCOPE OF SERVICES
KSU will assist the staff of the Elections Division under the direction of and as directed by
the Director of the Elections Division or his/her designee, in the following areas:
A. KSU shall maintain a "Center for Election Systems" (hereinafter "the Center") that
will primarily provide technical and training support on the statewide wiifonn
system to the Elections Division, Georgia election officials, county election board
members and election superintendents;
B. KSU shall test the voting system for compliance with the Georgia Elections Code,
as required under Article 9 of Chapter 21 of the Official Code of Georgia and under
the Rules of the State Election Board and the Rules of the Secretary of State, as
these laws and rules presently exist and may hereafter be amended. This testing to
be conducted during Fiscal Year 2017 shall include, but is not limited to, the
physical examination of software and voting equipment acquired by the Secretary
of State or any County in the State of Georgia in connection with deployment of
the voting system, and the preparation and submission of reports of such
evaluations to the staff of the Elections Division;
C. KSU shall work with the vendor and the Elections Division to define the next
versions of all components of the voting system;
D. KSU shall implement classes and training modules, using electronic media where
possible, for the instruction of Election Superintendents and Voter Registrars in the
use of the voting system;
E. KSU shall provide ballot building support for county election officials. KSU will
provide office space and appropriate technical support for these services. KSU will
coordinate the printing of paper absentee ballots;
F. KSU shall support the deployment of the ExpressPoJI electronic pollbook,

including preparation of compact flash memory cards with voter lists for each
election and extraction of credit-for-voting data, post-election;
G. KSU shall support all State certification testing of voting systems and will provide
acceptance testing for the State's voting system
H. KSU shall provide technical support for the State's election servers installed in the
county election offices throughout the State;
-2-
LAMB DECLARATION
I. KSU shall provide consultation and advice to local governments on the purchase,
testing, and utilization of the software, voting equipment and other components
which comprise the voting system;
J. KSU shall maintain a website that will provide an initial point of contact for
election officials wishing to utilize the services of the Center. The website shall
describe the various services available through the Center, provide directions for
obtaining these services from the Center, and facilitate answers to ..frequently asked
questions";
K. KSU shall maintain a Help Desk designed for immediate response to problems
encountered with any component of the voting system during the conduct of an
election in any precinct. The Help Desk shall be staffed from 8:00 a.m. to 5:00
p.m. on all business days throughout the year, and from 6:00 a.m. witil County
tabulations are concluded on election days;
L. Upon request of the Secretary of State, KSU shall assist the Secretary of State
with identifying, inspecting, and/ or implementing a new state wide voter
registration system which will allow integration with the voting system;
M. Upon request of the Secretary of State, KSU shall provide key faculty/employees
identified as the Executive Director, Director, and Assistant Director of KSU with
Blackberry technology or equivalent email and messaging capabilities;
N. KSU shall coordinate the proper disposal of decommissioned voting system

components at the direction of the Elections Division;
0. KSU shall provide consulting services to Secretary of State on legislation or

pending legislation and laws affecting elections;
P. KSU shall provide any other election services as may be required by the Elections
Division;
ARTICLE II. RESPONSIBILITIES OF KSU
KSU shall continue to maintain a permanent location on the KSU campus for the operation
of the Center. The Center shall be operated and maintained by a full-time staff, including but not
limited to, an Executive Director, a Center Director, a Center Assistant Director, technical support
staff, and student assistants. The Center shall contain voting equipment and software, provided by
the Secretary of State, necessary to completely define, setup and conduct a sampJe election. The
Center shall maintain a ballot building facility to house Center staff and Elections Division staff
for the purpose of building ballots for counties and municipalities.
-3-
LAMB DECLARATION
KSU shall not possess, obtain, or acquire, either directly or indirectly. a pecuniary interest
in any business entity involved in the development,. manufacture, marketing, or sale of computer
voting equipment or software during the term of this Agreement and for one year after the ending
date of this Agreement.
Any software, databases, or other analytic tools obtained or developed in support of

activities covered under this Agreement and any work product resulting from activities covered
under this Agreement are the property of the Secretary of State and may not be offered or utilized
by any other entity in any manner whatsoever, in whole or in part, without the written pennission
of the Secretary of State or a designee of the Secretary of State.
KSU shall deploy newly purchased property acquired by the Elections Division, only after
consultation with the individual within the Elections Division designated by the Elections Division
Director for such pwpose.
KSU shall require all employees of the Center who have access to the system and system
security measures to sign confidentiality agreements, as provided by the Secretary of State.
ARTICLE Ill. TIME OF PERFORMANCE./ arfctr

(., CJJ/7 cir q.-
The period of this Agreement shall be from July l , 201¥, through June 30, 201'. Either
party may cancel this Agreement upon thirty days written notice to the other party.
ARTICLE IV. COMPENSATION AND PAYMENT
For the satisfactory perfonnance of its duties and obligations set forth herein, K.SU shall
be compensated for its services for the full year of this Agreement in the amowit not to exceed
$792,385.00, for the State fiscal year 2017, billable in 12 installments of$66,032.08. Invoices shall
be submitted to the Secretary of State on a monthly basis. KSU 's services shall include support for
such professional services. including secretarial, student assistants, mail and express mail deliYery,
telephone, computer charges, computer equipment and software, photocopying and other staff
expenses as set forth in Appendix "A" attached hereto and incorporated herein by reference KSU' s
services and obligations under this Agreement shall be completed at or prior to the time of final
payment. In the event of cancellation under Article III, no further payments shall be required under
this Agreement beyond the end of the month in which the cancellation is executed.
ARTICLE V. RETENTION OF RECORDS
KSU shall keep and maintain as records of the Secretary of State all records and other
docwnents pertaining to the perfonnance of this Agreement until the final payment of funds to
-4- .
LAMB DECLARATION
KSU by the Secretary of State pursuant to this Agreement has been completed. At such time,
physical custody of the records and documents shall be returned to the Secretary of State.
The University and KSU shall give immediate notice by telephone to the Elections Division
Director of the Secretary of State of any open records request made pursuant to O.C.O.A. § 50-18-
70 et seq., request for production of documents and tlrings, or subpoena associated with any
litigation relating to any computer programs. computer software, equipment, or any other
documents, issues or materials relating to the Voting System or any of its components. The
University and KSU acknowledge that computer programs and computer software may be
exempted from disclosure when meeting the defmitions and provisions ofO.C.G.A. § S0-18-72(f)
and that an open records request may affect State or vendor rights. The University and KSU shall
deliver to the Elections Division Director a copy of any written open records request received by
the University or KSU promptly by electronic transmission. facsimile or in any event within 24~
hours of its receipt of the request. In so far as possible, the University and KSU will allow the
Secretary of State prior opportunity to comment on any response to any open records request
within this paragraph; however, such review shall be for the convenience of the Secretary of State.
without responsibility or liability to the University or KSU.
ARTICLE VI. REPORTING AND AUDITING REQUIREMENTS
KSU shall provide monthly reports to Secretary of State to report the status of the
Center's performance under the Agreement and the Center's progress toward fulfilling the
requirements of the Agreement KSU shall, ifit has expended $100,000 or more during its fiscal
year in State funds, provide for and cause to be made annually an audit of the financial affairs
and transactions of all the Center's funds and activities. The audit shall be performed in
accordance with generally accepted auditing standards. KSU shall, if it has expended less than
$ I 00,000 in a fiscal year in state funds, forward to the State auditor and each contracting State
organization a copy of the Center's financiaJ statements. If annual financial statements are
reported upon by a public accountant, the accountant's report must accompany them. If not, the
annual financial statements must be accompanied by the statement of the president or person
responsible for the nonprofit organization's financial statements.
-5-
LAMB DECLARATION
ARTICLE VIL MISCELLA1SEOUS
TI1e 'University, KSl r. and the Secretary of State further mutually agree as follows;
A. This Agreement constitutes the entire agreement bet\J.een the parties and any
amendments to this Agrc\!ment must be in writing.
8. The provisions of O.C.G.A. § 45-10-20. 111 wq! ~ill not be violated by the parties to this
agreement.
.fk
~-ITNESS WHEREOF. the parties hereto have executed this Agreement, this __Le'.
day of .,} , ,n.e.. , 20 V-:,G,
ON BEHALF OF THE SECRETARY OF

STATE OF THE STATE Of GEORGIA:
Print N e Title
Clee~fp 5°J
Date: :. _ 5_/1¼L.
-6-
LAMB DECLARATION
Appendix A
Budget, FY 2017
Center for Election Systems, Kennesaw State
University
Category FY 2017 Proposed Budget
Personnel
Center Executive Director $ 70.800.00
Director $ 87.800.00
Assistant Director $ 56.500.00
Election Professional II $ 48,500.00
Election Professional II $ 44,900.00
Election Professional II $ 43.300.00
IT Sys Supp Pro II $ 41,200.00
IT Sys Supp Pro I $ 36.500.00
Salaries $ 429,500.00
Fringes $ 128,850.00
Salaries and Fringes $ 558,350.00
Student Assistants $ 33,000.00

Temporary Staff Assistants $ 10,000.00
TOTAL PERSONNEL s 601,350.00
OFFICE/LAB SPACE RENT s 41,000.00
TRAVEL s 20.000.00
-7-
LAMB DECLARATION
TELECOMM $ 12,000.00
SUPPLIES s 12,000.00
COPYING $ 2,000.00
FREIGHT & SHIPPING $ 20,000.00
COMPUTERS/SOFTWARE $ 12,000.00
Indirects (10%) $ 72,035.00
TOTAL BUDGET $ 792,385.00
-8-
LAMB DECLARATION
FD-597 (Rev 8-11-94) Page _ - 4 -_ _ of·--11-'_
UNITED STATES DEPARTMENT OF JUSTICE
FEDERAL BUREAU OF INVESTIGATION
Receipt for Property Received/Returned/Released/Seized
File#
item(s) listed below were:

I O Re.ceived From
~eturned To
D Released To
D Seized
(Name) _ _ _ _/_-___._ _\_.....,,.._____ ~-r-"----------------------
(Street Address),_ _ _-"-_,__....,..._ _ _ _··...:-~;;...-''-.;......>_ _ _ _.:-.!,:..:·--, _ _ _ . . _ ; _ _ ~ - - - - - - - - - - - - - -
(City) _________________,,_-\_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __
Description of Item(s): - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
' .
!
-~
Received By: 4z6-(Signature):;;;,---

<" ~ Received From:
LAMB DECLARATION
FD-597 (Rev 8-11-94) Page _ ___,_/_ _of--+-'--
UNITED STATES DEPARTMENT OF JUSTICE

FEDERAL BUREAU OF INVESTIGATION
Receipt for Property Received/Returned/Released/Seized
File#
---=~-1-/. . .....:.·:--+;-+t~7'------------
1
item(s) )isted below were:
On (date) -r-
( _ ,· l Q....-Ireceived From
O Returned To
o Released To
D Seized
(Name) _______.:_/.;;.·-+--\.--". ...:;~-----'---¥--------------------------
(Street Address)._ _.....,.,.______._ _ _ _ _ /
· r___ _.________________________
(City) _ _ _ _ _----;..., , ~ . · . ; . . . · ~ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
· Description of Item(s): - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
·1/" Received From:

,,,.
Received By: 1
,· . / ._,..: • . · ··
_..::..,..:._.;::l:.a-.;_,;.,,.,:._-·::_'
(Signature)
,;_r(,--.::::.....,.__,,.__'"- __
LAMB DECLARATION
\Jonnaenua1
Evidence Tag
Date Tag No Case No: Location
March 2, 2017 20170302CES Center for Elections Systems
Public Safety Officer(s) involved__ NA

Description of Property
Server with DNS name elections.kennesaw.edu with KSU asset tag )030 IC,
Chain of Custody Receipt

Released by Received by
(Print and Sign) Date Purpose (Print and Sign) Date
Merle King Retrieving server after reported data breach. St,.ephen Rose (cp7
\MI"""", . . ?- ~
March 2, 2017 Server will be retrieved by the FBI by UITS ISO .f , .I ~ ~ March 2, 2017
c:7A(f 1.-.,.... - 'J Jar~ \ ~Swct? fidec.~~ of ~ t'.c;,c~t'1,~q'°1,y -> ,..
~+-cP,.,,., RosP
cw--~~~ 3/2/4oq~
'
,.e.__.L--r, ___ /J?~fch '3 1o(J
UITS Information Security Office

LAMB DECLARATION
From: Mariel Louise Fox

To: Stephen Craig Gav
Cc: Tamara Elena Livingston
Subject: Fwd: CONSULTATION REQUEST from Steven Dean, Kennesaw Campus
Date: Wednesday, March 15, 2017 4:22:40 PM
Stephen,
Below is the communication thread among Steven Dean, JeffMilsteen and myself.
I'll await your direction and guidance as to next steps in providing consultation to Steven regarding KSU records,
and I will communicate that message to Steven shortly.
Thanks!
Mariel Fox
Director, Records & Information Management
Museums, Archives & Rare Books (MARB)
LB216MD 1704
Direct: 4 70-578-2225
Main: 470-578-6289
----- Forwarded Message-----

From: "JeffMilsteen" <:jmilstee@kennesaw.edu>
To: "Steven Dean" <sdean29@kennesaw.edu>
Cc: "Mariel Fox" <mfox32@kennesaw.edu>
Sent: Friday, March 10, 2017 1:38:30 PM
Subject: Re: CONSULTATION REQUEST from Steven Dean, Kennesaw Campus
Steven,
Mariel forwarded your inquiry to me. I believe there are a number of issues here that will require some additional
work. For example, some of the data maintained by the Center is, by contract, property of the Secretary of State.
That data would be subject to the Secretary of State's records retention policies and presumably those records should
either be returned to the SOS Office or, if appropriate, destroyed at their direction and pursuant to their policies. All
other records of the Center would be subject to the retention policies ofKSU and Mariel can probably help you with
existing retention guidelines. The trick, of course, is to correctly identify and categorize those records.
I was not clear what was being asked with respect to FOIA requests. If the Center receives any open records
requests, those should immediately be forwarded to the Legal Division for review. The requests themselves, like all
other official records of the university, are subjection to our retention guidelines.
I hope this helps. If you have additional questions, please let me know. Thanks.
JeffMilsteen
Chief Legal Affairs Officer
----- Original Message -----

From: "Mariel Fox" <mfox32@kennesaw.edu>
To: "JeffMilsteen" <:jmilstee@kennesaw.edu>
Sent: Friday, March 10, 2017 9:26:22 AM
Jeff,
LAMB DECLARATION
This request (see below) for advice came from Steven Dean (sdean29@kennesaw.edu), IT Systems Support at the
Center for Election Systems.
I spoke to him on the phone concerning what types of records to keep and how long to keep them, directing him to
the State of Georgia retention schedules on the Georgia Archives website.
As to his question about FOIA requests, I said that for KSU open records requests, those are handled by Legal
Affairs. But for the Center's records, I did not know. I told him I would forward this question to you.
Please let me know if you have any questions, of if you have any suggestions on how to handle such inquiries in the
future.
Thank you!
Mariel Fox
LB 216 MD 1704
Direct: 470-578-2225
Main: 470-578-6289

From: stevendean@kennesaw.edu
To: "records2go" <records2go@kennesaw.edu>
Sent: Thursday, March 9, 2017 1:58:52 PM
Subject: CONSULTATION REQUEST from Steven Dean, Kennesaw Campus
Date Available for Consultation: No in-person consolation needed.
REQUESTED BY: Steven Dean Phone# 470-578-2120
Campus: Kennesaw
Department: Center for Election Systems
Office Location: House 3205
Advice requested for:

Myself and my supervisor or manager.
Need advice on:

['Which records do we need to keep?', 'How long do we need to keep records?', 'Do we need to keep both hard copy
and digitial files?', 'What are our records responsibilities?', 'Topic not listed above. Describe in comments.']
Additional comments:
In writing new policies for data storage for the Center, I'd like to see your written policies for data storage periods as
relating to FOIA requests.
Preferred communication method: Email.
LAMB DECLARATION
From: Mariel Louise Fox

To: Steven Jay Dean
Cc: Stephen Craig Gay
Steven,
I just learned that Stephen Gay will be providing direction and guidance concerning your inquiry about records
retention/data storage policies and issues.
I'm sure we'll be working together more closely in the future.
Thanks for bringing up these important issues!
Regards,
Mariel Fox
LB 216 MD 1704
Direct: 470-578-2225
Main: 470-578-6289

From: "JeffMilsteen" <jmilstee@kennesaw.edu>
Steven,
Mariel forwarded your inquiry to me. I believe there are a number of issues here that will require some additional
work. For example, some of the data maintained by the Center is, by contract, property of the Secretary of State.
That data would be subject to the Secretary of State's records retention policies and presumably those records should
either be returned to the SOS Office or, if appropriate, destroyed at their direction and pursuant to their policies. All
other records of the Center would be subject to the retention policies ofKSU and Mariel can probably help you with
existing retention guidelines. The trick, of course, is to correctly identify and categorize those records.
I was not clear what was being asked with respect to FOIA requests. If the Center receives any open records
requests, those should immediately be forwarded to the Legal Division for review. The requests themselves, like all
other official records of the university, are subjection to our retention guidelines.
Jeff Milsteen

To: "JeffMilsteen" <jmilstee@kennesaw.edu>
LAMB DECLARATION
Jeff,
This request (see below) for advice came from Steven Dean (sdean29@kennesaw.edu), IT Systems Support at the
Center for Election Systems.
I spoke to him on the phone concerning what types of records to keep and how long to keep them, directing him to
the State of Georgia retention schedules on the Georgia Archives website.
As to his question about FOIA requests, I said that for KSU open records requests, those are handled by Legal
Affairs. But for the Center's records, I did not know. I told him I would forward this question to you.
Please let me know if you have any questions, of if you have any suggestions on how to handle such inquiries in the
future.
Thank you!
Mariel Fox
LB 216 MD 1704
Direct: 470-578-2225
Main: 470-578-6289

Campus: Kennesaw

Need advice on:

('Which records do we need to keep?', 'How long do we need to keep records?', 'Do we need to keep both hard copy
and digitial files?', 'What are our records responsibilities?', 'Topic not listed above. Describe in comments.']
In writing new policies for data storage for the Center, I'd like to see your written policies for data storage periods as
relating to FOIA requests.
LAMB DECLARATION

To: Steven Jay Dean; Jason Stephen Figueroa
Cc: Christopher Michael Dehner: James Christopher Gaddis; Michael L Barnes
Subject: Fwd: Plan of action for the passing of data
Importance: High
Steven and Jason,
Please work with Christopher Dehner on this tomorrow, as this functionality is at the core of securely returning the
data to the Secretary of State's Office. Chris will pull in additional ISO staff members as needed and I'll be available
if any challenges or questions come up.
Thank you,

Kennesaw, GA 30144
Phone: (470) 578-6620
Fax: (470) 578-9050
sgay@kennesaw.edu

From: "Stephen C Gay" <sgay@kennesaw.edu>
To: mbeaver@sos.ga.gov
Cc: "Lectra Lawhorne" <llawhorn@kennesaw.edu>, "Michael Barnes" <mbarne28@kennesaw.edu>
Sent: Wednesday, March 22, 2017 6:25:02 PM
Subject: Plan of action for the passing of data
Merritt,
Thank you for the conversation regarding the ExpressPoll file pickup and discussion on getting the processed data
back to your office. Looking over my notes, I have the following plan of action from our discussion:
Objective: KSU will use the Secretary of State SFTP server to upload the data moving forward, after which
members of your team will coordinate the distribution to the counties which require the data.
Tasks:
- Remove all users/rights with the current KSU folder on the Secretary of State SFTP Server and provision new
accounts for specified users (Likely SDean, MFiguero, CDehner)
- Work with Chris Dehner, in the UITS Information Security Office, to share and validate SFTP certificate for
server.
- Work with Chris Dehner and members of CES to develop process for file transfer, account password expiration,
and archiving of file and associated password sharing
- Chris Dehner will work with Steven and Jason on selecting the archive software client, SFTP client and validating
the functionality
- Test the clients and processes, and resolve any challenges.
If you could send me the contact information for James and Stephen on your team I will share with the team and ask
that they connect 1st thing tomorrow. I don't want to be a roadblock to these tasks and progress, but will check-in on
LAMB DECLARATION
the progress and will be available to assist as needed.

KSU Chieflnformation Security Officer & UITS Executive Director
Kennesaw, GA 30144
Phone: (470) 578-6620
Fax: (470) 578-9050
sgay@kennesaw.edu
LAMB DECLARATION

To: Ware, William D. II CAD CEBil
Subject: Fwd: Request for data retrieval
Agent Ware,
We received the request below from the Center for Election Systems regarding data contained on the seized server
which they do not have a backup of. What is the possibility of having the data extracted and us picking it up?
Thank you for your consideration of this request.

Stephen

From: "Michael Barnes" <mbarne28@kennesaw.edu>
To: "Stephen C Gay" <sgay@kennesaw.edu>
Cc: "Steven Dean" <sdean29@kennesaw.edu>, "Merle King" <mking@kennesaw.edu>
Subject: Request for data retrieval
Stephen,
As discussed earlier today, we would like to retrieve certain records from

elections.kennesaw.edu that support our daily office activities, items
such as inventory records, workflow databases used during our ballot
building efforts, and operation manuals. These data are located in the
cesuser user directory at /home/cesuser. We would like to retrieve the
entire cesuser directory, if possible.
Thanks,
Michael Barnes
Director
Center for Election Systems
Kennesaw, GA 30144
ph: 470-KSU-6900
fax: 470-KSU-9012
LAMB DECLARATION

To: Christopher Michael Dehner
Cc: Davide Gaetano
Subject: Infrastructure projects for CES
Date: Monday, July 10, 2017 5:48:48 PM
Chris,
Speaking to Davide about the infrastructure surplus recommendations and I would like to
divide the project into 2 phases, one focused on the surplus, switches, and APC's mentioned in
the AAR; and the 2nd focused on the slightly longer plan to add environmental and log
monitoring. If you could please connect with him on these projects, I would sincerely
appreciate it and if I can assist in any way please let me know.

Kennesaw, GA 30144
Phone: (470) 578-6620
Fax: (470) 578-9050
sgay@kennesaw.edu
LAMB DECLARATION
From: stephen Craig Gay

To: Ware. William D. II (AT) (FBI)
Subject: Investigative update
Date: Monday, March 13, 2017 7:59:09 AM
Agent Ware,
Good Monday morning. I wanted to take a moment to reach out to ask for an update on the
status of the investigation. If there is anything at all we can do to assist please let me know.
Thank you,
Stephen
Sent from Nine
LAMB DECLARATION
March 3, 2017
Election-related files
elections.kennesaw.edu
The voting system and electronic pollbooks used in Georgia require files to be named in compliance with
the application's requirements. As a consequence, many of the files will have identical names, but their
contents vary by county.
Some of the pollbook related files will only contain voter registration values. These files are used to
update the electors list, indicating voters who were issued ballots during advance/early voting. Other
pollbook files will contain the state's entire electors list.
The folder names relate to the content contained within the files placed within the folders, back to the
county to which they are assigned. We developed a folder for each county (159) and within each folder
we placed files generated for that individual county.
Examples of files posted for a county to pull down:
./Appling County/Proof/Audio/Appling Audio.zip - This zip file contains audio files linked within the
county's election database. This files are posted so a county can proof whether the candidate's name,
ballot information headers, race headers are all present and recorded properly. The file is zipped due to
file size .
./Appling County/Proof/Ballot/01-Appling.zip - This zip file contains ballot proofs for a given election.
These files are provided to each county to allow them to confirm that the contents of their ballots are
accurate for the given election. The file is zipped due to files size .
./Appling County/Proof/Ballots/Ballot and Audio Proofs Signoff v2.pdf- This file is provided to every
county when proofing audio files and ballot proofs. We require each county to return a signed signoff
form to our office after they have completed their proofing. This form allows the completed election
database to be released from us to the jurisdiction for use in the given election. "V2" indicates that this
is the second version of this form .
./Appling County/ExpressPoll/Numbered List/001 (11-08-2016}.pdf-This file is provided to every

county after the completion of the given election. This file contains a list of those voters who
participated at their assigned polling location on Election Day in sequential order.
./Appling County/ExpressPoll/ABSFile/PollData.db3 -This is a data file for use within the assigned
county on their ExpressPoll units that are used to create voter access cards given to voters during the
Advance Voting period. No individual voter data is contained within this file. A file of this nature is
created for each county prior to a given election. "ABS" relates to voters casting ballots prior to Election
Day .
./Appling County/ExpressPoll/ABSFile/Expoll.resources - This file accompanies the above mention file.

The resource file instructs the ExpressPoll device what operations to allow and what buttons to display
on screen to the user of the ExpressPoll device.
LAMB DECLARATION
./Baldwin County/ExpressPoll/ED Files/November 2016 General Voter Lookup.zip - This file is not built
for all counties. This file is only built for those counties who request it from our office. This file contains
the elector's list for the county for the given election, but it is not used to create any voter access cards.
The file is zipped due to size of the files content .
./Baldwin County/ExpressPoll/ED Files/November 2016 General Voter Lookup Password Memo.pdf-

This file accompanies the above mentioned file. This file contains what the passwords are to access the
data contained in the zipped file above when loaded onto an ExpressPoll. These passwords are changed
for every election .
./Cherokee County/ExpressPoll/ED Files/November2016GeneralElectionDay.zip -This is not a file

posted for each county. This file is only posted to those counties who produce the storage media loaded
into the jurisdictions' ExpressPolls themselves. Counties that do this operation are: Fulton, Cobb,
Dekalb, Gwinnett, Forsyth, Chatham, Muscogee, Henry, Columbia, Clayton, and Cherokee. This file
contains the full elector's list for the state for a given election .
./Cherokee County/ExpressPoll/ED Files/November 2016 General Election Day Password Memo.pdf-

This file accompanies the above mentioned file. This file contains what the passwords are to access the
data contained in the zipped file above when loaded onto an ExpressPoll. These passwords are changed
for every election .
./Clayton County/GEMS DB/**** .gbf- This is a file posted to a county only in select circumstances.
This is an election database file containing the ballot contents for a given election. These files are
accessed by the GEMS application .
./Pickens County/ExpressPoll/ED Files/ExpReport.exe - File allows a county to produce a numbered list

of voters directly from the ExpressPoll media, when installed on the ExpressPoll media .
./Pickens County/ExpressPoll/ED Files/System.Data.SQLite.DLL-This file allows the file mentioned

above to operate on the ExpressPoll. The above file is inoperative without this file .
./Richmond County/GEMS DB/2. GEMS lnstructions.pdf-This is a manual on GEMS operations. Only

posted if requested by a county .
./Richmond County/GEMS DB/General Demo.zip - Only posted if requested by a county. Contains a

demonstration election database.
This concludes the types of files placed within the county folders for distribution to counties
LAMB DECLARATION
Attached is the known county user accounts allowing access to these to county folders. When an
account is created, the county recipient is automatically sent (by Drupal) an email that contains a
password reset link. Counties create their own passwords for accessing the folders.
Username Folder Phone Number

Appling County Elections Appling County 912-367-8113
Appling County Registrar Appling County 912-367-8113
Atkinson County Elections Atkinson County 912-422-3003
Atkinson County Registrar Atkinson County 912-422-3003
Bacon County Elections Bacon County 912-632-5551
Bacon County Registrar Bacon County 912-632-5551
Baker County Elections Baker County 229-734-3019
Baker County Registrar Baker County 229-734-3019
Baldwin County Elections Baldwin County 4 78-445-4807
Baldwin County Registrar Baldwin County 4 78-445-4807
Banks County Elections Banks County 706-677-6260
Banks County Registrar Banks County 706-677-6260
Barrow County Elections Barrow County 770-307-3510
Barrow County Registrar Barrow County 770-307-3510
Bartow County Elections Bartow County 770-387-5098
Bartow County Registrar Bartow County 770-387-5098
Ben Hill County Elections Ben Hill County 229-426-5151
Ben Hill County Registrar Ben Hill County 229-426-5151
Berrien County Elections Berrien County 229-686-5213
Berrien County Registrar Berrien County 229-686-5213
Bibb County Elections Bibb County 478-621-6622
Bibb County Registrar Bibb County 478-621-6622
Bleckley County Elections Bleckley County 478-934-3204
Bleckley County Registrar Bleckley County 478-934-3204
Brantley County Elections Brantley County 912-462-6159
Brantley County Registrar Brantley County 912-462-6159
Brooks County Elections Brooks County 229-263-9939
Brooks County Registrar Brooks County 229-263-9939
Bryan County Elections Bryan County 912-653-3859
Bryan County Registrar Bryan County 912-653-3859
Bulloch County Elections Bulloch County 912-764-6502
Bulloch County Registrar Bulloch County 912-764-6502
Burke County Elections Burke County 770-775-8299
Burke County Registrar Burke County 770-775-8299
Butts County Elections Butts County 770-775-8299
Butts County Registrar Butts County 770-775-8299
LAMB DECLARATION
Calhoun County Elections Calhoun County 229-849-2115

Calhoun County Registrar Calhoun County 229-849-2115
Camden County Elections Camden County 912-576-3785
Camden County Registrar Camden County 912-576-3785
Candler County Elections Candler County 912-515-4424
Candler County Registrar Candler County 912-515-4424
Carroll County Elections Carroll County 770-830-5824
Carroll County Registrar Carroll County 770-830-5824
Catoosa County Elections Catoosa County 706-935-3990
Catoosa County Registrar Catoosa County 706-935-3990
Charlton County Elections Charlton County 912-496-2607
Charlton County Registrar Charlton County 912-496-2607
Chatham County Elections Chatham County 912-201-4375
Chatham County Registrar Chatham County 912-201-4375
Chattahoochee County Chattahoochee
Elections County 706-989-3603
Chattahoochee County Chattahoochee
Registrar County 706-989-3603
Chattooga County Elections Chattooga County 706-857-0709
Chattooga County Registrar Chattooga County 706-85 7-0709
Cherokee County Elections Cherokee County 770-479-0407
Cherokee County Registrar Cherokee County 770-479-0407
Clarke County Elections Clarke County 706-613-3150
Clarke County Registrar Clarke County 706-613-3150
Clay County Elections Clay County 229-768-2445
Clay County Registrar Clay County 229-768-2445
Clayton County Elections Clayton County 770-477-4572
Clayton County Registrar Clayton County 770-477-4572
Clinch County Elections Clinch County 912-487-3656
Clinch County Registrar Clinch County 912-487-3656
Cobb County Elections Cobb County 770-528-2312
Cobb County Registrar Cobb County 770-528-2312
Coffee County Elections Coffee County 912-384-7018
Coffee County Registrar Coffee County 912-384-7018
Colquitt County Elections Colquitt County 229-616-7415
Colquitt County Registrar Colquitt County 229-616-7415
Columbia County Elections Columbia County 706-868-3355
Columbia County Registrar Columbia County 706-868-3355
Cook County Elections Cook County 229-896-7925
Cook County Registrar Cook County 229-896-7925
Coweta County Elections Coweta County 678-854-0015
LAMB DECLARATION
Coweta County Registrar Coweta County 678-854-0015

Crawford County Elections Crawford County 478-836-1877
Crawford County Registrar Crawford County 478-836-1877
Crisp County Elections Crisp County 229-276-2611
Crisp County Registrar Crisp County 229-276-2611
Dade County Elections Dade County 706-657-8170
Dade County Registrar Dade County 706-657-8170
Dawson County Elections Dawson County 706-344-3640
Dawson County Registrar Dawson County 706-344-3640
Decatur County Elections Decatur County 229-243-2087
Decatur County Registrar Decatur County 229-243-2087
DeKalb County Elections DeKalb County 404-298-4020
DeKalb County Registrar DeKalb County 404-298-4020
Dodge County Elections Dodge County 478-374-3775
Dodge County Registrar Dodge County 478-374-3775
Dooly County Elections Dooly County 229-268-9023
Dooly County Registrar Dooly County 229-268-9023
Dougherty County Elections Dougherty County 229-431-3247
Dougherty County Registrar Dougherty County 229-431-3247
Douglas County Elections Douglas County 770-920-7412
Douglas County Registrar Douglas County 770-920-7412
Early County Elections Early County 229-723-4522
Early County Registrar Early County 229-723-4522
Echols County Elections Echols County 229-559-7526
Echols County Registrar Echols County 229-559-7526
Effingham County Elections Effingham County 912 754-8030
Effingham County Registrar Effingham County 912 754-8030
Elbert County Elections Elbert County 706-283-2016
Elbert County Registrar Elbert County 706-283-2016
Emanuel County Elections Emanuel County 478-237-3471
Emanuel County Registrar Emanuel County 478-237-3471
Evans County Elections Evans County 912-739-4080
Evans County Registrar Evans County 912-739-4080
Fannin County Elections Fannin County 706-632-7740
Fannin County Registrar Fannin County 706-632-7740
Fayette County Elections Fayette County 770-305-5138
Fayette County Registrar Fayette County 770-305-5138
Floyd County Elections Floyd County 706-291-5167
Floyd County Registrar Floyd County 706-291-5167
Forsyth County Elections Forsyth County 770-781-2118
Forsyth County Registrar Forsyth County 770-781-2118
LAMB DECLARATION
Franklin County Elections Franklin County 706-384-4390

Franklin County Registrar Franklin County 706-384-4390
Fulton County Elections Fulton County 706-384-4390
Fulton County Registrar Fulton County 706-384-4390
Gilmer County Elections Gilmer County 706-635-4 763
Gilmer County Registrar Gilmer County 706-635-4763
Glascock County Elections Glascock County 706-598-3241
Glascock County Registrar Glascock County 706-598-3241
Glynn County Elections Glynn County 912-554-7063
Glynn County Registrar Glynn County 912-554-7063
Gordon County Elections Gordon County 706-629-7781
Gordon County Registrar Gordon County 706-629-7781
Grady County Elections Grady County 229-377-4621
Grady County Registrar Grady County 229-377-4621
Greene County Elections Greene County 706-531-1108
Greene County Registrar Greene County 706-531-1108
Gwinnett County Elections Gwinnett County 678-226-7231
Gwinnett County Registrar Gwinnett County 678-226-7231
Habersham County Elections Habersham County 706-839-0170
Habersham County Registrar Habersham County 706-839-0170
Hall County Elections Hall County 770-531-6945
Hall County Registrar Hall County 770-531-6945
Hancock County Elections Hancock County 706-444-5259
Hancock County Registrar Hancock County 706-444-5259
Haralson County Elections Haralson County 770-646-2010
Haralson County Registrar Haralson County 770-646-2010
Harris County Elections Harris County 706-628-5210
Harris County Registrar Harris County 706-628-5210
Hart County Elections Hart County 706-376-8911
Hart County Registrar Hart County 706-376-8911
Heard County Elections Heard County 706-675-3353
Heard County Registrar Heard County 706-675-3353
Henry County Elections Henry County 770-288-6448
Henry County Registrar Henry County 770-288-6448
Houston County Elections Houston County 478-987-1973
Houston County Registrar Houston County 478-987-1973
Irwin County Elections Irwin County 229-468-5894
Irwin County Registrar Irwin County 229-468-5894
Jackson County Elections Jackson County 706-367-6377
Jackson County Registrar Jackson County 706-367-6377
Jasper County Elections Jasper County 706-468-4903
LAMB DECLARATION
Jasper County Registrar Jasper County 706-468-4903

Jeff Davis County Elections Jeff Davis County 912-375-6635
Jeff Davis County Registrar Jeff Davis County 912-375-6635
Jefferson County Elections Jefferson County 478-625-8357
Jefferson County Registrar Jefferson County 4 78-625-835 7
Jenkins County Elections Jenkins County 478-982-5581
Jenkins County Registrar Jenkins County 478-982-5581
Johnson County Elections Johnson County 478-864-4019
Johnson County Registrar Johnson County 478-864-4019
Jones County Elections Jones County 478-986-8234
Jones County Registrar Jones County 4 78-986-8234
Lamar County Elections Lamar County 770-358-5235
Lamar County Registrar Lamar County 770-358-5235
Lanier County Elections Lanier County 229-482-3668
Lanier County Registrar Lanier County 229-482-3668
Laurens County Elections Laurens County 478-272-2566
Laurens County Registrar Laurens County 478-272-2566
Lee County Elections Lee County 229-759-6002
Lee County Registrar Lee County 229-759-6002
Liberty County Elections Liberty County 912-876-3310
Liberty County Registrar Liberty County 912-876-3310
Lincoln County Elections Lincoln County 706-359-6126
Lincoln County Registrar Lincoln County 706-359-6126
Long County Elections Long County 912-545-2234
Long County Registrar Long County 912-545-2234
Lowndes County Elections Lowndes County 229-671-2850
Lowndes County Registrar Lowndes County 229-671-2850
Lumpkin County Elections Lumpkin County 706-864-6279
Lumpkin County Registrar Lumpkin County 706-864-6279
Macon County Elections Macon County 478-472-8520
Macon County Registrar Macon County 478-472-8520
Madison County Elections Madison County 706-795-6335
Madison County Registrar Madison County 706-795-6335
Marion County Elections Marion County 229-649-9838
Marion County Registrar Marion County 229-649-9838
McDuffie County Elections McDuffie County 706-595-2105
McDuffie County Registrar McDuffie County 706-595-2105
McIntosh County Elections McIntosh County 912-437-6605
McIntosh County Registrar McIntosh County 912-437-6605
Meriwether County Elections Meriwether County 706-672-9433
Meriwether County Registrar Meriwether County 706-672-9433
LAMB DECLARATION
Miller County Elections Miller County 229-758-4110

Miller County Registrar Miller County 229-758-4110
Mitchell County Elections Mitchell County 229-336-2018
Mitchell County Registrar Mitchell County 229-336-2018
Monroe County Elections Monroe County 4 78-994-7036
Monroe County Registrar Monroe County 4 78-994-7036
Montgomery County Elections Montgomery County 912-583-2681
Montgomery County Registrar Montgomery County 912-583-2681
Morgan County Elections Morgan County 706-343-6311
Morgan County Registrar Morgan County 706-343-6311
Murray County Elections Murray County 706-517-1400 #7
Murray County Registrar Murray County 706-517-1400 #7
Muscogee County Elections Muscogee County 706-653-4392
Muscogee County Registrar Muscogee County 706-653-4392
Newton County Elections Newton County 678-625-1692
Newton County Registrar Newton County 678-625-1692
Oconee County Elections Oconee County 706-769-3958
Oconee County Registrar Oconee County 706-769-3958
Oglethorpe County Elections Oglethorpe County 706-7 43-5350
Oglethorpe County Registrar Oglethorpe County 706-743-5350
Paulding County Elections Paulding County 770-443-7503
Paulding County Registrar Paulding County 770-443-7503
Peach County Elections Peach County 478-825-3514
Peach County Registrar Peach County 478-825-3514
Pickens County Elections Pickens County 706-253-8781
Pickens County Registrar Pickens County 706-253-8781
Pierce County Elections Pierce County 912-449-2028
Pierce County Registrar Pierce County 912-449-2028
Pike County Elections Pike County 770-567-8734
Pike County Registrar Pike County 770-567-8734
Polk County Elections Polk County 770-749-2103
Polk County Registrar Polk County 770-749-2103
Pulaski County Elections Pulaski County 478-783-2061
Pulaski County Registrar Pulaski County 478-783-2061
Putnam County Elections Putnam County 706-485-8683
Putnam County Registrar Putnam County 706-485-8683
Quitman County Elections Quitman County 229-334-2224
Quitman County Registrar Quitman County 229-334-2224
Rabun County Elections Rabun County 706-782-1878
Rabun County Registrar Rabun County 706-782-1878
Randolph County Elections Randolph County 855-782-6310 ext 5
LAMB DECLARATION
Randolph County Registrar Randolph County 855-782-6310 ext 5

Richmond County Elections Richmond County 706-821-2340
Richmond County Registrar Richmond County 706-821-2340
Rockdale County Elections Rockdale County 770-278-7333
Rockdale County Registrar Rockdale County 770-278-7333
Schley County Elections Schley County 229-93 7-2905
Schley County Registrar Schley County 229-937-2905
Screven County Elections Screven County 912-564-2783
Screven County Registrar Screven County 912-564-2783
Seminole County Elections Seminole County 229-524-5256
Seminole County Registrar Seminole County 229-524-5256
Spalding County Elections Spalding County 770-467-4370
Spalding County Registrar Spalding County 770-467-4370
Stephens County Elections Stephens County 706-886-8954
Stephens County Registrar Stephens County 706-886-8954
229-838-4682 ext
Stewart County Elections Stewart County 210
229-838-4682 ext
Stewart County Registrar Stewart County 210
Sumter County Elections Sumter County 229-928-4580
Sumter County Registrar Sumter County 229-928-4580
Talbot County Elections Talbot County 706-665-8270
Talbot County Registrar Talbot County 706-665-8270
Taliaferro County Elections Taliaferro County 706-456-2253
Taliaferro County Registrar Taliaferro County 706-456-2253
Tattnall County Elections Tattnall County 912-557-6417
Tattnall County Registrar Tattnall County 912-557-6417
Taylor County Elections Taylor County 478-862-3997
Taylor County Registrar Taylor County 478-862-3997
Telfair County Elections Telfair County 229-868-6038
Telfair County Registrar Telfair County 229-868-6038
Terrell County Elections Terrell County 229-995-5066
Terrell County Registrar Terrell County 229-995-5066
Thomas County Elections Thomas County 229-225-4101
Thomas County Registrar Thomas County 229-225-4101
Tift County Elections Tift County 229-386-7915
Tift County Registrar Tift County 229-386-7915
Toombs County Elections Toombs County 912-526-8226
Toombs County Registrar Toombs County 912-526-8226
Towns County Elections Towns County 706-896-6920
Towns County Registrar Towns County 706-896-6920
LAMB DECLARATION
Treutlen County Elections Treutlen County 912-529-3342

Treutlen County Registrar Treutlen County 912-529-3342
Troup County Elections Troup County 706-883-17 45
Troup County Registrar Troup County 706-883-1745
Turner County Elections Turner County 229-567-2909
Turner County Registrar Turner County 229-567-2909
Twiggs County Elections Twiggs County 478-945-3639
Twiggs County Registrar Twiggs County 478-945-3639
Union County Elections Union County 706-439-6041
Union County Registrar Union County 706-439-6041
Upson County Elections Upson County 706-647-6259
Upson County Registrar Upson County 706-647-6259
Walker County Elections Walker County 706-638-4349
Walker County Registrar Walker County 706-638-4349
Walton County Elections Walton County 770-267-1337
Walton County Registrar Walton County 770-267-1337
Ware County Elections Ware County 912-287-4363
Ware County Registrar Ware County 912-287-4363
Warren County Elections Warren County 706-465-222 7
Warren County Registrar Warren County 706-465-222 7
Washington County Elections Washington County 478-552-3304
Washington County Registrar Washington County 478-552-3304
Wayne County Elections Wayne County 912-427-5940
Wayne County Registrar Wayne County 912-427-5940
Webster County Elections Webster County 229-828-5775
Webster County Registrar Webster County 229-828-5775
Wheeler County Elections Wheeler County 912-568-7133
Wheeler County Registrar Wheeler County 912-568-7133
White County Elections White County 706-865-4141
White County Registrar White County 706-865-4141
Whitfield County Elections Whitfield County 706-278-7183
Whitfield County Registrar Whitfield County 706-278-7183
Wilcox County Elections Wilcox County 229-467-2111
Wilcox County Registrar Wilcox County 229-467-2111
Wilkes County Elections Wilkes County 706-678-2523
Wilkes County Registrar Wilkes County 706-678-2523
Wilkinson County Elections Wilkinson County 478-946-2188
Wilkinson County Registrar Wilkinson County 478-946-2188
Worth County Elections Worth County 229-776-8208
Worth County Registrar Worth County 229-776-8208
LAMB DECLARATION
From: Steven Dean

To: James Christopher Gaddis
Cc: Williamc. Moore; Stephen Craig Gay: Michael L. Barnes; Merle Steven King
Subject: Next steps for elections.kennesaw.edu
Date: Thursday, March 2, 2017 1:32:27 PM
Chris, is there any further data you need from the server for your investigation? Our next
intention is to make a backup of the affected files and remove them from the server. This
would only affect files in the county folders, not log files are and config files. After that we
will reach out to have the security of the server assessed by your group so that we may bring it
back online without any previously vulnerable links.
Steven Dean
Kennesaw, GA 30144
P: 470-578-6900 F: 470-578-9012
LAMB DECLARATION
From: Stephen Craig Gav

To: mbeaver@sos.ga.gov
Cc: Lectra Lawhorne; Michael L. Barnes
Merritt,
Tasks:
server.
- Work with Chris Dehner and members of CES to develop process for file transfer, account password expiration,
the functionality

Kennesaw, GA 30144
Phone: ( 470) 578-6620
Fax: ( 470) 578-9050
sgay@kennesaw.edu
LAMB DECLARATION

To: Steven Jay Dean
Cc: Michael L. Barnes; Christopher Michael Dehner
Subject: Question regarding private network
Date: Friday, June 23, 2017 7:24:59 AM
Steven,
Quick question: In preparation for next week's infrastructure meeting regarding the devices on the CES private
network, I was curious how many of these devices allow for us to update or modify them? For example, the 16 Card
Duplicators are likely dictated by the Secretary of State's Office and I would assume that there are other devices in
this same scenario (GEMS server), but which devices could allow us to install local firewalls or run the latest
version of operating software (Windows file server perhaps)?
Thanks,

Kennesaw, GA 30144
Phone: (470) 578-6620
Fax: (470) 578-9050
sgay@kennesaw.edu
LAMB DECLARATION

To: Michael L. Barnes
Subject: Re: Center for Election Systems Contract FY"17
Date: Tuesday, March 7, 2017 9:32:10 AM
Thanks Michael.
Stephen
Sent from Nine
From: Michael Barnes

Sent: Mar 7, 2017 8:57 AM
To: 'Stephen C. Gay'
Subject: Center for Election Systems Contract FY' 17
Stephen,
Here is our current contract with the Secretary of State's office. The content of the contract hasn't
really changed since 2012 or so.
Michael Barnes
Director
Kennesaw, GA 30144
ph: 470-KSU-6900
fax: 470-KSU-9012
LAMB DECLARATION
From: Christopher Dehner

To: Davide Gaetano
Cc: Casey Darrow; Stephen Gay: Chris Gaddis
Subject: RE: CES Network Assessment Meeting Notes 6/26
Date: Wednesday, July 19, 2017 1:29:00 PM
Attachments: CES Network surplus milestones.xlsx
Davide,
I think we're ready to make the final push on closing the CES AAR recommendations. All we have left
is the imaging and transference of services of the two Dell PowerEdge R630s (both in CES private
network data center) and the replacement of the UPSs. Per our conversations, one server is for
DC/NAS and the other for Epic. I checked with Steven Dean and both servers not running any
services so we can begin as soon as possible without impacting their services. The UPSs were
ordered last week and we are waiting on delivery. I've included the project milestones and
suggested due dates. If these due dates are not feasible, please provide alternative dates. If you
have any questions, please feel free to reach out.
Regards,
Chris
From: Christopher Michael Dehner

Sent: Friday, July 7, 2017 11:16 AM
To: Davide Gaetano <dgaetano@students.kennesaw.edu>
Cc: Casey Darrow <cdarrow@kennesaw.edu>; Stephen Craig Gay <sgay@kennesaw.edu>; James
Christopher Gaddis <jgaddis6@kennesaw.edu>
Subject: Fw: CES Network Assessment Meeting Notes 6/26
Davide,
I am reseeding this email because for some reason, it was sent to a

dgaetano@students.kennesaw.edu account.
Per your instructions regarding the reimaging and installation of the CES server, we DBAN'd
the hard drives and delivered the server to TS023. The server is a Dell PowerEdge R610 (Asset
Tag: 103019). When it is ready for racking in the CES private network, please let me know and
I'll coordinate with the Steven Dean.
Regards,
Chris
LAMB DECLARATION

Sent: Tuesday, June 27, 2017 5:22 PM
To: Stephen Craig Gay; Nickolaus E Hassis; Jason Stephen Figueroa; Steven Jay Dean; Michael L.
Barnes; Davide F Gaetano
Subject: CES Network Assessment Meeting Notes 6/26
CES Network Assessment

6/27/17 4:00PM-5:lSPM
Attendees:
Nick Hassis, Stephen Gay, Jason Figuera, Steven Dean, Michael Barns, Davide Gaetano
Notes:
CES - is most secure network at KSU, making it more secure

9/10 AAR items closed - Final item: Private Network Inventory
Goal: Reduce number of devices on private network
IMI Card Duplicators also act as data extractor to private network NAS
Reconciled Windows XP devices not captured by network scan
GEMS services dependent on .NET version found on WinXP
Davide - Can GEMS services be virtualized to work on Win? or WinlO?

Steven - Not certain
Stephen: Can we use local authentication instead of domain controller?

Davide: Put domain controllers on Epic and NA
Cellular dialer to send syslog, environment, arpwatch alerts & GPS updates for time keeping.
New Epic and New NAS servicers will also be domain controllers
Cycle hard drive backups to fireproof safe in Secure Storage
Davide suggestions:
• Physically label computers if on private network
• Add distance between private and public network devices
• Replace wifi access point, create new ssid for only CES
• Arpwatch box for public and private networks to prevent network crossovers
• Put CES behind a firewall - force denial and whitelist
Action Items:
CES IT
• Confirm printer has unnecessary services disabled
• Work with vendor on upgrading Epic to more current version of Windows Server
UITS
• Build new XP image
• Windows 10 build for audio box
LAMB DECLARATION
• Migrate data from Poweredge 1900 to Server TBD and decommission box
• Spin up new servers
• Collaborate with CES on transferring services to new servers
• Chris: Connect with Jonathan on new APCs
• Chris: Wipe R610 server, deliver to Davide & Casey for install
• Chris Schedule update meetings for CES Network Updates (include Casey, Jonathan, and GJ)
Christopher Dehner, CISA

IT Security Professional Ill
Kennesaw, GA 30144
Phone: 470-578-6620
Fax: 470-578-9050
cmd9090@kennesaw.edu
LAMB DECLARATION

To: Stephen Gay
Cc: Michael Barnes; Steven Dean: Jason Fiqueroa
Subject: Re: CES server surplus
Date: Wednesday, August 9, 2017 3:S4:39 PM
Stephen,
I'm happy to report that the remaining two servers on the AAR were delivered to ITIM and the
hard drives were degaussed three times. Additionally, I followed up with Jonathan on
replacing the old UPSs with the new ones.
Regards,
Chris
From: Stephen Gay

Sent: Wednesday, August 9, 2017 11:32 AM
To: Christopher Dehner; Steven Dean; Jason Figueroa
Cc: Michael Barnes; Lectra Lawhorne
Chris,
This is fantastic news. Great work to all parties on closing the final recommendation from the
incident after action report.
In your service,
Stephen.
Sent from Nine

Sent: Aug 9, 2017 11:24 AM
Fellas,
Regards,
LAMB DECLARATION
Chris
LAMB DECLARATION
From: Stephen Gay

To: Christopher Dehner; Steven Dean; Jason Figueroa
Cc: Michael Barnes; Lectra Lawhorne
Date: Wednesday, August 9, 2017 11:32:38 AM
Chris,
This is fantastic news. Great work to all parties on closing the final recommendation from the
incident after action report.
In your service,
Stephen.
Sent from Nine

Sent: Aug 9, 2017 11:24 AM
Fellas,
Regards,
Chris
LAMB DECLARATION
From: Steven Dean

To: Marje! Louise Fox
Cc: Steven Jay Dean; Stephen Craig Gay
Thank you for your time the other day, Mariel, it was very helpful. I look forward to speaking
again about this soon.
Steven Dean
Kennesaw, GA 30144
P: 470-578-6900 F: 470-578-9012
On Mar 15, 2017, at 4:27 PM, Mariel Fox <mfox32@kennesaw.edu> wrote:
Steven,
I just learned that Stephen Gay will be providing direction and guidance
concerning your inquiry about records retention/data storage policies and issues.
I'm sure we'll be working together more closely in the future.
Thanks for bringing up these important issues!
Regards,
Mariel Fox
LB 216 MD 1704
Direct: 470-578-2225
Main: 470-578-6289
----- Forwarded Message -----

From: "JeffMilsteen" <jmilstee@kennesaw.edu>
Subject: Re: CONSULTATION REQUEST from Steven Dean, Kennesaw
Campus
Steven,
Mariel forwarded your inquiry to me. I believe there are a number of issues here
that will require some additional work. For example, some of the data maintained
by the Center is, by contract, property of the Secretary of State. That data would
be subject to the Secretary of State's records retention policies and presumably
LAMB DECLARATION
those records should either be returned to the SOS Office or, if appropriate,
destroyed at their direction and pursuant to their policies. All other records of the
Center would be subject to the retention policies of KSU and Mariel can probably
help you with existing retention guidelines. The trick, of course, is to correctly
identify and categorize those records.
I was not clear what was being asked with respect to FOIA requests. If the Center
receives any open records requests, those should immediately be forwarded to the
Legal Division for review. The requests themselves, like all other official
records of the university, are subjection to our retention guidelines.
Jeff Milsteen

To: "JeffMilsteen" <jmilstee@kennesaw.edu>
Subject: Fwd: CONSULTATION REQUEST from Steven Dean, Kennesaw
Campus
Jeff,
This request (see below) for advice came from Steven Dean
(sdean29@kennesaw.edu), IT Systems Support at the Center for Election
Systems.
I spoke to him on the phone concerning what types of records to keep and how
long to keep them, directing him to the State of Georgia retention schedules on
the Georgia Archives website.
As to his question about FOIA requests, I said that for KSU open records
requests, those are handled by Legal Affairs. But for the Center's records, I did
not know. I told him I would forward this question to you.
Please let me know if you have any questions, of if you have any suggestions on
how to handle such inquiries in the future.
Thank you!
Mariel Fox
LB 216 MD 1704
Direct: 470-578-2225
Main: 470-578-6289
LAMB DECLARATION

Campus: Kennesaw

Need advice on:

['Which records do we need to keep?', 'How long do we need to keep records?',
'Do we need to keep both hard copy and digitial files?', 'What are our records
responsibilities?', 'Topic not listed above. Describe in comments.']
In writing new policies for data storage for the Center, I'd like to see your written
policies for data storage periods as relating to FOIA requests.
LAMB DECLARATION
From: Ware, William D. II (AT) (FBI)

To: Stephen Craig Gay
Subject: RE: Investigative update
Date: Tuesday, March 14, 2017 9:02:53 AM
Hi Stephen,
Sorry for the late reply. The investigation is moving along. We are reviewing the logs and issuing legal
process. The legal process is what will take the longest. It could take from two weeks to a month
depending on the Internet Service Provider.
Thanks,
SA Davey Ware
FBI - Atlanta Division
2635 Century Parkway, NE
Suite 400
Atlanta, GA
0: 404-679-6126
C: 404-520-3342
F: 404-679-1417
From: Stephen C. Gay [mailto:sgay@kennesaw.edu]

Sent: Monday, March 13, 2017 7:59 AM
To: Ware, William D. II (AT) (FBI) <William.Ware@ic.fbi.gov>
Subject: Investigative update
Agent Ware,
Good Monday morning. I wanted to take a moment to reach out to ask for an update on the
status of the investigation. If there is anything at all we can do to assist please let me know.
Thank you,
Stephen
Sent from Nine
LAMB DECLARATION
From: Koonce, Steven

Cc: Oliver. James; Stephen Craig Gay; Steven Jay Dean; Jason Stephen Figueroa; James Christopher Gaddis
Subject: RE; KSU Account Creation and SFrP Key Management
Date: Friday, March 24, 2017 11:47:05 AM
Our current FTP server uses FTPS (also known as FTP with SSL). Whether we remain on the existing server or
stand up a new server, the FTP accounts we are setting up will use a secure protocol, most likely FTPS.
-----Original Message-----
From: Christopher M. Dehner [mailto:cmd9090@kennesaw edu]
Sent: Friday, March 24, 2017 11 :42 AM
To: Koonce, Steven <skoonce@sos.ga.gov>
Cc: Oliver, James <Joliver@sos.ga.gov>; sgay <sgay@kennesaw.edu>; Steven Dean <sdean29@kennesaw.edu>;
Jason Figueroa <jfiguel2@kennesaw.edu>; jgaddis6 <jgaddis6@kennesaw.edu>
Subject: Re: KSU Account Creation and SFTP Key Management
Steven,
Just a quick point of clarification, when referring to FTP in your email, are you including SFTP or FTPS in your
conversations? Per USG Policy and information security best practices, KSU don't allow straight FTP transfers.
External file transfers are managed through SFTP or FTPS. Can you confirm that we'll be using SFTP or FTPS to
manage these transfers.
Regards,

IT Security Professional III
University Information Technology Services (UITS) Kennesaw State University Technology Services Bldg, Room
027
Kennesaw, GA 30144
Phone: 470-578-6620
Fax: 470-578-9050

From: "Koonce, Steven" <skoonce@sos.ga.gov>
To: "Christopher M. Dehner" <cmd9090@kennesaw.edu>
Cc: "Oliver, James" <Joliver@sos.ga.gov>, "sgay" <sgay@kennesaw.edu>, "Steven Dean"
<sdean29@kennesaw.edu>, "Jason Figueroa" <jfiguel2@kennesaw.edu>, "jgaddis6" <jgaddis6@kennesaw.edu>
Sent: Friday, March 24, 2017 11 :33:01 AM
Subject: RE: KSU Account Creation and SFTP Key Management
We are having an Internal IT meeting Monday to review governance of our FTP site and to decide if a separate FTP
server will be used for Elections processes.
I am going to work on the accounts below this afternoon so that they will be ready to go on Monday provided we
have no significant changes in our FTP Infrastructure.
From: Christopher M. Dehner [majJto·cmd9090@kennesaw.edu]
Sent: Friday, March 24, 2017 11 :23 AM
LAMB DECLARATION
To: Koonce, Steven <skoonce@sos.ga.gov>

Cc: Oliver, James <Joliver@sos.ga.gov>; Stephen C. Gay <sgay@kennesaw.edu>; Steven Dean
<sdean29@kennesaw.edu>; Jason Figueroa <jfiguel2@kennesaw.edu>; Chris Gaddis <jgaddis6@kennesaw.edu>
Subject: KSU Account Creation and SFTP Key Management
Steven,
My name is Christopher Dehner and I work in the KSU Information Security Office. I've been tasked to cooridnate
with you on creating accounts for KSU Center for Elections Systems technicians in the Secretary of State's SFTP
server. We would like the following users added:
Steven Dean
Jason Figueroa
Christopher Dehner
I would like to have my account disabled but still in the system. This will allow us to reactivate the account ifmy
support is needed. Additionally, are you able to accommodate specific password requirements (length, special
characters, annual expiration, etc.). If at all possible, we would like to align it with our institutional practices. If
not, we can discuss this further.
After the accounts are provisioned but before any data transfers, we would like to validate the SFTP encryption key.
Based on our understanding, we'll need to make a connection and have you provide the key which we can validate
against the SFTP client. This would probably be best done over the phone. If you have an alternative method of
key validation, we'll be happy to discuss.
We're looking forward to patterning with your office in building secures processes for data transfers. If you have
any additional questions, comments, or concerns, please feel free to reach out.
Warmest Regards,

University Information Technology Services (UITS) Kennesaw State University Technology Services Bldg, Room
027
Kennesaw, GA 30144
Phone: 470-578-6620
Fax: 470-578-9050
LAMB DECLARATION

To: Casey Darrow
Cc: Stephen Craig Gay; Chase Alexander Elliott; Freddie Lewis
Subject: Re: New server and share
Date: Tuesday, March 21, 2017 3:09:44 PM
Casey,
We would like this only accessible on-campus from the following subnet:
10.62.44.0/24 (House 57)
Additionally, we would like all off-campus traffic prohibited. If you need anything else, just let me know.
Regards,

Kennesaw, GA 30144
Phone: 470-578-6620
Fax: 470-578-9050

From: "Casey Darrow" <cdarrow@kennesaw.edu>
Cc: "sgay" <sgay@kennesaw.edu>, "Chase Elliott" <ce11iot7@kennesaw.edu>, "Freddie Lewis"
<flewis l 5@kennesaw.edu>
Sent: Tuesday, March 21, 2017 2:44:04 PM
Thanks!
Casey Darrow
Director of Windows Server and Infrastructure
University Information Technology Services
Phone 470-578-2634
From: "Christopher M. Dehner" <cmd9090@kennesaw.edu>

To: "cdarrow" <cdarrow@kennesaw.edu>
Cc: "Stephen C Gay" <sgay@kennesaw.edu>, "Chase Elliott" <celliot7@kennesaw.edu>, "Freddie Lewis"
Casey,
LAMB DECLARATION
I'll co-ordinate with CFES technicians, let me gather that information and get back to you.

Kennesaw, GA 30144
Phone:470-578-6620
Fax: 470-578-9050

From: "Casey Darrow" <cdarrow@kennesaw.edu>
Cc: "sgay" <sgay@kennesaw.edu>, "Chase Elliott" <ce11iot7@kennesaw.edu>, "Freddie Lewis"
Chris,
Can you get us the firewall rules we that are needed? We just need to know what exact IP or what subnets need to
access this fileshare. Or should we work directly with Steven Dean on this?
Thanks,
Casey
Casey Darrow
Director of Windows Server and Infrastructure
University Information Technology Services
Phone 470-578-2634
From: "Stephen C Gay" <sgay@kennesaw.edu>

To: "Steven Dean" <stevendean@kennesaw.edu>
Cc: "Steven Dean" <sdean29@kennesaw.edu>, "Jason Figueroa" <jfiguel2@kennesaw.edu>, "Christopher M.
Dehner" <cmd9090@kennesaw.edu>, "Chase Elliott" <celliot7@kennesaw.edu>, "cdarrow"
<cdarrow@kennesaw.edu>
Sent: Tuesday, March 21, 2017 11:14:06 AM
Steven,
I would like for us to have all safeguards in place before CES begins using the server in a production sense. Chris
Dehner is CC'd on this email and, by copy, I'll ask him to coordinate between the WinServ team and CES on making
this a priority

KSU Chieflnformation Security Officer & UITS Executive Director
LAMB DECLARATION

Kennesaw, GA 30144
Phone: (470) 578-6620
Fax: (470) 578-9050
sgay@kennesaw.edu

From: "Steven Dean" <stevendean@kennesaw.edu>
Cc: "Steven Dean" <sdean29@kennesaw.edu>, "Jason Figueroa" <:jfigue12@kennesaw.edu>, "cmd9090"
<cmd9090@kennesaw.edu>, "Elliott Chase" <celliot7@kennesaw.edu>, "Casey Darrow"
<cdarrow@kennesaw.edu>
Sent: Tuesday, March 21, 2017 11:04:04 AM
Stephen, thank you. Can we begin using this share today to host our project tracker and inventory lists? Or do we
need to wait for the firewall changes?
Steven Dean
Kennesaw, GA 30144
P: 470-578-6900 F: 470-578-9012
> On Mar 21, 2017, at 7:44 AM, Stephen C. Gay <sgay@kennesaw.edu> wrote:
>
> Steven and Jason,
>
> The WinServ team has provisioned a new server dedicated to CES and created a file share which is locked down
to the list of users in the center. The path to the share is
>
> \\FS-ES.kennesaw.edu\shared
>
> As we discussed on Friday, I'd like to use a host-based firewall on the server to only allow traffic from the CES
network and the UITS network (for management). As I get more information I'll pass along.
>
> Stephen
LAMB DECLARATION
From: Beaver, Merritt

To: Stephen Craig Gay: Koonce. Steven; Oliver. James
Cc: Lectra Lawhorne; Michael L. Barnes
Subject: RE: Plan of action for the passing of data
Date: Thursday, March 23, 2017 10:24:00 AM
Stephen
I would like to tie in both Steven Koonce, one of our Network administrators and James Oliver, our security
manager. See their emails attached.
I talked with my team and our election"s team and we would like to just create a new set of SFTP folders for this
effort. The old folder was set up the exchange sample ballot forms and we would like to not repurpose that folder for
this new use. There will be a need for KSU to upload files to SOS and also for SOS to send files to KSU. We are
suggesting that we have two folders to serve each of these purposes. Both of these folders will only hold data for 30
days and after that time any files left will be automatically deleted as these will be transfer folders only.
I will let Steven and James work with your team to best set this environment up.
Thanks
Merritt
S. Merritt Beaver
Chief Information Officer
Office of Georgia Secretary of State Brian P. Kemp
Office (404) 656-7744 Mobile: (770)330-0016
mbeaver@sos.ga.gov
From: Stephen C. Gay [majjto·sgay@kennesaw.edu]
Sent: Wednesday, March 22, 2017 6:25 PM
To: Beaver, Merritt <mbeaver@sos.ga.gov>
Cc: Lectra Lawhorne <llawhorn@kennesaw.edu>; Michael Barnes <mbarne28@kennesaw.edu>
Merritt,
Tasks:
server.
- Work with Chris Dehner and members ofCES to develop process for file transfer, account password expiration,
the functionality
LAMB DECLARATION

KSU Chieflnformation Security Officer & UITS Executive Director Information Security Office University
Information Technology Services (UITS) Kennesaw State University Technology Services Bldg, Room 031
Kennesaw, GA 30144
Phone: (4 70) 578-6620
Fax: (470) 578-9050
sgay@kennesaw.edu
LAMB DECLARATION
From: Michael L. Barnes

To: Stephen Craig Gay
Subject: Re: Plan of action for the passing of data
Thank you jumping on this quickly.
Michael Barnes
Director
Kennesaw, GA 30144
ph: 470-578-6900
On Mar 22, 2017, at 6:25 PM, Stephen C. Gay <sgay@kennesaw.edu> wrote:
Merritt,
Thank you for the conversation regarding the ExpressPoll file pickup and
discussion on getting the processed data back to your office. Looking over my
notes, I have the following plan of action from our discussion:
Objective: KSU will use the Secretary of State SFTP server to upload the data
moving forward, after which members of your team will coordinate the
distribution to the counties which require the data.
Tasks:
- Remove all users/rights with the current KSU folder on the Secretary of State
SFTP Server and provision new accounts for specified users (Likely SDean,
MFiguero, CDehner)
- Work with Chris Dehner, in the UITS Information Security Office, to share and
validate SFTP certificate for server.
- Work with Chris Dehner and members of CES to develop process for file
transfer, account password expiration, and archiving of file and associated
password sharing
- Chris Dehner will work with Steven and Jason on selecting the archive software
client, SFTP client and validating the functionality
If you could send me the contact information for James and Stephen on your team
I will share with the team and ask that they connect 1st thing tomorrow. I don't
want to be a roadblock to these tasks and progress, but will check-in on the
progress and will be available to assist as needed.

LAMB DECLARATION

Kennesaw, GA 30144
Phone: (470) 578-6620
Fax: (470) 578-9050
sgay@kennesaw.edu
LAMB DECLARATION
From: Michael L Barnes

Cc: Steven Jay Dean; Stephen Craig Gay
Subject: Re: Question
Will do.
Thank you.
Michael Barnes
Director
Kennesaw, GA 30144
ph: 470-578-6900
On Mar 29, 2017, at 12:10 PM, Christopher M. Dehner <cmd9090@kennesaw.edu> wrote:
Michael,
From a security perspective we don't have an issue with sending a sample ballot
via email, as it contains no confidential data. I would advise to double check with
the SoS investigator that this is their preferred method of transmission. As we
continue to collaborate with the SoS IT department, we can standardize and
document these processes.
Regards,

Kennesaw, GA 30144
Phone: 470-578-6620
Fax: 470-578-9050
Cc: "Steven Dean" <sdean29@kennesaw.edu>
Sent: Wednesday, March 29, 2017 11:12:29 AM
Subject: Question
LAMB DECLARATION
E
X
H
I
B
I
T
LAMB DECLARATION
From: Merle S. King mking@kennesaw.edu

Subject: Re: PII found on unicoi.kennesaw.edu (only open to the KSU network)
Date: March 4, 2017 at 6:17 PM
To: Lectra Lawhorne llawhorn@kennesaw.edu
Cc: Stephen C. Gay sgay@kennesaw edu, Michael Barnes mbarne281'ilkennesa·Nedu, sdean29@kennesaw.edu
Working on it now
Merle S. King
Executive Director
3205 Campus Loop Road; MD#5700
Kennesaw, GA 30144
Voice: 470-578-6900
Fax: 470-578-9012
On Mar 4, 2017, at 5:51 PM, Lectra Lawhorne <llawhorn@kennesaw.edu> wrote:
Stephen,
Please call me.
Lee
On Mar 4, 2017, at 5:48 PM, Stephen C. Gay <§g§'{@kennesaw.edu> wrote:
Michael,
Please see below. Can you please shut this server down until we have a chance to meet
on Monday to discuss the Center's needs and how best we can work together to meet
them? Could you please send conformation of shutdown when completed.
Thank you,
Stephen
Sent from Nine
From: William C. Moore

Sent: Mar 4, 2017 5:44 PM
To: Stephen Gay
Cc: Chris Gaddis
Subject: Fwd: PII found on unicoi.kennesaw.edu (only open to the KSU network)
Stephen
The Core Team is reporting that the Center if Elections server unicoi.kennesaw.edu has files containing PII. One file potentially
has 5. 7 records and is suspected to be files from 2010.
Tt1e server is currently only available from the campus network. We however recommend that the server be removed from the
network until all PII data can be secured or removed and verified by the ISO
Bill
William C Moore II CISSP, MEd MLIS

Associate Executive Director
LAMB DECLARATION

Technology Services Bldg Rm 031
1075 Canton Pl
Kennesaw. GA 30144
Tel 470-578-6620
Fax 678-915-4940
wcmoore@kennesaw.edu
Begin forwarded message
From: Chris Gaddis <jgaddis6@kennesaw.edu>

Date: March 4, 2017 at 17:32:24 EST
To: "William C. Moore" <wmoore36@kennesaw.edu>
Subject: PII found on unicoi.kennesaw.edu (only open to the KSU network)
Bill,
I noticed that CES brought up Unicoi on Friday (I think its their backup server). Regardless I ran a spider tool on it and found a
number of files listed since directory listing is enabled. The top file on this list has 5.7 million records of PII. The rest have a
variety of different types of data and some may be completely fine to keep open to the public.
Please note that this server is ONLY open to the KSU network but even still this type of PII should not be open to the KSU
network in any form without authentication.
httQ://unicoi.kennesawedu/sites/default/files/vendors/ESandS/Primary 201 a.zip <---- main concern

httQ://unicoi.kennesaw.edu/sites/default/files/mQearso9/ExQressPoll/L&AFiles/PollData.db3
httQ://unicoi.kennesaw.edu/sites/default/files/ExQressPoll L&A/Pol1Data.db3
httQ://unicoi.kennesaw.edu/sites/default/files/ExQressPoll L&A/muni/Pol1Data.db3
httQ://unicoi.kennesaw.edu/sites/default/files/SoS Audio Proof/May 24 Primary/HD68 Audio.zip
httQ://unicoi.kennesaw.edu/sites/default/files/SoS Audio Proof/May 24 Primary/022 - Carroll.zip
httQ://unicoi.kennesaw.edu/sites/default/files/SoS Audio Proof/May 24 Primary/048 - Douglas.zip
http ://unicoi.kennesaw.edu/sites/default/files/ceswebadmin/Proof/Ballots/1-10-N P-FB. Qdf
httQ://unicoi. kennesaw. edu/sites/default/files/ceswebadmin/Proof/Ballots/1-100-N P-FB.Qdf
httQ://unicoi.kennesaw.edu/sites/default/files/ceswebadmin/Proof/Ballots/001.Qdf
httQ://u nicoi .kennesaw. edu/sites/default/files/ceswebadmin/ballotQroof/1-275-NP-FB. pdf
httQ ://u n icoi. kennesaw. edu/sites/default/files/ceswebadmin/1-10-N P-FB. pd!
http://unicoi.kennesaw.edu/sites/default/files/mpearso9/Proof/Bal1otsNote Centers with Cards.pd!
http://unicoi.kennesaw.edu/sites/default/files/mpearso9/Proof/Ballots/Sign Off Sheet - Ballot Proofs.pd!
http://unicoi.kennesaw.edu/sites/default/files/mpearso9/Proof/Ballots/1-50-NP-FB.pdf
http ://u n icoi. ken nesaw. edu/sites/defau It/Ii les/mpearso9 /Proof /Bal lots/Bal lot Order. pdf
httQ://unicoi.kennesaw.edu/sites/default/files/mpearso9/Proof/Ballots/1-40-NP-FB.pdf
httQ://unicoi.kennesaw.edu/sites/default/files/mQearso9/Proof/Ballots/1-30-NP-FB.pdf
httQ://unicoi.kennesaw.edu/sites/default/files/mQearso9/Proof/Ballots/1-20-NP-FB.Qdl
http://unicoi.kennesaw.edu/sites/default/files/mpearso9/Proof/Ballots/1-10-N P-FB. pd!
http://unicoi.kennesaw.edu/sites/defau1t/files/mpearso9/Proof/Audio/Sign Off Sheet - Audio Review.pd!
http://unicoi.kennesaw.edu/sites/delault/files/ExpressPoll L&A/muni/Reporting Precincts with Cards.pd!
httQ://unicoi.kennesaw.edu/sites/delault/files/ExpressPoll L&A/Reporting Precincts with Cards.pd!
http://unicoi.kennesaw.edu/sites/delault/files/Documents/Summary Statistics.pd!
httQ://u nicoi.kennesaw. edu/sites/default/files/ceswebadmin/Proof/Ballots/1-90-N P-FB.pdf
httQ://unicoi.kennesaw.edu/sites/default/files/ceswebadmin/Proof/BallotsNote Centers with Cards.pd!
http://unicoi. kennesaw. edu/sites/defau lt/files/ceswebadmin/Proof/Ballots/1-80-N P-FB.pdf
http ://un icoi.kennesaw. edu/sites/default/files/ceswebadmin/Proof/Ballots/1-70-N P-FB.Qdf
http://unicoi.kennesaw.edu/sites/defaultlfiles/ceswebadmin/Proof/Ballots/Sign Off Sheet - March 15, 2011 Proofs.pd!
http://unicoi.kennesaw.edu/sites/default/files/ceswebadmin/Proof/Ballots/Ballot Order.pd!
httQ://un icoi.kennesaw.edu/sites/default/files/ceswebadmin/Proof/Ballots/1-60-N P-FB. Qdf
httQ://unicoi. kennesaw.edu/sites/default/fi les/ceswebadmin/Proof/Ballots/1-50-N P-FB.pdf
httQ ://unicoi. kennesaw. edu/sites/default/files/ceswebadmin/Proof/Ballots/1-40-N P-FB. pdf
httQ://unicoi.kennesaw.edu/sites/default/files/ceswebadmin/Proof/Ballots/1-30-NP-FB.Qdf
http://unicoi.kennesaw.edu/sites/default/files/ceswebadmin/Proof/Ballots/1-20-NP-FB.pdf
http ://unicoi. ken nesaw.edu/sites/defaultlfiles/ceswebadmin/Proof/Ballots/1-170-NP-FB. pdf
http ://unicoi. ken nesaw.edu/sites/defau ltlfiles/ceswebadmin/Proof/Ballots/1-160-NP-FB. pdf
http://unicoi.kennesaw.edu/sites/default/files/ceswebadmin/Proof/Ballots/1-140-N P-FB. pd!
httQ://un icoi. kennesaw.edu/sites/default/files/ceswebadmin/Proof/Ballots/1-130-N P-FB. Qdf
httQ ://u n icoi. kennesaw. edu/sites/default/fi les/ceswebadmin/Proof/Ballots/1-120-N P-FB.pdf
httQ ://u n icoi.kennesaw. edu/sites/default/files/ceswebadmin/Proof/Ballots/1-110-NP-FB. Qdf
Let me know if you have any questions about this.
LAMB DECLARATION
Thanks,
Chris
Chris Gaddis SSCP

Information Security Engineer
Kennesaw, GA 30144 USA
Phone: (470) 578-6620
Fax: (470) 578-9050
jgaddis6@kennesaw.edu
LAMB DECLARATION
Michael Barnes

Sent: Saturday, March 04, 2017 5:49 PM
Cc: Lectra Lawhorne; Merle Steven King
Subject: Fw: PII found on unicoi.kennesaw.edu (only open to the KSU network)
Michael,
Please see below. Can you please shut this server down until we have a chance to meet on Monday to discuss
the Center's needs and how best we can work together to meet them? Could you please send conformation of
shutdown when completed.
Thank you,
Stephen
Sent from Nine

Sent: Mar 4, 2017 5:44 PM
To: Stephen Gay
Cc: Chris Gaddis
Stephen
The Core Team is reporting that the Center if Elections server unicoi.kennesaw.edu has files containing PII.
One file potentially has 5. 7 records and is suspected to be files from 2010.
The server is currently only available from the campus network. We however recommend that the server be
removed from the network until all PII data can be secured or removed and verified by the ISO.
Bill
William C. Moore II CISSP, MEd,MLIS

Technology Services Bldg. Rm 031
1075 Canton Pl
Kennesaw, GA 30144
Tel: 470-578-6620
1
LAMB DECLARATION
Fax: 678-915-4940
Begin forwarded message:
From: Chris Gaddis <jgaddis6@kennesaw.edu>

To: "William C. Moore" <wmoore36@kennesaw.edu>
Bill,
I noticed that CES brought up Unicoi on Friday (I think its their backup server). Regardless I ran
a spider tool on it and found a number of files listed since directory listing is enabled. The top
file on this list has 5. 7 million records of PII. The rest have a variety of different types of data
and some may be completely fine to keep open to the public.
Please note that this server is ONLY open to the KSU network but even still this type of PII
should not be open to the KSU network in any form without authentication.
http://unicoi .kennesaw .edu/sites/default/fi les/vendors/ESandS/Primary 2010 .zip <---- main

concern
http://unicoi.kennesaw.edu/sites/default/files/mpearso9/ExpressPo11/L&AFiles/Pol1Data.db3
http ://unicoi .kennesaw .edu/sites/default/files/ExpressPo 11 L&A/Po 11Data.db3
http://unicoi.kennesaw.edu/sites/default/files/ExpressPolI L&A/muni/Pol!Data.db3
http://unicoi.kennesaw.edu/sites/default/files/SoS Audio Proof/May 24 Primary/HD68 Audio.zip
http://unicoi.kennesaw.edu/sites/default/files/SoS Audio Proof/May 24 Primary/022 - Carroll.zip
http://unicoi.kennesaw.edu/sites/default/files/SoS Audio Proof/May 24 Primary/048 -
Douglas.zip
http://unicoi.kennesaw.edu/sites/default/files/ceswebadmin/Proof/Ballots/1-1 00-NP-FB.pdf
http://unicoi.kennesaw.edu/sites/default/files/ceswebadmin/Proof/Ballots/OO l .pdf
http://unicoi.kennesaw.edu/sites/default/files/ceswebadmin/bal lotproof/ 1-2 75-NP-FB. pdf
http://unicoi.kennesaw.edu/sites/default/files/ceswebadmin/l-l 0-NP-FB.pdf
http://unicoi.kennesaw.edu/sites/default/fi les/mpearso9 /Proof/Ballots/Vote Centers with
Cards.pdf
http://unicoi.kennesaw.edu/sites/default/files/mpearso9/Proof/Ballots/S ign Off Sheet - Ballot
Proofs.pdf
http://unicoi.kennesaw.edu/sites/default/files/mpearso9/Proof/Ba11ots/1-50-NP-FB.pdf
http://unicoi.kennesaw.edu/sites/default/files/mpearso9/Proof/Ballots/Ballot Order.pdf
http://un icoi.kennesaw .edu/sites/default/files/mpearso9 /Proof/Ballots/l -40-NP-FB .pdf
http://unicoi.kennesaw.edu/sites/default/files/mpearso9/Proof/Ballots/l-30-NP-FB.pdf
http://unicoi.kennesaw.edu/ sites/default/files/mpearso9 /Proof/Ballots/ 1-20-NP-FB. pdf
http://unicoi.kennesaw.edu/sites/default/files/mpearso9/Proof/Ballots/l- l 0-NP-FB.pdf
http://unicoi.kennesaw.edu/sites/default/files/mpearso9/Proof/Audio/Sign Off Sheet - Audio
Review.pdf
http://unicoi.kennesaw.edu/sites/default/files/ExpressPoll L&A/muni/Reporting Precincts with
Cards.pdf
http://unicoi.kennesaw.edu/sites/default/files/ExpressPoll L&A/Reporting Precincts with
Cards.pd[
http://unico i.kennesaw .edu/sites/default/files/Documents/Summary Statistics. pdf
2
LAMB DECLARATION
http ://uni coi .kennesaw .edu/sites/default/files/ceswebadmin/Proof/Bal lots/Vote Centers with
Cards.pd[
http://unicoi.kennesaw.edu/sites/default/files/ceswebadmin/Proof/Ballots/l-80-NP-FB.pdf
http://unicoi.kennesaw.edu/sites/default/files/ceswebadmin/Proof/Ballots/Sign Off Sheet - March
15, 2011 Proofs.pdf
http://unicoi.kennesaw.edu/sites/default/files/ceswebadmin/Proof/Ballots/Ballot Order.pd[
http://unicoi.kennesaw.edu/sites/default/files/ceswebadmin/Proof/Ballots/l-l 70-NP-FB.pdf
http://unicoi .kennesaw .edu/sites/default/files/ceswebadmin/Proof/Ballots/1-140-NP-FB. pdf
http://unico i.kennesaw .edu/sites/default/fi !es/ceswe badmin/Proof/Ballots/1-13 0-NP-F B. pdf
http://unicoi.kennesaw.edu/sites/default/files/ceswebadmin/Proof/Ballots/l-l l 0-NP-FB.pdf
Thanks,
Chris
Chris Gaddis SSCP

I 075 Canton Pl, MB #3503
Phone: (470) 578-6620
Fax: (470) 578-9050
LAMB DECLARATION
Michael Barnes
From: Merle Steven King

Sent: Sunday, August 28, 2016 3:56 PM
To: Steven Jay Dean; Jason Stephen Figueroa
Cc: Michael L. Barnes
Subject: Fwd: [IMPORTANT] concerning the security of elections.kennesaw.edu
Steven and Jason - Please review this email and advise. Sooner is better than later.
Thanks,
MSK
From: "Logan Lamb"

To: "Merle King"
Cc: research@bastille.net
Sent: Sunday, August 28, 2016 3:47:50 PM
Subject: [IMPORTANT] concerning the security of elections.kennesaw.edu
Hello Merle,
My name is Logan Lamb, and I'm a cybersecurity researcher who is a member of

Bastille Threat Research Team. We work to secure devices against new and
existing wireless threats: https://www.bastille.net/. This past Tuesday I went
to Fulton County Government Center to speak with Rick Barron about securing
voting machines against wireless threats. I was then directed to contact you
and the center. I'd like to collaborate with you on securing our state's
election systems infrastructure against wireless attacks.
While attempting to get more background information on the center prior to

contacting you, I discovered serious vulnerabilities affecting
elections.kennesaw.edu.
The following google searches reveal documents that shouldn't be indexed and
appear to be critical to the elections process. In addition, the Drupal install
needs to be immediately upgraded from the current version, 7.31:
"site:elections.kennesaw.edu inurl:pdf"
I generally use this type of search to find documents on websites that lack
search functionality. This search revealed a completely open Drupal install.
LAMB DECLARATION
Assume any document that requires authorization has already been downloaded
without authorization.
"site:elections.kennesaw.edu L&A"
The second search result appears to be for disseminating critical voting
system software. This is especially concerning because, as the following article
states, there's a strong probability that your site is already compromised.
https://www.drupal.org/project/drupalgeddon
https://www.drupal.org/SA-CORE-2014-005
If you have any questions or concerns please contact me. I'm able to come to the
center this Monday for a more thorough discussion.
Take care,
Logan
Merle S. King
Executive Director
Kennesaw, Georgia 30144
Voice: 470-578-6900
Fax: 470-578-9012
LAMB DECLARATION
Michael Barnes

Sent: Wednesday, March 01, 2017 11 :45 PM
To: Michael L. Barnes; Steven Jay Dean
Subject: Fwd: Vulnerability on the elections.kennesaw.edu website
FYI.
Sent from my iPad
From: "Stephen C. Gay" <sgay@kennesaw.edu>

Date: March 1, 2017 at 11 :10:16 PM EST
To: Merle King <mking@kennesaw.edu>, Steven Dean <sdean29@kennesaw.edu>
Cc: Lectra Lawhorne <llawhom@kennesaw.edu>, "William C. Moore"
<wmoore36@kennesaw.edu>
Merle,
I received the following email, and call, tonight regarding a directory traversal vulnerability on
elections.kennesaw.edu. I immediately activated our Incident Response Team and, through the
use of burp suite, we were able to recreate the vulnerability described below. In the vulnerability
recreation, we were able to pull voter information in database files for counties across the state
and the data elements included DOB, Drivers License Number, Party Affiliation, etc.
Understanding the risk associated with this vulnerability, we have closed all firewall exceptions
for elections.kennesaw.edu to contain the incident. I have asked Bill Moore to act as point for
this incident and we need to coordinate with your team on the web logs for
elections.kennesaw.edu first thing tomorrow morning. The logs will help us understand the scope
of the breach and allow us to advise the CI O as to next steps.
I will be temporarily out of pocket for a short time tomorrow, then remote thereafter, but your
cooperation in this incident response is appreciated.

Kennesaw, GA 30144
Phone:(470)578-6620
Fax: (470) 578-9050
sgay@kennesaw.edu
LAMB DECLARATION
From: "Andy Green" <agreen57(a),kennesaw.edu>

To: "Stephen C Gay" <sgay(a),kennesaw.edu>
Subject: Vulnerability on the elections.kennesaw.edu website
Stephen,
Thanks for taking the time to talk with me tonight. As I mentioned during our call, I was
contacted by a friend in the security space here in Atlanta earlier tonight. My friend relayed to
me the existence of a Drupal plug-in vulnerability that a friend of his located on the
elections.kennesaw.edu website. The vulnerability allows for directory traversal without
authentication, leaving files exposed.
My friend shared with me that the exposed directories contained, among other things:
- voter registration detail files, including DOB and full SSN.
- PDFs of memos to county election officials which contained full credentials for ExpressPoll
Election Day access, for the November 2016 election.
I was able to verify the presence of the vulnerability myself, and was able to traverse directories
without authenticating. I did not download any of the voter data files to verify his statement, for
obvious reasons. However, I did successfully open a PDF in my browser window, located in the
Fulton County Elections/ExpressPoll/ED_Files/ folder for proof of concept.
The base URL of interest is http://elections.kennesaw.edu/sites/default/files - please note that the

URL must be http, as use of https will return a 404 error.
I'm told the researcher works for a reputable organization. I'm also told that the organization may
be interested in going public with this at some point, due to the seriousness of the matter as well
as the related publicity it would generate for the organization. My sense is that there is a desire to
go public in a coordinated, responsible manner, in order to give the university appropriate time to
remediate the vulnerability. This is certainly not set in bedrock, as I'm just the middleman here.
However, given that they reached out to me as opposed to releasing to the public, I'm hopeful
that my sense is correct.
If I can be of further service, including facilitating communication between all parties, please
don't hesitate to let me know.
Thanks
Andy Green, MSIS
Lecturer of Information Security and Assurance

BBA-ISA program coordinator
KSU Student ISSA chapter faculty sponsor
KSU Offensive Security Research Club faculty sponsor
Michael J. Coles College of Business

Kennesaw State University - A Center of Academic Excellence in Information Assurance
Education
560 Parliament Garden Way NW, MD 0405
Kennesaw, GA 30144-5591
2
LAMB DECLARATION
agreen57 (a),kennesaw.edu
http://coles.kennesaw.edu/faculty/green-andrew.php
Ph: 470-578-4352
Burruss Building, Room #490
73656d7065722070617261747573
LAMB DECLARATION
Michael Barnes
From: Steven Dean <stevendean@kennesaw.edu >

Sent: Thursday, March 02, 2017 1:32 PM
Cc: William C. Moore; Stephen Craig Gay; Michael L. Barnes; Merle Steven King
Chris, is there any further data you need from the server for your investigation? Our next intention is to make a
backup of the affected files and remove them from the server. This would only affect files in the county folders,
not log files are and config files. After that we will reach out to have the security of the server assessed by your
group so that we may bring it back online without any previously vulnerable links.
Steven Dean
Kennesaw, GA 30144
P: 470-578-6900 F: 470-578-9012
LAMB DECLARATION
Michael Barnes
From: Steven Jay Dean

Sent: Wednesday, April 26, 2017 3:18 PM
Cc: Merle Steven King; Michael L. Barnes; Jason Stephen Figueroa
Subject: Private Network Hardware Assessment
Chris, we recently receive a draft of the Incident report and I would like to go through the hardware section to
get a plan outlined for addressing the recommendations. The document states the following:
1. Rackmount UPS Battery backups (one displaying warning light)

Recommendation: Replace batteries as needed and move under UITS ISS management
2. 3com Switches -Age IO+ years -- No Support -- L2 only
Recommendation: Replace and move under UITS ISS management
3. Dell 1950 (Windows Domain Controller)-Age 10+ years
Recommendation: Surplus
4. Dell PowerEdge R630 - Age I year
Recommendation: Migrate services from Dell 1950 and move under UITS ISS management on CES
Isolated Network
5. EPIC - Vision Computer-Age Unknown- Electors list creation box
Recommendation: Continue as ISO/CES managed
6. EPIC Files - Dell 1900 - Age 6+ years - Electors list creation box backups
7. NAS - Dell 1900 - Age 6+ years - CES Isolated Network NAS
8. elections.kennesaw.edu - Age 5 years - Dell PowerEdge R610
Recommendation: Format and reinstall on CES Isolated Network as NAS
9. unicoi.kennesaw.edu - Age 6+ years. Dell PowerEdge 1950
10. Web server backup
We had submitted for approval to UITS the purchase of two new UPS units prior to the incident. Should we
continue and order these as previously planned?
Will new hardware (and other equipment) be ordered by ISO under ISO budget, ordered by ISO under CES
budget, or ordered by CES? Who will decide what hardware is purchased?
How should we proceed with replacing the Switches and who will install and manage them?
When will the assessment of the private network software commence and what department will handle the
migrations and updates? How will this project factor into their schedule?
We would like to get moving on this list as soon as possible. Please let me know what I can do as the next step.
Thanks.
Steven Dean
1
LAMB DECLARATION
Kennesaw, GA 30144
P: 470-578-6900 F: 470-578-9012
LAMB DECLARATION
Michael Barnes

Sent: Monday, August 29, 2016 11 :06 AM
Subject: Re: Follow Up from earlier email regarding security of elections.kennesaw.edu
Well said. Thanks
Merle S. King
Executive Director
3205 Campus Loop Road; MD#5700
Kennesaw, GA 30144
Voice: 470-578-6900
Fax:470-578-9012
On Aug 29, 2016, at 11:04 AM, Michael Barnes <mbarne28@kennesaw.edu> wrote:
Stephen,
In retrospect, I need to pull back my request that you include Logan Lamb or his associated organization
Bastille Threat Research Team (www.bastille.net) on a black list of ip addresses. My request was an
over-reaction on my part. The quick security assessment they provided us, though unsolicited, did
highlight an issue we needed to resolve with our website. To black list them for helping us would be
inappropriate.
Leading up to this election, where the question of whether or not someone can hack election systems is
so in the forefront, we will need your team will help us continually analyze our on line systems and
inspect for any openings that need to be sealed. Our IT staff will be in touch today to let you know what
enhancements we have made and will request that your team ping our system to see if you all find other
issues.
Thanks in advance for your help,
Michael Barnes
Director
Kennesaw, GA 30144
ph: 470-KSU-6900
fax: 470-KSU-9012
LAMB DECLARATION
Michael Barnes

Sent: Thursday, April 27, 2017 10:29 AM
To: Michael L. Barnes; Merle Steven King
Cc: Lectra Lawhorne; Christopher Michael Dehner
Subject: Re: Incident Reponse Walk through
Attachments: CES AAR Rev04.pdf
Michael and Merle,
Thank you for the edits. I have accepted them and attached the updated version and will be on the lookout for the
referenced email.

KSU Chief Information Security Officer & UITS Executive Director Information Security Office University Information
Technology Services {UITS} Kennesaw State University Technology Services Bldg, Room 031
Kennesaw, GA 30144
Phone: (470} 578-6620
Fax: (470} 578-9050
sgay@kennesaw.edu

Cc: "Lectra Lawhorne" <llawhorn@kennesaw.edu>, "cmd9090" <cmd9090@kennesaw.edu>, "Merle King"
<mking@kennesaw.edu>
Sent: Wednesday, April 26, 2017 3:29:43 PM
Subject: RE: Incident Reponse Walk through
Stephen,
Thank you for giving us the opportunity to review the attached. We have provided a few grammatical changes and
added just a few clarifying comments.
I am attaching a copy with Change Tracker on so you can quickly see those changes.
We have asked Steven Dean to follow up with Chris Dehner to see what timeline may be in place in relation to items
listed in Issue 7. We want to make sure we are doing our part but we will need some guidance.
Please let us know what other assistance we can provide.
Thanks,
Michael Barnes
Director
Kennesaw, GA 30144
LAMB DECLARATION
ph: 470-KSU-6900
fax: 470-KSU-9012
From: Stephen C. Gay [mailto:sgay@kennesaw.edu]
Sent: Monday, April 24, 2017 12:01 PM
To: Merle King <mking@kennesaw.edu>; Michael Barnes <mbarne28@kennesaw.edu>
Cc: Lectra Lawhorne <llawhorn@kennesaw.edu>; Christopher M. Dehner <cmd9090@kennesaw.edu>
Subject: Re: Incident Reponse Walk through
Merle & Michael,
Following up on this, one of the areas in which we are actively looking to grow is in the "Post-Incident Activity" area and
specifically working to understand what vectors led to a compromise and what KSU could have done better to close
those vectors (or minimally detected earlier). For the Center for Election Systems incident, we adopted a format which
GaTech shared to conduct document incident "After Action Reports". The document purposely vague in regards to the
incident, but is highly tactical in prescribing mitigation steps to prevent future incidents.
Can I ask you to review and provide your feedback, as I value your input and all mitigation is going to be conducted in a
secure and collaborative manner.
Thank you,
Stephen
----- Original Message-----

From: "Merle King" <mking@kennesaw.edu>
Cc: "Michael Barnes" <mbarne28@kennesaw.edu>, "Lectra Lawhorne"
<llawhorn@kennesaw.edu>, "Steven Dean" <sdean29@kennesaw.edu>
Sent: Tuesday, April 18, 2017 9:55:05 AM
Subject: Incident Reponse Walk through
Stephen - We are looking for assistance in designing and conducting an incident response exercise walk through for
several difference scenarios here at the Center. Do you have a template or other guidelines that can help us organize the
exercise? We would like to include our staff, UITS, and SOS IT staff in the exercise.
Thanks in advance,
Merle
Merle S. King
Executive Director
Voice: 470-578-6900
Fax: 470-578-9012
LAMB DECLARATION
Michael Barnes
From: James Christopher Gaddis

Sent: Thursday, March 02, 2017 1:59 PM
To: Steven Dean
Cc: William C. Moore; Stephen Craig Gay; Michael L. Barnes; Merle Steven King
Subject: Re: Next steps for elections.kennesaw.edu
Steven,
As long as all log and config files are kept and you keep a record of what actions you are taking then I have no problem
with that. We SHOULD have everything we need but you never know what questions might come up based upon the
data we are reviewing.
Thanks,
Chris Gaddis SSCP

University Information Technology Services (UITS) Kennesaw State University Technology Services Bldg, Room 029
Phone: (470) 578-6620
Fax: (470) 578-9050

To: "Chris Gaddis" <jgaddis6@kennesaw.edu>
Cc: "William C.Moore"<wcmoore@kennesaw.edu>, ''Stephen C Gay" <sgay@kennesaw.edu>, "Michael Barnes"
<mbarne28@kennesaw.edu>, "Merle S. King" <mking@kennesaw.edu>
Chris, is there any further data you need from the server for your investigation? Our next intention is to make a backup
of the affected files and remove them from the server. This would only affect files in the county folders, not log files are
and config files. After that we will reach out to have the security of the server assessed by your group so that we may
bring it back online without any previously vulnerable links.
Steven Dean
Kennesaw, GA 30144
P: 470-578-6900 F: 470-578-9012
LAMB DECLARATION
Michael Barnes

Sent: Saturday, March 04, 2017 7:42 PM
Cc: Lectra Lawhorne; Merle Steven King
Michael,
Thank you so much and appreciate you coming to KSU to handle this tonight.
Stephen
Sent from Nine
From: Michael Barnes

Sent: Mar 4, 2017 7:11 PM
To: Stephen C. Gay
Cc: Lectra Lawhorne; Merle King
Unicoi has been shutdown
Michael Barnes
Director
Kennesaw, GA 30144
ph: 470-578-6900
On Mar 4, 2017, at 5:48 PM, Stephen C. Gay <sgay@kennesaw.edu> wrote:
Michael,
Please see below. Can you please shut this server down until we have a chance to meet on
Monday to discuss the Center's needs and how best we can work together to meet them?
Could you please send conformation of shutdown when completed.
Thank you,
Stephen
Sent from Nine

Sent: Mar 4, 2017 5:44 PM
To: Stephen Gay
LAMB DECLARATION
Cc: Chris Gaddis

Stephen
The Core Team is reporting that the Center if Elections server unicoi.kennesaw.edu has files
containing PII. One file potentially has 5. 7 records and is suspected to be files from 2010.
The server is currently only available from the campus network. We however recommend that
the server be removed from the network until all PII data can be secured or removed and verified
by the ISO.
Bill

I 075 Canton Pl
Kennesaw, GA 30144
Tel: 470-578-6620
Fax: 678-915-4940
From: Chris Gaddis <jgaddis6@,kennesaw.edu>

To: "William C. Moore" <wmoore36@,kennesaw.edu>
Bill,
I noticed that CES brought up Unicoi on Friday (I think its their backup server).
Regardless I ran a spider tool on it and found a number of files listed since
directory listing is enabled. The top file on this list has 5.7 million records of PII.
The rest have a variety of different types of data and some may be completely fine
to keep open to the public.
Please note that this server is ONLY open to the KSU network but even still this
type of PII should not be open to the KSU network in any form without
authentication.
http://unicoi.kennesaw.edu/sites/default/files/vendors/ESandS/Primary
2
LAMB DECLARATION
2010.zip <---- main concern

http://unicoi.kennesaw.edu/sites/default/files/mpearso9/ExpressPoll/L&AFiles/Po
11Data.db3
http://unicoi.kennesaw.edu/sites/default/files/ExpressPoll L&A/Pol1Data.db3
http://uni coi .kennesaw .edu/s ites/default/fil es/ExpressPo 11
L&A/muni/Pol1Data.db3
http://unicoi.kennesaw.edu/sites/default/files/SoS Audio Proof/May 24
Primary/HD68 Audio.zip
Primary/022 - Carroll.zip
Primary/048 - Douglas.zip
http://unicoi.kennesaw.edu/sites/default/files/ceswebadmin/Proof/Ballots/l-l 0-
NP-FB.pdf
http://unicoi.kennesaw.edu/sites/default/files/ceswebadmin/Proof/Ballots/1-100-
NP-F B. pdf
http://uni co i .kennesaw .edu/sites/default/files/ceswebadmin/Proof/Ballots/001. pdf
http://unicoi.kennesaw.edu/sites/default/files/ceswebadmin/ballotproof/1-275-NP-
FB.pdf
http://unicoi.kennesaw.edu/sites/default/files/ceswebadmin/1-10-NP-FB .pdf
http://unicoi.kennesaw.edu/sites/default/files/mpearso9/Proof/BallotsNote
Centers with Cards.pdf
http ://uni coi .kennesaw .edu/sites/default/files/mpearso 9/Proof/Ballots/Sign Off
Sheet - Ballot Proofs.pd[
http://unicoi.kennesaw.edu/sites/defau1t/files/mpearso9/Proof/Ballots/l-50-NP-
FB.pdf
http://unicoi.kennesaw.edu/sites/default/files/mpearso9/Proof/Ballots/Ballot
Order.pd[
http://unicoi.kennesaw.edu/sites/default/files/mpearso9/Proof/Ballots/l-40-NP-
FB.pdf
http://unicoi.kennesaw.edu/sites/default/files/mpearso9/Proof/Ballots/1-30-NP-
FB.pdf
http://uni co i .kennesaw .edu/sites/default/ti les/mpearso9 /Proof/Bal lots/ 1-2 0-NP-
FB. pdf
http ://unicoi .kennesaw.edu/sites/default/files/mpearso9/Proof/Ballots/ 1-10-NP-
FB. pdf
http://unicoi.kennesaw.edu/sites/default/files/mpearso9/Proof/Audio/Sign Off
Sheet - Audio Review.pdf
http://unicoi.kennesaw.edu/sites/default/files/ExpressPoll L&A/muni/Reporting
Precincts with Cards.pd[
http://unicoi.kennesaw.edu/sites/default/files/ExpressPoll L&A/Reporting
Precincts with Cards.pd[
http://unicoi.kennesaw.edu/sites/default/files/Documents/Summary Statistics.pdf
http://unicoi.kennesaw.edu/sites/default/files/ceswebadmin/Proof/Ballots/ 1-90-
NP-F B. pdf
http://unicoi.kennesaw.edu/sites/default/files/ceswebadmin/Proof/BallotsNote
Centers with Cards.pdf
http://uni co i .kennesaw.edu/sites/default/files/ceswebadmin/Proof/Ballots/ 1-80-
NP-FB. pdf
http://unicoi.kennesaw.edu/sites/default/files/ceswebadmin/Proof/Ballots/l-70-
NP-FB.pdf
3
LAMB DECLARATION
http://uni co i.kennesaw .edu/sites/default/files/ceswebadm in/Proof/Bal lots/Sign Off

Sheet - March 15, 2011 Proofs.pdf
http ://unico i.kenne saw. ed u/ sites/default/files/ce swe badm in/Proof/Bal 1ots/B allot
Order.pdf
http ://unicoi .kennesaw .edu/sites/default/files/ceswebadmin/Proof/Ballots/ 1-60-
N P-FB. pdf
http://unicoi.kennesaw.edu/sites/default/files/ceswebadmin/Proof/Ballots/ 1-5 0-
NP-F B .pdf
http ://unico i.kennesaw .edu/sites/default/files/ceswe badmin/Proof/Ballots/1-40-
NP-FB. pdf
http://unicoi .kennesaw .edu/sites/default/files/ceswebadmin/Proof/Bal lots/ 1-3 0-
N P-FB. pdf
NP-FB.pdf
http ://unicoi .kennesaw. edu/sites/default/files/ceswebadmin/Proof/Ballots/ 1-17 0-
NP-F B. pdf
NP-F B. pdf
http://unicoi.kennesaw.edu/sites/default/files/ceswebadmin/Proof/Ballots/l-140-
NP-FB.pdf
NP-FB.pdf
NP-FB .pdf
http://unicoi.kennesaw.edu/sites/default/files/ceswebadmin/Proof/Ballots/1-l 10-
NP-FB.pdf
Thanks,
Chris
Chris Gaddis SSCP

Phone: (470) 578-6620
Fax: (470) 578-9050
LAMB DECLARATION
Michael Barnes

Sent: Thursday, May 04, 2017 10:08 AM
Cc: Lectra Lawhorne; Christopher Michael Dehner; Merle Steven King
Subject: Re: Private Network Hardware Assessment
Michael,
Thank you for forwarding the email. UITS, as the provider of network infrastructure & connectivity, will provide the
funding and specs for the battery backups as well as replacement switches. Other IT equipment which is specific to CES's
mission {desktops/servers on the isolated network) will continue to be funded from the Center's budget and we will all
work together on hardware specs which allows for support/maintenance to align with KSU standards.
The assessment & hardening of the private network will begin with the port locks and continue with post moves and
equipment surplus as noted in the AAR. Our ultimate goal is to collectively remove all unnecessary services/hardware
from the network and further secure and improve the remaining/new systems. I've asked Chris Dehner to take point
and, working with his embedded staff, develop a plan for these items.
As always, please let me know if you have any additional questions or if I can assist further in any way,

KSU Chief Information Security Officer & UITS Executive Director Information Security Office University Information
Technology Services {UITS) Kennesaw State University Technology Services Bldg, Room 031
Kennesaw, GA 30144
Phone:(470) 578-6620
Fax: (470} 578-9050
sgay@kennesaw.edu

Cc: "Merle King" <mking@kennesaw.edu>
Sent: Thursday, April 27, 2017 10:39:08 AM
Subject: FW: Private Network Hardware Assessment
Stephen,
Here is the email Steven Dean sent Chris Dehner yesterday.
Michael Barnes
Director
LAMB DECLARATION

Kennesaw, GA 30144
ph: 470-KSU-6900
fax: 470-KSU-9012
From: Steven Dean [mailto:sdean29@kennesaw.edu]

Sent: Wednesday, April 26, 2017 3:18 PM
To: Christopher M. Dehner <cmd9090@kennesaw.edu>
Cc: Merle S. King <mking@kennesaw.edu>; Michael Barnes <mbarne28@kennesaw.edu>; Jason Figueroa
<jfiguel2@kennesaw.edu>
Subject: Private Network Hardware Assessment
Chris, we recently receive a draft of the Incident report and I would like
to go through the hardware section to get a plan outlined for addressing the
recommendations. The document states the following:
1. Rackmount UPS Battery backups (one displaying warning light)

Recommendation: Replace batteries as needed and move under UITS
ISS management
2. 3com Switches -Age 10+ years -- No Support -- L2 only
Recommendation: Replace and move under UITS ISS management
3. Dell 1950 (Windows Domain Controller) -Age 10+ years
4. Dell PowerEdge R630 - Age 1 year
Recommendation: Migrate services from Dell 1950 and move under
UITS ISS management on CES Isolated Network
5. EPIC-Vision Computer-Age Unknown - Electors list creation box
Recommendation: Continue as ISO/CES managed
6. EPIC Files - Dell 1900 -Age 6+ years - Electors list creation box
backups
7. NAS - Dell 1900 -Age 6+ years - CES Isolated Network NAS
8. elections.kennesaw.edu <http://elections.kennesaw.edu> - Age 5
years - Dell PowerEdge R610
Recommendation: Format and reinstall on CES Isolated Network as
NAS
9. unicoi.kennesaw.edu -Age 6+ years. Dell PowerEdge 1950
10. Web server backup
We had submitted for approval to UITS the purchase of two new UPS units
prior to the incident. Should we continue and order these as previously
LAMB DECLARATION
planned?
Will new hardware (and other equipment) be ordered by ISO under ISO budget,
ordered by ISO under CES budget, or ordered by CES? Who will decide what
hardware is purchased?
How should we proceed with replacing the Switches and who will install and
manage them?
When will the assessment of the private network software commence and what
department will handle the migrations and updates? How will this project
factor into their schedule?
We would like to get moving on this list as soon as possible. Please let me
know what I can do as the next step. Thanks.
Steven Dean
Kennesaw, GA 30144
P: 470-578-6900 F: 470-578-9012
LAMB DECLARATION
Michael Barnes

Sent: Monday, March 20, 2017 8:54 AM
Cc: Steven Jay Dean; Michael L. Barnes; James Christopher Gaddis
Subject: Re: Request for data retrieval
Chris,
This server is physically secured in ISO Evidence Storage. Please coordinate with Chris Gaddis and Steven Dean on the
Data Recovery this morning.
Stephen

Cc: "Steven Dean" <sdean29@kennesaw.edu>, "Merle King" <mking@kennesaw.edu>, "Lectra Lawhorne"
<llawhorn@kennesaw.edu>
Subject: RE: Request for data retrieval
Stephen,
Thank you. Steven and Jason will be available first thing Monday to assist.
Michael Barnes
Director
Kennesaw, GA 30144
ph: 470-KSU-6900
fax: 470-KSU-9012
From: Stephen C.Gay[mailto:sgay@kennesaw.edu]
Sent: Friday, March 17, 2017 9:09 AM
To: Michael Barnes <mbarne28@kennesaw.edu>
Cc: Steven Dean <sdean29@kennesaw.edu>; Merle King <mking@kennesaw.edu>; Lectra Lawhorne
<llawhorn@kennesaw.edu>
Subject: Re: Request for data retrieval
Michael,
I have contacted the Federal investigators and they have agreed to return the server. I will be meeting with them late
this afternoon to receive it and then secure it within ISO Secure Storage. I have asked the team to make this a top
priority and to work with Steven and Jason on the request data retrieval 1st thing on Monday.
Please let me know if you have any questions or if I can assist further in any way, Stephen
LAMB DECLARATION

Cc: "Steven Dean" <sdean29@kennesaw.edu>, "Merle King" <mking@kennesaw.edu>
Subject: Request for data retrieval
Stephen,
As discussed earlier today, we would like to retrieve certain records from elections.kennesaw.edu that support our daily
office activities, items such as inventory records, workflow databases used during our ballot building efforts, and
operation manuals. These data are located in the cesuser user directory at /home/cesuser. We would like to retrieve
the entire cesuser directory, if possible.
Thanks,
Michael Barnes
Director
Kennesaw, GA 30144
ph: 470-KSU-6900
fax: 470-KSU-9012
LAMB DECLARATION
Michael Barnes
From: Steven Dean <stevendean@kennesaw.edu>

Sent: Wednesday, March 29, 2017 1:43 PM
Cc: Christopher Michael Dehner
Subject: Re: Unknown files on elections.kennesaw.edu
Importance: High
Chris, here are the data contained in each of the file types you have listed:
>mpearso9/ExpressPoll/L&AFiles/PollData.db3
This type of file may contain a subset of the list of voters and any associated voter information for a given
election. The file is used for testing purposes by counties before using an ExpressPoll during an election. The
directory listed here indicates that this file was for CES testing purposes and may not contain PII.
>ExpressPoll%20L%26A/PollData.db3.php
>Test%20Staff/ExpressPoll/ABSFile/PollData.db3.php
>County%20U ser/ExpressPol 1/AB SFile/Po 11Data.db3. php
These files enable download of associated "Pol1Data.db3" files by every browser. Note: these are PHP files that
only link to other files and do not contain any election data.
>/sites/default/fi les/vendors/ESandS/Primary%20201 0 .zip
Without analyzing this file, I cannot say for certain what is in it. Previous emails from ISO have indicated that
inspection of this file showed it to contain voter information from the time the file was created in 2010. May
contain PII.
Steven Dean
Kennesaw, GA 30144
P: 470-578-6900 F: 470-578-9012
On Mar 29, 2017, at 1:15 PM, Chris Gaddis <jgaddis6@KENNESAW.EDU> wrote:
Steven,
Can you please help me understand what data was contain in the files listed below.
Was this County data?

Full state data?
Other Pii?
Something else?
1
LAMB DECLARATION
Also can you please respond ASAP on this.
Unique file names
ExpressPoll%20L%26A/PollData.db3.php
mpearso9/ExpressPoll/L&AFiles/PollData.db3
Test%20Staff/ExpressPoll/AB SFile/PollData.db3 .php
County%20U ser/ExpressPoll/ABSFile/PollData.db3 .php
/sites/default/files/vendors/ESandS/Primary%20201 0.zip
Thanks so much!
-Chris
LAMB DECLARATION
Michael Barnes
From: Steven Dean <stevendean@kennesaw.edu >

Sent: Wednesday, March 01, 2017 11 :49 PM
To: Merle Steven King
Cc: Michael L. Barnes
Subject: Re: Vulnerability on the elections.kennesaw.edu website
Acknowledging that I've seen this. See you tomorrow.
Steven Dean
Kennesaw, GA 30144
P: 470-578-6900 F: 470-578-9012
On Mar 1, 2017, at 11 :44 PM, Merle S. King <mking@kennesaw.edu> wrote:
FYI.
Sent from my iPad
From: "Stephen C. Gay" <sgay@kennesaw.edu>

Date: March 1, 2017 at 11:10:16 PM EST
To: Merle King <mking(a),kennesaw.edu>, Steven Dean
<sdean29@kennesaw.edu>
Cc: Lectra Lawhorne <llawhorn@kennesaw.edu>, "William C. Moore"
<wmoore36@kennesaw.edu>
Merle,
l received the following email, and call, tonight regarding a directory traversal
vulnerability on elections.kennesaw.edu. I immediately activated our Incident
Response Team and, through the use of burp suite, we were able to recreate the
vulnerability described below. In the vulnerability recreation, we were able to pull
voter information in database files for counties across the state and the data
elements included DOB, Drivers License Number, Party Affiliation, etc.
Understanding the risk associated with this vulnerability, we have closed all
firewall exceptions for elections.kennesaw.edu to contain the incident. I have
asked Bill Moore to act as point for this incident and we need to coordinate with
your team on the web logs for elections.kennesaw.edu first thing tomorrow
morning. The logs will help us understand the scope of the breach and allow us to
advise the CIO as to next steps.
I will be temporarily out of pocket for a short time tomorrow, then remote
LAMB DECLARATION
thereafter, but your cooperation in this incident response is appreciated.

Kennesaw, GA 30144
Phone: (470) 578-6620
Fax: (470) 578-9050
sgay@kennesaw.edu

From: "Andy Green" <agreen57@kennesaw.edu>
Subject: Vulnerability on the elections.kennesaw.edu website
Stephen,
Thanks for taking the time to talk with me tonight. As I mentioned during our
call, I was contacted by a friend in the security space here in Atlanta earlier
tonight. My friend relayed to me the existence of a Drupal plug-in vulnerability
that a friend of his located on the elections.kennesaw.edu website. The
vulnerability allows for directory traversal without authentication, leaving files
exposed.
My friend shared with me that the exposed directories contained, among other
things:
- voter registration detail files, including DOB and full SSN.
- PDFs of memos to county election officials which contained full credentials for
ExpressPoll Election Day access, for the November 2016 election.
I was able to verify the presence of the vulnerability myself, and was able to
traverse directories without authenticating. I did not download any of the voter
data files to verify his statement, for obvious reasons. However, I did successfully
open a PDF in my browser window, located in the Fulton County
Elections/ExpressPoll/ED_Files/ folder for proof of concept.
The base URL of interest is http://elections.kennesaw.edu/sites/default/files -

please note that the URL must be http, as use of https will return a 404 error.
I'm told the researcher works for a reputable organization. I'm also told that the
organization may be interested in going public with this at some point, due to the
seriousness of the matter as well as the related publicity it would generate for the
organization. My sense is that there is a desire to go public in a coordinated,
responsible manner, in order to give the university appropriate time to remediate
the vulnerability. This is certainly not set in bedrock, as I'm just the middleman
here. However, given that they reached out to me as opposed to releasing to the
2
LAMB DECLARATION
public, I'm hopeful that my sense is correct.
If I can be of further service, including facilitating communication between all

parties, please don't hesitate to let me know.
Thanks
Andy Green, MSIS
Lecturer of Information Security and Assurance

BBA-ISA program coordinator
KSU Student ISSA chapter faculty sponsor
KSU Offensive Security Research Club faculty sponsor
Michael J. Coles College of Business

Kennesaw State University - A Center of Academic Excellence in Information
Assurance Education
560 Parliament Garden Way NW, MD 0405
Kennesaw, GA 30144-5591
agreen5 7@kennesaw.edu
http://co les.kennesaw .edu/faculty/green-andrew. php
Ph: 470-578-4352
Burruss Building, Room #490
73656d7065722070617261747573
LAMB DECLARATION
Bill, we updated the production server last night and I initiated a scan this morning. It looks really good
to me, I'll just need your guidance on what issues we should address immediately. Thank you again for
you and your department's work on the security on campus. This has been a huge help to us.
Steven Dean
Kennesaw, GA 30144
P: 470-578-6900 F: 470-578-9012
On Oct 12, 2016, at 5:53 PM, Steven Dean <stevendean@kennesaw.edu> wrote:
Bill, thank you! This is great news. The unicoi server doesn't have an ssl cert so the plain text log-ins over http will be
corrected when we role the updates into the production server.
Samba shouldn't be running on these servers so that is also easily remedied.
Elections.kennesaw hasn't been updated yet, so that's why you're seeing all of the same vulnerabilities. Now that
we've confirmed the updates fix most if not all of the vulnerabilities, we will work after hours in the coming days to
transition elections.kennesaw to the latest versions of Debian and PHP, as is currently the case on unicoi.
Thank you for all your help with this, we will let you know when we are ready for the next round of scans.
Steven Dean
Kennesaw, GA 30144
P: 470-578-6900 F: 470-578-9012
On Wed, Oct 12, 2016 at 2:25 PM -0400, "William C. Moore" <wcmoore@kennesaw.edu> wrote:
Steven,
We have scanned both elections and Unicoi servers with basic level scans. The scan of the Unicoi server
identified one critical vulnerability but we also noticed two pages that allowed plaintext logins
LAMB DECLARATION
(http://unicoi.kennesaw.edu/?q=user/login and the samba-swat login http://unicoi.kennesaw.edu:901/l

. I am sure that you are aware that these are opportunities for malicious users to gather account
credentials. Therefore, all website logins should be passed through an SSL tunnel such as using https for
authentication.
The critical vulnerability discovered on the Unicoi server is for "Invalid CIFS Logins Permitted" which is
most likely related to the Samba Configuration file smb.conf
(https://www.samba.org/samba/docs/man/manpages-3/smb.conf.5.html).
The server elections.kennesaw.edu however is still showing that an outdated version of PHP is running
and may be the reason 40+ critical vulnerabilities are being identified as related to PHP.
Can you tell us what version of PHP is running and when we may be allowed to run a more through
scan?
Bill
William C. Moore II CISSP, MEd, MLIS

1075 Canton Pl
Kennesaw, GA 30144
Tel: 470-578-6620
Fax: 678-915-4940
LAMB DECLARATION
From: Steven Dean [mailto:stevendean@kennesaw.edu)

Sent: Thursday, October 06, 2016 11:58
To: William C. Moore <wcmoore@kennesaw.edu>
Cc: Michael Barnes <mbarne28@kennesaw.edu>; Jason Figueroa <jfigue12@kennesaw.edu>; Chris
Gaddis <jgaddis6@kennesaw.edu>; Merle S. King <mking@kennesaw.edu>; Stephen C. Gay
<sgay@kennesaw.edu>
Subject: Re: [IMPORTANT) concerning the security of elections.kennesaw.edu
Bill, we have the backup site up and running (thanks to G.J.!) on the new version of Debian with all
packages updated. Can we have unicoi.kennesaw.edu added to NeXpose for scanning?
Steven Dean
Kennesaw, GA 30144
P: 470-578-6900 F: 470-578-9012
On Oct 4, 2016, at 4:41 PM, Steven Dean <stevendean@kennesaw.edu> wrote:
Bill, thank you for following up. So far we haven't heard from anyone who can help us reconfigure
apache and have thus far been unable to get it working. I sent our apache server logs to Matt as
requested. Has any information about our configuration come from them?
Steven Dean
Kennesaw, GA 30144
P: 470-578-6900 F: 470-578-9012
On Oct 4, 2016, at 4:37 PM, William C. Moore <wcmoore@kennesaw.edu> wrote:
Steven,
I and my team are taking the ISO lead on working with your team to help resolve any security issues with
the server elections.kennesaw.edu. This is the last communication that I was copied on so can you
LAMB DECLARATION
please provide me an update on where we stand on the server, PHP and Apache configurations? Where
can we help and provide the greatest level of security support?
Thanks,
Bill

1075 Canton Pl
Kennesaw, GA 30144
Tel: 470-578-6620
Fax: 678-915-4940
wcmoore@kennesaw .ed u
From: Steven Dean (mailto:stevendean@kennesaw.edu]

Sent: Thursday, September 15, 2016 12:37
To: Matthew Sims <msims24@kennesaw.edu>
Cc: Michael Barnes <mbarne28@kennesaw.edu>; William C. Moore <wcmoore@kennesaw.edu>; Tyler
Hayden <thayden2@kennesaw.edu>; Jason Figueroa <jfigue12@kennesaw.edu>; Chris Gaddis
<jgaddis6@kennesaw.edu>; Merle S. King <mking@kennesaw.edu>
Subject: Re: (IMPORTANT] concerning the security of elections.kennesaw.edu
Matt, we've the backup server updated to Debian Jessie, but with the changes to apache between
versions, we've discovered we're a little out of our depth in trying to reconfigure apache to work with
our website. Can you put us in touch with someone who may be able to help us get the website back up
LAMB DECLARATION
on the backup server? We're probably up to date with security on the backup server, but it's all for
naught if the website doesn't work;-)
Thank you!
Steven Dean
Kennesaw, GA 30144
P: 470-578-6900 F: 470-578-9012
On Sep 12, 2016, at 11:55 AM, Matthew Sims <msims24@kennesaw.edu> wrote:
Steven,
I'm glad that the backup server is up and running. Thank you for the updates, and I hope your roll to
production goes smoothly after testing.

To: "Matthew Sims" <msims24@kennesaw.edu>
Cc: "Michael Barnes" <mbarne28@kennesaw.edu>, "William C. Moore" <wcmoore@kennesaw.edu>,
"Tyler Hayden" <thayden2@kennesaw.edu>, "Jason Figueroa" <jfigue12@kennesaw.edu>, "Chris
Gaddis" <jgaddis6@kennesaw.edu>, "Merle S. King" <mking@kennesaw.edu>
Sent: Friday, September 9, 2016 3:54:40 PM
Subject: Re: [IMPORTANT] concerning the security of elections.kennesaw.edu
Good afternoon, Matt. We have our backup server up and running and just need to do a little testing
before performing the updates. Once we confirm the distro update works on the backup server, we will
roll the updates onto the production server and have you begin scans. This will give the most accurate
scan results and tells us what we actually need help with security-wise. Thanks for your patience and the
offer of help. I'll send you another update early next week. Have a great weekend.
Steven Dean
LAMB DECLARATION
Kennesaw, GA 30144
P: 470-578-6900 F: 470-578-9012
On Sep 7, 2016, at 5:03 PM, Matthew Sims <msims24@kennesaw.edu> wrote:
Steven,
Thank you for the updates and transparency. We look forward to hearing back from you.
Have a good afternoon.

To: "Matthew Sims" <msims24@kennesaw.edu>
Cc: "Michael Barnes" <mbarne28@kennesaw.edu>, "William C. Moore" <wcmoore@kennesaw.edu>,
"Tyler Hayden" <thayden2@kennesaw.edu>, "Jason Figueroa" <jfigue12@kennesaw.edu>, "Chris
Gaddis" <jqaddis6@kennesaw.edu>
Sent: Wednesday, September 7, 2016 4:43:28 PM
Matt, we're still working on getting a fully working clone on another server to perform the updates on.
Once we have that working we'll roll the updates onto the production server. Then you can begin a new
round of testing through NeXpose. Unfortunately, getting the updates completed with proper backups and
testing has been slow going because of the election build, but that is all but passed and we are now
working to get the server updated.
We will send you an update tomorrow on our progress and we should have a day for you to begin the
new round of testing.
Steven Dean
Kennesaw, GA 30144
P: 470-578-6900 F: 470-578-9012
On Sep 7, 2016, at 3:29 PM, Matthew Sims <msims24@kennesaw.edu> wrote:
Hi Michael,
LAMB DECLARATION
I wanted to touch base with you and see what our game plan will be moving forward. Are we still in the
stages of upgrading the OS and PHP version or has that already happened? In terms of scanning at the
application level, I am trying to iron out a timeline and determine when this can be done using more
aggressive scanning similar to Nexpose, but if you are going to be upgrading the OS and PHP version,
then I may need to wait and coordinate a later time.
Thanks for your time and please let me know what you think.

To: "William C. Moore" <wcmoore@kennesaw.edu>
Cc: "Steven Dean" <stevendean@kennesaw.edu>, "Tyler Hayden" <thayden2@kennesaw.edu>, "Jason
Figueroa" <jfigue12@kennesaw.edu>, "Matthew Sims" <msims24@kennesaw.edu>, "Chris Gaddis"
<jqaddis6@kennesaw.edu>
Sent: Friday, September 2, 2016 5:59:17 PM
Bill,
Thank you. I will be back in touch on Tuesday to discuss when we would like for these scans to begin.
Sincerely,
Michael Barnes
Director
Kennesaw, GA 30144
ph: 4 70-578-6900
On Sep 2, 2016, at 5:55 PM, William C. Moore <wcmoore@kennesaw.edu> wrote:
Michael,
The directive to begin more agressive scanning came from Stephen Gay to help ensure that the server
was not posing a risk to the Center of Elections missions and objectives.
The probability of damaging your website should be low. We do not wish to take any action that would
actually damage any of your data or website(s). Typically a large portion of emails are sent by the
LAMB DECLARATION
scanning engines auto completing website forms tha are not properly protected. These are usually more
of an annoyance than any real damage.
The server does however have a number of critical and severe vulnerabilities some of which are reported
to be exploitable. The majority of these are centered around PHP but others are OS related. These may
be problematic but we would much rather test under controlled environments instead of the system
becoming exploited during a time when your services are under high scrutiny and in great demand by
polling stations around the state.
Since we would control the assessment tools the Information Security Office would be able to stop any
assessments we (the ISO) are performing as soon as you noticed a degradation in services via a phone
call to our team. Of course, I suspect that you have current backups of your website and data in case any
other persons are performing malicious attacks against the Center of Elections. We do not of course
anticipate you needing these backups for our assessments but you should still keep them and the
restoration process up-to-date as a best practice. The Information Security Office does not want to
impede the Center's objectives at all. We want to help mitigate any risks that the Center is facing such as
the risks that Mr. Lamb from the Bastille Threat Research Team discovered and reported. There are a
number of documents found from the Center of Elections website that have been cached by various
search engines. These are not threats that we can now prevent; however, we can offer suggestions on
how to request those cached documents be removed from the various search engine providers.
I hope that this addresses some of your concerns and since this has to be a two way partnership in our
assessment we encourage you to ask questions along the way.
Bill

1075 Canton Pl
Kennesaw, GA 30144
Tel: 470-578-6620
Fax: 678-915-4940
wcmoore@kennesaw .ed u

To: "William C. Moore" <wcmoore@kennesaw.edu>, "Steven Dean" <stevendean@kennesaw.edu>
Cc: "Tyler Hayden" <thayden2@kennesaw.edu>, "Jason Figueroa" <jfigue12@kennesaw.edu>, "Matthew
Sims" <msims24@kennesaw.edu>, "Chris Gaddis" <jgaddis6@kennesaw.edu>
Sent: Wednesday, August 31, 2016 3:15:46 PM
Subject: RE: [IMPORTANT] concerning the security of elections.kennesaw.edu
LAMB DECLARATION
Bill,
Before we give go ahead on potential scan periods I have a couple of follow

up questions:
1. The directive to begin more aggressive scanning has come from who
and for what reason?
2. How high a probability is there of issues being created that could

damage the functionality of our website?
We are currently in the busiest time of the year for use of our website by
our county clients. The last thing we can afford to have happen is for our
website to become unavailable or usable. If the action of conducting these
scans were to disable our website, what remedy would be available so the
services we provide to the election community in Georgia would not be
damaged?
Michael Barnes
Director
Kennesaw, GA 30144
ph: 4 70-KSU-6900
fax: 470-KSU-9012
From: William C. Moore [mailto:wcmoore@kennesaw.edu]

Sent: Wednesday, August 31, 2016 2:47 PM
To: 'Steven Dean' <stevendean@kennesaw.edu>
Cc: 'Tyler Hayden' <thayden2@kennesaw.edu>; 'Michael Barnes'
<mbarne28@kennesaw.edu>; 'Jason Figueroa' <jfigue12@kennesaw.edu>; 'Matthew
Sims' <msims24@kennesaw.edu>; Chris Gaddis <jgaddis6@kennesaw.edu>
Steven,
The recent scans have been "Safe Scans w/o Spidering". I have been asked
though to begin more aggressive scanning. Since these types of scans have
the potential of creating issues such as completing and submitting forms
LAMB DECLARATION
(creating email messages) interfering with services and/or stopping services

which we try to avoid. Since these assessments have the potential of
creating issues we need to schedule these types of assessments. Please
understand that we do not perform any testing that cannot already be
performed by any user on the campus network. We also do not purposefully
perform any DOS or DDOS attempts since the network perimeter firewalls
provide some level of protection against DDOS attempts.
When is the earliest we can schedule more aggressive scanning of the server?
Bill

1075 Canton Pl
Kennesaw, GA 30144
Tel: 470-578-6620
Fax: 678-915-4940
wcmoore@kennesaw.edu<mailto:wcmoore@kennesaw.edu>
From: Steven Dean (mailto:stevendean@kennesaw.edu]

Sent: Wednesday, August 31, 2016 10:38
To: William C. Moore <wcmoore@kennesaw.edu<mailto:wcmoore@kennesaw.edu> >
Cc: Tyler Hayden <thayden2@kennesaw.edu<mailto:thayden2@kennesaw.edu> >;
Michael Barnes <mbarne28@kennesaw.edu<mailto:mbarne28@kennesaw.edu> >;
Jason Figueroa <jfigue12@kennesaw.edu<mailto:jfique12@kennesaw.edu> >;
Matthew Sims <msims24@kennesaw.edu<mailto:msims24@kennesaw.edu> >
Subject: Re: (IMPORTANT] concerning the security of elections.kennesaw.edu
LAMB DECLARATION
Thanks Bill. I see the list appears to be the same as from the first scan.
Jason and I are working on a plan to upgrade to the latest version of Debian
which will also allow us to update to the latest version of PHP, where it
seems most of the vulnerabilities are. Let me know if there is anything in
the scan we should be concerned about that the Debian update may not fix.
Thanks for all the help, we really appreciate your time. It has been
immensely beneficial.
Steven Dean
Kennesaw, GA 30144
P: 4 70-578-6900 F: 4 70-578-9012
On Aug 31, 2016, at 10:34 AM, William C. Moore <wcmoore@kennesaw.edu

<mailto:wcmoore@kennesaw.edu> > wrote:
Steven
The authenticated scan completed last night and I will share the results as
soon as my current meeting completes.


1075 Canton Pl
Kennesaw, GA 30144
LAMB DECLARATION
Tel: 470-578-6620
Fax: 678-915-4940
On Aug 31, 2016, at 10:00, Steven Dean <stevendean@kennesaw.edu

<mailto:stevendean@kennesaw.edu> > wrote:
Sounds good to us. Thanks Tyler.
What is the status of the authenticated scan? I couldn't find where it had
been run and when I went to run a scan, the available options made it
difficult to choose while not really understanding them.
Steven Dean
Kennesaw, GA 30144
P: 470-578-6900 F: 470-578-9012
On Wed, Aug 31, 2016 at 9:56 AM -0400, "Tyler Hayden" <thayden2@kennesaw.edu

<mailto:thayden2@kennesaw.edu> > wrote:
Hi Steven,
In addition to the NeXpose scan, we'd also like to scan with IBM AppScan.
AppScan will focus more specifically on the Drupal application rather than
an overarching system scan with NeXpose. Matt Sims will reach out to you to
configure and schedule the AppScan assessment.
Regards,
Tyler Hayden
LAMB DECLARATION
Kennesaw, GA 30144
Phone: (470) 578-6620
Fax: (470) 578-9051
thayden2@kennesaw.edu<mailto:thayden2@kennesaw.edu>

From: "William C. Moore" <wcmoore@kennesaw.edu<mailto:wcmoore@kennesaw.edu>
To: "Steven Dean" <sdean29@kennesaw.edu<mailto:sdean29@kennesaw.edu> >

Cc: "Tyler Hayden" <thayden2@kennesaw.edu<mailto:thayden2@kennesaw.edu> >,
"Michael Barnes" <mbarne28@kennesaw.edu<mailto:mbarne28@kennesaw.edu> >,
"Jason Figueroa" <jfigue12@kennesaw.edu<mailto:jfigue12@kennesaw.edu> >,
"Matthew Sims" <msims24@kennesaw.edu<mailto:msims24@kennesaw.edu> >
Sent: Tuesday, August 30, 2016 2:03:57 PM
<http://elections.kennesaw.edu/>
Yes, this will be a local Linux account. It is preferable that the account
be provided sudo privileges only. I strongly recommend that you limit the
account to only be allowed to log in locally for your testing purposes and
from the IP addresses 130.218.100.80 and 10.97.52.25 (the two current
Nexpose scanning engines).
Bill

1075 Canton Pl
Kennesaw, GA 30144
Tel: 470-578-6620
Fax: 678-915-4940
LAMB DECLARATION
From: Steven Dean [mailto:sdean29@kennesaw.edu1

Sent: Tuesday, August 30, 2016 12:21
To: William C. Moore <wcmoore@kennesaw.edu<mailto:wcmoore@kennesaw.edu> >
Cc: Tyler Hayden <thayden2@kennesaw.edu<mailto:thayden2@kennesaw.edu> >;
Michael Barnes
<mbarne28@kennesaw.edu<mailto:mbarne28@kennesaw.edu> >; Jason Figueroa
<jfigue12@kennesaw.edu<mailto:jfigue12@kennesaw.edu> >; Matthew
Sims <msims24@kennesaw.edu<mailto:msims24@kennesaw.edu> >
<http://elections. kennesaw. edu/>
Just to clarify, are the required credentials a linux account for the server
itself? Also, could you define "privileged account"? Does it need to be an
admin or just have sudo ability?
Steven Dean
Kennesaw, GA 30144
P: 470-578-6900 F: 470-578-9012
On Aug 30, 2016, at 11 :59 AM, William C. Moore <wcmoore@kennesaw.edu

<mailto:wcmoore@kennesaw.edu>
<mailto:wcmoore@kennesaw.edu> > wrote:
Steven,
Please log back in to Nexpose and use the following steps to add an account
for patching and vulnerability verification.
Select Home then scroll though Sites until you find the site
"Elections-Server".
Select the Edit icon (pencil) for the Elections-Server site.
Select the Authentication tab at the top of the page.
Click the "Elections-Server-Account" link under Scan Credentials.
You should now be in the Edit Credential page. From this page select
LAMB DECLARATION
"Account" on the left hand side of the page.
This page already has the Service as Secure Shell (SSH) selected. You
should enter the User Name and enter the appropriate password in both the
Password field and Confirm Password field.
After you have entered and confirmed the account credentials please click
the "Test Credentials" link beside the question mark near the bottom of the
page to verify the account and credentials work.
After successfully testing the credentials click the Save button at the
bottom of the page then click the Save button at the top right hand side of
the page.
Please let us know when you have added, tested and saved the authentication
information and we will test the site again for vulnerabilities.
Bill

1075 Canton Pl
Kennesaw, GA 30144
Tel: 470-578-6620
Fax: 678-915-4940
<mailto:wcmoore@kennesaw.edu> wcmoore@kennesaw.edu
<mailto:wcmoore@kennesaw.edu>
From: Steven Dean [mailto:sdean29@kennesaw.edu]

Sent: Monday, August 29, 2016 16:46
To: Tyler Hayden <thayden2@kennesaw.edu<mailto:thayden2@kennesaw.edu>
<mailto:thayden2@kennesaw.edu> >
LAMB DECLARATION
Cc: Michael Barnes <mbarne28@kennesaw.edu<mailto:mbarne28@kennesaw.edu>

<mailto:mbarne28@kennesaw.edu> >;
Jason Figueroa <jfigue12@kennesaw.edu<mailto:jfigue12@kennesaw.edu>
<mailto:jfigue12@kennesaw.edu> >;
Matthew Sims <msims24@kennesaw.edu<mailto:msims24@kennesaw.edu>
<mailto:msims24@kennesaw.edu> >; William
C. Moore <wmoore36@ken nesaw. edu<mailto:wmoore36@ken nesaw. ed u>
<mailto:wmoore36@kennesaw.edu> >
<http://elections. ken nesaw. ed u/>
<http://elections.kennesaw.edu<http://elections.kennesaw.edu%3e> >;
Thanks Tyler. I've logged into NeXpose so we're ready to have our server
added. Server info:
Hostname: <http://elections.kennesaw.edu/
<http://elections.kennesaw.edu/%3E> >; elections.kennesaw.edu
<http://elections.kennesaw.edu/>
IP: 130.218.251.50
OS: Debian Wheezy v7.11
Hosted Application: Drupal 7.5
Steven Dean
Kennesaw, GA 30144
P: 470-578-6900 F: 470-578-9012
On Aug 29, 2016, at 4:22 PM, Tyler Hayden< <mailto:thayden2@kennesaw.edu>

thayden2@kennesaw.edu<mailto:thayden2@kennesaw.edu> > wrote:
Hi Steven,
Thanks for reaching out. We can definitely assist in assessing the security
and of your site. For starters, we can arrange for a security and
vulnerability assessment scan on your systems via NeXpose to get some better
insight.
We can scan both authenticated or unauthenticated. Authenticated scans will
LAMB DECLARATION
produce more accurate results, but also require credentials for a privileged
account. We can configure it to allow you to log in to NeXpose to provide
these credentials, if you do not want to provide them to us directly. We'll
just need information on the systems you'd want assessed. (Host names, OS,
IP address, hosted applications, etc.)
While I am not all too familiar with Drupal, I do know that there are
several modules available for restricting content in Drupal, such as the
Secure Site module which is available here:
<https://www.drupal.org/project/securesite
<https://www.drupal.org/project/securesite%3E> >;
https://www.drupal.org/project/securesite
This is just one of the available modules, so if this does not suit your
needs there are others available. I would also review Drupal's documentation
on secure configuration available here:
<https://www.drupal.org/security/secure-configuration
<https://www.drupal.org/security/secure-configuration%3E> >;
https://www.drupal.org/security/secure-configuration
to ensure that your site is following their best practices.
Without doing some research of my own, I am not certain on how to go about

restricting file access using the htaccess files. Typically you would
include a directive to only allow authenticated users to access the file,
however, I am not certain of how Drupal handles it's authentication or if it
shares it with the Apache web server. This is something we can look into and
let you know what we find.
Regards,
Tyler Hayden
Kennesaw, GA 30144
Phone: (470) 578-6620
Fax: (470) 578-9051
<mailto:thayden2@kennesaw.edu> thayden2@kennesaw.edu
<mailto:thayden2@kennesaw.edu>

From: "Steven Dean" < <mailto:sdean29@kennesaw.edu> sdean29@kennesaw.edu
<mailto:sdean29@kennesaw.edu> >
To: "Tyler Ray Hayden" < <mailto:thayden2@kennesaw.edu>
thayden2@kennesaw.edu<mailto:thayden2@kennesaw.edu> >
LAMB DECLARATION
Cc: "Michael Barnes" < <mailto:mbarne28@kennesaw.edu>

mbarne28@kennesaw.edu<mailto:mbarne28@kennesaw.edu> >, "Merle S. King"<
<mailto:mkinq@kennesaw.edu>
mking@kennesaw.edu<mailto:mking@kennesaw.edu> >, "Jason Figueroa"<
<mailto:jfigue12@kennesaw.edu>
jfigue12@kennesaw.edu<mailto:jfigue12@kennesaw.edu> >
Sent: Monday, August 29, 2016 2:39:41 PM
Subject: Re: [IMPORTANT] concerning the security of
<http://elections.kennesaw.edu/<http://elections.kennesaw.edu/%3E> >;
elections.kennesaw.edu<http://elections.kennesaw.edu/>
Good afternoon, Tyler. I wanted to reach out for some assistance with our
website as suggested in Stephen's email below.
For some background information, Jason and I have taken responsibility for
the website here at Center for Election Systems. This site was build on
Drupal before either of us were employed here and we have spent the last
several years simply maintaining it in the order it had been working
previously. Obviously this has become untenable in the current atmosphere,
and Jason and I must learn more to get the security of the website under
control. In this regard we appreciate any help you can offer on security
best practices and specific security implementations that will allow us to
secure the site.
This morning we implemented a patch to disallow file tree access by

anonymous users and we updated our Drupal installation to the current
version of Drupal 7. Unfortunately, until today, it seems the file tree had
been available to anonymous users. We have denied access by changing the
"AllowOverride None" in the apache virtualhost configuration for /var/www/
to "AllowOverride All" so that the .htaccess file parameters will disallow
anonymous user access outside Drupal.
While we have denied access to the file tree, we are currently we are having
trouble patching the ability for anonymous users to access individual files
directly without also disallowing Drupal user access to those files. We have
tried adding a <files> tag section tot he apache2.conf to deny access to pdf
files, but this breaks Drupal user access as well. I'm sure there is some
way to do this in the .htaccess file, but we have so far been unable to find
the method.
Please let Jason and I know if you have any insights that will help
accomplish this goal, as well as get a local firewall set up to allow us to
monitor access through logs.
Thank you,
Steven Dean
Kennesaw, GA 30144
P: 470-578-6900 F: 470-578-9012
LAMB DECLARATION
On Aug 29, 2016, at 11 :31 AM, Stephen C. Gay< <mailto:sgay@kennesaw.edu>

sgay@kennesaw.edu<mailto:sgay@kennesaw.edu> > wrote:
Michael,
Thanks for reaching out and we stand on ready to help. The source email
domain, <http://bastille.net/<http://basti11e.net/%3E> >; bastille.net
<http://bastille.net/> < <http://bastille.net/<http://bastille.net/%3E> >;
http://bastille.net/ <http://bastille.net/%3E> >;, has a valid domain
registration through GoDaddy and
located in Atlanta:
Registry Registrant ID:

Registrant Name: Michael Engle
Registrant Organization: Bastille Networks
Registrant Street: 1000 Marietta St NW
Registrant Street: Suite 112
Registrant City: Atlanta
Registrant State/Province: GA
Registrant Postal Code: 30318
Registrant Country: US
Registrant Phone: +1.7328200096
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: <mailto:domains@bastillenetworks.com>
domains@bastillenetworks.com<mailto:domains@bastillenetworks.com> <
<mailto:domains@bastillenetworks.com>
mailto:domains@bastillenetworks.com>
We don't put internal domain blocks in place unless we detect a spike in

phishing or vulnerability scanning from that domain which, at this point,
isn't the case for <http://bastille.net/<http://bastille.net/%3E> >;
bastille.net <http://bastille.net/> <
<http://bastille.net/ <http://bastille.net/%3E> >; http://bastille.net/
<http://bastille.net/%3E> >;. It's very likely that the
tester utilized Google searches on the <http://elections.kennesaw.edu/
<http://elections.kennesaw.edu/%3E> >;
elections. ken nesaw .ed u<http://elections. kennesaw. ed u/> <
http://elections.kennesaw.edu/<http://elections.kennesaw.edu/%3E> >; domain
which included file extensions, along
with HTML Headers which include the service versions.
Here the the Google search string which reveals the document he references
".pdf site:elections.kennesaw.edu"
Reporting precincts with cards -
LAMB DECLARATION
<https://elections.kennesaw.edu/sites/default/files/ExpressPoll%20L
<https://elections.kennesaw.edu/sites/default/files/ExpressPoll%20L&A/Reporting%20Precincts%20with%
20Cards.pdf%3E>
&A/Reporting%20Precincts%20with%20Cards.pdf>;
https://elections.kennesaw.edu/sites/default/files/ExpressPoll%20L
20Cards.pdf%3C>
&A/Reporting%20Precincts%20with%20Cards.pdf<;
<https://elections.kennesaw.edu/sites/default/files/ExpressPoll%20L
20Cards.pdf%3E>
https://elections.kennesaw.edu/sites/default/files/ExpressPoll%20L
20Cards.pdf%3E>
And here is the header response for

<https://elections.kennesaw.edu/?q=user/login
<https://elections.kennesaw.edu/?g=user/login%3E> >;
https://elections.kennesaw.edu/?g=user/login
<https://elections.kennesaw.edu/?q=user/login%3C> <;
<https://elections.kennesaw.edu/?g=user/login
<https://elections.kennesaw.edu/?q=user/login%3E> >;
https://elections.kennesaw.edu/?q=user/login
<https://elections.kennesaw.edu/?q=user/loqin%3E> >; that gives away the use
of
Drupal
<https ://elections. ken nesaw. edu/misc/dru pal. js?ococft
<https://elections.kennesaw.edu/misc/drupal.js?ococft%3E> >;
https://elections.kennesaw.edu/misc/drupal.js?ococft <
<https://elections.kennesaw.edu/misc/drupal.js?ococft
https://elections.kennesaw.edu/misc/drupal.js?ococft
It is reasonable to assume that these types of unsolicited requests are

going to increase leading up to the general election in November and we
stand on ready to offer application security analysis and recommendations.
In turn, I would highly recommend the use of an server based firewall/IDS to
track this activity (specifically brute force attempts on the login page)
and ensure that all access are logged.
I am cc'ing 2 members of my team, Mr. Tyler Haden and Mr. Bill Moore, to
advise on operating system/application vulnerabilities and provide advice on
mitigating strategies. Tyler will act as your point of contact and if I can
assist in any way please let me know.
In service,

LAMB DECLARATION

Kennesaw, GA 30144
Phone: (470) 578-6620
Fax: (470) 578-9050
<mailto:sqay@kennesaw.edu> sgay@kennesaw.edu<mailto:sgay@kennesaw.edu> <
<mailto:sqay@kennesaw.edu>
mailto:sgay@kennesaw.edu>

From: "Michael Barnes" < <mailto:mbarne28@kennesaw.edu>
mbarne28@kennesaw.edu<mailto:mbarne28@kennesaw.edu> <
<mailto:mbarne28@kennesaw.edu>
mailto:mbarne28@kennesaw.edu>>
To: "Stephen C Gay" < <mailto:sgay@kennesaw.edu> sqay@kennesaw.edu
<mailto:sgay@kennesaw.edu> <
<mailto:sgay@kennesaw.edu> mailto:sgay@kennesaw.edu>>
Cc: "Merle King" < <mailto:mkinq@kennesaw.edu> mking@kennesaw.edu
<mailto:mkinq@kennesaw.edu> <
<mailto:mking@kennesaw.edu> mailto:mking@kennesaw.edu>>, "Steven Dean"<
<mailto:sdean29@kennesaw.edu> sdean29@kennesaw.edu
<mailto:sdean29@kennesaw.edu> <
<mailto:sdean29@kennesaw.edu> mailto:sdean29@kennesaw.edu>>, "Jason
Figueroa" < <mailto:jfique12@kennesaw.edu> jfique12@kennesaw.edu
<mailto:jfigue12@kennesaw.edu> <
<mailto:jfigue12@kennesaw.edu> mailto:jfigue12@kennesaw.edu»
Sent: Monday, August 29, 2016 9:24:30 AM
Subject: FW: [IMPORTANT] concerning the security of
elections.kennesaw.edu<http://elections.kennesaw.edu/> <
http://elections.kennesaw.edu/<http://elections.kennesaw.edu/%3E> >;
Stephen,
We received an unsolicited email over the weekend from a Logan Lamb. The
content of the email has engaged our staff and we are looking into these
claims regarding the security of our website. Would you please add this
individual and the organization he claims to be affiliated with to the list
of IP addresses most recently black listed? Also, our IT staff, Steven Dean
and Jason Figueroa will be reaching out to you and your staff to see what
assistance your group can provide us in pinging our site to verify that we
are addressing security issues within our site.
Thank you in advance,
LAMB DECLARATION
Michael Barnes
Director
Kennesaw, GA 30144
ph: 470-KSU-6900
fax: 470-KSU-9012
From: Merle S. King [ <mailto:mking@kennesaw.edu> mailto:mking@kennesaw.edu]

Sent: Sunday, August 28, 2016 3:56 PM
To: Steven Dean < <mailto:sdean29@kennesaw.edu> sdean29@kennesaw.edu
<mailto:sdean29@kennesaw.edu> >; Jason
Figueroa
< <mailto:jfigue12@kennesaw.edu> jfigue12@kennesaw.edu
<mailto:jfigue12@kennesaw.edu> >
Cc: Michael Barnes < <mailto:mbarne28@kennesaw.edu> mbarne28@kennesaw.edu
<mailto:mbarne28@kennesaw.edu> >
Subject: Fwd: [IMPORTANT] concerning the security of
elections. ken nesaw. ed u <http://elections. ken nesaw. ed u/>
Steven and Jason - Please review this email and advise. Sooner is better
than later.
Thanks,
MSK
From: "Logan Lamb"< <mailto:logan@bastille.net> logan@bastille.net

<mailto:loqan@bastille.net> <
<mailto: logan@bastille.net> mailto:logan@bastille. net> <
<mailto:logan@bastille.net> mailto:logan@bastille.net<
<mailto:logan@bastille.net> mailto:loqan@bastille.net» >
To: "Merle King" < <mailto:mkinq@kennesaw.edu> mking@kennesaw.edu
<mailto:mking@kennesaw.edu> <
<mailto:mkinq@kennesaw.edu> mailto:mkinq@kennesaw.edu> <
<mailto:mkinq@kennesaw.edu> mailto:mking@kennesaw.edu<
<mailto:mkinq@kennesaw.edu> mailto:mking@kennesaw.edu>> >
LAMB DECLARATION
Cc: <mailto:research@bastille.net> research@bastille.net

<mailto:research@bastille.net> <
<mailto:research@bastille.net> mailto:research@bastille.net> <
<mailto:research@bastille.net> mailto:research@bastille.net<
<mailto:research@bastille.net> mailto:research@bastille.net>>
Sent: Sunday, August 28, 2016 3:47:50 PM
Subject: [IMPORTANT] concerning the security of
elections. kennesaw .ed u<http://elections. kennesaw. ed u/> <
http://elections.kennesaw.edu/<http://elections.kennesaw.edu/%3E> >;
Hello Merle,
My name is Logan Lamb, and I'm a cybersecurity researcher who is a member of
Bastille Threat Research Team. We work to secure devices against new and
existing wireless threats: <https://www.bastille.net/

<https://www.bastille.net/%3E> >;
https://www.bastille.net/ < <https://www.bastille.net/
<https://www.bastille.net/%3E> >;
https://www.bastille.net/<https://www.bastille.net/%3E> >;. This past
Tuesday I
went
to Fulton County Government Center to speak with Rick Barron about securing
voting machines against wireless threats. I was then directed to contact you
and the center. I'd like to collaborate with you on securing our state's
election systems infrastructure against wireless attacks.
While attempting to get more background information on the center prior to
contacting you, I discovered serious vulnerabilities affecting
elections.kennesaw.edu<http://elections.kennesaw.edu/> <
http://elections.kennesaw.edu/<http://elections.kennesaw.edu/%3E> >; <
http://elections.kennesaw.edu<http://elections.kennesaw.edu%3c> <;
http://elections.kennesaw.edu/<http://elections.kennesaw.edu/%3E%3E> »; .
LAMB DECLARATION
The following google searches reveal documents that shouldn't be indexed and
appear to be critical to the elections process. In addition, the Drupal

install
needs to be immediately upgraded from the current version, 7.31:
"site:elections.kennesaw.edu < <http://elections.kennesaw.edu/

http://elections.kennesaw.edu<http://elections.kennesaw.edu/> <
http://elections.kennesaw.edu/<http://elections.kennesaw.edu/%3E%3E> >>;
inurl:pdf"
I generally use this type of search to find documents on websites that

lack
search functionality. This search revealed a completely open Drupal install.
Assume any document that requires authorization has already been downloaded
without authorization.
"site:elections.kennesaw.edu < <http://elections.kennesaw.edu/

http://elections.kennesaw.edu<http://elections.kennesaw.edu/> <
http://elections.kennesaw.edu/<http://elections.kennesaw.edu/%3E%3E> >>;
L&A"
The second search result appears to be for disseminating critical voting
system software. This is especially concerning because, as the following

article
states, there's a strong probability that your site is already compromised.
<https://www.drupal.org/project/drupalgeddon
<https://www.drupal.org/project/drupalgeddon%3E> >;
https://www.drupal.org/project/drupalgeddon<
<https://www.drupal.org/project/drupalgeddon
https://www.drupal.org/project/drupalqeddon
LAMB DECLARATION
<https://www.drupal.org/SA-CORE-2014-005
<https://www.drupal.org/SA-CORE-2014-005%3E> >;
https://www.drupal.org/SA-CORE-2014-005<
<https ://www.drupal.org/SA-CORE-2014-005
https://www.drupal.org/SA-CORE-2014-005
If you have any questions or concerns please contact me. I'm able to come to
the
center this Monday for a more thorough discussion.
Take care,
Logan
Merle S. King
Executive Director
Voice: 470-578-6900
Fax: 470-578-9012
LAMB DECLARATION
Matt Sims
Information Security Specialist
Identity & Access Management

Kennesaw, GA 30144
Phone: (470) 578-6620
msims24@kennesaw.edu
Matt Sims

Kennesaw, GA 30144
Phone: (470) 578-6620
Matt Sims

Kennesaw, GA 30144
LAMB DECLARATION
Phone: (470) 578-6620

LAMB DECLARATION
DECLARATION OF CARRI GIBBS LUSE


ATLANTA DIVISION
)
)
Plaintiff, )
) CIVIL ACTION FILE NO.: 1:17-cv-
vs. ) 2989-AT
)
)
Defendant. )
)
)
DECLARATION OF CARRI GIBBS LUSE
CARRI GIBBS LUSE hereby declares as follows:
1. I am have been a Georgia voter since at least 1992 and am currently
registered to vote at 175 Sampson Street NE, Atlanta, Georgia 30312,
in Fulton County. I have been registered to vote at this address since
November 2013.
2. On May 1, 2018 I voted in early voting at the Fulton County Elections
Office at 140 Pryor Street, Atlanta in the May 22, 2018 primary.
3. I made a special trip to the central Elections Office to vote because I
felt more confident of my early vote being counted at the central
office than at a remote voting location. I took my mother to vote there
at the same time.
LUSE DECLARATION
4. I requested a Democratic Party ballot by completing the voter
application certificate, specifying the Democratic Party ballot. I voted
a Democratic Party electronic ballot on the touchscreen, and later
proudly told friends about the candidates I selected on my ballot. I am
very confident that I voted a Democratic Party ballot on the
touchscreen machine that day.
5. On July 2, 2018 I voted in the July 24, 2018 runoff during early
voting, this time choosing to vote in the Ponce de Leon Library early
voting location.
6. When I checked in to vote that day and asked for a Democratic ballot,
the pollworkers claimed that I had voted a Republican Party ballot in
May, and could not vote a Democratic Party ballot in the runoff. I was
in disbelief and continued to challenge the pollworkers, as I was
confident that I voted a Democratic Party ballot in May.
7. I repeatedly asked what could be done to correct this error and vote a
Democratic Party ballot, and the poll workers said that nothing could
be done, and permitted me only to vote a Republican ballot or a non-
partisan ballot, or not vote at all.
8. The pollworkers did not offer to let me vote a Democratic Party
provisional ballot, despite my repeated request for a solution so that I
LUSE DECLARATION
could vote for Democrats. I don’t understand why I was not offered a
provisional ballot which could have been counted after reviewing my
May 1, 2018 voter application documenting the fact that I requested a
Democratic ballot.
9. I am concerned that I was disenfranchised in this way, and concerned
about the integrity of the electronic pollbooks that contain this error
that caused my disenfranchisement. I am concerned that I might be
further disenfranchised in the November election by other types of
electronic election records errors.
10. I have read a number of recent reports of voter disenfranchisement,
electronic pollbook errors, and voting machine errors, and I now have
grave concerns about the integrity of the upcoming November
election.
11. Because of my concerns about the integrity of the electronic election
records in Georgia, I am researching the procedure and pros and cons
of voting a paper mail-in ballot in November. It is my preference to
have the flexibility of voting on Election Day in my home precinct, as
I may want to wait until Election Day to obtain all last minute
information about all campaigns, and not be required to vote several
days before Election Day to assure that my mail ballot arrives in time
LUSE DECLARATION
LUSE DECLARATION
DECLARATION OF MARILYN MARKS


ATLANTA DIVISION

Plaintiffs
, v.
BRIAN KEMP, ET AL.,

Defendants.
DECLARATION OF MARILYN MARKS
MARILYN MARKS hereby declares as follows:
1. I am Executive Director of Coalition for Good Government, a Plaintiff in
this action.
2. Attached as Exhibit 1 are true and correct copies of documents received by
Coalition from Fulton County Board of Elections on June 7, 2017 at a hearing in the
matter of Curling v Kemp (2017cv290630)
3. Attached as Exhibit 2 are true and correct copies of a sample of documents
showing differences between the number of voters reported as voting at the polling place
on Election Day and the number of ballots cast as reported on the polling place DRE
machine results tapes. The documents were obtained from Fulton County Board of
Elections as part of the agreed on DRE inventory information submission in this action.
4. Attached as Exhibit 3 are true and correct copies of documents appearing
to show greater than 100% voter turnout. The documents are screenshots taken from
MARKS DECLARATION
official reports from the Secretary of State’s election results pages on website:
http://sos.ga.gov/index.php/Elections/current_and_past_elections_results )
5. This is a link to a news report describing how electronic pollbook
eliminated some voters’ records with recent 4 digit zipcode suffix additions, forcing
them to vote by provisional ballot:
https://www.11alive.com/article/news/politics/voters-in-certain-metro-atlanta-
counties-say-they-were-given-provisional-ballots-because-of-this/85-577127862.
6. Attached as Exhibit 4 is a screen shot from Secretary of State’s election
results pages on website:
(http://sos.ga.gov/index.php/Elections/current_and_past_elections_results ) from the
November 8, 2016 election showing a DRE machine vote for a Congressional District 6
candidate from a precinct in Congressional District 5.
7. Attached as Exhibit 5 is a letter dated August 1, 2018 addressed to County
Election Officials and Registrars from State Elections Division Director, Chris Harvey. I
obtained this letter from Stephens County voter Packy McKibben via email who
reported that he had obtained it as a public document at the August 2, 2018 Stephens
County Board of Elections meeting.
In accordance with 28 U.S.C. § 1746, I pledge under penalty of perjury that the
______________________
Marilyn Marks
PAGE 2
MARKS DECLARATION
E
X
H
I
B
I
T
MARKS DECLARATION
MARKS DECLARATION
MARKS DECLARATION
MARKS DECLARATION
MARKS DECLARATION
E
X
H
I
B
I
T
MARKS DECLARATION
Exhibit 2.1
Fulton County Polling Place Recap Sheet Discrepancy
April 18, 2017 (Congressional District 6 Runoff)
Polling Place SS25
Note: The number of voters applying to vote at the polling place should reconcile to the
number of ballots cast and number of votes reported with few, if any, reconciling items.
The example recap sheet shows unreconciled differences. The number of ballots cast
should not exceed the number of voters voting.
Information on Recap Sheet:
Reported ballots cast per DRE results tape=486
Reported number of voter certificates (voters voting)= 477
Reported election day votes for CD6 per official results= 479 (computed)
(http://results.enr.clarityelections.com/GA/Fulton/67378/Web02/#/)
MARKS DECLARATION
USE BALL POINT PEN
ELECTION: (Check One) 0 General
i
Primary
Bear Down_ - You Are Making Three Copies
Runoff (if applicable) WHITE sheet to Secretary of State
Special YEUOW sheet to Superintendent
0 / Presidential Preference Primary PINK sheet to Clerk of Superior Court or Municipal Clerk
DATE OF ELECTION _Apr i ~~0 l 1 TIME LAST VOTER VOTED _

COUNTY /MUNICIPALITY fb' \~ - \. .
0...C.. - l v NUMBER OF REGISTERED
PRECINCT '....-Uc2,b -.. . VOTERS IN PRECINCT _
/i
~ }
/ -·( (
DIRECT RECORD'EL.ECTRONIC VOTING MACHINE RECAP···,
SECTION A: RECORD EACH UNIT
Before Polls Open Before Polls Open After Pons-close ..
DRE UNIT NUMBER SEAL NUMBER COUNT NUMBER COUNT N-UMBER
I l 1-l l I l , _,'
(
I~)'-/
l--'--1(....:, -, I Pl
I ! ,-.oc' / II/ I II ()
. -· •. -·--- \ '
l
J
_____..;...__i.....
... .,1
. '
~
-------'--. -~·-------
SECTION B: TOTAL OF ALL VOTES CAST (ALL UNITS COMBINED)

SECTION C: NUMBERED LISTS and VOTER CERTIFICATES
I I
ExpressPoll <See ExpressPoll Recap) Supplemental Total Voter's Certificates
Democratic Pfi~afy_' _ Democratic Primary _ Democratic Primary _
Republican P~(ll~ry. Republican Primary Republican Primary _
General/Special
9 /'./
I (/1 7 General/Special ------
/·-, GeneraVSpecial . L/ '/ r;
Total (a) . / { ,,.,r. , Total (b) _-=L--"
=---=-
·'-- · Total (c) .,. _ ,
. JI
1
.,, ,_# ' ,,.

t.
iJ
SECTION D: TOTAL NUMBER OF PERSONS VOTING AS SHOWN BY:
1. Results Tapes (or.Accumulator Tape Results) (Total from Section B above) = 4A6
2. "Voters Mar,k,d" (See ExpressPoll Recap) LJ2L. + Supplement~! List _0
=-.._ = ---177
3. Numbered Lists
I'
on ExpressPoll (a) lf7'7 ~ Supplemental (b) h = L/77
4. Voter's Certificates (c) = 417
NOT,E: N.ymbers from ,P,1, 02, 03, and 04 should
I ~/}le_ ,Z. d!vt- tJ-.
Y.:. ,..-,,. ,, ..u
ram
We, the unders~n~Managers, hereby 9'ftify th~Hhe above is a true and correct accounting on this
the
//'.;;
/% -~ day of
/ ,,,~
':/AJ-<;_j-/.'
/'>--
/1 , 20 I?
'
. SIGNED/IN.TRl~
- -
VIA E
7 .·
/,//a--'fA:. d, /,-k- ,,, /.A!-d--"'""- -.,u.-e__c, _,..,.-(__ /~ - / cC/-- C7':·/,J4;l_JL".C, ci!v~
Manager / Aaalstant Manager - Aaalstant Manager;,- " -
MARKS DECLARATION
Form RS-DRE-10
Exhibit 2.2
June 20, 2017 (Congressional District 6 Runoff)
Polling Place RW20
The example recap sheet shows unreconciled differences. The number of voter
certificates (voters voting) should be equal to the number of ballots cast.
Reported number of voters recorded in electronic pollbook=345
MARKS DECLARATION
. USE
Case 1:17-cv-02989-AT Document 258-1 Filed 08/03/18 BALL
Page POINT
273 PEN
of 369
General
1
ELECTION: (Check One) 0 Bear Down - You Are Making Three ~opie_s
Primary ~
Runoff (if applicable) -· WHITE sheet to Secretary of State
---.f0 \ fuV\..'
Special YELLOW sheet to Superintendent
0 Presidential Preference Primary PINK sheet to Clerk of Superior Court or Municipal Clerk
QQ , QU l l 15 3
1
DATE OF ELECTION ~) Y\ f.. TIME LAST VOTER VOTED

COUNTY /MUNICIPALITY
PRECINCT n/ \)9,_Q 7
NUMBER OF REGISTERED
VOTERS IN PRECINCT
DIRECT RECORD ELECTRONIC VOTING MACHINE RECAP

Before Polls Open Before Polls Open After Polls Close After Polls Close
DRE UNIT NUMBER SEAL NUMBER COUNT NUMBER SEAL NU~ER coui~7~MBER
Is- 'JP!!-1
57i·
101303 'J 5 ~ t)
JI~(_, ~ 1.._:::,
I I 2- 7 (..I 2. ..Jb6 3.~ --; '-'}
(Z.2U---£5 0 t{, 35 4 7 I~
)>;;i 17 #--
1/;?L. L_ I l:/I
12 l71 ?_ ut{, 3 5 6 } /55'i71 :;,;-_-,..a.. _
11-s 76 'i ) bl '] S cf L] l:?'>712!1 ~
I Li-- 5· 7 ll--- 7 v tt 3 S' 7 4/ t'.)~ 7'7J.'7 0
.'-

. SECTION C: NUMBERED LISTS and VOTER CERTIFICATES
1
E~pressPoll (See ExpressPoll Recap) Su6plemental Total Voter's Certificates ~/ ;J__
===:::-:_--
Democratic Primary______ Democratic Primary _ Democratic Primary ..., ( 0--
I ' '
Republican Primary __ Republican Primary Republican Primary _
<~-
General/Special ~ General/Special --- ,,_(-~ri--- General/Special
_ Total (a) ·' ')! ':2
1 ~
~ Total {b) _---== ./__ Total (c) Ji r V.
~ ( \ }
~
\ I V' '' ......, •;,,
SECTION D: T0TAL NUMBER OF PERSOI\IS VOTING AS SHOWN BY:

1. -Results {ap~s (or Accumulator Ta~_e\~esu!!§) (Total from Section B above)
2. "Voters ~~rke~ (See ExpressPoll Recap)3 S + Supplemental List ~ 1-
~t J
3. Numbered ~ists ~'} ExpressPoll {a) \ + Supplemental (b) _ =_..5_b_Z.:
~
4. Voter's Certificates (c) =
If n9t, explain c;lifference here:~~e,./ 1, 1--e_ we..;::;;,/-
(1/ ' I . , '/ Jl..r 1
NOTE: Numbers-fr?~ _D1',))2, D3, and p4 should match.
d~ Je Ve,reul -n rYJe-5. Nup, p-ffW-'2.-r,e. <0F •
• I
I
I
')' , 0
We, the unp signed Managers, herelfydertify 1at the above is a true J11d co,:r,e_frt accounting on this
. ,?(, ]I/ , ·.' d~y of y/,{,n(j-, ,t' ! /!!!!7. SIGNED IN TRIPLICATE_ _,,t-./ . _
:.,
; (;t/1/,t
1 Manager
I fr,_, / v ;J / 1 • 1' L---- / 1 Z~ Ii_ /1 · f / /t,__
_;. ,
/'~«.- ~; ~
L.- J 'Assistant Manager
1 --ksislant Manager -
/ MARKS DECLARATION
Form RS-DRE-JO
Exhibit 2.3
April 18, 2017 (Congressional District 6 Special Election)
Polling Places SS02A/B, SS19A/B, SS20, SS26 (combined)
should not exceed the number of voters applying to vote.
Reported ballots cast per DRE results tape= 1,962
Reported number of voter certificates (voters voting)= not reported, unknown
Electronic Pollbook voter count (voters voting)= 1,790
MARKS DECLARATION
USE BALL POINT PEN
· I 615-V
~ 0 Primary
Bear Down, - You Are Making Three Copies
Q__ \ O.,i Runoff (if applicable) WHITE sheet to Secretary of State
'P. Special YELLOW sheet to Superintendent
l J"' ~ 'Presidential Preference Primary PINK sheet to Clerk of Superior Court or Municipal Clerk
DATE OF ELECTIONfrV( l
COUNTY/ MUNICIPALrrt -J.
tl-+0""'4l4t+
\
:5)
;;.ii1c,1.,,-
t
. . I----
..20l] TIME LAST VOTER VOTED __ /
-=---.'_Q
_~__
Ln :), NUMBER OF REGISTERED / q lo ·2-
PRECINC-6.Sc.'.;l $l9' ,.:4AF, ~~alp(5, vorens rN PREcINcT _

DRE UNIT NUMBER SEAL NUMB~~ COUNT NUMBER SEAL NUMBER COUNT NUMB E~
\ . . . q . . . ,-
05941'ti1 I..,
ILJ-7.51..l. 9b 1
\L...\ 7~-343 ~~
I I I - 1- 'I -P-\1~4 <r.?
l '- - t~ \L\7.S~\..\ ~
\L\759 9S
,._,. \ C\7s3St)
,.) , \.\7s34q
C: \'475"3LI q 9U
,) )S3,~gs-\o
\l.47.$ ~L.\ 7
\ L\l.S-34\Q
_) I'
\L\l~ 3QI
· I . . . ' I ,.., , 1..1 . l.• \U.7ss\a.,
! I I,.._ I' I ,) \ 1.4 7s" S\Q<k' \ \ >_ :
•J \ L.\-, ~::;-70 ,• /
SECTION B: TOTAL OF ALL VOTES CAST (ALL UNITS COMBINED) ----'-----'----

I

ExpressPoll /See ExpressPon Recap) Supplemental Total Voter's Certificates
Democratic Primary _ Democratic Primary _ Democratic Primary _
Republican.Primary _ Republican Primary _ Republican Primary _
General/Special General/Special :I General/Special
Total (a) _ Total (b) ~ Tot~I (c) _
SEqTION D: TOTAL NUMBER OF PERSONS VOTING AS SHOWN BY:

1. Results Tapes (or Accumulator Tape Results) (Total from Section B above)
2. "Voters Marked" (See ExpressPoll Recap) \ 7 q,u+ Supplemental List-=-'--
! 3. Numbered Lists on ExpressPoll (a) \ 1 ~\) + Supplemental (b) (l . =-----
NOTE:
4. Voter's Certificates (c)
Numbers from D1, D2l ~3, and D4 should match. If not, explajP difference here..'
, .
t+·
~~-.::.--t.u.r'> ~ :::2::'::::<:..=::::.c~-S..':> ?:t:>\\ c- ~ r-~').,
' ' '
-~IGNE:r~ AT . :.
We, the under~l}_,ed Managers, hereby certify
~ that the ab~ve is a true and correct accounting on t~
'·s
the~ dayof c--' J . ,2Q\] I
-~
Manager
( (I ,YA[,
Assistant Manager
l~ .t,_L
~ _/
_ ..:..._
·
Assistant M\ager
-=!----
~
MARKS DECLARATION
Form RS-DRE-JO
.cL/) J{'l-, a
USE BALL POINT PEN
O Primary
Runoff {if applicable) WHITE sheet to Secretary of State
f Special YELLOW sheet to Superintendent
I? Presidential Preference Primary ?'
PINK sheet to Clerk Superior Court or Municipal Clerk
DATEOFELECTION~ri I Ii ~ll TIME LAST VOTER VOTED ]. ,(}._S../

'
COUNTY I Ml!_~ICIPAUTY +
tl-+-,
04--( +-l~
~~,------
t
A l'Ez, 55 ,er A rP.z, :.::z..&o .t ~ vorsas 1N PREc1NcT
PREc1NcOSOQ
I I

.~
,, Before Polls Open Before Polls Open After Polls Close After Polls Close
DRE UNIT
- NUMBER SEAL NUMBER COUNT NUMBER SEAL NUMBER
/Q S:lL./ -,u,q
COUNT§'bBER
I l \\...\7 ,s;~~$
I - -..., - I I OSC,'--1 7 Lc>5 \~ls-Sw'Z_ G?'j_
I L It;. I" I \ ·
I I 1..... l '-1 'c
05C-?Lf,q::;
QSltLI-/C(L/ ~,,.
\ ~3,3,2(~~
)'-\l S~\..ov,
JG
yfj
>
\ ,. I· I .059L\t{J)3 ,~, S"L\{14 J C. 7
I - > LI .:. I O.SCIL./ r-13 'Y 3 4 ~ \'1' ~7
l
i , ' I (It 0Si'i78] ,__,
\Y7s' ~\.D9 ~>
I I I I,;: , / 059'-l ?lPO \ I..\=( SS'o ~' ] 3>
11 1 ~'-1'-I ,. '/ 05941 LPb \'--\"3>~~\\ I
'*
I_ :- c , I 05lJ~ 17J-. t....: ,~-rss~~·
111..1-.., ! ~ O~YP-rl1+3 'L\7-S3>7 lo·· . 3Q
l'-f'-1 ,_ ~ I :
I ._ .: . I L
. 0§~~1ir::;
.0 ''l'Lf15l./
V \ L-\ 7 ~S:\J) \
\ l..\ 7 SL\<-\ -:7
. YIP .
LQ ~
11 ~ _) l "()54i:/ 74~ \Y, sa.7 ~ gy.,
l' I ·; \ 2..c - o::/:;I J../ 717 Cl ~ L..\ 7 S:.:. 7~,.. .
'
.;k~
---
ExpressPoll csee ExpressPoll Recap) Supplemental Total Voter's Certificates
Democratic Primary _ Democratic Primary _ Democratic Primary _
Republican ~rimary _ Republican Primary _ Republican Primary _
General/Special General/Special General/Special
Total (a) _ Total (b) _ Total (c) _

1. Results Tapes (or Accumulator Tape Results) (Total from Section B above) = \v._\,L
2. "Voters Marked" (See ExpressPoll Recap) + Supplemental List _.J___ = \7 ½ \
3. Numbered Lists on ExpressPoll (a) + Supplemental (b) _
=-----
4. Voter's Certificates (c) ··•
=-----
NOTE:c....Numbers from D1, b2, b3, and 04 should match. If not, explain difference here: _
c,,Z. 6,~! "'-~~ >½-.L.
Manager Assls1ant Mar;iager

MARKS DECLARATION
Form RS-DRE-10
- 6 "\~ii
USE BALL POINT PEN
ELECTION: (Check One) ' 0 General
• • · 0 Primary
0
Runoff (if applicable} -WHITE sheet to Secrelary of State
(~ Special YELLOW sheet to Superintendent
()·c. 0 Presidential Preference Primary
, , , , ,. .
PINK sheet to Clerk of Superior Court or Municipal Clerk
DATE OF EL.ECTION
_ COUNTY / MUNICIPALITY
Aft~~~iL)-++-I / \ ~ JD l 7
- ,=:;.~
-1- ~A
~----
TIME LAST VOTER VOTED 7· \) ~
PRECINC~ ).. \J½, 3St9Affi,~C~Jr- VOTERS IN PRECINCT
- l I ~l4'
SECTION A: REC.ORD EACH UNIT
DRE UNIT NUMBER SE'1k N'1JMBER COUNT NUMBER
( 0!:>'1'-f 7.3:k
COUNTNPER
\L \ LI ,:_ I, u }~~~~~
I'- /C '- b · 05'1Y148 (.) \q7s3Ltg

ExpressPo!I /See Expresseon Beca11l, Supplemental Total Voter's Certificates
Democratic Primary _ Democratic Primary_,,__ _ Democratic Rrimary _
Republican Primary ___,_, __ Republican Primary _ Republican Primary _
GeneraVSpecial General/Special GeneraVSpecial
Total (a) _,;'--- ~ Total (b>--------''--- Total (c) _

1. Results Tapes (or Accumulator Tape Results) (Total from Section B above)
2. "Voters Marked" (See ExpressPoll Recap}\' qi) + Supplemental List----'\ __
3. Numbered Lists on ExpressPoll (a) \ 1 ~ V + Supplemental (b) _ =-----
4. Voter's Certificates (c)
=-----
· NOTE: Numbers from D1, D2, D~~d 04 should match. If not, explain difference here:
~ -v-6 ~ .E.~. 6-~ "'o~ ~\t...t>·t.,.
MARKS DECLARATION
Form RS-DRE- I 0
Exhibit 2.4
December 5, 2017 (Atlanta Municipal Election Runoff)
Polling Place 07F 08L
should not exceed than the number of voters applying to vote.
Reported election day votes for CD6 per official results= 479 (computed)
(http://results.enr.clarityelections.com/GA/Fulton/67378/Web02/#/)
MARKS DECLARATION
Case 1:17-cv-02989-AT Document 258-1 Filed 08/03/18
USE Page
BALL 279 of 369
POINT PEN
ELECTION: (Check Onei General Bear Down - You Are Making Three Copies
Primary
Runoff (if applicable) WHITE sheet to Secretary of State
Special YELLOW sheet to Superintendent
0 Presidential Preference Primary PINK sheet to Clerk of Superior Court or Municipal Clerk
DATE OF ELECTION )1 TIME LAST VOTER VOTED _

COUNTY /MUNICIPAL!
VOTERS IN PRECINCT

Before Polls Open Before Polls Open After Polls Close
'ff
DRE UNIT NUll,'IBER
I :z_ :g q
SEAL NUMBER
06 I 33.{; ~
COUNT NUMBER
0
COllNT N~BER
'3321
,12-[?6
1//0f'S ~t: ~1ii-6
i/6':)4--z_
/ '2-5 7/
1/ 5' 3 0 t-i-
7- ~~iii?#
di 336 2-
I lo ,3
I I ooo Cf ,x,/ 337tc:

I li-- 3 '1 i.,c 9_
tzf l'tJ ff
i"'
18
;s¥ :;-~
12--S~,3
06/ s s4-o
o/2/338'.S: I
q

ExpressPoll (Sea ExpressPoll Recap} Supplemental Total Voter's Certificates
Democratic Primary ./ Democratic Primary---,,L-+-- Democratic Primary_-r':..___
7
Republican-,Primary __ _ Republican Primary_~~-- Republican Primary~-~--
General/Special ---11,cl/'lo~l~-- General/Special General/Special . .,J_3,.,
, 3;;.Z)I---
Total (a) ~l~l~(-o~I _ Total (b) ~I-"-'--- Total (c) ~1_3~3=:~ 3 --

1. Results Tapes (or Accumulator Tape Results) (Total from Section B above) = ll
{olf
2. ''Voters Marked" {See ExpressPo11 Recap) I I Ip l + Supplemental List O =~ l l~\~n,_(__
:i Numbered Lists on Express Poll {a) IQ + Supplemental (b) t) = ~-.{"7~--
)
4. Voter's Certificates (c) = I ':/f/i
NOTE: Numbers from D1, D2, D3, and D4 should match. If not, explain difference here: I :5Sl\c::"S W f e-J.- .Pff'S 5,
\?Dl\s sh1~.Jt,,1el Glo&rl, 10~;09 spnc cg1nl<::bOY\, /VJ\lV\"'Q ,Si.,_,_, }-M1:2,hj
the=
\A-'• _)
We, the undersigned Managers, hereby certify that the above is a true and correct accounting on this
day of '/)f<.([l:he,f ,2 0/1 .SIGNEDINTRIPLICATE
M~ ""'"'"' M,o,go, ..,.

=,,. =m"M-',o=,cc,,cc,-------
MARKS DECLARATION
Forn1 RS-DRE-10
E
X
H
I
B
I
T
MARKS DECLARATION
MARKS DECLARATION
MARKS DECLARATION
E
X
H
I
B
I
T
MARKS DECLARATION
MARKS DECLARATION
DECLARATION OF LAURIE ADERHOLT MITCHELL


ATLANTA DIVISION
)
)
Plaintiff, )
) CIVIL ACTION FILE NO.: 1:17-cv
vs. ) 2989-AT
)
)
Defendant. )
)
------------ )
DECLARATION OF LAURIE ADERHOLT MITCHELL
LAURIE ADERHOLT MITCHELL hereby declares as follows:
1. I am have been a Georgia voter since 2015 and am currently
registered to vote at 408 E. Wesley Road NE, Atlanta, GA 30305. I
have been continuously registered to vote at this address since June
20, 2015.
2. I have not made changes to my voter registration while living at this
address.
3. I reside with my husband Mark Mitchell, who is also registered to
vote at the above address, and has been continuously registered at this
address since February 10, 2014.
MITCHELL DECLARATION
remained at Precinct 07F with the same polling location at St. Philip's
Cathedral. (Exhibit C)
11. I reviewed both my husband's and my registration information on My
Voter Page and noted that I am assigned to City Council District 8,
while he is assigned to City Council District 7, although the City
Council District maps appear to show that we live in District 7.
12. I plan to vote in the November 2018 election and am concerned that
I may be given an inaccurate ballot, or that my name may not be
found in the pollbook, or that I will be otherwise disenfranchised.
13.After reading of reports of widespread errors in the pollbooks, I am
also concerned about the impact of such discrepancies on the election
as a whole, and the impact of widespread errors on voter confidence
and voter turnout.
Executed on this date, July 30, 2018. ,1A'p,1/I }

~~ J'akJ{IJ!/
Laurie Aderholt Mitchell
E
X
H
I
B
I
T
A
A TTENTl0N: This is your NEW Voter Registration Precinct Card. It replaces any other Voter
Cardyou currentlyhave in your possession.Keep for your records.
(Cut or fold on the dottedlinefor wallet card)
---------- - ---- - - -- ------ ----------------
YOUR NEW RESIDENCE ADDRESS WITHIN
If you change your address within the COUNTY (PleasePrint)
county, complete this form and mail to
the return address on the front of this
Nu mber Street Apartment
card .
Note: Change of addressmustbe
City Zip Code
submittedat.feast30-dayspreceeding
any election.
If you move to another county or if ~----------------------
.,
I
"O
Ma iliag Add ress (If different)
there is a change in your,J~gal name, 0
u..
you must complete a .ne.wvoter Z ip Code
registration application in order ,to
remain qualified to vote.
Dayt11ne Tele phone Date
This card may not be used as evidenceto
prove United States Citizenshipor as
identificationto vote. (ref.1996 UnitedStates VOTER'S SIGNATURE
Public Law 104-99)
Visit our website@ www.mvp.sos.ga.gov/MVP, download the GA Votes

app or contact your local registrar's p_ffu;e.
For Android
E
X
H
I
B
I
T
B
7/29/2018 Georgia MyFiled
Case 1:17-cv-02989-AT Document 258-1 Voter Page
08/03/18 Page 293 of 369
Corporations Elections News Room Professional Licensing Boards Securities Charities
My Voter Page
Voter Information Polling Place for State, County, and Municipal Elections
LAURIE ADERHOLT MITCHELL Precinct 08H

408 WESLEY RD NW SUTTON MIDDLE SCHOOL
ATLANTA, GA, 30305 2875 NORTHSIDE DRIVE NW
Race: White not of Hispanic Origin ATLANTA, GA, 30305 - 0000
Gender: Female Status: Active Election Day polling place hours are 7:00 am - 7:00 pm.
Registration Date: 06/20/2015
Absentee Ballot Request Information Your Elected Officials
If you prefer to vote off-site, mail or fax your absentee Candidates Elected: Officials Elected Statewide
District Maps: Congressional District Maps
ballot application to your county registrar.
U.S. Congress: District 005
Click Here for an Absentee Ballot Application Georgia Senate: District 039
Click here for Absentee Ballot status Georgia House: District 054
Click Here for Qualified Candidates
Check your Provisional Ballot Status
Please Note: Polling places are subject to change. Always check your designated polling place location via this website prior to going to vote.
Newly Registered Voters: Please review your registration date which is located under your name and address above. You must be registered on or
before the established deadlines to vote in upcoming elections. Please view the current election calendar to confirm the first election in which you will
be eligible to vote.
Print / Email Precinct Card Back
Home | GA.gov Home
https://www.mvp.sos.ga.gov/MVP/voterDetails.do 1/1
E
X
H
I
B
I
T
C
7/29/2018 Georgia MyFiled
Case 1:17-cv-02989-AT Document 258-1 Voter Page
08/03/18 Page 295 of 369
Corporations Elections News Room Professional Licensing Boards Securities Charities
My Voter Page
Voter Information Polling Place for State, County, and Municipal Elections
MARK ALEXANDER MITCHELL Precinct 07F

408 E WESLEY RD NE CATHEDRAL OF SAINT PHILIP
ATLANTA, GA, 30305 2744 PEACHTREE RD NW
Race: White not of Hispanic Origin ATLANTA, GA, 30305 - 2937
Gender: Male Status: Active Election Day polling place hours are 7:00 am - 7:00 pm.
Registration Date: 02/10/2014
Absentee Ballot Request Information Your Elected Officials
If you prefer to vote off-site, mail or fax your absentee Candidates Elected: Officials Elected Statewide
District Maps: Congressional District Maps
ballot application to your county registrar.
U.S. Congress: District 005
Click Here for an Absentee Ballot Application Georgia Senate: District 039
Click here for Absentee Ballot status Georgia House: District 054
Click Here for Qualified Candidates
Check your Provisional Ballot Status
Please Note: Polling places are subject to change. Always check your designated polling place location via this website prior to going to vote.
Newly Registered Voters: Please review your registration date which is located under your name and address above. You must be registered on or
before the established deadlines to vote in upcoming elections. Please view the current election calendar to confirm the first election in which you will
be eligible to vote.
Print / Email Precinct Card Back
Home | GA.gov Home
https://www.mvp.sos.ga.gov/MVP/voterDetails.do 1/1
DECLARATION OF REBECCA WILSON

WILSON DECLARATION
WILSON DECLARATION
WILSON DECLARATION
WILSON DECLARATION
E
X
H
I
B
I
T
A
E
X
H
I
B
I
T
B
E
X
H
I
B
I
T
C
E
X
H
I
B
I
T
D
E
X
H
I
B
I
T
E
Wait times, A rrival to Check-in at E-Pollbook

NOVEMBER 6, 2012 PRESI DENTIA L GENERA L ELECTI ON
Prince George’s County, MD Precinct 17-01 Mt. Rainier Elementary S chool
Chief judges were instructed to report wait times Arrival Check-in Wait time
longer than 90 minutes to the county board of Time Time (mins)
elections. No directions were provided for how to
7:00 AM 8:30 AM 90
assess wait times other than informal estimates. We
decided to gather the data in a more precise way. 7:05 AM 8:34 AM 89
7:15 AM 8:35 AM 80
Data collection method 7:20 AM 8:45 AM 85
Arriving voters were periodically handed slips of paper 7:25 AM 8:46 AM 81
with their arrival time written on it and instructed 7:40 AM 9:05 AM 85
to give it to the election judge at check-in. Check-in 7:45 AM 9:07 AM 82
judges wrote the current time on the paper and gave
8:11 AM 9:52 AM 101
it to chief judges. After check-in they usually had
to wait an additional 10 to 20 minutes for a DRE to 8:20 AM 10:05 AM 105
become available but we did not fornally gather that 11:10 AM 12:25 PM 75
data. 12:00 PM 1:05 PM 65
1:15 PM 2:00 PM 45
TURNOUT 1:30 PM 2:20 PM 50
51% of voters registered in this precinct (1582 of 1:45 PM 2:30 PM 45
3112) voted on DREs on election day.
2:00 PM 2:45 PM 45
BALLOT LENGTH 2:30 PM 3:10 PM 40
The ballot contained 21 contests, including 7 state 3:00 PM 3:30 PM 30
ballot questions and 7 county ballot questions. 3:30 PM 3:50 PM 20
4:00 PM 4:35 PM 35
EQUIPMENT 5:17 PM 6:02 PM 45
Thirteen DREs were deployed in this precinct. One
5:55 PM 6:35 PM 40
had to be removed from use at approximately 2:45pm
because of calibration problems with the touchscreen. 7:23 PM 7:35 PM 12
2 HOURS
552 VOTE D ON DREs 372 VOTE D ON DREs
477 VOTE D ON DREs 181 VOTE D
ON DREs
90
minutes
NOTE:
Wait time data
were not gathered
during this period
1 HOUR of heaviest turnout
because election
judges were too
busy managing the
complex queue,
30 formed of two
minutes intersecting loops
so that all voters
could wait indoors
in the hallway.
7:00 8:00 9:00 10:00 11:00 12:00 1:00 2:00 3:00 4:00 5:00 6:00 7:00 8:00
AM AM AM AM AM PM PM PM PM PM PM PM PM PM

ATLANTA DIVISION

Plaintiffs,
v.
BRIAN KEMP, ET AL.,

Defendants.
[PROPOSED] ORDER GRANTING

COALITION PLAINTIFFS’ MOTION FOR PRELIMINARY INJUNCTION
This matter is before the Court on the Motion for Preliminary Injunction of
Plaintiffs Coalition for Good Governance, William Digges III, Laura Digges,
Megan Missett, and Ricardo Davis (the “Coalition Plaintiffs”).
Upon considering the motion and supporting authorities, the response from
the Defendants, and the evidence and pleadings of record, the Court finds that
Plaintiffs are likely to succeed on the merits of their claims, that they will be
irreparably harmed if this motion is not granted, that the balance of equities tip in
Plaintiffs’ favor, and that an injunction is in the public interest. See Winter v. Nat.
Res. Def. Council, Inc., 555 U.S. 7, 20 (2008). The Court accordingly GRANTS
the motion and issues the relief set forth below.
THEREFORE, Defendants are HEREBY:

1. Enjoined from conducting the November 2018 general election and the
related December 2018 runoff election through the use of direct
recording electronic (DRE) voting units for in-person voting;
2. Enjoined to conduct both such elections using paper ballots;
3. Provided, however, that Defendants shall make available at each polling
place at least one voting system equipped for individuals with disabilities
that produces a permanent paper record, see 52 U.S.C. § 21081(a)(2)(B)
and § 21081(a)(3)(B), which may not be a paperless DRE voting unit
unless no other equipment equipped for individuals with disabilities is
reasonably available that satisfies the requirement to have a manual audit
capacity.
4. IT IS FURTHER ORDERED that the Defendant State Election Board
Members shall promulgate rules requiring and specifying appropriate
procedures for conducting pre-certification audits of the results of both
such elections.
5. IT IS FURTHER ORDERED that the Defendant Secretary of State shall,
before October 1, 2018, conduct an audit of, and correct any identified
errors in, the DRE system’s electronic pollbook data that will be used in
both such elections.
PAGE 2
[PROPOSED] ORDER GRANTING PLAINTIFFS’ MOTION

_________, 2018
Done in Chambers this ____ day of ________, 2018.
___________________________________
U.S. District Court Judge Amy Totenberg
PAGE 3

_________, 2018
This is to certify that I have this day caused the foregoing [PROPOSED]
ORDER GRANTING COALITION PLAINTIFFS’ MOTION FOR
PRELIMINARY INJUNCTION to be served upon all other parties in this action
by via electronic delivery using the PACER-ECF system.
/s/ Bruce P. Brown

Bruce P. Brown
Good Governance
Suite 6
(404) 881-0700
PAGE 4

_________, 2018

Coalition Plaintiffs' Motion For Preliminary Injunction

Uploaded by

Copyright:

Available Formats

Coalition Plaintiffs' Motion For Preliminary Injunction

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Coalition Plaintiffs' Motion For Preliminary Injunction

Uploaded by

Copyright:

Available Formats

What is the purpose of the motion?

What is the purpose of the motion?

What relief is being requested from the court?

What relief is being requested from the court?

Case 1:17-cv-02989-AT Document 258 Filed 08/03/18 Page 1 of 5

IN THE UNITED STATES DISTRICT COURT

DONNA CURLING, ET AL.,

BRIAN KEMP, ET AL.,