Iowa Supreme Court Rules Linn County Auditor’s Election Data Security Complaint Can Proceed

Linn County Auditor Joel Miller may file a lawsuit against the Iowa Voter Registration Commission, alleging the Iowa Secretary of State’s office failed to properly protect the state’s voter registration database, the Iowa Supreme Court ruled.

The Iowa Supreme Court on Friday vacated a district court order denying a motion by Miller for judicial review of the Iowa Voter Registration Commission’s 2020 decision to reject his claims that the office by Iowa Secretary of State Paul Pate had failed to meet federal election security requirements.

The court remanded the case to the district court for further proceedings regarding Miller’s complaint.

Miller’s attorney, James Larew, argued the commission improperly denied the county auditor a contested hearing to present evidence whether Iowa’s voter rolls were secure, properly maintained and compliant with federal guidelines.

An assistant Iowa attorney general representing the commission argued that Miller lacked standing and that his complaint against Pate was properly investigated before it was dismissed.

The commission

The Voter Registration Commission voted 2-1 in January 2020 to dismiss Miller’s complaint, stating that the complaint “leads to speculation rather than facts” and that the Linn County auditor had not identified no examples of successful hacking.

During a December 2019 hearing before the commission, Miller and an attorney for Pate acknowledged they were unaware of any past security violations of I-Voters, according to court records.

Pate, in seeking dismissal of the complaint, argued that Miller did not give a specific example that his office failed to comply with the federal Help America Vote Act, or HAVA, which requires state election officials and premises to provide “adequate technological security measures”.

However, Iowa Supreme Court justices ruled that the commission’s decision to dismiss the complaint in 2020 did not properly resolve factual questions without the presentation of evidence. It also ruled unanimously that Miller could become Linn County elections commissioner to pursue his years-old complaint about threats to the state’s voter registration system.

In the 2022 election, Miller, a Democrat, and Pate, a Republican, ran for secretary of state, with Pate winning about 60% of the vote. Miller later changed his voter registration to no party.

Why this complaint?

Miller said he filed his complaint after Pate’s office failed to adequately respond to requests for information about the I-Voters database. Among his concerns were the lack of a two-step process for transferring voter records between counties and errors in the state’s list of felons ineligible to vote.

Pate says his office has instituted “robust cybersecurity measures” to protect the I-Voters database, but did not elaborate. Pate’s office did not immediately respond Thursday afternoon to follow-up questions emailed by The Gazette.

Pate’s office rebuilt the state’s felons database, after news reports in late 2019 determined that the list previously included more than two dozen eligible voters with misdemeanor convictions, as well as former felons including the right to vote had been restored.

“Above all, I want to assure Iowa voters that our election systems are secure,” Pate said in a statement to The Gazette. “There are numerous safeguards and cybersecurity measures in place to protect our I-Voters database.

“With the rapid development of technology and increase in cyberattacks, we have significantly refined our cybersecurity posture around all of our election systems, including I-Voters, in the years since 2019.”

Pate said his primary goal continues to be administering safe and secure elections and protecting Iowa’s election integrity.

“As technology continues to evolve, we are committed to further enhancing our cybersecurity posture to ensure the highest level of protection,” he said.

Miller: Still valid

Miller, speaking to The Gazette on Thursday, says his complaint is still valid since the state still uses the same voter registration system, which was implemented in 2005.

It maintains that the I-Voters system is old and potentially vulnerable to hackers, and notes that the Secretary of State’s office solicited information from qualified vendors in March 2020 for potential new software and services for the system voter registration.

“The fact that they still have the same system in place, and have for 20 years, is an indication that not much has changed,” Miller said. “The software was not created with security in mind. … They did not replace the entire software system used. And if they did, why did they come up with a new system?

Miller said he intends to request and review documents from the Secretary of State’s office relating to his alleged plans to replace I-Voters, “and I suspect that the documents they provide will confirm that My concerns were well-founded.

The state’s notice emphasized that the request for information was for planning purposes only and did not constitute a request for proposal, bidding opportunity, or commitment to the project. The status of the project to modernize or replace the state’s voter registration system was not immediately clear.

Miller said the court’s decision is a victory for the public, “reaffirming that complaints related to voter registration and our voter registration infrastructure can be filed by any person, who will benefit from a hearing fair and timely”.

Ccomments: (319) 398-8499; [email protected]