Iowa Supreme Court Rules Linn County Auditor’s Election Data Security Complaint Can Proceed

Linn County Auditor Joel Miller may file a lawsuit against the Iowa Voter Registration Commission, alleging the Iowa Secretary of State’s office failed to properly protect the state’s voter registration database, the Iowa Supreme Court ruled.

The Iowa Supreme Court on Friday vacated a district court order denying Miller’s petition for judicial review of the Iowa Voter Registration Commission’s 2020 decision to reject his claims that Iowa Secretary of State Paul Pate’s office had failed to meet federal election security requirements.

The court remanded the case to the district court for further proceedings regarding Miller’s complaint.

Miller’s attorney, James Larew, argued the commission improperly denied the county auditor a contested hearing to present evidence whether Iowa’s voter rolls were secure, properly maintained and compliant with federal guidelines.

An assistant Iowa attorney general representing the commission argued that Miller lacked standing and that his complaint against Pate was properly investigated before it was dismissed.

The commission

The Voter Registration Commission voted 2-1 in January 2020 to dismiss Miller’s complaint, stating that the complaint “leads to speculation rather than facts” and that the Linn County auditor had not identified no examples of successful hacking.

During a December 2019 hearing before the commission, Miller and an attorney for Pate acknowledged they were unaware of any past security violations of I-Voters, according to court records.

Pate, in seeking dismissal of the complaint, argued that Miller did not give a specific example that his office failed to comply with the federal Help America Vote Act, or HAVA, which requires state election officials and premises to provide “adequate technological security measures”.

However, Iowa Supreme Court justices ruled that the commission’s decision to dismiss the complaint in 2020 did not properly resolve factual questions without the presentation of evidence. It also ruled unanimously that Miller could become Linn County elections commissioner to pursue his years-old complaint about threats to the state’s voter registration system.

In the 2022 election, Miller, a Democrat, and Pate, a Republican, ran for secretary of state, with Pate winning about 60% of the vote. Miller later changed his voter registration to no party.

Miller said he filed his complaint after Pate’s office failed to adequately respond to requests for information about the I-Voters database. Among his concerns were the lack of a two-step process for transferring voter records between counties and errors in the state’s list of felons ineligible to vote.

“Robust Cybersecurity”

Pate says his office has instituted “robust cybersecurity measures” to protect the I-Voters database.

Ashley Hunt Esquivel, communications director for the Iowa Secretary of State’s office, said it has implemented a “defense in depth” approach to protecting iVoters, using multiple layers of security controls, including physical, technical and administrative.

She said the office also used advanced threat intelligence and monitoring, conducted penetration testing and invited security researchers to identify vulnerabilities.

It also uses tools such as the Vote Shield program to monitor anomalies in voter registration patterns.

“And all county auditors have access to these programs,” Esquivel said.

The office also required all county audit offices to implement security measures, such as endpoint detection on all devices accessing the Internet and the use of 24-hour monitoring software and 7 days a week. for any intrusion, viruses or ransomware attempting to infiltrate departmental networks.

The office has an incident response plan, conducts physical security assessments of county election offices, and conducts regional tabletop exercises to test the incident response plan. The secretary of state’s office also is conducting a phishing assessment against county auditor employees, Esquivel said.

Pate’s office rebuilt the state’s felons database, after news reports in late 2019 determined that the list previously included more than two dozen eligible voters with misdemeanor convictions, as well as former felons including the right to vote had been restored.

“Above all, I want to assure Iowa voters that our election systems are secure,” Pate said in a statement to The Gazette. “There are numerous safeguards and cybersecurity measures in place to protect our I-Voters database.

“With the rapid development of technology and increase in cyberattacks, we have significantly refined our cybersecurity posture around all of our election systems, including I-Voters, in the years since 2019.”

Pate said his primary goal continues to be administering safe and secure elections and protecting Iowa’s election integrity.

“As technology continues to evolve, we are committed to further enhancing our cybersecurity posture to ensure the highest level of protection,” he said.

Miller: Still valid

Miller, speaking to The Gazette on Thursday, says his complaint is still valid since the state still uses the same voter registration system, which was implemented in 2005.

It maintains that the I-Voters system is old and potentially vulnerable to hackers, and notes that the Secretary of State’s office solicited information from qualified vendors in March 2020 for potential new software and services for the system voter registration.

“The fact that they still have the same system in place, and have for 20 years, is an indication that not much has changed,” Miller said. “The software was not created with security in mind. … They did not replace the entire software system used. And if they did, why did they come up with a new system?

Miller said he intends to request and review documents from the Secretary of State’s office relating to his alleged plans to replace I-Voters, “and I suspect that the documents they provide will confirm that My concerns were well-founded.

Pate’s office said it has been working with county auditors since 2020 on implementing a new voter registration and election management system as part of an ongoing administrative process.

“Throughout the process, auditors provided input and reviewed each of the requirements of the new system,” Esquivel said. “They worked closely with us to evaluate and we ultimately awarded the project to Civix. County auditors will test and evaluate the new system as it is developed and deployed.

Miller said the court’s decision is a victory for the public, “reaffirming that complaints related to voter registration and our voter registration infrastructure can be filed by any person, who will benefit from a hearing fair and timely”.

Ccomments: (319) 398-8499; [email protected]