Iowa Supreme Court rules Linn County auditor’s complaint over election data security can proceed

Linn County Auditor Joel Miller may proceed with a lawsuit against the Iowa Voter Registration Commission alleging the Iowa Secretary of State’s Office has not adequately safeguarded the state's voter registration database, the Iowa Supreme Court ruled.

The Iowa Supreme Court on Friday reversed a district court order denying a petition by Miller for judicial review of the Iowa Voter Registration Commission’s 2020 decision to dismiss his allegations that Iowa Secretary of State Paul Pate's office had fallen short of federal election security requirements.

The court remanded the case back to the district court for further proceedings on Miller’s complaint.

Miller's attorney, James Larew, argued the commission wrongly denied the county auditor a contested case hearing to present evidence whether lists of Iowa voters are secure, properly maintained and in compliance with federal guidelines.

An assistant Iowa attorney general representing the commission argued Miller lacked standing and that his complaint against Pate was properly reviewed before its dismissal.

The commission

The Voter Registration Commission voted 2-1 in January 2020 to reject Miller's complaint, stating the complaint “leads to speculation as opposed to fact,” and that the Linn County auditor had not identified an example of a successful hack.

During a December 2019 hearing before the commission, both Miller and an attorney for Pate acknowledged they were not aware of any past security breach of I-Voters, according to court records.

Pate, in moving to dismiss the complaint, argued Miller had failed to give a specific example that his office failed to comply with the federal Help America Vote Act, or HAVA, which mandates state and local election officials provide “adequate technological security measures.”

However, Iowa Supreme Court justices ruled the commission’s decision to dismiss the complaint in 2020 did not properly resolve factual questions without the presentation of evidence. It also unanimously ruled that Miller has standing as Linn County's commissioner of elections to pursue his yearslong complaint of threats to the state's voter registration system.

In the 2022 election, Miller, a Democrat, and Pate, a Republican, ran for secretary of state, with Pate winning about 60 percent of the vote. Miller later changed his voter registration to no party.

Miller said he initiated his complaint after Pate's office did not adequately respond to requests for information on the I-Voters database. Among his concerns were the absence of a two-step process for transferring voter records between counties and errors with the state's list of felons ineligible to vote.

  Buy Photo

‘Robust cybersecurity’

Pate contends his office has instituted “robust cybersecurity measures” to protect the I-Voters database.

Ashley Hunt Esquivel, communications director for the Iowa Secretary of State’s Office, said it has implemented a “defense in depth” approach to protect iVoters, utilizing multiple layers of security controls — including physical, technical and administrative controls.

She said the office also has employed advanced threat intelligence and monitoring, conducted penetration tests and invited security researchers to identify vulnerabilities.

It also uses tools such as the Vote Shield program to monitor for anomalies in voter registration patterns.

“And every county auditors have access to these programs,” Esquivel said.

The office also has required all county auditor's offices to implement security measures, such as end-point detection on all devices accessing the internet and the use of software that monitors 24/7 for any intrusion, virus or ransomware that tries to infiltrate county networks.

The office has an incident response plan, conducts physical security assessments of county election offices and conducts regional tabletop exercises to test the incident response plan. The Secretary of State’s Office also conducts phishing assessment on county auditor employees, Esquivel said.

Pate's office did rebuild the state's felon database, after news reports in late 2019 determined the list previously included more than two dozen eligible voters with misdemeanor convictions, plus former felons whose voting rights had been restored.

“I want to assure Iowa voters, first and foremost, that our election systems are secure,” Pate said in a statement to The Gazette. “There are numerous safeguards and cybersecurity measures in place that protect our I-Voters database.

“With the rapid development of technology and rise in cyberattacks, we have significantly matured our cybersecurity posture around all of our elections systems, including I-Voters, in the years since 2019.”

Pate said his primary focus continues to be administering safe and secure elections and protecting Iowa election integrity.

“As technology continues to evolve, we are committed to further enhancing our cybersecurity posture to ensure the highest level of protection,” he said.

Miller: Still valid

Miller, speaking to The Gazette on Thursday, contends his complaint still is valid as the state still uses the same voter registration system, which was implemented in 2005.

He maintains the I-Voters system is old and potentially vulnerable to hackers, and notes the Secretary of State’s Office solicited information from qualified vendors in March 2020 for a potential new voter registration system software and services.

“The fact they still have the same system in place, and have had for 20 years, is an indication that not much has changed,” Miller said. “The software wasn’t created with security in mind. … They didn’t replace the whole software system that’s being used. And, if they did, why did they propose a new system?”

Miller said he intends to request and review documents from the Secretary of State’s Office related to its purported plans to replace I-Voters, “and I suspect documents they provide will confirm my concerns were valid.”

Pate’s office said is has been working with county auditors since 2020 on the implementation of a new voter registration and election management system as part of an ongoing administrative process.

“Throughout the process, auditors have provided their input and reviewed each of the requirements for the new system,” Esquivel said. “They have worked closely with us to evaluate and we ultimately awarded the project to Civix. County auditors will test and evaluate the new system as it is being developed and deployed.”

Miller said the court’s ruling is a win for the public, “by reaffirming that complaints related to voter registration and our voter registration infrastructure can be made by any person, who will receive a fair hearing in a timely manner.”

Comments: (319) 398-8499; tom.barton@thegazette.com