Georgia is still using Diebold Accuvote TSX touchscreen machines whose hardware and software date back to around 2005. In 2006 and 2007, security researchers discovered numerous security vulnerabilities in these machines—problems serious enough to cause California to decertify them from use in state elections.

The lack of care for security here is downright appealing. While I'm glad this is being addressed, I find it concerning that they were allowed to operate for over a decade after these vulnerabilities were revealed. Even worse they made no attempts to remedy the situation.

After one 2006 report, Totenberg writes, "Diebold was forced to create a security patch for the vulnerable TSX software." Yet incredibly, "there is no evidence that Georgia ever implemented the software patch or made any upgrades to protect the integrity of its DRE machines," Totenberg says.

The security problems found by those early researchers were serious. Not only can someone with physical access to the machine install vote-stealing malware, it's also possible to deliver such malware using viruses that spread from machine to machine on the memory cards election workers use to load ballot information onto them. Hence, a malicious actor with a few minutes' access to a single machine could potentially hack dozens or even hundreds of machines.

I don't know how the state of Georgia can justify their behavior here. It seems like their was negligence across the board. Even by the organization contracted to help them.

It gets worse. In 2016, a Georgia-based security researcher discovered that Kennesaw State University’s Center for Election Systems, which has a contract to help Georgia manage its elections, had a massive cache of sensitive election-related documents—including private voter data and passwords for election systems—publicly available on its website for anyone to download. After being notified of the breach, it took officials months to remove the sensitive information from the website.