Feds oppose immediate release of voting machine report

ATLANTA (AP) — A federal cybersecurity agency is reviewing a report that alleges security vulnerabilities in voting machines used by Georgia and other states and says the document shouldn't be made public until the agency has had time to assess and mitigate potential risks.

The report has been under seal since July in federal court in Atlanta, part of a long-running lawsuit challenging Georgia's voting machines. Its author, J. Alex Halderman, said in sworn declarations filed publicly with the court that he examined the Dominion Voting Systems machines for 12 weeks and identified “multiple severe security flaws" that would allow bad actors to install malicious software.

Plaintiffs in the case, who are election security advocates and individual voters, have for months called for the release of a redacted version of the report and urged that it be shared with state and federal election security officials. Lawyers for the state had repeatedly objected to those requests, but Secretary of State Brad Raffensperger last month put out a news release calling for its release.

U.S. District Judge Amy Totenberg agreed on Feb. 2 that the report could be shared with the U.S. Cybersecurity and Infrastructure Agency, or CISA. The agency said in a court filing Thursday that it would work with Halderman and Dominion to analyze potential vulnerabilities, develop any necessary mitigation measures and work with jurisdictions that use the machines to test and apply any protections.

CISA said it would complete its “coordinated vulnerability disclosure” process as quickly as possible, but urged the judge not to release the report before it's done, saying “premature disclosure of Dr. Halderman’s report, even in redacted form, could, in the event any vulnerabilities ultimately are identified, assist malicious actors and thereby undermine...