Minnesota Said “Show Us the Code.” Georgia Said “It’s a Secret.”

Minnesota courts have repeatedly ordered production of Intoxilyzer source code in DUI cases, recognizing that defendants have a constitutional right to challenge the reliability of the evidence used against them. When CMI (the manufacturer) resisted, the state itself took legal action to force disclosure. The result? Years of litigation, independent expert review, and—importantly—actual accountability for the technology that decides guilt or innocence.

Georgia has taken the opposite approach.

Instead of full, independent access, the state commissioned its own limited review through the Georgia Tech Research Institute (GTRI). Led by Senior Research Scientist Andrew Howard, the GTRI assessment focused on security vulnerabilities, code quality, and data handling—using tools like CppLint and FxCop for automated scans and manual inspections. It identified only minor issues, such as potential SQL injections, buffer overflows, and weak passwords, but deemed them non-critical under normal use.

The review, however, was conducted under strict limitations imposed by CMI. As the report itself states:

“CMI did not allow the source code or detailed notes pertaining to the source code to leave their facility. Given this limitation, this report only contains high-level observations from the source code review.”

Even more glaring is what the GTRI report ignored. It explicitly avoided the device’s core scientific functions, assuming “breath alcohol values returned by device infrared spectrometry were correct.” The authors openly admitted:

“the method and accuracy of the mathematical calculations regarding breath alcohol testing contained in the source code were not within the scope of this study. These calculations require review by experts in infrared spectrometry and breath alcohol.”

This omission is critical—those very IR algorithms and mathematical calculations are what produce the BrAC readings that prosecutors use to convict people in Georgia courtrooms every single day.

This state-funded, CMI-controlled evaluation introduces obvious potential bias. The government, which relies on the Intoxilyzer 9000 for thousands of DUI convictions, has every incentive to affirm the device’s reliability. Critics rightly argue that such government-commissioned reviews lack true independence—especially when defense experts are still completely denied similar access. Georgia courts have repeatedly denied motions to compel full source code disclosure, further tilting the scales in favor of the prosecution.

Should States Be Allowed to Keep Secrets in Criminal Prosecutions?

That is the question the article forces us to confront.

We do not allow the government to hide the inner workings of a radar gun, a drug-testing lab, or a DNA sequencer when those tools are used to take away someone’s liberty. Why is a breathalyzer different? When the state claims the power to brand you a criminal based on a machine’s output, the machine should not enjoy greater privacy rights than the accused citizen.

Secrecy breeds doubt. Doubt undermines public confidence in the justice system. And in DUI cases, that doubt is justified—history is littered with examples of breath-testing devices producing false positives due to software bugs, calibration errors, and operator mistakes. Minnesota’s willingness to litigate source-code access has led to greater scrutiny and, ultimately, better science. Georgia’s refusal has produced the opposite: a “trust us” system that leaves defendants—and the public—wondering what exactly the machine is really doing.