Voting machine password breach: Polis deploys teams to fix problem quickly
Oct 31, 2024
Colorado leaders scrambled to shore up security around the state’s election voting machine system following a leak of partial passwords, deploying public safety and information technology teams to change passwords by the end of the day.
Gov. Jared Polis announced the blitz on Thursday afternoon to deal with “this unfortunate leak,” a day after Trump campaign attorneys demanded that Colorado Secretary of State Jena Griswold take immediate action to secure the state’s elections.
On Tuesday, Griswold announced that a spreadsheet posted publicly on her office’s website for several months contained a hidden tab that led to partial passwords — one layer in a security system that relies on multiple passwords and restricted access — protecting Colorado voting machines.
“We want to resolve the current situation quickly by lending resources to help get the necessary passwords changed as quickly as possible with minimal impact on county clerk operations,” Polis said.
Griswold on Thursday hastily deputized state employees who have undergone background checks for deployment around the state. They were to enter restricted-access areas in pairs to update the passwords for election equipment in county offices with local employees observing.
County clerks secure voting machines behind locked doors. State public safety officials on Wednesday morning briefed Polis on the leak and he spoke with Griswold Wednesday afternoon, gubernatorial officials said. The teams deployed to counties include state public safety, homeland security, information technology, and Colorado State Patrol employees. Federal law enforcement officials also were involved.
“Colorado has countless layers of security to ensure voters’ voices are heard,” Griswold said in a prepared statement. “I’m thankful to the governor for his support to quickly resolve this unfortunate mistake.”
In a letter sent to Griswold on Wednesday, the attorneys for former President Donald Trump’s Republican campaign said the password disclosure violates state law and “undermines the integrity of our elections.” They asked that Griswold immediately identify counties affected by the security breach, notify them, direct them to stop processing mail-in ballots and prepare to re-scan all ballots.
“We recognize these steps may be an inconvenience for your office and for the affected counties. But this inconvenience is necessary because it is the only way to guarantee that the elections equipment in those counties whose current BIOS passwords were disclosed by your office are secure and that the chain of custody for that equipment required by Colorado law and regulations is unbroken,” said the letter from Scott Gessler, a Republican attorney with Gessler Blue LLC representing the Trump campaign. Gessler served as secretary of state from 2011 to 2014.
The letter asked that Griswold, a Democrat, confirm by 10 a.m. Thursday that “you will undertake these steps.” Secretary of State spokesman Jack Todd confirmed receipt of the letter but did not respond to Denver Post questions about whether officials had taken or would take the requested actions. State officials first learned of the breach Tuesday, and password changes began Tuesday, Todd said.
Related Articles
Election |
US voters hear a stark message in the presidential race: The country’s fate is on the line
Election |
Meat industry donates big to defeat Denver slaughterhouse ban, while sales tax campaigns build war chests
Election |
Ahead of the election, here’s what thousands of Coloradans told us matters most in their votes
Election |
Cash infusion hits RTD races in effort to boost pro-transit candidates
Election |
Money from across the country pours into Colorado’s fight over big cat hunting
State elections officials are investigating how state voting machine passwords ended up online. Griswold has said an employee who was involved no longer works for the state. State Republican Party officials first revealed the leak. A state news release Tuesday said the partial passwords were “improperly included” on the site.