New details: Election passwords posted online for more than 3 months
Nov 04, 2024
DENVER (KDVR) -- After partial passwords for voting systems were recently discovered posted on the Secretary of State’s website, an investigation found the passwords were posted in June.
The Department of State said a former staff member, who left "amicably" before the incident, created a spreadsheet containing passwords in a hidden tab - which was not part of their security practice.
This was posted online on June 21 and stayed on the Department’s subpage for voting system equipment until late October.
Former Colorado Secretary of State reacts to election systems password breach
"Colorado’s elections are safe and Coloradans will have their voices heard on Election Day. Our elections have many layers of security. Ensuring that Colorado’s elections are secure and accessible has been and will always be our top priority, which is why the Department of State, along with County Clerks and election workers across the state, address any and every potential risk to our elections with the utmost seriousness. I am regretful for this error. I am dedicated to making sure we address this matter fully and that mistakes of this nature never happen again."
Secretary of State Jena Griswold
Since this incident, the Secretary of State updated the passwords and verified the security of the voting machines.
Passwords posted on Secretary of State's website
The department said a voting machines vendor informed employees of the passwords on Oct. 24, which is when passwords were removed from the website. The department said it consulted with the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency and determined the data didn't pose an immediate security threat.
The next day, on Oct. 25, the department found that 34 of Colorado’s 64 counties were affected.
Days later, on Oct. 29, Colorado’s Republican party accused the Colorado Secretary of State’s Office of “quietly” removing a publicly accessible spreadsheet from the office’s website. However, the department said it didn't release the information because it still didn't understand the size and scope of the disclosure and didn't have a concrete plan for moving forward
Colorado Libertarian party files lawsuit against Secretary of State
The department said it finished identifying the disclosure and started updating the password on Oct. 29, and by Oct. 31, the passwords were updated and the voting systems were verified.
Since the passwords were discovered, former President Donald Trump demanded in a letter that the Secretary of State temporarily halt processing mail-in ballots in Colorado and the El Paso County Clerk and Recorder called for Griswold’s resignation.
Griswold said she wouldn't resign and the Secretary of State maintains that the posted passwords won’t impact how ballots are counted.
The department said it is working with a law firm on an outside investigation to determine how it happened, how it could be prevented and any recommendations for improvement. The department said it will require additional cybersecurity training with all staff, including password management and security procedures.