Kelly Owen/Zuma
A little more than a week ago, the Department of Homeland Security confirmed that it was going to forensically analyze computer equipment associated with part of the 2016 elections in North Carolina in association with questions about Russian hacking. The news prompted an information security researcher to announce that he’d found evidence of other election security issues in North Carolina last fall, which he’d kept quiet until now.
Chris Vickery, the director of cyber-risk research at UpGuard, a cybersecurity services firm, tweeted June 7 that he had found an unlocked online repository that contained what he said were passwords for touchscreen voting machines. The repository, he said, also contained other information, including serial numbers for machines that had modems, which theoretically could have allowed them to connect to the internet.
Vickery said that after he found the open repository in September 2018, he immediately told state officials, who locked the file. State officials have told Mother Jones that the passwords were nearly 10 years old and encrypted—a claim disputed by Vickery and a Democratic technology consultant in North Carolina—but admitted that the file shouldn’t have been publicly available online.
In a statement provided to Mother Jones, State Board of Elections spokesperson Patrick Gannon said the passwords were encrypted and only applied to machines from one county that used them in 2010. Any suggestion that the passwords’ discovery in an open online repository posed a danger to elections was “false and irresponsible,” he said. Even if an attacker could have decrypted the passwords, the passwords would’ve been changed before the 2011 elections and every subsequent election, and “there is no way they could have been used to affect any election.”
But others disagree. Matt Bernhard, an election security expert at the University of Michigan, acknowledged that the passwords would have had limited use for anyone wanting them for ill purposes, given that they seem to apply to individual voting machines. But, he said, the fact that they were publicly accessible reflects a lack of election security protocols that has plagued election officials over the years.
“I think, really, it’s catastrophically dumb…profoundly stupid that they were online at all,” Bernhard told Mother Jones. “In the space of problems with North Carolina’s elections, this is fairly far down on the totem pole.” He noted that what’s important about the suspected breach was that “this is not a North Carolina-specific problem. It’s generally reflective of just a lack of security posture of election officials at all levels. Hopefully this is a good teachable moment for all of them.”
Vickery said last week that he shared what he had found in light of the Department of Homeland Security telling the Washington Post June 5 that it was conducting a forensic analysis of laptops used in Durham County, North Carolina, during the 2016 election. The laptops in that case are associated with what are known as poll books, which are devices used by local election workers to check voters in when they show up to cast their ballots. Problems with the poll books manufactured by Florida-based VR Systems led to significant delays in Durham County, and forced some voters to leave without casting a ballot.
In 2016, VR Systems believes it was targeted by the Russians (but denies it was hacked), and senators Ron Wyden (D-Ore.) and Amy Klobuchar (D-Minn.) have asked the FBI to respond to questions about what happened at that time. Wyden, who serves on the Senate Intelligence Committee, and Klobuchar, who is the ranking member of the Senate Rules Committee, which has oversight of federal elections, have both taken an interest in election security.
Vickery’s find relates to an entirely different kind of voting technology. The passwords he found were for iVotronic touchscreen voting machines manufactured by Omaha-based Election Systems & Software, one of the country’s largest voting equipment vendors. Vickery said he found the passwords in an open State Board of Elections folder on an Amazon server, accessible to anyone who came across it.
“Immediately I understood the importance of it,” he told Mother Jones. He then confidentially got in touch with state election officials who closed access to the file and took it offline. The officials told him the passwords were old and had been changed years ago. Vickery said the most recent file in the folder had been uploaded in 2016.
State elections officials “immediately removed the outdated and encrypted password information” when Vickery notified them, Gannon wrote to Mother Jones in response to questions. The board has “taken steps to try to prevent similar information—even if it is harmless—from being posted to the website in the future.” Gannon added that “legitimate concerns about cybersecurity must be addressed,” even while “erroneous, misleading and politically charged attacks on the State Board and its employees unnecessarily decrease voters’ confidence in elections, which may decrease voter turnout, while taking resources away from important issues.”
Charlie Collicutt, director of the Board of Elections in Guilford County, North Carolina, explained that the passwords applied to a subset of iVotronic voting machines in Guilford County. He’s not sure why the file was uploaded to a publicly accessible folder, but reiterated that the passwords were changed after 2010. The passwords were “ciphered” somehow—with letters or symbols systematically changed to other letters and symbols—and there there might be confusion around referring to them as encrypted. Either way, he said, “This file was a one-off that was posted years” after the passwords within it applied to the machines.
