Colorado Secretary of State Jena Griswold Left Voting System Passwords Exposed Online for Months, Only Acted to Change Some Passwords After GOP Exposed the Security Risk
In a serious breach of election security, Colorado Secretary of State Jena Griswold’s office left voting system passwords publicly accessible on the state’s website for several months.
Despite discovering the exposure on October 24, Griswold’s team only began to change the leaked passwords after the Colorado GOP brought the issue to light.
WATCH:
Colorado Secretary of State Jena Griswold (D) knew her office had left voting system passwords exposed online but did not change the passwords until the Colorado GOP told the public about the security threat. @marshall9news reports for @nexton9news. #copolitics pic.twitter.com/oD48FqGu5J
— Kyle Clark (@KyleClark) October 31, 2024
For months, passwords necessary to access Colorado’s voting systems in 63 out of the state’s 64 counties were available on a hidden tab of a spreadsheet on the Secretary of State’s website.
The exposed information included one of the two passwords required to modify each county’s voting machine configurations, with data listed by serial number, model, and county.
While this alone ‘may not provide full access,’ security experts have expressed concern that even partial passwords should never have been made public.
Griswold’s office did not notify local election officials until the GOP exposed the security risk, underscoring a major lapse in transparency. A spokesperson from her office later stated that federal agencies, including the Cybersecurity and Infrastructure Security Agency (CISA), were informed promptly and that an internal investigation was underway.
During an interview with 9News’ Kyle Clark, Griswold did not answer if the incident would be investigated by their office or if it involved a third party.
Kyle Clark: Is your office solely responsible for investigating this, or is there an outside agency involved?
Jena Griswold: This is a straightforward case of a civil servant uploading a spreadsheet with some passwords. Two sets of passwords are required for access, and we notified CISA immediately.
At the same interview, Clark turned to Griswold’s apparent double standard and reminded her of her previous statement, where she labeled the unauthorized release of any voting system password as a serious breach.
He noted her office’s firm stance in 2021 during a similar incident involving Tina Peters, who faced severe legal consequences for accessing voting systems in her attempt to safeguard election integrity.
Kyle Clark: You frequently warn of insider threats to elections. The U.S. Department of Homeland Security defines an insider threat as someone who uses authorized access, wittingly or unwittingly, to do harm. Did the actions of your office constitute an insider threat?
Jena Griswold: No.
Kyle Clark: Why do you say that?
Jena Griswold: For several reasons. First, this does not pose an immediate security threat to Colorado’s elections. Colorado has multiple layers of security. There are two unique passwords held by different parties to access voting equipment, and physical access is also required. These passwords must be used in person. Under Colorado law, we have secure rooms, restricted access, and 24/7 video recording of all election equipment. Additionally, we use paper ballots and conduct risk-limiting audits. Our elections are some of the most secure in the nation, and many of these security measures have been enhanced since 2021.
Kyle Clark: In 2021, when Mesa County’s voting system passwords leaked, your office stated that the disclosure of BIOS passwords alone constituted a serious breach. By that standard, did your office commit a serious breach of security protocols?
Jena Griswold: No. The situation in Mesa County was distinct. Tina Peters was just convicted, and we were actively investigating a broader breach in Mesa County.
Kyle Clark: But your office said the public disclosure of BIOS passwords alone constituted a serious breach. Now that your office has leaked passwords, does that constitute a serious breach?
Jena Griswold: The statement was part of a broader press release. The situation with Mesa County involved two sets of unauthorized passwords and a larger security breach. Our security measures have improved since then, with 24/7 surveillance and access badges.
Kyle Clark: The wording used by your office was that passwords alone constituted the breach. What have you done to determine whether those passwords were used by an unauthorized person?
Jena Griswold: We began an investigation immediately and have no reason to believe there are any breaches. Federal partners are assisting, and we are examining access logs and chain-of-custody records.
Kyle Clark: In 2021, you ordered Mesa County to stop using machines for which passwords were leaked. Why no similar order now?
Jena Griswold: In Mesa County, both passwords were used, and unauthorized access occurred. With our improved security measures, we have no evidence of a similar situation here.
The public outcry led Governor Jared Polis to release a statement saying he had been briefed on the incident, initially claiming that “all passwords have been changed.” When informed by 9NEWS that this was incorrect, Polis’s office issued a revised statement that removed the claim but failed to explain the initial inaccuracy.
A spokesperson for @GovofCO Polis said he’d been briefed on election security and was assured all the leaked passwords had been changed. When 9NEWS informed Polis’ office that some leaked passwords are still in use, his office sent a statement with that sentence removed.
— Kyle Clark (@KyleClark) October 31, 2024
Former Colorado Secretary of State Wayne Williams believes this oversight deserves more than just a simple password reset.
“We need to have an inspection occur of each of the machines that the passwords were potentially disclosed,” Williams said.
Related story:
You can email Jim Hᴏft here, and read more of Jim Hᴏft's articles here.