Following the leak of partial passwords online, Secretary of State Jena Griswold said in a statement on Tuesday that the error does not pose an immediate security threat to the upcoming election. Gunnison County has two pieces of equipment that were included in the leak, but both are back-up devices that haven’t been used in years and are not currently in use for the coming election, said Gunnison County Elections Director Michael Metcalf.
The Gunnison County Clerk and Recorder’s Office keeps those devices updated for elections in the event they’re needed to replace a failed device, he said. The office is now coordinating with the Colorado Secretary of State’s Office to have them come on-site and update passwords for those two pieces of equipment.
“We're not worried about it,” said Gunnison County Clerk and Recorder Kathy Simillion. “Everybody's vote is safe and secure.”
In June, the Secretary of State’s Office, led by Griswold, unintentionally posted Colorado voting equipment passwords to its public-facing website. State officials were alerted of a spreadsheet, which contained the passwords in a hidden tab, on Oct. 24 and took immediate action to address the situation. Election officials also informed the U.S. Cybersecurity and Infrastructure Security Agency of the leak. The Colorado Republican Party informed the Gunnison County Clerk’s office of the breach on the afternoon of Oct. 29, Simillion said.
According to the Colorado County Clerks Association, these BIOS (basic input/output system) passwords allow access to the underlying software of a computer. The county’s current tabulation equipment was last updated at the end of 2023, so those passwords were not included in the file that was found on the Secretary of State’s website. The county’s machines are also not connected to the internet, Simillion said. This means that in order to use leaked passwords, an individual would have to be sitting at the tabulation machine computer, and know how to use it.
The leaked BIOS passwords are just one of two sets of passwords needed to access any part of the voting system, Metcalf said. The leaked ones belong to the state, but the secure ones — which allow one to use the computer as a normal workstation — remain with local clerk’s offices. All of the county employees that have access to the voting equipment have had background checks.
“Think of it as a deadbolt and a lock on the door,” Metcalf said. “One person has a key for the dead bolt. That's the state with the BIOS passwords. One person has a key for the lock. That's us here locally … We don't know theirs. They don't know ours.”
In Gunnison County, tabulation machines sit behind three locked doors and a safe, Metcalf said. The Blackstock Building, which contains the clerk’s office, is under 24/7 video surveillance from six cameras that include night vision and motion sensors. Security protocols include law enforcement being notified immediately in the case someone broke through the front door. And, anyone wishing to access the machines would have to get past stationed election judges.
“This is something that with our security requirements would be extremely difficult to achieve, and due to the monitoring and alerts we have set up, we would be notified within a few seconds of any movement within our area,” he said.
Following the incident, the Colorado House Republicans called for Griswold’s resignation.
“While I have the utmost trust in the integrity of our county clerks, who actually oversee the counting of votes, I have no trust that Secretary Griswold is capable of leading our election system,” Minority Leader Rose Pugliese said in an Oct. 30 press release. “Enough of her incompetence; it is time for her to resign. The people of Colorado deserve better.”
The Secretary of State’s Office is sending out teams to update older machines across the state, which could be impacted by the leaked passwords, Metcalf said.
For more information on the breach, visit the Colorado County Clerks Association website at clerkandrecorder.org/frequently-asked-questions.
(The Gunnison Country Times can be contacted at 970.641.1414.)
Comments
No comments on this item Please log in to comment by clicking here