The office of Colorado’s secretary of state has said partial passwords for voting system components were mistakenly posted on its official website.
The passwords, accessible via a hidden tab in a publicly available spreadsheet, were removed on October 24 after the error was discovered. State officials emphasized that the incident was inadvertent, has been rectified, and has not affected the election process.
“This does not pose an immediate security threat to Colorado’s elections, nor will it impact how ballots are counted,” the Colorado Department of State said in a statement on Tuesday.
Election integrity has been a central concern in the lead-up to November 5, as former President Donald Trump continues to make unsupported claims that the 2020 election was stolen from him through widespread voter fraud. Last week, Colorado Secretary of State Jena Griswold said the state’s elections were secure after election staff discovered a dozen fraudulent mailed ballots during a signature verification process.
A stock photo of a voter putting a ballot envelope into a ballot drop box in Jefferson County, Colorado. The Colorado secretary of state announced on Tuesday that some voting system passwords in a spreadsheet had been accidentally posted on a government website.
Merrimon/Getty Images
According to a release from the Colorado Republican Party, the spreadsheet contained more than 600 partial BIOS passwords for voting system components across 63 of Colorado’s 64 counties.
BIOS (basic input/output systems) passwords are a core component of security control for a computer system, like a master key that controls access to the basic hardware settings of a computer. The passwords in question were neither encrypted nor otherwise protected.
Despite the exposure, state officials have said that multiple security layers safeguard the election process in the state. “There are two unique passwords for every election equipment component, which are kept in separate places and held by different parties,” the Colorado Department of State said. “Passwords can only be used with physical in-person access to a voting system.”
The department said it informed the Cybersecurity and Infrastructure Security Agency about the incident. A CISA spokesperson told Reuters the agency was working with Colorado officials to monitor the situation. “We understand the incident only impacts voting systems in Colorado and defer to the Secretary of State’s office for mitigation specifics,” the spokesperson said.
The Colorado Republican Party expressed concerns over the accidental password leak. Dave Williams, the chair of the Colorado GOP, criticized the secretary of state’s office for what he termed “significant incompetence and negligence.”
“We hear all the time in Colorado from Secretary Griswold and Governor Polis that we represent the ‘Gold Standard’ for election integrity, a model for the nation. One can only hope that by the Secretary of State posting our most sensitive passwords online to the world dispels that myth,” Williams said in a statement.
In a letter addressed to Griswold, Williams asked for written confirmation within 24 hours that the disclosed passwords were changed and that the election systems were secure.
The letter asked for “confirmation that all passwords disclosed have since been changed or were otherwise not current at any point while made public” and “that all new passwords, their storage, and management meet best practices for password strength and encryption, unlike those publicly disclosed.”
Newsweek contacted Griswold via email for comment outside normal business hours.
In its Tuesday statement, the Colorado Department of State outlined the levels of security around access to voting equipment that, under state law, “must be stored in secure rooms that require a secure ID badge to access.”
“That ID badge creates an access log that tracks who enters a secure area and when. There is 24/7 video camera recording on all election equipment. Clerks are required to maintain restricted access to secure ballot areas, and may only share access information with background-checked individuals,” the statement continued.
It went on to explain that all votes in Colorado are cast on paper ballots, which are then audited during the “Risk Limiting Audit” to verify that they were counted correctly.
