Lawsuit filed against Colorado Secretary of State after partial password leak

DENVER — Colorado Gov. Jared Polis and Secretary of State Jena Griswold say the passwords of all voting machines affected by a partial password leak have been updated and that the voting machines are secure.

“That made me very relieved [Griswold] “We asked for our help and were willing to change those passwords,” Polis said. “We were able to use state aircraft to get to remote areas of our state. As far as I know, all passwords have been updated since just after midnight last night.”

Griswold said an employee mistakenly pasted parts of voting system passwords into a spreadsheet that anyone could download from her office's website.

“A department official made a serious error that we must actively address,” Griswold said. “People make mistakes.”

Lawsuit filed against Colorado Secretary of State after partial password leak

Griswold said the employee is no longer with her department, but would not say whether that person was fired or resigned before the incident became public.

The public first became aware of the leak after the Colorado Republican Party issued a press release about it on Wednesday, nearly a week after Griswold said her office was informed of it on Thursday, Oct. 24.

Dave Williams, chairman of the Colorado Republican Party, said a “whistleblower” informed the party about the partial password leak.

Griswold declined to tell Denver7 who informed her office.

“Given the nature of this investigation right now, I cannot go into those details,” Griswold said.

It's unclear why the State Department didn't immediately notify the public or why it waited just as long to issue an emergency rule allowing passwords to be updated.

Griswold said the partial leak never posed an immediate threat to Colorado's election.

“Colorado elections have layers of security, so you actually need two passwords and physical access to the voting machines to use them for it to be worth anything,” Griswold said. “The two passwords are kept by different parties in different locations. And of course, under Colorado law, voting machines are kept in secure rooms that require IDs, which are secure IDs. We have 24/7 video surveillance of voting equipment, we have a strict chain of custody for access to voting equipment, and of course it is a felony in the state of Colorado to access and tamper with voting equipment.”

But Republicans in the capital say Griswold's assurances are not enough and are calling for her resignation.

“Secretary of State Jena Griswold’s reckless disregard for professional standards and continued lack of transparency have threatened trust in our democratic system and raised doubts about the security of our electoral process. Her office sent postcards to 30,000 non-citizens illegally encouraging them to register to vote, falsely informed other voters that they had not voted when they had already voted, and now has passwords to the voting system in the system Internet disclosed,” said House Minority Caucus Chairwoman, State Rep. Rose Apulia. “While I have the utmost confidence in the integrity of our county clerks who actually oversee the vote count, I have no confidence in Secretary Griswold’s ability to run our election system. Enough of their incompetence; it's time for them to step down. The people of Colorado deserve better.”

Griswold told Denver7 that she has no plans to step down as the state's top election official.

“No, I will not resign,” Griswold said.

Denver7 asked Griswold who was ultimately responsible for the leak.

“I take responsibility for anything that goes wrong in the office,” Griswold said. “Ultimately, this was an officer hiding tabs in a spreadsheet.”

On Friday, the Libertarian Party of Colorado filed a lawsuit against Griswold in Denver District Court.

“By releasing these passwords to the public, the Secretary breached her duty to ensure that Colorado’s upcoming general election was fair and accurate,” her attorney, Gary Fielder, said in the lawsuit.

They are also asking the court to order Griswold to withdraw from participating in Tuesday's election, to immediately decommission all voting system equipment associated with the published passwords, to order the hand-counting of ballots in the affected precincts and a to revoke the temporary regulation that allowed the use of passwords to be changed.

“Based on information and belief, any changes described herein, including updating passwords on the affected voting machines and systems, will result in a circumstance in which the prior certifications of the affected voting systems will be invalidated,” the lawsuit says.

They also want Colorado Attorney General Phil Weiser to conduct an investigation.

“While the Attorney General's Office cannot confirm or otherwise comment on the investigation, in Colorado we are very proud that our election system is the gold standard in the country,” the Attorney General's Office said in a statement. “Any unlawful actions that damage public confidence in our elections should be taken seriously. With regard to the disclosure of voting system passwords, it is critical that this matter is thoroughly investigated and that every step is taken to ensure our elections are secure and every vote is counted.”

The partial password leak has once again catapulted Colorado into the national political spotlight.

On Thursday, former President Donald Trump's campaign announced that it had sent a letter to Griswold asking her to “identify the counties affected by the security breach, notify them, direct them to stop processing mail-in ballots, and prepare to re-scan all ballots.”

Colorado Deputy Secretary of State Christopher Bell responded to the Trump campaign, saying that “background-checked government cybersecurity experts” would help update the passwords.

Republicans in the state capitol are calling on the Legislative Audit Committee to hold an emergency hearing on the partial password leak.

The committee's chair, state Rep. Lisa Frizell, said a 2021 rule change prevented her from unilaterally calling an emergency meeting.

Frizell said it could be convened if five members of the eight-member committee, which includes four Republicans and four Democrats, agreed. As of Friday evening, it was unclear whether there was enough support for such a meeting.

The committee's next regular meeting is scheduled for December 9th.