close
close

Trial for sharing Colorado voting system passwords takes place a day before election • Colorado Newsline

On Monday, a day before the general election, a daylong trial over whether voting machines in 34 Colorado counties should be shut down took place in Denver District Court.

Decision 2024: Election coverage on the ground in Colorado and by local reporters in all 50 states. Just. Fearless. Free.

It was about a massive leak of hundreds of voting equipment passwords that were inadvertently exposed on the Colorado Secretary of State's website for months.

Judge Kandace C. Gerdes heard testimony and opening and closing remarks from both sides at the end of a hearing that began shortly after 1:30 p.m. and lasted well past 5 p.m. before announcing she would consider the material before her and make a decision a written order “in due course.”

The plaintiffs argued that voting computers in the affected counties were at risk of being compromised and should not be trusted to produce accurate election results. They want the court to order hand counts in these districts.

“There is a security risk and we don’t have enough time to figure it out,” said Gary Fielder, an attorney for the plaintiffs.

The suit was filed Friday in Denver District Court by the Libertarian Party of Colorado; James Wiley, the Libertarian candidate for Colorado's 3rd Congressional District seat; and Hannah Goodman, state chair of the Libertarian Party and Libertarian candidate for Colorado's 4th Congressional District seat. Jena Griswold, the Democratic secretary of state, and Chris Beall, the deputy secretary of state, are the defendants.

GET TOMORROW'S HEADLINES.

Griswold, as well as Republican and Democratic election officials across Colorado and other election experts, have done so appeared confident that Tuesday's general election in Colorado remains safe.

Griswold admitted on Oct. 29 that the passwords were hidden but accessible in a spreadsheet posted online. The leak involved Basic Input Output System, or BIOS, passwords, which provide access to the basic functions of a computer system. Griswold said she had known about the revelation since Oct. 24, but county officials who manage elections across the state were not informed of it until five days later.

The Secretariat announced in a press release on Monday new details offered about losing passwords. The office said the passwords were disclosed starting June 21, meaning they were accessible online when Colorado's June 25 primary election took place. More than 600 passwords in 63 of the state's 64 districts were exposed, but the minister noted that voting machines in 34 districts were affected by the leak as some of the exposed passwords had already been updated and were not included in the table.

Colorado officials said Friday that state officials were finished the process of updating passwords about voting equipment in the affected counties.

The press release said the Secretary of State initially learned of the leak from “a voting machine provider.”

Shawn Smith testifies that he found the leak

The leak was publicly disclosed in a mass email from the Colorado Republican Party, which said it learned of the leak after an unnamed person sent the party an affidavit attesting to how the person discovered it.

That person turned out to be Shawn Smith, a Teller County election conspirator and retired Air Force colonel who was a key witness for the plaintiffs in the trial on Monday. Smith testified that he discovered the exposed passwords after downloading a spreadsheet posted on the secretary of state's website on Oct. 23 that contains an inventory of voting system components used statewide, to be maintained by the secretary of state. He said he downloaded the Excel document “30 to 40 times” as part of his “election integrity” activities. But the next day he noticed the passwords for the first time.

“On the 24th I noticed that there were worksheets hidden at the bottom of the page. You can right-click on the active, visible worksheet… You can select Unhide. A list of hidden worksheets will then appear.”

He found a column labeled “BIOS Passwords” that listed the passwords.

Smith runs an “election integrity” organization, Cause of America, for Mike Lindell, the former ally of President Donald Trump who has long been vocal in baselessly denying the results of the 2020 election.

In 2022 Smith suggested Griswold should hang for voter fraud. A Colorado Newsline investigation This year it was revealed that he was part of the pro-Trump mafia that clashed with police during the January 6 insurrection.

Plaintiff witness Clay Parikh, a cybersecurity expert who also has ties on Lindell's election denial activities said that the leaked passwords constituted a “serious security breach.”

When Fielder asked if there was now “a possibility of compromising Colorado's voting system,” Parikh replied, “The likelihood is very high,” given how long the passwords were exposed and “the vulnerabilities of the overall system.”

But Beall, while acknowledging in his testimony that the leak was “significant,” rejected the idea that a person in possession of the leaked passwords could change the way voting systems work.

“In our scenario, there is basically no way to exploit password disclosure,” he said.

This is due to the “layers of security” in place around election administration in the state, he said.

Election officials in the state have said that a person must be physically present to access the BIOS and that voting equipment must be stored in a secure environment. Ballots in the state are cast on paper that can be audited after an election to ensure accuracy.

LeeAnn Morrill, first assistant attorney general who represented Griswold and Beall during the trial, said: “We do not believe there is any factual or legal basis for this court to grant the extraordinary and unprecedented relief that plaintiffs seek.”

“It is impossible to overstate the chaos that would result from shutting down voting system equipment,” Morrill argued. Far from protecting the election, she said, it would instead “impose unknown, last-minute procedures that the petitioners essentially dreamed up and asked the court to order.”

All active registered voters in Colorado will receive a mail-in ballot. Ballots were mailed starting October 11th. From Monday lunchtime more than 2 million of the approximately 4 million active voters in the state had already returned their ballot.

YOU MAKE OUR WORK POSSIBLE.