Georgia Scrambles To Patch Massive Vulnerabilities In Its Voter Registration System After Insisting It Was Totally Secure

from the so-about-that-voting-system... dept

Yesterday we had a rather incredible story about Georgia’s Secretary of State, Brian Kemp, who, despite the conflict of interest, is both running for Governor and in charge of making sure Georgia’s elections are fair. Over the weekend, Kemp had made a highly questionable claim that his opponents in the Democratic Party of Georgia had attempted to hack the voter registration system, and he was opening an investigation. As we noted, what appears to have actually happened was that an independent security researcher had discovered massive, stunning, gaping security flaws in Georgia’s voter registration system, that would potentially allow anyone to access anyone else’s information and even modify it. That’s an especially big deal in Georgia, where the very same Secretary of State Brian Kemp had pushed for laws that meant that if any of your ID information was different from what was in the voter system, you didn’t get to vote.

Incredibly, despite multiple security experts pointing out some fairly basic flaws, Kemp’s office insisted the site was secure. According to press secretary Candice Broce:

?We can also confirm that no personal data was breached and our system remains secure.?

Elsewhere the Secretary of State’s Office insisted there were no problems with the site. However, as ProPublica is now reporting, late Sunday night, after it had insisted there was nothing wrong, it appeared that someone behind the scenes was scrambling to patch the vulnerabilities:

ProPublica?s review of the state?s voter system followed a detailed recipe created by the tipster, who was described as having IT experience and alerted Democrats to the possible security problems. Using the name of a valid Georgia voter who gave ProPublica permission to access his voter file, reporters attempted to trace the security lapses that were identified.

ProPublica found the website was returning information in such a way that it revealed hidden locations on the file system. Computer security experts had said that revelation could give an intruder access to a range of information, including personal data about other voters and sensitive operating system details.

ProPublica?s attempt to take the next step ? to poke around the concealed files and the innards of the operating system ? was blocked by software fixes made that evening.

The same Candice Broce who had insisted that there was absolutely nothing wrong with the site then told ProPublica two obviously bullshit claims. First, that the setup that allowed users to see exactly where files were stored was standard practice, and so was making last minute changes to a voter registration website two days before an election:

Broce said the ability to see where files were stored was ?common? across many websites, and she said it was not an inherent vulnerability. She did not deny that the website?s code was rewritten and would not say whether changes were made as a result of the possible security holes.

?We make changes to our website all the time,? Broce said. ?We always move our My Voter Page to a static page before Election Day to manage volume and capacity. It is standard practice.? By Monday afternoon, the page did not appear to be static in the way Broce described, and she did not respond to a request to provide evidence of the change.

Of course, as anyone who has done any serious website building in, let’s say, the last 10 to 15 years, knows well, that is not at all standard practice. But, let’s see the quote from an expert anyway:

Joseph Lorenzo Hall, the chief technologist at the Center for Democracy and Technology in Washington, D.C., disputed that visibility into file storage was common. ?It?s definitely not best practice,? he said. He said it appeared the state had made the change in response to being notified of the problem and could see no reason why officials would otherwise make such a change ahead of Election Day.

Security experts frown on making such seemingly ad hoc changes close to major events, such as an election, because they can create unforeseen problems when made so quickly.

Basically, it appears that Kemp and the Secretary of State’s office are betting on voters in Georgia being totally ignorant. Meanwhile, this is the same office that just a couple months ago made the following bold statement:

?There has never been a breach in the Secretary of State?s office. We have never been hacked, and according to President Trump and the Department Of Homeland Security, we have never been targeted. Georgia has secure, accessible, and fair elections because Kemp has leveraged private sector solutions for robust cyber security, well before any of those options were offered by the federal government.?

I don’t care what side of the partisan divide you fall on, but Kemp’s actions in failing to protect the system, overseeing the voting in his own election, then attacking the messenger for pointing out his own vulnerability, denying the vulnerability, and then scrambling to fix the vulnerability at the last minute without telling anyone, should disqualify him from running a Burger King, let alone being Governor of the state of Georgia.

Filed Under: , , , , ,

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Georgia Scrambles To Patch Massive Vulnerabilities In Its Voter Registration System After Insisting It Was Totally Secure”

Subscribe: RSS Leave a comment
That One Guy (profile) says:

'We're not incompetent, just extremely suspicious.'

They really did not think that excuse out very well. If that sort of setup is normal and nothing to be concerned about then why are they patching it this close to the election? Their own argument shoots itself in the foot.

If it is a bad setup(and it is), then patching it makes perfect sense, even if that patch is well overdue.

(Also well overdue: a public apology for blaming the opposition for trying to inform those running the election of a major security flaw, and an admission that the original claim of them ‘hacking’ the system was wrong.)

If it’s not a bad setup, then they should have no reason to be making changes to it, and doing so raises the question as to why one of those running in the election is fiddling with the voting system just prior to it.

Even taking them at their word and assuming they were right they still come out looking bad/suspect.

Anonymous Coward says:

We will fix this promptly!

“In order to patch the security holes and fix any vulnerability, we will need to take offline all democrat leaning and minority-heavy polling locations. The locations should be fixed no earlier than 19:00 tonight.

Secretary of State Kemp will not be extending voting hours for those locations. Anyone wishing to vote in an affected precinct may do so by requesting an absentee ballot prior to the absentee mail-in deadline.”

ShadowNinja (profile) says:

Re: We will fix this promptly!

You joke, but there’s some states with rules nearly that bad.

My dad didn’t get to vote one year because he had a last minute trip scheduled to visit a client. It was after the deadline to get an absentee ballot, and it was a state with no early voting (even today it still has no early voting).

Oh and the worst part of that state’s rules? It’s illegal to vote by absentee ballot if you’ll be home that day and able to show up at the polls. You have to sign under penalty of perjury that you’ll be out of the state on the election day in order to get an absentee ballot.

(The state is Pennsylvania)

Anonymous Coward says:

Re: Re: We will fix this promptly!

Those are abysmal rules. Hopefulyl one day they will get fixed.

But sadly the way the GOP run states are going, if they do loose the House today, I expect laws just to get more rediculous.

– Fewer polling locations
– Reduced early voting hours
– Stricter voter exact match ID laws
– Forced disenfranchisement for debt or tax issues (“can’t pay taxes or your debts on time? Can’t vote!)

Anything to stay in power.

Anonymous Coward says:

Re: Re: Re:4 We will fix this promptly!

From the 2014 Presidential election (considering 20 states which require an excuse for absentee voting, 27 states which do not, and ignoring 3 states which only vote by mail):

The average R:D for all 47 states was 51.2 to 43.2

For the 20 states in which absentee voting required an excuse, the average R:D was 52.9 to 42.7

For the 27 states in which absentee voting did not require an excuse, the average R:D was 48.2 to 42.0

Make of that what you will

Anonymous Anonymous Coward (profile) says:

Technologist Trump

“There has never been a breach in the Secretary of State’s office. We have never been hacked, and according to President Trump and the Department Of Homeland Security, we have never been targeted."

Now there’s the most technologically adept reference I’ve ever heard! /s

How many phones does Trump have? How much security do they carry? Does Trump’s staff feel good about the security of Trump’s phones? Do foreign powers appreciate the security of Trump’s phones?

Citizen says:

There has to be a body of impartial observers supervising this election. This guy’s arrogant sense of self entitlement, including his insistence on presiding as the secretary of state during his own candidacy, let alone his effort to purge legitimate voters, indicates he has every intention of cheating if he can get away with it.

Add Your Comment

Your email address will not be published.

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...