A Researcher Found a Bunch of Voting Machine Passwords Online

“There is no way they could have been used to affect any election.”

Kelly Owen/Zuma

Fight disinformation: Sign up for the free Mother Jones Daily newsletter and follow the news that matters.

A little more than a week ago, the Department of Homeland Security confirmed that it was going to forensically analyze computer equipment associated with part of the 2016 elections in North Carolina in association with questions about Russian hacking. The news prompted an information security researcher to announce that he’d found evidence of other election security issues in North Carolina last fall, which he’d kept quiet until now.

Chris Vickery, the director of cyber-risk research at UpGuard, a cybersecurity services firm, tweeted June 7 that he had found an unlocked online repository that contained what he said were passwords for touchscreen voting machines. The repository, he said, also contained other information, including serial numbers for machines that had modems, which theoretically could have allowed them to connect to the internet.

Vickery said that after he found the open repository in September 2018, he immediately told state officials, who locked the file. State officials have told Mother Jones that the passwords were nearly 10 years old and encrypted—a claim disputed by Vickery and a Democratic technology consultant in North Carolina—but admitted that the file shouldn’t have been publicly available online.

In a statement provided to Mother Jones, State Board of Elections spokesperson Patrick Gannon said the passwords were encrypted and only applied to machines from one county that used them in 2010. Any suggestion that the passwords’ discovery in an open online repository posed a danger to elections was “false and irresponsible,” he said. Even if an attacker could have decrypted the passwords, the passwords would’ve been changed before the 2011 elections and every subsequent election, and “there is no way they could have been used to affect any election.”

But others disagree. Matt Bernhard, an election security expert at the University of Michigan, acknowledged that the passwords would have had limited use for anyone wanting them for ill purposes, given that they seem to apply to individual voting machines. But, he said, the fact that they were publicly accessible reflects a lack of election security protocols that has plagued election officials over the years.

“I think, really, it’s catastrophically dumb…profoundly stupid that they were online at all,” Bernhard told Mother Jones. “In the space of problems with North Carolina’s elections, this is fairly far down on the totem pole.” He noted that what’s important about the suspected breach was that “this is not a North Carolina-specific problem. It’s generally reflective of just a lack of security posture of election officials at all levels. Hopefully this is a good teachable moment for all of them.”

Vickery said last week that he shared what he had found in light of the Department of Homeland Security telling the Washington Post June 5 that it was conducting a forensic analysis of laptops used in Durham County, North Carolina, during the 2016 election. The laptops in that case are associated with what are known as poll books, which are devices used by local election workers to check voters in when they show up to cast their ballots. Problems with the poll books manufactured by Florida-based VR Systems led to significant delays in Durham County, and forced some voters to leave without casting a ballot.

In 2016, VR Systems believes it was targeted by the Russians (but denies it was hacked), and senators Ron Wyden (D-Ore.) and Amy Klobuchar (D-Minn.) have asked the FBI to respond to questions about what happened at that time. Wyden, who serves on the Senate Intelligence Committee, and Klobuchar, who is the ranking member of the Senate Rules Committee, which has oversight of federal elections, have both taken an interest in election security.

Vickery’s find relates to an entirely different kind of voting technology. The passwords he found were for iVotronic touchscreen voting machines manufactured by Omaha-based Election Systems & Software, one of the country’s largest voting equipment vendors. Vickery said he found the passwords in an open State Board of Elections folder on an Amazon server, accessible to anyone who came across it.

“Immediately I understood the importance of it,” he told Mother Jones. He then confidentially got in touch with state election officials who closed access to the file and took it offline. The officials told him the passwords were old and had been changed years ago. Vickery said the most recent file in the folder had been uploaded in 2016.

State elections officials “immediately removed the outdated and encrypted password information” when Vickery notified them, Gannon wrote to Mother Jones in response to questions. The board has “taken steps to try to prevent similar information—even if it is harmless—from being posted to the website in the future.” Gannon added that “legitimate concerns about cybersecurity must be addressed,” even while “erroneous, misleading and politically charged attacks on the State Board and its employees unnecessarily decrease voters’ confidence in elections, which may decrease voter turnout, while taking resources away from important issues.”

Charlie Collicutt, director of the Board of Elections in Guilford County, North Carolina, explained that the passwords applied to a subset of iVotronic voting machines in Guilford County. He’s not sure why the file was uploaded to a publicly accessible folder, but reiterated that the passwords were changed after 2010. The passwords were “ciphered” somehowwith letters or symbols systematically changed to other letters and symbols—and there there might be confusion around referring to them as encrypted. Either way, he said, “This file was a one-off that was posted years” after the passwords within it applied to the machines.

AN IMPORTANT UPDATE

We’re falling behind our online fundraising goals and we can’t sustain coming up short on donations month after month. Perhaps you’ve heard? It is impossibly hard in the news business right now, with layoffs intensifying and fancy new startups and funding going kaput.

The crisis facing journalism and democracy isn’t going away anytime soon. And neither is Mother Jones, our readers, or our unique way of doing in-depth reporting that exists to bring about change.

Which is exactly why, despite the challenges we face, we just took a big gulp and joined forces with the Center for Investigative Reporting, a team of ace journalists who create the amazing podcast and public radio show Reveal.

If you can part with even just a few bucks, please help us pick up the pace of donations. We simply can’t afford to keep falling behind on our fundraising targets month after month.

Editor-in-Chief Clara Jeffery said it well to our team recently, and that team 100 percent includes readers like you who make it all possible: “This is a year to prove that we can pull off this merger, grow our audiences and impact, attract more funding and keep growing. More broadly, it’s a year when the very future of both journalism and democracy is on the line. We have to go for every important story, every reader/listener/viewer, and leave it all on the field. I’m very proud of all the hard work that’s gotten us to this moment, and confident that we can meet it.”

Let’s do this. If you can right now, please support Mother Jones and investigative journalism with an urgently needed donation today.

payment methods

AN IMPORTANT UPDATE

We’re falling behind our online fundraising goals and we can’t sustain coming up short on donations month after month. Perhaps you’ve heard? It is impossibly hard in the news business right now, with layoffs intensifying and fancy new startups and funding going kaput.

The crisis facing journalism and democracy isn’t going away anytime soon. And neither is Mother Jones, our readers, or our unique way of doing in-depth reporting that exists to bring about change.

Which is exactly why, despite the challenges we face, we just took a big gulp and joined forces with the Center for Investigative Reporting, a team of ace journalists who create the amazing podcast and public radio show Reveal.

If you can part with even just a few bucks, please help us pick up the pace of donations. We simply can’t afford to keep falling behind on our fundraising targets month after month.

Editor-in-Chief Clara Jeffery said it well to our team recently, and that team 100 percent includes readers like you who make it all possible: “This is a year to prove that we can pull off this merger, grow our audiences and impact, attract more funding and keep growing. More broadly, it’s a year when the very future of both journalism and democracy is on the line. We have to go for every important story, every reader/listener/viewer, and leave it all on the field. I’m very proud of all the hard work that’s gotten us to this moment, and confident that we can meet it.”

Let’s do this. If you can right now, please support Mother Jones and investigative journalism with an urgently needed donation today.

payment methods

We Recommend

Latest

Sign up for our free newsletter

Subscribe to the Mother Jones Daily to have our top stories delivered directly to your inbox.

Get our award-winning magazine

Save big on a full year of investigations, ideas, and insights.

Subscribe

Support our journalism

Help Mother Jones' reporters dig deep with a tax-deductible donation.

Donate