National Security

Timeline: A furor over Georgia’s election security

We know Russian hackers targeted at least 21 states and compromised the voting systems of at least seven states prior to the 2016 election.
We know Russian hackers targeted at least 21 states and compromised the voting systems of at least seven states prior to the 2016 election. AP

Open records requests from election security advocates in Georgia have revealed what went on inside the Center for Election Services in the months leading up to the 2016 election, and in the months after.

Here’s a timeline of events.

August 28, 2016, 7:09 a.m.

Politico publishes an article wherein Georgia’s secretary of state, Brian Kemp, decries a federal push to designate election systems “critical infrastructure,” citing his concerns for federal overreach.

August 28, 2016, 3:47 p.m.

Logan Lamb, a researcher for online security firm Bastille, notifies the Center for Election Systems at Kennesaw State University that voting system software and documents including voter registration information for millions of Georgians, were “completely open” and could be manipulated.

October 12, 2016

The Center’s latest scan reveals “40+ critical vulnerabilities” in the election server, “most if not all” of which the Center’s technical coordinator, Steven Dean, said would be solved by updating software.

November 8, 2016

Election Day

February 22, 2017

Christopher Grayson, another cyber security professional, begins testing the defenses of Center’s system and finds that he, too, could gain access to voter rolls. He later alerts Andy Green, a Kennesaw State lecturer on information security.

March 1, 2017, 9:55 p.m.

Green contacts the Center to say that files, including personally identifiable information on Georgia voters such as Social Security numbers, were “exposed.”

March 1, 2017, 11:10 p.m.

Kennesaw State’s chief information officer, Stephen Gay, confirms to his superiors that “voter information in database files for counties across the state” is available to the public, and states that he’s “closed all firewall exceptions” for the server to contain the incident.

March 3, 2017

The FBI takes possession of the election server to conduct its investigation.

March 17, 2017

The FBI returns the server to Kennesaw State’s information technology office, after finding no data that “escalates to the point of breach” by a malicious actor.

July 3, 2017

Election security advocates, charging that the state’s negligence and misconduct have left the state’s voting system insecure, sue Kennesaw’s Center and Georgia’s secretary of state’s office in an attempt to force a shift to paper ballots.

October 6, 2017

Cristina Correia, Georgia’s assistant attorney general, divulges in response to an open records request that the Center’s election server and a backup server used in 2016 were wiped clean on March 17.

October 18, 2017

Correia advises a lawyer for the plaintiffs in the suit that records were not destroyed in March, but rather were erased from one elections server on July 7 and the second on Aug. 9, 2017, both after the suit was filed. Correia said that data once accessed by Logan Lamb “exists elsewhere” at the Center.

July 13, 2018

Special Counsel Robert Mueller’s indictment of Russian intelligence officers indicates they “visited the websites of certain counties in Georgia, Iowa, and Florida to identify vulnerabilities.”

July 18, 2018

A spokesperson for the secretary of state’s office affirms Kemp’s repeated statements about his own record, telling Politico, “We have never been hacked, and according to President Trump and the Department Of Homeland Security, we have never been targeted.”

Related stories from McClatchy DC