Former Sec. state reacts to password leak in voting system, security measures in place
4 mins read

Former Sec. state reacts to password leak in voting system, security measures in place

EL PASO COUNTY — A former state election official said the release of voting system passwords on the secretary of state’s website is a significant error but does not automatically compromise the county’s voting equipment.

In a press release Tuesday, the Colorado Department of State confirmed that an Excel spreadsheet containing hundreds of passwords to Colorado’s voting system was posted on the Secretary of State’s website for months. In an interview with Scripps News Denver, Secretary of State Jena Griswold said an official made a “serious mistake” and that an outside party will investigate. She said the officer was no longer with the department but could not say if that person was fired.

Former Colorado Secretary of State Wayne Williams, a Republican who held the office before current Secretary of State Jena Griswold, said the leaked Basic Input/Output System (BIOS) passwords held by the state are one of two passwords used to access election voting systems. The second is a Windows password held by county officials, creating a system of control.

“The release of the BIOS passwords means that some of that control was lost, and so now someone who had the Windows password and access to the machine could make changes without the knowledge of the Secretary of State’s office, and that’s a significant problem,” Williams said. “There are a number of changes that can be made with the BIOS password, even without the Windows password. For example, one of them would be to install a wireless device that would allow someone to download malware to the computer.”

The Secretary of State’s office and the El Paso County Clerk and Recorder’s Office said BIOS passwords can only be used through direct, personal access to the voting equipment. The voice equipment is kept in highly secure rooms that are only accessible to people with an ID tag and security code.

El Paso County Clerk and Recorder Steve Schleiker said that while the error is significant, it does not affect the security of voting systems in the county. He sent a statement to News5 that reads in part:

To further secure our systems, all election equipment is under 24/7 video surveillance, monitored and patrolled by county security personnel. Our voting equipment is also housed in locked and secure CPU cabinets, adding an extra layer of protection. Only authorized, background-checked employees are allowed access to these areas, and anyone working with voice system components is subject to strict chain-of-customer protocols, with detailed logs recording every instance of access.

Steve Schleiker El Paso County Clerk and Recorder

Williams said the error raises concerns about transparency within the secretary of state’s office. He said the office did not immediately notify county election officials of the leak.

“I think they could have gotten it done faster if they had worked with the counties and informed them of the problem,” Williams said.

The secretary of state’s office said it took immediate action as soon as it became aware of the published passwords and informed the Cybersecurity and Infrastructure Security Agency, which closely monitors and protects the county’s essential security infrastructure. An office spokesperson said out of an abundance of caution, the department is checking voice system access logs in all affected counties, updating passwords and verifying settings.

Williams said voters should still have confidence in Colorado’s elections despite the password leak, pointing to paper ballots and forensic reviews before voter certification as additional safeguards.

“We know that the results that are reported are either going to be accurate or we’re going to find that out in the audit process with the actual paper votes,” Williams said.

On Wednesday, Republicans in the Colorado House began calling for Griswold’s resignation.

House Minority Leader Rep. Rose Pugliese, R-District 14, released a statement that said in part:

“While I have the utmost confidence in the integrity of our county clerks, who actually oversee the vote counting, I have no confidence that Secretary Griswold is capable of leading our election system. Enough with her incompetence; it’s time for her to resign. The people in Colorado deserve better.”

Partial passwords for Colorado’s voting system are posted online