Trial over leak of Colorado voting system passwords occurs a day before election

A one-day trial over whether election machines in 34 Colorado counties should be shut down took place in Denver District Court on Monday, a day before the general election.

Decision 2024: On-the-ground election coverage in Colorado and by local reporters in all 50 states. Fair. Fearless. Free.

At issue was a massive leak of hundreds of election equipment passwords, which were inadvertently exposed for months on the website of the Colorado secretary of state.

Judge Kandace C. Gerdes, at the end of a hearing that began shortly after 1:30 p.m. and lasted well past 5 p.m., heard witness testimony and opening and closing remarks from the two sides before announcing she would review the material before her and issue a written order “in due course.”

Plaintiffs argued that election computers in affected counties were at risk of being compromised and should not be trusted to produce accurate election results. They want the court to order hand counts in those counties.

“There’s a security risk and there’s not enough time to figure it out,” Gary Fielder, attorney for the plaintiffs, said.

The lawsuit was filed Friday in Denver District Court by the Libertarian Party of Colorado; James Wiley, the Libertarian candidate for Colorado’s 3rd Congressional District seat; and Hannah Goodman, the Libertarian Party state chair and the Libertarian candidate for Colorado’s 4th Congressional District seat. Jena Griswold, the Democratic secretary of state, and Chris Beall, the deputy secretary of state, are the defendants.

Griswold, as well as Republican and Democratic election officials throughout Colorado and other election experts, have expressed confidence that the Colorado general election Tuesday remains secure.

Griswold acknowledged Oct. 29 that the passwords were hidden but accessible on a spreadsheet posted online. The leak involved Basic Input Output System — or BIOS — passwords, which provide access to the basic functioning of a computer system. Griswold said she’d known about the leak starting Oct. 24, but county clerks, who administer elections throughout the state, weren’t informed about it until five days later.

In a press release Monday, the secretary’s office offered new details about the leak of passwords. The office said the passwords were exposed starting June 21, meaning they were accessible online when Colorado’s June 25 primary election took place. More than 600 passwords in 63 of the state’s 64 counties were exposed, but the secretary determined election equipment in 34 counties were affected by the leak, since some of the exposed passwords had already been updated and were not listed on the spreadsheet.

Colorado officials said Friday that state employees had completed the process of updating passwords on election equipment in affected counties.

The press release said the secretary of state first learned of the leak from “a voting machines vendor.”

Shawn Smith testifies he found the leak

The leak was revealed publicly in a mass email from the Colorado Republican Party, which said it learned of the leak after an unnamed person sent to the party an affidavit attesting to how the person discovered it.

That person turned out to have been Shawn Smith, a Teller County election conspiracist and retired Air Force colonel who was a key witness for the plaintiffs in the trial Monday. Smith testified that he discovered the exposed passwords after he downloaded on Oct. 23 a spreadsheet posted on the secretary of state’s website that contains an inventory, which the secretary is required to maintain, of voting system components used throughout the state. He said he has downloaded the Excel document “30 to 40 times” as part of his “election integrity” activities. But the next day, he noticed the passwords for the first time.

“On the 24th I noticed that there were hidden worksheets at the bottom of the page. You can right-click on the active, visible worksheet … you can select ‘unhide,’ it would pop up with a list of hidden worksheets.”

He located a column labeled “BIOS passwords” with the passwords listed.

Smith runs an “election integrity” organization, Cause of America, for Mike Lindell, the former President Donald Trump ally who has long been vocal in baselessly denying the results of the 2020 election.

In 2022, Smith suggested Griswold should hang for election fraud. A Colorado Newsline investigation that year revealed that he was part of the pro-Trump mob that clashed with police during the Jan. 6 insurrection.

Plaintiff witness Clay Parikh, a cybersecurity expert who also has ties to Lindell’s election-denial activities, testified that the leaked passwords present a “serious security breach.”

Asked by Fielder if there is now “a possibility of compromising the voting system in Colorado,” Parikh responded, “There’s a very high likelihood,” given the amount of time the passwords were exposed and “the vulnerabilities of the overall system.”

But Beall in his testimony, though he acknowledged the leak was “significant,” rejected the suggestion that a person in possession of the leaked passwords could change the operation of election systems.

“There is fundamentally no way that a password disclosure could be exploited in our scenario,” he said.

This is due to the “layers of security” in place around election administration in the state, he said.

State election officials have said that a person must be physically present to gain BIOS access, and election equipment is required to be kept in a secure environment. Ballots in the state are cast on paper, which can be audited after an election to ensure accuracy.

LeeAnn Morrill, first assistant state attorney general, who represented Griswold and Beall during the trial, said, “We do not think there is any factual or legal basis for this court to award the extraordinary and unprecedented relief that the petitioners seek.”

“It cannot be overstated the chaos” that would come from shutting down voting system equipment, Morrill argued. Far from protecting the election, she said, it would instead “inject unknown procedures at the last minute that petitioners have essentially made up and asked the court to order.”

All active registered voters in Colorado receive a mail ballot. Ballots were sent out starting Oct. 11. As of midday Monday, more than 2 million of the roughly 4 million active registered voters in the state had already returned their ballot.

Colorado Newsline is part of States Newsroom, a nonprofit news network supported by grants and a coalition of donors as a 501c(3) public charity. Colorado Newsline maintains editorial independence. Contact Editor Quentin Young for questions: info@coloradonewsline.com. Follow Colorado Newsline on Facebook and X.