(Colorado Newsline) With just days to go before the general election, the Colorado secretary of state is facing a lawsuit over the leak of sensitive election system passwords that were inadvertently left exposed for months on her office’s website.

The lawsuit, filed Friday in Denver District Court by the Libertarian Party of Colorado and James Wiley, the Libertarian candidate for Colorado’s 3rd Congressional District seat, names Jena Griswold, the Democratic secretary of state, and Chris Beall, the deputy secretary of state, as defendants. Hannah Goodman, the Libertarian Party state chair, is also named as a plaintiff. The suit had not yet appeared in an online state filing system by the time of publication, but Wiley shared a copy of the complaint with Newsline.

The Libertarian Party announced the lawsuit on X, calling the exposed passwords “a severe breach of election security protocols.” The suit asks the court to order a hand count of ballots in all affected counties.

Image

Griswold, as well as Republican and Democratic election officials throughout Colorado and other election experts, have expressed confidence that the Colorado general election Tuesday remains secure. U.S. Representative Lauren Boebert, the Republican candidate for U.S. House in Colorado’s 4th Congressional District, who cast doubt on the 2020 election, said Wednesday, “I have faith in our county clerks to run this election well and make sure every legal vote counts.”

Griswold acknowledged Tuesday that the passwords were hidden but accessible on a spreadsheet posted online. She said she’d known about the leak starting October 24, but county clerks, who administer elections throughout the state, weren’t informed about it until late Tuesday.

The leak was revealed in a mass email from the Colorado Republican Party, which said it learned of the leak after an unnamed person sent to the party an affidavit attesting to how the person discovered it. The leak involved Basic Input Output System — or BIOS — passwords for more than 700 election system components in every Colorado county except Las Animas, the affidavit says.

Colorado officials said Friday that state employees had completed the process of updating passwords on elections equipment across the state in affected counties.

The lawsuit argues that BIOS passwords could give a person access to critical parts of a county’s election management system and “allow the user to manipulate the data,” and it asserts updating the passwords in affected counties “creates a circumstance wherein the previous certifications of the voting systems involved are void.”

“We need to shut down. We need to shut down immediately,” Wiley said in a phone interview Friday. “We’re asking for a hearing on Monday. We would like the machines to stop counting immediately, because every ballot that passes through them, the chain of custody on that is compromised by the fact that the machines that they’re passing through are all compromised.”

State officials and county clerks have stressed that the use of BIOS passwords requires in-person physical access to voting machines, which are kept in secure areas subject to controlled keycard access and 24/7 video surveillance. Under an emergency rule adopted Thursday, state cybersecurity employees who assisted in changing the passwords will also “review logs to ensure that no tampering occurred,” Governor Jared Polis’ office said.

The person whose affidavit the state Republican Party shared said the passwords were exposed as part of a spreadsheet at least as early as August 8. But Wiley said he is in possession of a copy of the spreadsheet with the exposed passwords that his investigative team downloaded in June — meaning the passwords were exposed at least as early as June, before the June 25 Colorado primary election, he said.

He didn’t realize his copy of the spreadsheet contained the exposed passwords until news about their existence became public this week, he said.

Asked for comment, a spokesperson for Griswold said they can’t comment on litigation.

View the lawsuit filing here: 2024-11-01_10-41-14_Libertarian_Petition_113_Stamped

Colorado Newsline is part of States Newsroom, a nonprofit news network supported by grants and a coalition of donors as a 501c(3) public charity. Colorado Newsline maintains editorial independence. Contact Editor Quentin Young for questions: info@coloradonewsline.com. Follow Colorado Newsline on Facebook and X.