NCSBE Password Leak Exposed ‘Override’ Access to Voting Machines in 24 Counties

RALEIGH – The North Carolina State Board of Elections (NCSBE) seems to have a cyber (in)security problem. Or at least a risk of one. The recent leaked voting machine passwords apparently include those for functions like “Override” and they would grant access to certain voting machines in 24 counties across the Old North State.

This adds to election hacking hype, warranted or not, after federal investigators recently seized Durham County laptops in relation to suspicious electronic voter roll problems that disrupted voting in that county in November 2016.

Should we be worried?

Some bkgd & analysis re: the @NCSBE password leak revealed yesterday by the invaluable @VickerySec:

NCSBE doc (https://t.co/cp4R3VUJw0) shows that 3 of the named passwords exposed in the NCSBE leak grant admin access to the state’s ES&S iVotronic machines #ncpol (thread; 1/6)

— EQV Analytics (@AnalyticsEqv) June 8, 2019

Other @NCSBE info (https://t.co/4cB5ivOa1R) shows that these machines were used in 24 of 100 NC counties in 2018: Alamance, Brunswick, Burke, Caswell, Cherokee, Davidson, Davie, Forsyth, Guilford, Haywood, Henderson, Jackson, Lenoir, Mecklenburg, New Hanover…. (2/6) #ncpol

— EQV Analytics (@AnalyticsEqv) June 8, 2019

…Pamlico, Pender, Perquimans, Polk, Rutherford, Surry, Transylvania, Union, and Warren. They’re used in conjunction with a supervisor PEB (cartridge) to test and reset the voting machines. (3/6) #ncpol

— EQV Analytics (@AnalyticsEqv) June 8, 2019

The passwords we’ve been able to identify the function of so far are “ServiceMenuPassword”, “ElectionCentralMenuPassword”, and “OverridePassword.” Stay tuned…. (4/6) #ncpol

— EQV Analytics (@AnalyticsEqv) June 8, 2019

A physical cartridge inserted into a machine is required in order to use these passwords, so this doesn’t yet look like a leak that would hand the keys to the whole election to hackers. But it certainly reveals a dangerously lax cybersecurity culture at @NCSBE, plus (5/6) #ncpol

— EQV Analytics (@AnalyticsEqv) June 8, 2019

the worthlessness of DHS’s cybersecurity scans of state elections systems (since DHS apparently failed to detect this leak). (6/6) #ncpol

— EQV Analytics (@AnalyticsEqv) June 8, 2019

So, while the leaking of “Override” function passwords would seem fatal for an an E-voting system, the required delivery (physical cartridge) drastically limits the risk of systemic interference.  Those ringing the alarm the loudest about the possibility of someone launching a Mission Impossible style assault on a voting machine to change votes or ‘rig elections’ in Perquimans County seem to also have an undeniable political interest in undermining election results.

The analysis above comes from EQV Analytics, and while it sounds very facts-driven, EQV also labels itself a champion of the progressive cause. Such a blatant political association and drive kind of taints any semblance of objectivity.

Even though he Durham County laptops/E-voting rolls disruption happened, it’s cause could have a relatively benign explanation as well; Initial reviews pegged the problems with the electronic voter logs on “user error.”

As such, it’s hard to figure if the voting systems security scares are truly breaches warranting more concern, or wishful thinking by forces on the Left that want to keep Trump/Russia alive. Either way, such risks reinforce the need for stepped up vote integrity efforts, and that means even the simplest forms of voting security such as photo identification. We’re sure EQV would agree.