Thread by @reveal

1/ Georgia Secretary of State @BrianKempGA touted the security of his state’s elections – and turned down federal cybersecurity help.

At the same time, his system was being breached. And he didn't even know it. revealnews.org/episodes/who-g…

2/ Back in August of 2016, a cyber researcher in Atlanta named Logan Lamb made a troubling discovery: He was able to download millions of voters’ personal identifying information from the state’s elections website.

Via @kimzetter: politico.com/magazine/story…

3/ Lamb found other things that alarmed him, too. Passwords. Training videos. A serious vulnerability in the architecture of the site itself. This stuff could *still* be used to disenfranchise voters in 2018, Lamb said.

4/ His discovery set off a wave of alarmed internal emails at @kennesawstate, which at the time was helping manage Georgia’s election systems. (They're not anymore.)

5/ The emails paint a damning picture:

* The university’s team identified “a number of critical and severe vulnerabilities.”
* Yet it took two months to get the problem Lamb found fixed.
* At one point, election employees admitted, “we’re a little out of our depth.”

6/ 2016’s election came and went.

Then, months later, Logan Lamb and a friend visited the website again – and download just about all the same information. Here’s how Lamb explained it to @byardduncan:

7/ So where was the person in charge of elections during this breach? Well, it just so happens that Secretary of State @BrianKempGA was in Washington – touting the security of his state’s election system. Full hearing: c-span.org/video/?415978-…

8/ He didn't know about Lamb's discovery.

In the previous days, Kemp had been railing against government efforts to classify election systems as “critical infrastructure,” a move he told reporter @AliyaSternstein was a “vast federal overreach.” nextgov.com/cybersecurity/…

9/ He also declined offers from the DHS to inspect Georgia's election systems. Georgia was one of just seven states to reject such help outright, @cbsnews reported: cbsnews.com/news/ahead-of-…

10/ In November of 2016, Kemp reassured voters. “We have a secure system,” he said. “There’s no question in my mind.” mcclatchydc.com/news/politics-…

11/ There’s no evidence that foreign hackers downloaded the same info that Logan Lamb found. But that’s little comfort to him. He believes they would’ve just covered their tracks – that it would have been easy to do so.

12/ If this sounds like fodder for a lawsuit, that’s because it was. Earlier this year, a coalition of voting rights groups sued Kemp, charging that the state’s recklessness with election systems – and its aging machines – constituted a threat to voters’ constitutional rights.

13/ Kemp prevailed, mostly because a federal judge decided that trying to switch to paper ballots, as the groups had suggested, would create chaos before election day.

14/ But in her order, which came out in September, Judge Amy Totenberg offered up blistering criticism of Kemp and Georgia’s election security:

15/ So that’s where things stand in Georgia. Voters will head to polls in a couple weeks on machines that very few experts trust – and with a system that has historically been proven to be vulnerable to hacking.

16/ We’re staying on this story. For updates, please consider subscribing to our newsletter: revealnews.org/newsletter