Thread by @ByardDuncan

1/ OK, folks. Here’s a little thread about a BIG election security breach that happened under @BrianKempGA ’s watch in 2016-17.

There’s something about it that never added up. Let me explain ...

2/ First, though: Meet Logan Lamb, a security researcher in Atlanta. Back in August of 2016, he found a collection of massive vulnerabilities in Georgia’s election system.

I reported on them for @reveal here: revealnews.org/episodes/who-g…

3/ Logan sent an email to the elections team at @kennesawstate, which for more than a decade managed GA’s elections.

It set off a firestorm of activity – a lot of it occurring over email.

4/ These emails, acquired through a public records request, paint a damning picture of delays and disorganization. At one point, one of the people trying to secure the system wrote, “we’re a little out of our depth.”

5/ Two months after Logan emailed KSU to tell them he’d found the vulnerability, they finally got it fixed.

… Or so they thought.

6/ In fact, the system was never secure.

In late February (2017!), Logan and a friend went to the site and were able to get the same sensitive info Logan had found in August.

Effectively, nothing had been fixed – MONTHS AFTER 2016'S ELECTIONS CAME AND WENT.

7/ MORE emails start circulating around KSU. This time, university officials begins to worry this will all go public:

8/ So on March 1, they write up an incident report. (There was no incident report from the first time Logan broke in. Not sure why, but trust me: I asked.)

9/ Instead, a press release claimed “university officials were first notified of the situation on March 1.”

This doesn’t seem true. There were dozens of emails between university officials from when Logan contacted them the *first* time. They’re public record, for God's sake.

10/ So this all leads us back to @briankempGA. As secretary of state, he was in charge of the Center for Election Systems at KSU.

Yet he has maintained that he didn’t find out about the breach until March. 🤔🤔 politics.myajc.com/news/state--re…

11/ Put another way: Brian Kemp, the man in charge of Georgia’s elections, maintains he didn’t know about a massive breach in his state’s system until SIX MONTHS after it happened.

No one tried to notify him? Two months before the election? Really?

11/ Fair enough.

But here’s the thing: I submitted a records request for all email correspondences between KSU and Kemp’s office between August (when Logan emailed them the first time) and March (when they finally filed an incident report) …

12/ … And guess how many emails there are that may be responsive?

331.

So what were Kemp's office and KSU chatting about that whole time?

I’ll keep y’all posted as soon as I get these emails.