After initial claims of the site vulnerability, I looked at this as well and saw the numeric IDs. The presence of a numeric ID in a given URL is not the same as saying changing it provides you access to someone else's data. More work is needed here. 1/n
cbs46.com/news/democrati…
cbs46.com/news/democrati…
After the SB315 debacle earlier this year (also GA), you'd have to be insane (or sure your legal team could get you out of trouble and willing to deal with the hassle) to actually attempt to download additional data by changing URL parameters. For obvious reasons, I didn't try 2/
It's an interesting legal question to ask whether the guy who might have tried would be in trouble for doing so. You are definitely exceeding your intended access to the system. A prosecutor could argue that disclosing your attempt caused loss of confidence (e.g. damage). 3/n
We clearly need more public debate about how to handle this sort of issue. I don't believe for a minute that GA has adequately tested its election systems. I don't doubt that there are vulnerabilities. But I can't test them (even if I want to for free) without consequences. 4/n
Intent is impossible to quantify and my test looks a lot like a hack. Further, suppose the systems are vulnerable to SQL injection and you CAN update data. What if a well-meaning tester updates all voter records in the state to be his own by accident? 5/n
Suppose the state doesn't have good backups or they don't notice immediately (suppose the tester doesn't know this happened either). This could be a major, major issue. I don't want to advocate for vigilante testing for public resources, and yet we need more transparency. 6/6
