1/ GA Election Admin Server Compromise Issue: Here is a timeline thread on the GA server compromise events from @gam1357 and @ejsebes so we can frame the chronology more easily and quickly. Thread/ nbcnews.com/tech/security/…
2/ December 2014: This is the date of a possible compromise, suggested by information found by a recent examination of the FBI's forensic image; said examination performed by Logan Lamb, a cybersecurity specialist.
3/ August 2016: Logan Lamb, the cybersecurity expert, first finds the server unprotected on the Internet. Raises concerns about potential for data breach, possible compromise, and downstream effects on election operations.
4/ November 10 2016: Server logs wiped. No log data to help assess possible 2014 incident.
5/ March 2017: FBI compiles a forensic image.
6/ December 2019: Logan Lamb, serving as an expert witness for a plaintiff in a related lawsuit finally obtains access to the FBI forensic image for independent evaluation.
7/ January 2020: Logan Lamb in fact, finds evidence suggesting an intrusion back in December 2014 and hitherto *not* detected. It is possible the server was compromised from 2014 onward, but that's difficult to confirm because the November 2016 logs were wiped.
8/ Side issue: In mid-2017 (June?) the server was completely wiped. But the FBI retained the March 2017 image. The "wipe" is concerning, but its of no importance to the assessment since the image was retained.
9/ Finally, a new issue: Why were the logs wiped on November 10th 2016? 🤔 That reduced the data available from examining the forensic image of March 2017. Clearly, there's more to be investigated. This appears to be the start and not the conclusion. /END
