by Doug Bock Clark
A nonprofit news organization that investigates energy abuses is ProPublica. To get our stories in your inbox every fortnight, sign up for Bulletins, a newsletter that highlights wrongdoing in various parts of the country.
A new online website run by the Georgia Secretary of State’s Office, which experts described as having a serious security risk, made it possible for anyone to obtain a voter cancellation request for any Victorian up until Monday. A brand, date of birth, and county of property were all that was needed, which was information that was readily available online.
A security scholar, Jason Parker, over the weekend brought the issue up to ProPublica and Atlanta News First. Parker, who uses they/them adjectives, said that after discovering it, they attempted to contact the Georgia Secretary of State’s Office. Parker’s attempts to contact the company were unreported, according to the company.
” It’s a sad vulnerability to keep empty, and it’s important to be fixed”, Parker said.
Parker, a senior risk scientist at Silent Push, who requested a review of the bug, described it as” as bad as any voter cancellation bug may be” and described it as “extremely sloppy coding.” One of these pests appears to be present on a significant website, which is surprising. Perhaps a basic penetration test, which involves outsiders assessing a website’s security before it launches,” should have picked this up,” according to Edwards.
The Secretary of State’s Office was simultaneously informed of the risk and ProPublica held publishing their reports until it was fixed.
” We have updated the approach to include an error message letting the individual know their distribution is inadequate and will not be processed”, Blake Evans, Georgia’s votes chairman, said in a statement from the Secretary of State’s Office.
The Associated Press and The Current both reported the existence of individual security threats that exposed citizens ‘ sensitive personal information, including their entire driver’s license number and the last four digits, shortly after the website was launched final Monday. The Secretary of State’s Office informed the media that the site was immediately fixed. Liberals warned that the system may be abused because a 2021 state law expanded the method through which right-wing protesters have challenged tens of thousands of voter registrations. According to ProPublica over the weekend, customers of the site tried unsuccessfully to revoke the voter registrations of Marjorie Taylor Greene, the representative for the party, and Secretary of State Brad Raffensperger.
Parker discovered a flaw that was unique from the two that had formerly been discovered. This one would let anyone who wants to use the website to skip the requirement for a pilot’s license number and post a cancellation request without it.
The Secretary of State “needs to take this situation seriously,” Edwards said, and instead should employ several screening and security companies. Additionally, they should quit relying on the government’s kindness and pro bono safety researchers to assess the website’s value. We should assume that there are other subtle bugs that could possibly have a significant impact at this time. According to Edwards, it would have been simple for a malicious actor to manage cancellation requests and send thousands of them without using the website’s security measures.
Parker, who is moving from Georgia to another position, demonstrated how the membership withdrawal device could be used in a film that was shared with ProPublica. Second, they entered their name, date of birth and state of residence to get past the website’s original verification page. Parker right-clicked the browser’s HTML code to check for its simple option, which required them to provide their driver’s license number, and removed a couple lines of code. Parker finally hit send. Your withdrawal request has been properly submitted, according to a window that appeared and county election workers are working on it within a week.
Parker claimed that the risk was discovered after less than two hours of searching the site.
” Inadequate papers and online programs will not be accepted”, Evans said in the statement. ( Parker’s cancellation request would have lacked a driver’s license number. ) In response to specific inquiries about the security practices that the website underwent prior to launch, the security procedures used by the system, Parker’s withdrawal request, and how the general public could be assured of the portal’s security in light of recent security breaches, the Secretary of State’s Office did not respond.
A scholar examines Georgia’s voting registration website and finds a flaw.
” The Secretary of State’s Office needs to do better”, said Marisa Pyle, the mature democracy security director for Georgia with All Voting is Local, a voting rights advocacy organization. The state must be very cautious with how it distributes these items. They must be secured, and they must explain why they were made.
There have been numerous instances of elections-related websites that have easily accessible security flaws, including Russian hackers hacking election equipment during the 2016 election and public interest competitions where participants have hacked versions of state election websites in minutes, according to Jake Braun, the author of a book on cybersecurity flaws in election systems and lecturer at the University of Chicago. Online elections infrastructure, he said, “needs more standards and better standards”.
Edwards said that the portal’s vulnerability-plagued rollout showed the necessity of improving the vetting process.
According to Edwards,” Georgia should step up and pass a law requiring an outside review of all new websites where the public interacts with government documents.” The public” should expect” officials “did some due diligence”.
Do you have any useful information on the Georgia voter registration cancellation portal, voter challenges, or other voter-related issues? Email Doug Bock Clark, a reporter, at doug@gmail.com. clark@propublica .org and by phone or Signal at 678-243-0784. If you’re concerned about confidentiality, check out our advice on the most secure ways to share tips.
