Experts weigh in on Kentucky state election security

Posted at 5:46 PM, Oct 16, 2019

FRANKFORT, Ky. (LEX 18) — On Tuesday, the State Board of Elections meeting ended with arguments and a lot of yelling.

LEX 18 had the only news crew there when the secretary of state and the State Board of Elections argued over whether secret voter registration information was revealed.

"In a month a half, she'll be gone. Disregard her," said Secretary of State Alison Lundergan-Grimes. "That's going to be the quote I'm putting out."

That statement was part of a heated exchange LEX 18 caught on camera after Tuesday's State Board of Elections meeting. While LEX 18's political reporter Karolina Buczek stood in the hallway waiting for an interview, tensions flared inside the meeting room. Grimes and the Board's Executive Director Jared Dearing exchanged words. Both raised their voices.

Grimes was heard saying she heard someone tell the board that they don't need to listen to her because her term is almost up. Dearing, who left the room first, walked over to LEX 18 and said, "It's a circus and chaos."

But before that interaction happened, things got tense between Grimes and Dearing during the meeting. That tension escalated when posters were unveiled.

"I don't know how many of y'all have access to our voter registration system," said Grimes as she revealed posters showing a snapshot of Kentucky's Voter Registration System.

"Please don't put that on TV," said Dearing. "Please do not put that on TV."

Grimes said she put the posters up to show the members errors she found in the VRS. She believes those errors have caused voters to be listed as 'inactive.'

"This is Ms. Valeria Badley. We are marking her inactive on the basis of a card that's addressed to Tammy Jane Allen," said Grimes. "There's no other way to show you all this because you aren't asking for the information. You aren't overseeing the information, so I'm bringing this forward to you today."

While Grimes continued, several board members got upset that the posters were being shown. They said the information on them could put Kentucky's system at risk of a cyberattack.

"Please do not put our system at risk by putting how our fields are laid out on television in this state," said Dearing. "This is beyond irresponsible."

"This is publicly available information," responded Grimes.

"It is not," said Dearing.

Other members of the board chimed. "It is not publicly available information."

"I, as chief election official, who is responsible for maintaining the system, am publishing it to the public because they deserve to see," responded Grimes.

After the meeting ended, Dearing asked LEX 18 to not air images of the posters.

"Because of systems securities, I think any IT or systems professional will tell you, there are some systems parameters that you don't publish and you don't make them public. And so I am asking you as journalists, as professionals, as voters of the commonwealth - I hope you're registered - that you not publish those," said Dearing.

Grimes insisted the information is publicly available, therefor it can be shown to the public.

So the question became: who is right? Was the secretary of state, an elected official, allowed to publish this information? Or, is the board's executive director correct when he says the information puts Kentucky at risk?

LEX 18 turned to the experts for answers. Some of those who we consulted with served as elected officials. Others specialize in cybersecurity and election security.

We asked: Does the information on the poster put Kentucky's election or voter registration system at risk?

"Not at all," said Gregory Miller, the chair of the OSET Institute. "First off, to be quite honest with you, any malfeasance - even someone like myself trying to understand what's exactly on those boards - would have some difficultly, with all due respect to your TV camera equipment. There's a lot of information on there and showing models and schema of data is not in itself a security breach. A hacker doesn't need those to compromise the system, frankly."

The OSET Institute is a non-profit "election technology research, development and education organization." Their goal is to "increase confidence in elections and their outcomes in order to preserve the operational continuity of democracy --ultimately worldwide -- and because everyone deserves a better voting experience."

The group's engineers went through LEX 18's video to see if the information on the posters could harm Kentucky's system. Miller said the information on the posters is essentially the inside of the system, so in order for it to be useful, he believes someone would have to first breach the system. Miller also said that even if that happened, the stuff on the posters isn't something hackers need.

"They're fairly complex to garner any useful data out of them - looking across a television screen at them," said Miller. "We've replayed your story several times and yeah, there's some interesting stuff there, but as an attacker, I frankly, wouldn't be bothered with it."

Miller admitted that he understands why the Board of Elections is on edge - given that cybersecurity and elections is a hot topic. However, he believes in order for the public to have trust in elections, transparency is needed. So he thinks Grimes did the right thing by showing the public errors in the system.

"Secretary Grimes is doing the right thing to bring to the surface right now, to make sure it gets properly addressed if possible," said Miller.

The Board of Elections, on the other hand, still believes making the posters public was not the way to address errors in the system.

LEX 18 is standing by its reporting and decision to air the images of the posters because the information was released and discussed in an open, public meeting. The information was also released by the secretary of state, an elected official.