EL PASO COUNTY — A former state election official said the release of voting system passwords on the Secretary of State's website is a significant error but does not automatically compromise county voting equipment.
In a press release on Tuesday, the Colorado Department of State confirmed an Excel spreadsheet containing hundreds of passwords to Colorado's voting systems was published on the Secretary of State’s website for months. In an interview with Scripps News Denver, Secretary of State Jena Griswold said a civil servant made a "serious mistake" and an outside party will investigate. She said the civil servant was no longer with the department but could not say whether that person was fired.
Former Colorado Secretary of State Wayne Williams, a Republican who held the office before current Secretary of State Jena Griswold, said the leaked Basic Input/Output System (BIOS) passwords held by the state are one of two passwords used to gain access to election voting systems. The second is a Windows password held by county clerks, creating a checks and balances system.
"The release of the BIOS passwords means that part of that check went away, and so now someone who had the Windows password and the access to the machine could make changes without the knowledge of the Secretary of State's office, and that is a significant problem," said Williams. "There's a number of changes that could be made with the BIOS password, even without the Windows password. One of those would be, for example, installing a wireless device that would allow someone to download malware into the computer."
The Secretary of State's Office and the El Paso County Clerk and Recorder's Office said BIOS passwords can only be used through direct, in-person access to the voting equipment. The voting equipment is stored in highly secure rooms that are only accessible by individuals with an ID badge and a security code.
El Paso County Clerk and Recorder Steve Schleiker said while the error is significant, it does not impact the security of voting systems in the county. He sent News5 a statement that reads in part:
To further safeguard our systems, all election equipment is under 24/7 video surveillance, monitored and patrolled by county security personnel. Our voting equipment is also housed within locked and secure CPU locker enclosures, adding an additional layer of protection. Only authorized, background-checked employees are permitted access to these areas, and anyone working with voting system components is subject to strict chain-of-custody protocols, with detailed logs recording each instance of access.
Williams said the error brings up concerns about transparency within the Secretary of State's Office. He said the office did not immediately notify county election officials of the leak.
"I think they could have gotten that done more quickly if they had worked with the counties and informed them of the issue," said Williams.
The Secretary of State's Office said it took immediate action as soon as it was aware of the published passwords and informed the Cybersecurity and Infrastructure Security Agency, which closely monitors and protects the county’s essential security infrastructure. A spokesperson for the office said out of an abundance of caution, the department is checking voting system access logs in all affected counties, updating passwords, and verifying settings.
Williams said voters should still have confidence in Colorado's elections despite the password leak, pointing to paper ballots and forensic audits before election certification as extra safeguards.
"We know that the results that are reported are either going to be accurate or we will find that in the audit process using the actual paper ballots," said Williams.
On Wednesday, Colorado House Republicans began calling for Griswold's resignation.
Minority House Leader Rep. Rose Pugliese, R-District 14, released a statement that said, in part:
“While I have the utmost trust in the integrity of our county clerks, who actually oversee the counting of votes, I have no trust that Secretary Griswold is capable of leading our election system. Enough of her incompetence; it is time for her to resign. The people of Colorado deserve better.”
