A computer security expert says he found that an election server central to a legal battle over the integrity of Georgia elections showed signs of tampering.
The server was left exposed to the open internet for at least six months, a problem discovered in August 2016. It was subsequently wiped clean in mid-2017 with no notice, just days after election integrity activists filed a lawsuit seeking an overhaul of what they called the state's unreliable and negligently run election system.
In late December 2019, the plaintiffs were finally able to obtain a copy of the server's contents that the FBI made in March 2017 and retained.
FILE - This Sept. 22, 2016 file photo shows the screen of an electronic voting machine during testing at the Kennesaw State University Center for Election Systems in Kennesaw, Ga. A computer security expert says he found that an election server central to a legal battle over the integrity of Georgia elections showed signs of tampering. The server was left exposed to the open internet for at least six months, a problem discovered in August 2016. (AP PhotoAlex Sanz, File)
State officials have said they've seen no evidence that any election-related data was compromised.
Logan Lamb, a security expert for the plaintiffs, said in an affidavit filed in Atlanta federal court on Thursday that he found evidence suggesting the server was compromised in December 2014. Lamb said the evidence suggests an attacker exploited a bug that provided full control of the server.
Lamb also said he determined that computer logs that would have been critical to understanding what might have been altered on or stolen from the server only go back to Nov. 10, 2016 — two days after Donald Trump was elected U.S. president and Brian Kemp won the Georgia’s governor’s race by a narrow margin over Democrat Stacey Abrams.
Kemp oversaw Georgia’s elections during that race as secretary of state. Election administration was handled at Kennesaw State University by an outfit that Kemp's office dismantled after the server-wiping incident.
Additionally, Lamb found evidence that election-related files were deleted from the server on March 2, 2017, just after a colleague of his alerted KSU officials that the election server remained vulnerable to hackers.
It was Lamb who initially alerted the state elections director in August 2016 that the elections server was vulnerable to tampering.
The fact that the access logs were deleted suggests possible foul play, Lamb wrote. “I can think of no legitimate reason why records from that critical period of time should have been deleted,” he stated in his sworn statement.