The flaw would have allowed anyone to submit a voter registration cancellation request for any Georgian using their name, date of birth and county of residence \u2014 information that is easily discoverable online.<\/p>\n\n\n\n
by\u00a0Doug Bock Clark<\/a><\/strong><\/p>\n\n\n\n Aug. 5, 5:45 p.m. EDT<\/p>\n\n\n\n Until Monday, a new online portal run by the Georgia Secretary of State\u2019s Office contained what experts describe as a serious security vulnerability that would have allowed anyone to submit a voter cancellation request for any Georgian. All that was required was a name, date of birth and county of residence \u2014 information easily discoverable for many people online.<\/p>\n\n\n\n The flaw was brought to the attention of ProPublica and Atlanta News First<\/a> over the weekend by a cybersecurity researcher, Jason Parker. Parker, who uses they\/them pronouns, said that after discovering it, they attempted to contact the Georgia Secretary of State\u2019s Office. The office said it had no records of Parker\u2019s attempts to reach out.<\/p>\n\n\n\n \u201cIt\u2019s a terrible vulnerability to leave open, and it\u2019s essential to be fixed,\u201d Parker said.<\/p>\n\n\n\n The issue Parker exposed was \u201cas bad as any voter cancellation bug could be\u201d and \u201cincredibly sloppy coding,\u201d said Zach Edwards, a senior threat researcher at the cybersecurity firm Silent Push, who reviewed the flaw at the request of ProPublica. \u201cIt\u2019s shocking to have one of these bugs occur on a serious website.\u201d Edwards said that even a basic penetration test, in which outside experts vet the security of a website before its launch, \u201cshould have picked this up.\u201d<\/p>\n\n\n\n ProPublica and Atlanta News First jointly alerted the Secretary of State\u2019s Office to the vulnerability and held the publication of their articles until it was fixed.<\/p>\n\n\n\n \u201cWe have updated the process to include an error message letting the individual know their submission is incomplete and will not be processed,\u201d Blake Evans, Georgia\u2019s elections director, said in a statement from the Secretary of State\u2019s Office.<\/p>\n\n\n\n In the days after the portal launched last Monday, The Associated Press<\/a> and The Current<\/a> each reported the existence of separate security vulnerabilities that exposed voters\u2019 sensitive personal information, including the last four digits of their Social Security number and their full driver\u2019s license number. The Secretary of State\u2019s Office told the news organizations that it quickly fixed the portal. Democrats warned that the system could be abused, as right-wing activists have been challenging tens of thousands of voter registrations<\/a> in a different process that a 2021 state law expanded. Over the weekend, ProPublica reported that<\/a> users of the portal had unsuccessfully attempted to cancel the voter registrations of two prominent Republican officials, Secretary of State Brad Raffensperger and Rep. Marjorie Taylor Greene.<\/p>\n\n\n\n The flaw found by Parker was different from the two previously reported ones. This one would allow any user of the portal to bypass the screen that requires a driver\u2019s license number and submit the cancellation request without it.<\/p>\n\n\n\n The Secretary of State \u201cneeds to consider this an all-hands-on-deck\u201d moment \u201cand hire multiple testing and security firms and stop relying on the public\u2019s goodwill and pro bono security researchers to test the quality of their website,\u201d Edwards said. \u201cAt this point, we should assume there are other subtle bugs that could have potentially serious impact.\u201d Edwards said that it would have been easy for a malicious actor to automate cancellation requests to get around security measures built into the website and submit thousands of them.<\/p>\n\n\n\n In a video shared with ProPublica, Parker, who is moving from Georgia to another state, demonstrated how the registration cancellation tool could be exploited in roughly a minute. First, they entered their name, date of birth and county of residence to get past the website\u2019s initial screening page. When the portal asked them for a driver\u2019s license number, Parker right-clicked to inspect the browser\u2019s HTML code \u2014 a basic option available to anyone \u2014 and deleted a few lines of code requiring them to submit their driver\u2019s license number. Parker then hit submit. A window popped up stating that \u201cYour cancellation request has been successfully submitted\u201d and that county election workers would process the request within a week.<\/p>\n\n\n\n Parker said it took them less than two hours of poking around the website to find the vulnerability.<\/p>\n\n\n\n \u201cIncomplete paper and online applications will not be accepted,\u201d Evans said in the statement. (Parker\u2019s cancellation request would have lacked a driver\u2019s license number.) The Secretary of State\u2019s Office did not respond to individual questions about what testing the portal underwent before launch, the system\u2019s security procedures, what happened to Parker\u2019s cancellation request and how the public could be sure of the portal\u2019s security given the recent disclosures of security flaws.<\/p>\n\n\n\n \u201cThe Secretary of State\u2019s Office needs to do better,\u201d said Marisa Pyle, the senior democracy defense manager for Georgia with All Voting is Local, a voting rights advocacy organization. \u201cThe state needs to be really intentional about how it rolls out these things. It needs to make sure they\u2019re secure and provide their rationale for making them.\u201d<\/p>\n\n\n\n Jake Braun, the author of a book on cybersecurity flaws in election systems and lecturer at the University of Chicago, said that there is a long history of elections-related websites suffering from easily exploitable security failures, including Russians hacking election infrastructure during the 2016 election<\/a> and public-interest competitions in which participants breached replicas of state election websites in minutes<\/a>. Online elections infrastructure, he said, \u201cneeds more standards and better standards.\u201d<\/p>\n\n\n\n Edwards said that the portal\u2019s vulnerability-plagued rollout showed the necessity of improving the vetting process.<\/p>\n\n\n\n \u201cGeorgia should step up and pass a law saying all new websites in which the public interacts with government documents should have an outside review,\u201d Edwards said. The public \u201cshould expect\u201d officials \u201cdid some due diligence.\u201d<\/p>\n\n\n\n