![](\"https:\/\/media.wired.com\/photos\/5bdf57b08a2ca166d289574f\/master\/pass\/Brian_Kemp-1004927120.jpg\"\/)
<\/p>\n<\/p>\n
Credit to Author: Lily Hay Newman| Date: Sun, 04 Nov 2018 22:08:06 +0000<\/strong><\/p>\n In December 2016, <\/span>Georgia secretary of state Brian Kemp accused<\/a> the Department of Homeland Security of attempting to hack his office's systems, which include the Georgia voter registration database. Six months later, the DHS inspector general concluded that the allegations were unfounded<\/a>; someone on a DHS computer had simply visited the Georgia Secretary of State website. Now, two days before an election in which Kemp himself is the Republican candidate for governor, he has levied similarly unsupported charges\u2014this time against his democratic opponents.<\/p>\n The Georgia Secretary of State\u2019s office released a short statement<\/a> on Sunday morning that it had opened an investigation into the Democratic Party the previous evening, \u201cafter a failed attempt to hack the state's voter registration system.\u201d<\/p>\n The Democratic Party of Georgia sharply denied the accusations in a statement to reporters. \u201cBrian Kemp\u2019s scurrilous claims are 100 percent false, and this so-called investigation was unknown to the Democratic Party of Georgia until a campaign operative in Kemp\u2019s official office released a statement this morning,\u201d wrote Rebecca DeHart, executive director of the state\u2019s Democratic Party. \u201cThis is yet another example of abuse of power by an unethical Secretary of State.\u201d<\/p>\n Kemp\u2019s office said it has alerted DHS and the FBI. A DHS official told WIRED in a statement that, \u201cThe State of Georgia has notified us of this issue. We defer to the State for further details.\u201d The National Association of Secretaries of State declined to comment on state-specific investigations.<\/p>\n "Kemp is redirecting his administration's failure to secure state infrastructure to his opponents."<\/p>\n Jake Williams, Rendition InfoSec<\/p>\n While anything is possible, Kemp's claims seem unlikely on their face, especially when you parse what little information his team has provided. \u201cWe opened an investigation into the Democratic Party of Georgia after receiving information from our legal team about failed efforts to breach the online voter registration system and My Voter Page,\u201d his office said in a statement. \u201cWe are working with our private sector vendors and investigators to review data logs.\u201d<\/p>\n A legal team seems like a surprising source for the discovery of a hacking attempt, and the fact that security teams then began reviewing the logs makes whether any suspicious activity was actually seen an open question. Kemp\u2019s office did not provide any information about the alleged attack, or when it purportedly occurred.<\/p>\n \u201cWhile we cannot comment on the specifics of an ongoing investigation, I can confirm that the Democratic Party of Georgia is under investigation for possible cyber crimes," Georgia secretary of state press secretary Candice Broce wrote in a statement. Not sharing details of an investigation is a common practice, but that supposed restraint apparently did not apply to the direct, vocal accusation of Kemp's Democratic opposition.<\/p>\n In his dual role as Georgia secretary of state and gubernatorial candidate, Kemp wields tremendous influence and faces monumental conflicts of interest. Over the past year, for instance, Kemp purged more than a million voters from Georgia\u2019s rolls and has backed restrictive voter ID laws. On Friday, a federal judge determined that Kemp's "exact match" policy, which required that a voter's name on the roles perfectly mirror that on their identification, was likely to infringe on voting rights, and issued a preliminary injunction<\/a> allowing impacted people to simply show proof of citizenship to a poll worker before voting.<\/p>\n Under Kemp's watch, Georgia is also one of only five states that still uses electronic voting machines that do not generate a voter-verified paper backup\u2014meaning there is no auditable alternative accounting of votes aside from the digital record. Kemp has resisted finding the funding to replace the machines, and was one of only about 11 top election officials who declined assistance from DHS<\/a> to secure election infrastructure in the wake of the 2016 presidential election. Georgia\u2019s digital election infrastructure has had numerous vulnerabilities and data exposures while Kemp has been in charge.<\/p>\n \u201cThere are already allegations that the Georgia voter registration page is vulnerable to attack and data is vulnerable to modification,\u201d says Jake Williams, founder of the Georgia-based security firm Rendition Infosec. \u201cInstead of dealing with the potential fallout of that, Kemp is redirecting his administration's failure to secure state infrastructure to his opponents.\u201d<\/p>\n In his own preliminary evaluation of Georgia\u2019s voter registration system, Williams says he found numerous signs that the system is badly coded and may be poorly secured. He did not download or alter data or probe the site, and simply reviewed publicly accessible information.<\/p>\n "This is yet another example of abuse of power by an unethical Secretary of State."<\/p>\n Rebecca DeHart, Democratic Party of Georgia<\/p>\n Indeed, it seems within the realm of possibility that Kemp has conflated concerns about vulnerabilities with actual hacking. A report from WhoWhatWhy<\/a> on Sunday detailed a memo from the Democratic Party of Georgia that outlined flaws in the state\u2019s voter registration system. If Democrats had actually tested those flaws without permission, they would have run afoul of the Computer Fraud and Abuse Act. But plenty of third-party security researchers have identified issues with Georgia's voter registration system without actively testing them.<\/p>\n Kemp\u2019s opponent in the Georgia gubernatorial race, Democrat Stacey Abrams, told CNN\u2019s State Of The Union<\/em> on Sunday that Kemp\u2019s office\u2019s hacking accusations are \u201ca desperate attempt\u2026to distract people from the fact that two different federal judges found him derelict in his duties and forced him to allow absentee ballots to be counted and those who are being held captive by the exact match system be allowed to vote.\u201d<\/p>\n Meanwhile, Kemp has plastered the accusations on the front of the Georgia Secretary of State website, where state residents also go to find voting information. And the Kemp for Governor campaign issued a parallel statement about the accusations of voter registration service hacking. \u201cIn an act of desperation, the Democrats tried to expose vulnerabilities in Georgia\u2019s voter registration system,\u201d the campaign wrote. \u201cThanks to the systems and protocols established by Secretary of State Brian Kemp, no personal information was breached.\u201d<\/p>\n The Georgia Secretary of State\u2019s office did not specifically accuse Democrats of attempting to penetration test the voter registration system to reveal flaws. It is also unclear why the party would attempt to steal voters\u2019 personal information in the first place, given that the Georgia Secretary of State\u2019s office will send it<\/a>\u2014minus Social Security numbers and driver's licenses\u2014to any member of the public who requests it. It costs $250.<\/p>\n