Incident: Unauthorized Access to Election Equipment in Coffee County, Georgia

Published Date: 2022-09-23

Postmortem Analysis
Timeline 1. The software failure incident of unauthorized access to election equipment in Coffee County, Georgia, happened in January 2021 [133282].
System 1. Election management system server 2. Election system components 3. Touchscreen voting machines 4. Printers 5. Precinct scanners 6. Tablets used to check in voters 7. Flash cards and thumb drives 8. Election management server 9. Central scanner workstation 10. Personally identifiable information system [133282]
Responsible Organization 1. Former election officials in Coffee County [133282] 2. Worker in Fulton County [133282]
Impacted Organization 1. Coffee County election officials [133282] 2. Fulton County election officials [133282]
Software Causes 1. Unauthorized access to election equipment by former Coffee County election officials, leading to potential security breaches [133282] 2. Sharing of personally identifiable information by a worker in Fulton County, indicating a potential data security breach [133282]
Non-software Causes 1. Unauthorized access by individuals to election equipment in Coffee County, Georgia, as reported by the Secretary of State Brad Raffensperger [133282]. 2. Failure to secure the election equipment as required by Georgia law, as evidenced by security camera footage showing former election officials permitting access by unauthorized individuals [133282]. 3. Sharing of personally identifiable information with an individual outside the organization by a worker in Fulton County, leading to their termination [133282].
Impacts 1. Unauthorized access to election equipment in Coffee County led to concerns about the security and integrity of the election process [133282]. 2. The incident resulted in the replacement of election equipment in Coffee County, including the election management server, central scanner workstation, and the introduction of new voting machines, printers, precinct scanners, tablets, flash cards, and thumb drives [133282]. 3. The incident caused disruptions and distractions for election officials in Coffee County, potentially affecting their preparations for the upcoming 2022 election [133282]. 4. In a separate incident in Fulton County, the sharing of personally identifiable information with an external individual led to the firing of a worker and raised concerns about data security [133282].
Preventions 1. Implementing stricter access controls and security measures to prevent unauthorized individuals from accessing election equipment [133282]. 2. Conducting regular security audits and monitoring of election equipment to detect any unauthorized access or suspicious activities [133282]. 3. Providing comprehensive training to election officials on the importance of securing voting machines and equipment to prevent incidents like unauthorized access [133282].
Fixes 1. Replacing election equipment in Coffee County, Georgia, following unauthorized access to the equipment [133282]. 2. Conducting a thorough investigation into the unauthorized access by former Coffee County election officials [133282]. 3. Implementing stricter security measures to ensure that election equipment is properly secured and access is restricted to authorized individuals only [133282]. 4. Providing training and awareness programs for election officials to prevent future incidents of unauthorized access to sensitive equipment [133282].
References 1. Secretary of State Brad Raffensperger 2. Former election officials in Coffee County 3. Marilyn Marks, executive director of the Coalition for Good Governance 4. Election officials in Fulton County

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The software failure incident related to unauthorized access to election equipment in Coffee County, Georgia, happened again at the same organization. The article mentions that the county's election management server and central scanner workstation were previously replaced in June 2021 due to the unauthorized access incident. However, the current incident involved former election officials in Coffee County permitting access by unauthorized individuals to the equipment, which should have been secured under Georgia law [133282]. This indicates a recurrence of the software failure incident within the same organization. (b) The software failure incident related to unauthorized access to election equipment in Coffee County, Georgia, does not explicitly mention similar incidents happening at other organizations in the articles provided.
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be seen in the unauthorized access to election equipment in Coffee County, Georgia. Former election officials in Coffee County permitted access by unauthorized individuals to equipment that should have been secured under Georgia law. This breach in security was a result of design flaws or gaps in the system development or procedures to operate and maintain the system [133282]. (b) The software failure incident related to the operation phase is evident in the firing of a worker in Fulton County after personally identifiable information was shared with an individual outside the organization. This failure was due to contributing factors introduced by the operation or misuse of the system, leading to a breach of data security protocols [133282].
Boundary (Internal/External) within_system (a) The software failure incident described in the article is primarily within_system. The incident involved unauthorized access to election equipment in Coffee County, Georgia, by individuals associated with efforts to discredit the 2020 election results [133282]. The breach of security and potential tampering with the election equipment were internal to the system, leading to concerns about the security and integrity of the voting machines. Additionally, the replacement of election equipment and the investigation into unauthorized access by former election officials in Coffee County further highlight the internal nature of the software failure incident.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in Coffee County, Georgia, was related to non-human actions. Unauthorized access to election equipment by individuals, including former election officials, was a key factor in the incident. Security camera footage showed former election officials permitting access by unauthorized individuals to equipment that should have been secured under Georgia law [133282]. (b) The incident in Fulton County, Georgia, involved a human action leading to a software failure. A worker was fired after it was discovered that personally identifiable information was shared with an individual outside the organization. This breach of data security was attributed to the actions of the individual responsible for the incident [133282].
Dimension (Hardware/Software) hardware (a) The software failure incident in the article is related to hardware. The incident involved unauthorized access to election equipment in Coffee County, Georgia, which led to concerns about the security and integrity of the equipment used in elections. The unauthorized individuals were able to access the election management system server and other election system components, indicating a breach in the physical security of the hardware [133282]. (b) The software failure incident in the article is not directly related to software issues but rather to unauthorized access to the hardware components of the election equipment. There is no mention of software bugs, faults, errors, or glitches contributing to the failure incident reported in the article.
Objective (Malicious/Non-malicious) malicious (a) The software failure incident reported in Article 133282 appears to be malicious in nature. The incident involved unauthorized access to election equipment in Coffee County, Georgia, by individuals associated with efforts to discredit the 2020 election results. This unauthorized access included making complete copies of the election management system server and other election system components. Additionally, security camera footage showed former election officials in Coffee County permitting access by unauthorized individuals to equipment that should have been secured under Georgia law. These actions suggest a deliberate attempt to interfere with the election equipment, indicating a malicious intent [133282].
Intent (Poor/Accidental Decisions) poor_decisions [a] The intent of the software failure incident in the reported articles seems to be more aligned with poor_decisions. This is evident from the unauthorized access to election equipment in Coffee County, Georgia, which involved former election officials permitting access by unauthorized individuals to equipment that should have been secured under Georgia law [133282]. Additionally, the incident involved individuals spending hours inside the elections office with access to the equipment, which raises concerns about the security and integrity of the election systems. The decision to allow such access and potential tampering with election equipment reflects poor decision-making that could have serious implications for election integrity.
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident in Coffee County, Georgia, where unauthorized access to election equipment occurred, could potentially be linked to development incompetence. This is evident from the fact that former election officials in Coffee County permitted access by unauthorized individuals to equipment that should have been secured under Georgia law [133282]. The incident highlights a lack of professional competence in ensuring the security and integrity of the election equipment. (b) The incident in Fulton County, where a worker was fired for sharing personally identifiable information with an individual outside the organization, could be categorized as an accidental software failure. The sharing of sensitive information was likely unintentional and accidental, leading to a breach of data security protocols [133282].
Duration permanent (a) The software failure incident in the reported articles seems to be more of a permanent nature. The unauthorized access to election equipment in Coffee County, Georgia, led to concerns about the security and integrity of the election management system server and other election system components. This incident prompted the decision to replace election equipment in the county, including the election management server and central scanner workstation, to ensure the security and reliability of future elections [133282]. Additionally, the incident involving the sharing of personally identifiable information in Fulton County resulted in the termination of the responsible individual and the commitment to notify and provide credit monitoring services to those affected, indicating a permanent impact on data security [133282]. (b) The software failure incident does not appear to be temporary as the unauthorized access to the election equipment raised significant concerns about the security and integrity of the election systems. The decision to replace election equipment and take measures to enhance security suggests a more permanent impact on the system's reliability and trustworthiness [133282]. The incident involving the sharing of personally identifiable information in Fulton County also indicates a lasting impact on data security, as the county took steps to address the breach and provide support to affected individuals [133282].
Behaviour omission, other (a) crash: The incident in Coffee County, Georgia, involved unauthorized access to election equipment, including the election management system server and other election system components. This unauthorized access led to concerns about the security and integrity of the election equipment, prompting the decision to replace certain components such as the election management server and central scanner workstation [133282]. (b) omission: The article mentions that security camera footage showed former election officials in Coffee County permitting access by unauthorized individuals to equipment that should have been secured under Georgia law. This omission to properly secure the equipment raised concerns about the integrity of the election process and the potential for unauthorized manipulation of the equipment [133282]. (c) timing: There is no specific mention of a timing-related failure in the articles provided. (d) value: The incident did not involve the system performing its intended functions incorrectly. (e) byzantine: The articles do not describe the system behaving with inconsistent responses and interactions. (f) other: The behavior of the software failure incident in this case could be described as a security breach or unauthorized access leading to potential risks to the election process and the integrity of the equipment involved [133282].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence unknown (a) death: There is no mention of any deaths resulting from the software failure incident in the provided article [133282].
Domain government (a) The failed system in the incident was related to the government industry. The software failure incident occurred in Coffee County, Georgia, where there was unauthorized access to election equipment following the 2020 election [133282]. The Secretary of State of Georgia announced plans to replace election equipment in response to the unauthorized access incident [133282]. The incident involved former election officials in Coffee County permitting access by unauthorized individuals to election equipment, which should have been secured by law [133282]. Additionally, there were concerns raised about the security of the state's touchscreen voting machines, leading to a long-running lawsuit against state election officials [133282]. (l) The failed system was also related to the government industry as it involved election equipment and processes. The incident highlighted the need for secure election equipment and procedures to ensure the integrity of the electoral process [133282]. The unauthorized access to the election equipment raised concerns about the security and reliability of the voting machines used in the county [133282]. The replacement of election management servers and other components indicated a response to the software failure incident to ensure the upcoming elections could proceed without disruptions [133282].

Sources

Back to List