Password mishap latest headache for Colorado’s beleaguered election clerks

A security lapse at the Secretary of State’s Office that juiced election security concerns has meant new questions for some County Clerks who oversee elections — and, for others, more of the same.

Earlier this week, the Colorado Secretary of State said parts of sensitive passwords for voting machines distributed across the state had been mistakenly posted online for months in a hidden tab of a spreadsheet on the agency’s website.

While Secretary of State Jena Griswold said the passwords alone were not enough to compromise election equipment, it has bolstered concerns, both genuine and conspiratorial, about the security of the upcoming state election — including a demand from the Donald Trump campaign to rescan ballots.

Many clerks across the state said the biggest frustration was with the delayed communication from the Secretary of State’s Office.

"All the clerks are mission-focused right now; on making sure that we can conduct an accurate and secure election for the citizens of Colorado," said Matt Crane, the executive director of the Colorado Clerks Association, "And so when something like this happens — which is a big concern — and to not be told about it and having to address it all the while being mission-focused … it's frustrating."

Crane said election officials in every county — including those whose passwords were compromised — were prepared to respond to the situation.

"One of the things the election community has done over the last six or seven years is have trainings where we practice different things that might pop up," Crane said. "So, if a facility is set on fire or if a password is leaked, and then how do you respond to that incident?"

But in Western Colorado’s Mesa County, the issue is just the latest in a string of frustrating developments around elections this month alone.

Frustration with slow communication after password problem

October began with the sentencing of former Mesa County Clerk Tina Peters for her role in compromising county election equipment and ended with news from the Secretary of State about partial BIOS passwords posted online. In between, officials with the state announced that evidence of a small-scale voter fraud scheme was discovered in the county, with around a dozen ballots being stolen and submitted fraudulently. 

“Mostly, what we're seeing here lately (is) about the BIOS, passwords. That's where most voters are concerned,” Mesa County Clerk and Recorder Bobbie Gross said. “With the fraudulent ballots that were attempted to be cast in Mesa County, that's still an ongoing investigation.” 

Gross spent Thursday night overseeing the changing of the passwords, which the Secretary of State’s Office said was completed for all affected counties by Friday morning. Gross said she first heard from the state officials on Tuesday, a delay that she said puts clerks in a bad position with their constituents. 

“Communication is key, especially with your county clerks to inform them of what's going on and you can't withhold information that affects the counties, especially when we have voters to answer to in our community,” Gross said. 

The election disinformation driven by Peters, the former clerk, and her supporters has plagued Mesa County for years. After Gross was elected in 2022, she prioritized transparency in order to alleviate concerns in the county. 

“I think it's important for voters to have confidence in our procedures. We've held a few open houses. We had a couple (Colorado Mesa University) classes come through here,” Gross said. “It was a great turnout on our open houses so people could actually see how the ballots are processed.” 

In nearby Montrose County, Clerk and Recorder Tressa Guynes was similarly frustrated by the chain of communication, including that the Secretary of State’s office didn’t notify local election officials about the breach until news of it became public.

“What I would most appreciate is a team attitude, consistently,” Guynes said, not just a one-sided reporting system.”

Password release not affecting elections in some counties

In Hinsdale County, which is home to five 14,000-foot peaks and 774 residents, Deputy County Clerk Allison Athey said the password release has not prompted any issues for them. 

“Everything's been running pretty dang smooth, considering,” Athey said. Hinsdale County was one of the counties that did not require a password reset, she said. 

Delta County similarly avoided having to reset any passwords, said Delta County Clerk and Recorder Teri Stephenson. Their systems were newer, “so anything that showed up online was for old equipment that we no longer have.”

Arapahoe County’s voting machines were upgraded in 2023 and were not affected. Still, Tom Skelly, a spokesperson for the Arapahoe County Clerk and Recorder’s Office, said officials there received a few questions from voters who’d heard about it but he described them as more “curious” than concerned.

In Teller and Crowley counties in Southern Colorado, the voting machines and software were also recently updated and not affected.

Crowley County Clerk Melinda Carter said she heard about the password problem on Tuesday, but everything has been running smoothly and she hasn’t heard concerns from voters.

“Things have been going great here,” she said. “My machines are not directly affected. I have one machine that we kept after we refreshed our equipment that we were going to use as a backup if needed. That machine, the password was compromised but we don't plan on using it.”

Stephenson said Delta County election officials have not received a flood of questions about security. She also said she was a little frustrated by how the Secretary of State’s office told Clerks about the password release, though she said she’s thankful she’s not in the same boat as other counties that needed to scramble for password updates. 

“My heart goes out to them because it is really not a good time for that,” Stephenson said. “But, the fact that they're (the Secretary of State’s Office) trying to rectify it and do what they can to get that confidence back for our voters, I do appreciate that.” 

Across the state, in eastern Colorado, Delisa Weeks, the county clerk and recorder of Kiowa County — home to just over 1,000 residents — says that she is not worried about the password lapse impacting voter confidence in her county.

“Everything is in place, we have so many checks and balances,” Weeks said. “I just can’t see that it will be a problem.”

Joe Wertz contributed reporting.