PHOENIX — Arizona Secretary of State Katie Hobbs posted on social media Wednesday that a Wi-Fi router was discovered by Maricopa County audit observers connected to the servers that are being used to collect and store ballot data.
RELATED: What is Cyber Ninjas looking for with your ballot?
“There’s no way to ensure that ballot images, vote counts & perhaps voter data weren’t connected to external networks or the internet,” she tweeted.
🚨 Yesterday, observers from my office discovered a WiFi router connected to the "audit" servers.
— Secretary Katie Hobbs (@SecretaryHobbs) May 12, 2021
There’s no way to ensure that ballot images, vote counts, & perhaps voter data weren’t connected to external networks or the internet. https://t.co/Edgjwc8HUp
WHY IS THIS IMPORTANT?
The public was told that the audit of Maricopa County’s 2.1 million ballots would be done on what is called an “air-gapped” network.
What this means is computers, cameras, and other devices can communicate with each other, but cannot connect to the outside world. Having a wireless router on an air-gapped network means that, depending upon how the router and the larger network are configured, there is potential for devices to reach the internet.
Maricopa County audit leaders have in their possession, not just the county’s ballots, but also voter registration data that includes private information such as driver licenses and the last four numbers of a voter’s Social Security number. They also have a digital copy of signatures for county registrants that voted in November.
While a network connection could put this data in jeopardy of leaking out, there is no indication at this time if the voter data and signatures are even present on the network.
This comes at a time when the Arizona State Senate is threatening to subpoena Maricopa County’s networking equipment to ensure that election equipment used by the county was not connected to the internet during the November general election.
WHAT DO WE KNOW?
A source on the floor where the audit is being conducted with knowledge of the situation said that the type of router being used is one that you might find in any home.
Audit staff insist that the router is being used only to give IP addresses to wireless cameras that are being used to keep the ballots and audit process under surveillance.
The router did not have a cable attached to its internet port but was connected to the main networking switches that all of the audit devices are using.
DOES THIS MEAN THE NETWORK WAS NOT SECURED?
No, but it does mean that audit leaders need to prove definitively that the wireless router was not connected to the internet in some way.
Networks that handle election data do not typically contain wireless routers since they can make it easier for cyber criminals to enter a network. Election officials confirmed to ABC15 that MCTEC, Maricopa County’s election warehouse, does not have a wireless router.
The presence of a wireless router does not automatically mean that there is an internet connection. An IT security analyst who works for ABC15 said there are multiple ways Wi-Fi routers can be properly configured and secured.
“The introduction of a Wi-Fi router is a huge opening to a network, air-gapped or otherwise," he explained. “If I were tasked with setting up this network, I would have simply purchased equipment that would have made the network beyond reproach and undoubtedly secure.”
Without knowing the full scope of the audit’s network, it is difficult to say whether the Wi-Fi router had the Wi-Fi settings properly disabled and that the network was properly isolated from the internet.
The Maricopa audit twitter account stated on social media that, “No wireless was ever enabled. This was explicitly explained to the SoS observers on site. We are open to providing all passwords and access needed for a forensic investigation of the router if requested.”
